In short: Harmony Email Advanced Protect is the threat protection tier of Check Point Email Security. It includes anti-phishing for inbound and internal mail, BEC and impersonation protection, account takeover detection, anti-malware, malicious and click-time URL protection, sandboxing, attachment sanitisation (CDR) and shadow IT detection, for email alone or email plus collaboration apps.
What Advanced Protect includes
Advanced Protect is available with either coverage option: Email Only (Microsoft 365 mail and Gmail) or Email & Collaboration (adding Teams, SharePoint, OneDrive, Google Drive, Slack, Box, Dropbox and ShareFile). See the plans comparison for how the options fit together.
| Capability | What it does |
|---|---|
| Anti-phishing (incoming and internal) | Analyses each message to catch phishing, including mail sent between your own users |
| BEC and impersonation protection | Part of anti-phishing: aimed at messages pretending to be executives, suppliers or lookalike domains, which often carry no link or attachment |
| Account takeover prevention | Uses anomaly detection to spot sign-ins and behaviour that suggest an account has been compromised |
| Known malware prevention | Anti-virus scanning of attachments and shared files |
| Malicious URL prevention | Checks links in email and messages against threat intelligence and analysis |
| Click-time URL protection | Rewrites links so they are re-checked when the user opens them, not just when the mail arrives |
| URL emulation | Analyses suspicious linked pages in an emulated environment |
| Sandboxing (Threat Emulation) | Detonates unknown files to catch zero-day malware |
| Attachment sanitisation (CDR, Threat Extraction) | Removes risky active content and delivers a safe copy quickly |
| Shadow IT detection | Shows unauthorised cloud applications in use across the organisation |
Phishing, BEC and account takeover
Some of the most damaging email attacks carry no malware at all. A finance team receives a convincing message from a supplier's genuine but compromised mailbox asking for new bank details, or a user is sent to a login page that looks exactly like Microsoft's. Reputation lists and attachment scanning do little against these.
Catching these attacks means judging the message in context rather than only checking it against lists of known-bad senders, links and files, and Advanced Protect's anti-phishing is built for that job. Because it is connected inside the tenant, it can also inspect internal mail, so a phishing message sent from one compromised account to colleagues is caught rather than trusted.
Account takeover prevention adds the other half of the picture, flagging unusual sign-ins and account activity so you can reset credentials before an attacker uses the account to target others. Pair it with the Leaked Credentials add-on if you want early warning of passwords exposed on the dark web.
Malware, links and safe attachments
For files and links, Advanced Protect uses several layers in turn:
- Known malware scanning removes anything already recognised as malicious.
- URL checks and URL emulation assess links at delivery time.
- Click-time protection checks each link again when the user clicks it, which matters because an attacker can make a page malicious after the email has been delivered.
- Sandboxing runs unknown attachments in an emulated environment to see what they do.
- Attachment sanitisation delivers a cleaned copy of documents with active content stripped out, so users are not left waiting for the sandbox.
These engines draw on ThreatCloud AI, the same threat intelligence used by Harmony Endpoint and Check Point's other products. With Email & Collaboration coverage, the same checks apply to files and links shared in Teams, SharePoint, OneDrive, Slack and the file-sharing apps.
Who Advanced Protect suits
Advanced Protect is the right tier for most organisations whose priority is stopping attacks rather than controlling outbound data. It suits:
- small and mid-sized businesses on Microsoft 365 Business Standard or Business Premium that want a second layer after Microsoft's filtering
- organisations that have suffered invoice fraud, supplier impersonation or compromised mailboxes
- teams already using Microsoft Purview or another tool for data loss prevention, who do not need DLP twice
- businesses moving off an email gateway that want equivalent or better threat protection without MX changes
Many customers add DMARC Management to stop their own domain being spoofed, and Security Awareness Training so users learn from the threats actually reaching them.
When to step up to Complete Protect
Move to Harmony Email Complete Protect if:
- staff regularly email personal data, health information, payroll or financial records
- you have had, or are worried about, sensitive data being emailed outside the organisation by mistake
- you want sensitive outbound messages encrypted automatically by policy
- you share files externally through OneDrive, SharePoint or Dropbox and want to control what leaves
Complete Protect keeps every Advanced Protect feature and adds data loss prevention for email and shared files, with policies that can quarantine, alert on or encrypt sensitive content.
Licensing and how we help
Advanced Protect is licensed per protected user, normally as an annual subscription, with monthly pay-as-you-go available through managed service providers in the Check Point Portal. The price depends on coverage, user numbers, add-ons and term, so ask us for a quote. The Harmony pricing and licensing guide explains the structure.
Forever Systems connects your tenant, runs Advanced Protect in monitor mode so you can see what it catches, tunes policies with you and then moves it to inline prevention. Contact us to arrange a proof of value.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Harmony Email Advanced Protect include?
Anti-phishing for incoming and internal mail (including BEC and impersonation), account takeover prevention, known malware prevention, malicious URL and click-time URL protection, URL emulation, sandboxing, attachment sanitisation (CDR) and shadow IT detection.
Does Advanced Protect include DLP?
No. Data loss prevention is the difference between Advanced Protect and Complete Protect. Check Point's plans table shows the same threat protection in both tiers, with DLP only in Complete Protect.
Does Advanced Protect cover Microsoft Teams?
Yes, if you choose Email & Collaboration coverage. Advanced Protect with Email Only coverage protects Microsoft 365 mail and Gmail only.
Is Advanced Protect enough for a small business?
For most small businesses whose main risk is phishing, invoice fraud and malware, yes. If you send personal or financial data by email regularly, look at Complete Protect.