In short: Check Point ThreatCloud AI is Check Point's shared threat intelligence service and the set of AI engines that analyse it. It gathers telemetry from Check Point gateways, endpoints and other products, Check Point Research and external feeds, then pushes verdicts on files, URLs, domains and IP addresses back to every product, including Harmony Endpoint, Email, Mobile, Browse and SASE.
What is ThreatCloud AI?
ThreatCloud AI is the cloud service that Check Point products consult when they need to decide whether something is malicious. Check Point calls it the brain behind all of its products: rather than each product keeping its own blocklists, they all draw on, and contribute to, the same intelligence.
It combines three things:
- Telemetry from Check Point products in customer environments: network gateways, endpoint agents, email, mobile and cloud protections
- Research from Check Point Research (CPR), Check Point's threat intelligence and research team, plus external intelligence feeds
- AI and machine learning engines that analyse that data to classify files, pages and behaviour, and to create new protections automatically
In Check Point's March 2026 structure, ThreatCloud AI is listed under the Exposure Management pillar alongside threat intelligence and attack surface management, but it serves every pillar, including Check Point Workspace Security.
How shared intelligence works
- A product meets something it has not seen before: a new attachment, a newly registered domain, an unusual login page or a suspicious process.
- It checks ThreatCloud AI for an existing verdict. If there is none, the item is analysed, for example by emulating a file in the sandbox or examining a page's content and structure.
- If the item is judged malicious, the verdict and related indicators (file hashes, URLs, domains, IP addresses) are recorded in ThreatCloud AI.
- Other Check Point products, at your organisation and elsewhere, can then block the same threat without having to analyse it again.
The benefit for a small or mid-sized UK organisation is that you are not relying on threats you have personally seen. A phishing kit first spotted elsewhere can be blocked at your inbox, browser or endpoint shortly afterwards.
The AI engines
Check Point groups its AI-based engines by job. Among the categories it describes:
- Unknown malware detection: static analysis and emulation of files that have no known signature
- Zero-day phishing: analysis of web pages and messages to spot newly created phishing sites, used across network, mobile, email and browser protection
- Classification: classifying documents and malware families, and grouping related XDR/XPR alerts into incidents
- Anomaly detection: unusual behaviour in cloud networks and user activity, and techniques such as SSH tunnelling
- DNS security: detecting DNS tunnelling and algorithmically generated domains used by malware
- Campaign hunting: linking related indicators so a whole attack campaign can be blocked, not just one sample
Check Point publishes figures for engine counts and detection rates; we do not repeat them here because they change frequently and are vendor-reported. What matters for buyers is that the same engines work behind every product you license. Threat Extraction, Check Point's content disarm and reconstruction (CDR), is one example: it is powered by ThreatCloud AI and used in both Check Point's network products and Check Point Endpoint Security.
How ThreatCloud AI improves each Harmony product
| Product | What ThreatCloud AI contributes |
|---|---|
| Harmony Endpoint | Reputation for files, URLs and IP addresses used by anti-malware and anti-bot; verdicts for Threat Emulation; intelligence used in anti-ransomware and EDR investigations |
| Harmony Email and Collaboration | URL and attachment reputation, sandbox verdicts and phishing intelligence applied after Microsoft 365 or Gmail filtering |
| Harmony Mobile | App and URL reputation, and phishing detection on iOS and Android |
| Harmony Browse | Zero-phishing analysis, URL categorisation for filtering, and verdicts on downloaded files |
| Harmony SASE | Web and DNS filtering categories and threat prevention for Internet Access users |
It also feeds Check Point's network firewalls and cloud products, so organisations that run Check Point at the perimeter and in the workspace get one consistent set of verdicts.
IOC management: adding your own indicators
ThreatCloud AI is Check Point's intelligence, but you will sometimes have your own: an indicator from a supplier's incident notice, an NCSC alert or your own investigation. Threat intelligence and indicator of compromise (IOC) management is included in Harmony Endpoint Advanced and above, so administrators can add indicators such as domains, URLs, IP addresses and file hashes for the agent to block, alongside the ThreatCloud feed.
At platform level, Check Point XDR/XPR (formerly Infinity XDR; included in Harmony Endpoint Elite and available as an add-on) correlates events across endpoint, email, network, mobile and cloud and applies ThreatCloud AI and third-party intelligence to them, and Check Point MDR analysts use the same intelligence when investigating incidents for you.
What this means for you
You do not buy ThreatCloud AI separately: it is built into Check Point's products and comes with their subscriptions. The practical questions are which products you connect to it and whether someone is acting on what it finds. We help you choose and deploy the right Harmony products, connect them in one Check Point Portal account so the intelligence is shared, and add IOCs or managed detection where it helps. Contact us to discuss your set-up.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point ThreatCloud AI?
ThreatCloud AI is Check Point's shared threat intelligence service and AI engines. It collects telemetry from Check Point products, Check Point Research and external feeds, and sends verdicts on files, URLs, domains and IP addresses back to every Check Point product.
Do I need to buy ThreatCloud AI separately?
No. ThreatCloud AI is built into Check Point products, including Harmony Endpoint, Email and Collaboration, Mobile, Browse and SASE, as part of their subscriptions.
What is the difference between ThreatCloud AI and Check Point Research?
Check Point Research is the team of researchers who investigate threats and publish findings. ThreatCloud AI is the service that turns intelligence, including CPR's, into automated protections that products apply.
Can I add my own indicators of compromise?
Yes. Harmony Endpoint includes IOC management from the Advanced edition up, so you can add domains, URLs, IP addresses and file hashes to block. Check Point XDR/XPR then correlates events across products.
Where does ThreatCloud AI get its data?
From telemetry sent by Check Point products in customer networks and on endpoints, from Check Point Research, and from external threat intelligence feeds. AI engines analyse that data and share the resulting verdicts with every connected Check Point product.