In short: Harmony Email Complete Protect is Check Point Email Security's top tier: everything in Advanced Protect plus data loss prevention (DLP) for email and shared files, with policies that can quarantine, alert on or encrypt sensitive content. It suits organisations that send personal, financial or regulated data and want to reduce the risk of a reportable data breach.
What Complete Protect adds
Complete Protect is Advanced Protect plus data loss prevention (DLP). The threat protection is identical in both tiers: anti-phishing, BEC and impersonation protection, account takeover detection, anti-malware, URL protection, sandboxing, attachment sanitisation and shadow IT detection. What changes is that Complete Protect also watches what goes out.
| Advanced Protect | Complete Protect | |
|---|---|---|
| Inbound and internal threat protection | Yes | Yes |
| DLP for outbound email | No | Yes |
| DLP for shared files (with Email & Collaboration coverage) | No | Yes |
| Policy actions on sensitive content: quarantine, alert or encrypt | No | Yes |
Like Advanced Protect, it can be bought with Email Only or Email & Collaboration coverage. See the plans comparison for the full grid.
Data loss prevention for email and shared files
DLP inspects outgoing messages, attachments and, with Email & Collaboration coverage, files shared through apps such as OneDrive, SharePoint, Google Drive, Box and Dropbox. Policies look for sensitive content, such as personal details or financial information, and you decide what happens when a match is found. Check Point describes workflows that can quarantine the message, alert on it or encrypt it, and on its file-sharing page it describes policy-driven controls that apply encryption to shared content.
Check Point describes its email security as covering internal, external and outgoing mail, and DLP is managed from the same console as threat protection in the Check Point Portal. If you already run Microsoft Purview DLP, we will look at both together so you are not writing the same policy twice.
Encryption and the user experience
Encryption by policy. Rather than relying on staff to remember a separate encryption tool, Complete Protect lets DLP policies encrypt a sensitive message automatically when it matches a rule. That keeps the decision consistent and takes it out of the hands of a busy user.
Choosing the right action. Not every match should be blocked. A sensible design uses different actions for different risks:
| Situation | Typical DLP action |
|---|---|
| Low-risk match, or a new rule still being tuned | Alert the administrator so you can review matches before enforcing |
| Sensitive data that may legitimately go to an outside party | Encrypt the message so only the intended recipient can read it |
| Data that should never leave the organisation by email | Quarantine the message for review |
We usually start new rules on alert only, review what they catch with you, then move the clear-cut cases to encryption or quarantine. That avoids blocking legitimate work while the rules settle in.
The UK GDPR angle
Under UK GDPR, organisations must protect personal data with appropriate technical and organisational measures, and a personal data breach that is likely to result in a risk to people's rights and freedoms must be reported to the Information Commissioner's Office (ICO) without undue delay and within 72 hours of becoming aware of it. The ICO lists sending personal data to an incorrect recipient as one kind of breach, so an unencrypted email or attachment containing personal data that goes to the wrong place can be exactly that kind of incident.
Complete Protect helps by:
- spotting personal or financial data in outgoing email and shared files before it leaves
- encrypting sensitive messages so that an intercepted or wrongly addressed email is less likely to expose data
- quarantining messages that break policy, and alerting you to matches, which gives you a record of the measures you take
It does not make you compliant on its own: policies, training and processes matter too. For the people side, see our GDPR training for staff page on security-awareness-training.co.uk.
Is the upgrade worth it?
Complete Protect is usually worth it if:
- you work in a regulated or sensitive sector, such as legal, financial services, healthcare, education, recruitment or HR outsourcing
- staff regularly email payroll, client files, medical information or identity documents
- you share files externally through cloud storage and want control over what leaves
- you want encryption without buying and training users on a separate product
It is less likely to be worth it if you already have mature DLP and encryption in Microsoft Purview that you actively manage, and your main gap is threat protection. In that case, Advanced Protect with the right add-ons may be the better buy.
Licensing and how we help
Complete Protect is licensed per protected user, normally on an annual subscription, with monthly pay-as-you-go available through managed service providers in the Check Point Portal. The cost depends on coverage, user numbers, add-ons and term; the Harmony pricing and licensing guide explains the factors, and for figures, ask us for a quote.
Forever Systems helps you decide what counts as sensitive for your organisation, builds DLP policies that start in monitor mode, agrees the user experience for warnings and encryption, and tunes the rules until they catch real issues without blocking normal work. Contact us to discuss Complete Protect.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Complete Protect and Advanced Protect?
Complete Protect includes everything in Advanced Protect plus data loss prevention for email and shared files, with policies that can quarantine, alert on or encrypt sensitive content. The threat protection is the same in both.
Does Complete Protect include email encryption?
Encryption is one of the actions Check Point lists for its DLP workflows, alongside quarantine and alerts, and DLP is the part of the product that Complete Protect adds. Policies can apply it automatically when sensitive content is detected. We confirm the exact encryption options for your tenant when we scope the project.
Does Complete Protect help with UK GDPR?
It can support your UK GDPR obligations by detecting personal data in outgoing email and shared files, encrypting or quarantining it by policy, and alerting you to matches. It is one technical measure among several; policies, training and processes are still needed.
Can I use Complete Protect alongside Microsoft Purview?
Yes. Some organisations use Check Point's DLP for email and shared files and keep Purview for other workloads. We will review both so policies do not overlap or conflict.