In short: Avanan incident response as a service (IRaaS) is an add-on to Check Point Email Security, formerly Harmony Email and Collaboration and Avanan. Check Point's analysts review emails your users report as suspicious and handle requests to release quarantined mail, investigating and remediating as needed, so your help desk is not tied up with email tickets.
What IRaaS is
Every email security product produces two streams of human work:
- User reports. Staff are trained to report anything suspicious, so someone has to look at each report, decide if it is malicious and, if it is, remove copies from other mailboxes.
- Release requests. Some legitimate mail is quarantined, and the recipient asks for it back. Someone has to check it is safe before releasing it.
In a small organisation that someone is usually the one IT person or a help desk with plenty else to do. With the IRaaS add-on for Harmony Email and Collaboration, now officially Check Point Email Security, Check Point's incident team takes on both streams. Check Point says its experts are on call 24/7.
How the workflow runs
- A user reports an email as suspicious, or asks for a quarantined message to be released
- The request reaches Check Point's incident team instead of your help desk queue
- An analyst reviews the message
- For a reported email, the analyst chooses the appropriate action from the options available; for a release request, they investigate and remediate as necessary before deciding whether the message is released
- We agree with you how outcomes are reported back, so your administrators keep visibility and can step in at any time
Your own administrators still own the policy. IRaaS takes on the repetitive triage, not control of your settings.
Who IRaaS suits
IRaaS is a good fit where:
- IT is a small team or one person, and phishing reports and release requests interrupt project work
- You actively encourage reporting, for example after security awareness training, and the volume of reports has grown
- You run strict quarantine policies, which keep users safe but generate more release requests
- Out-of-hours cover matters, because people in other time zones or on shifts need answers when your team is offline
- You want triage done by the vendor's own team, the people who know how Check Point's engines reached their verdict
Larger organisations with their own security operations centre may prefer to handle these tickets in-house and feed the events into their SIEM instead.
What changes for your users and your IT team
For users, very little changes. They report suspicious messages and ask for quarantined mail in the same way as before; the difference is that a specialist looks at each request instead of it waiting in a general help desk queue. Quick, consistent answers encourage people to keep reporting, which is the behaviour every awareness programme is trying to build.
For your IT team, the change is bigger:
- Fewer interruptions. Routine "is this email safe?" and "please release my email" tickets stop landing on the help desk.
- Consistent decisions. Release requests are judged by analysts who look at email threats all day, which reduces the risk of a busy technician releasing a well-crafted phishing message.
- Out-of-hours cover. Requests raised in the evening or at weekends do not have to wait until Monday.
- Time back for prevention work, such as getting your domains to enforcement with DMARC Management or acting on leaked credential alerts.
IRaaS works best alongside a strong core policy. The detection engines in Advanced Protect stop most threats before a user ever sees them; IRaaS handles the small number of judgement calls that remain.
IRaaS vs Check Point MDR
IRaaS is often confused with full managed detection and response. They solve different problems:
| Incident Response as a Service | Check Point MDR | |
|---|---|---|
| Scope | Email only: user-reported suspicious mail and quarantine release requests | Your wider estate: endpoint, email, network, cloud and identity |
| What it replaces | Help desk email triage | Round-the-clock security monitoring, threat hunting and response |
| How it is bought | Add-on to Harmony Email and Collaboration | Separate managed service that works with Check Point and third-party tools |
| Best for | Small IT teams drowning in email tickets | Organisations that want a 24/7 security team watching everything |
If you want people watching endpoints and identities as well as email, read our Check Point MDR page. Some organisations start with IRaaS and consider MDR as their estate and risk grow.
Licensing and how we help
IRaaS is licensed as an add-on to either security tier of Harmony Email and Collaboration; see the plans comparison and the Harmony pricing guide for how the pieces fit together. Forever Systems can enable IRaaS, set up the user reporting route, agree with you which actions Check Point's analysts can take, and review what is being reported with you each month.
Contact us for a quote.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Avanan incident response as a service?
It is an add-on to Check Point Email Security (formerly Harmony Email and Collaboration and Avanan) in which Check Point's analysts handle users' reports of suspicious email and requests to release quarantined mail, investigating and remediating as needed.
Is IRaaS the same as Check Point MDR?
No. IRaaS covers email tickets only: reported phishing and quarantine release requests. Check Point MDR is a 24/7 managed detection and response service across endpoint, email, network, cloud and identity.
Do I lose control of my email security policy with IRaaS?
No. Your administrators still set and own the policy and can step in at any time. IRaaS takes on the repetitive triage work.
Who should buy IRaaS?
Organisations with small IT teams, strict quarantine policies or a high volume of user phishing reports, and those that need email triage outside office hours.
Is Check Point's incident response team available 24/7?
Yes. Check Point says the experts behind Incident Response as a Service are on call 24/7, so reports and release requests raised in the evening or at weekends do not have to wait for your own team.