Check Point Email Security puts the bouncer before the inbox

An early Avanan customer had a comforting theory about cybersecurity: his consulting firm was too obscure to attract much attention. Then its chief financial officer began receiving spear-phishing emails every week. Obscurity, it turned out, was a rather unreliable firewall. In the company’s anonymous case study, the security architect is called Jim. His firm had moved from Exchange to Office 365 in 2016. The office had moved to the cloud. The unwanted visitors had followed.

Jim added Avanan, an extra security layer. One attack passed Office 365’s junk filtering; Avanan caught it. The first failure in this account was a specific message slipping through the existing filter. The change of mind was equally specific: being a modestly visible business offered no immunity. His experience explains the company more neatly than a parade of acronyms.

01 / A question of placement

Check Point Email Security is the business built on Avanan, now owned by Check Point Software. Its distinction begins with placement. A conventional secure email gateway checks traffic on its way into an organization. A service that removes messages after delivery allows a period when the user can encounter them. Avanan’s patented approach combines cloud APIs with inline inspection: it can examine a message before it reaches the recipient’s inbox.

The administration guide describes the sequence: intercept the message, send it to ThreatCloud for analysis, then apply the configured workflow. Malicious mail can be quarantined; acceptable mail proceeds. Internal and outgoing traffic can also be inspected. That matters when the suspicious sender is a compromised colleague whose address everybody recognizes.

This positioning puts Check Point between cloud platforms’ built-in defenses and the employee. Buyers also encounter Microsoft Defender, Proofpoint, Mimecast, Abnormal Security and Barracuda. The sensible comparison is operational: which traffic is examined, when enforcement happens, and what administrators must do afterward. A useful filter must fit the office it protects.

02 / The buyer became the owner

Avanan’s founders came from Forescout: Gil Friedrich, Roy Rotem, Avi Zelovich and Michael Landewe. Contemporary reporting dates its founding to 2014, with New York headquarters and development in Tel Aviv. By December 2018, it had announced a $25 million Series B backed by StageOne, Magma and Greenfield Partners. The earlier Series A had brought in $14.9 million.

Its early proposition let businesses use familiar security engines across cloud applications. The 2018 offering integrated technology from several vendors, including Check Point, rather than asking customers to abandon every tool they already trusted. There is a commercial insight here: a new delivery method can make existing expertise useful in a changed environment.

Check Point announced the acquisition in August 2021. Avanan then protected more than 5,000 customers and 2.5 million inboxes. More revealing than either number was the relationship behind the transaction. Check Point had already used Avanan technology as an OEM for three years. The buyer had been living with the product before deciding to own it.

“We’ve been using the Avanan technology as an OEM for the last 3 years”Dorit Dor, Check Point acquisition announcement, 2021

03 / Email has company

The customer is usually an IT team, security team or managed service provider responsible for other people’s communications. Public references span healthcare, hospitality, schools and staffing. The current product page claims more than 80,000 protected organizations. That is a vendor-reported scale measure, rather than a promise about any individual deployment.

The broader packages follow files and messages into OneDrive, SharePoint, Google Drive, Teams, Slack and other supported applications. Malware inspection, phishing detection and data-loss policies address related problems across those services. Email gets the headline because everyone understands an inbox. The file shared five minutes later deserves attention too.

The expertise combines message inspection, behavioral signals, attachment analysis and threat intelligence. Account-takeover detection examines patterns such as logins and correspondence. Data loss prevention addresses the reverse journey: sensitive material leaving the organization. Encryption workflows can use Microsoft 365 encryption or Avanan SmartVault. Administrators choose policies; software does not know a company’s disclosure rules by instinct.

04 / The price of a second look

The official package menu separates Email Only from Email & Collaboration, then Advanced Protect from Complete Protect. Advanced includes phishing and account-takeover protection, URL emulation, sandboxing and attachment sanitization. Complete adds DLP. Archiving, DMARC management and analyst assistance are among the optional services.

That marketplace listing gives buyers something concrete to calculate. At its published unit price, 100 users would total $10,914 annually before extras or negotiated terms. The licensing rules deserve equal attention: one person with separate Microsoft and Google addresses can consume two licenses. Count protected identities carefully before admiring the monthly figure.

05 / Borrow the trial, measure the work

Rotana offers a useful buying method. Its information-security director said the hotel group ran the product beside existing systems for about a month. The published customer account describes sophisticated phishing and a burdensome previous solution, then reports that the replacement stopped 50% more phishing and targeted attacks. That result belongs to this deployment; it is no universal catch-rate guarantee.

Readers can copy the method: examine their own traffic, compare misses, and count the administrative work. The trial should test false positives, legitimate-message recovery and delivery behavior as well as attacks caught. Email-only coverage will not protect every collaboration app. Monitor mode will not enforce inline blocking. A poor fit between permissions, licensed users and policy can leave an expensive gap.

The company keeps adapting to its hosts. In March 2026, Harmony Email & Collaboration became Check Point Email Security. In September, it removed its dependency on EWS full-access permission ahead of Microsoft’s retirement of the interface. Names change; permissions change. The original wager remains useful: inspect the message before someone has reason to trust it.