Sophos Email Protection
Stop the attack before it's opened.
Email is still the number one way attackers get in — and modern phishing is written by AI, not by someone who can't spell. Sophos Email uses layered machine learning, sender authentication and cloud sandboxing to stop phishing, impersonation and malware before they ever reach an inbox.
Works with Microsoft 365, Google Workspace and any email service where you control the domain. Billed monthly per user, ex VAT. New accounts set up within one business day.
What it stops
- Phishing & credential theft — including QR-code and image-based attacks
- Business email compromise & CEO impersonation
- Malware & ransomware in attachments and links
- Data leaks — outbound scanning, DLP and encryption
Layered protection, not a single filter
Impersonation & BEC defence
Natural-language AI reads the tone, context and structure of messages to catch impersonation and business email compromise — the attacks that carry no malware at all and walk straight past traditional filters.
Time-of-click URL protection
Links are rewritten and checked at the moment they're clicked, not just when the email arrives — defeating attackers who weaponise a clean link hours after delivery. QR codes inside messages are scanned too.
Cloud sandboxing
Suspicious attachments are detonated in a cloud sandbox that watches file, registry and network behaviour — catching brand-new ransomware by what it does, not what it looks like.
Post-delivery clawback
If a message is identified as malicious after it's been delivered, it's automatically pulled back out of inboxes — closing the gap between delivery and detection.
Sender authentication with SPF, DKIM and DMARC verifies that mail claiming to be from your suppliers, your bank — or you — genuinely is. Outbound scanning and multi-rule data loss prevention catch sensitive information leaving the business, with automatic encryption when policy requires it. And because it integrates with Microsoft 365 via API, there's no MX record surgery to get started.
Two tiers, one decision
Sophos Email covers the security. Email Plus adds control over what happens after delivery — and protects your own domain from being spoofed.
Sophos Email
Complete email security for most businesses
- Inbound & outbound scanning with AI threat detection
- Phishing, impersonation & BEC protection
- Cloud sandboxing & time-of-click URL protection
- SPF, DKIM & DMARC sender authentication
- Data loss prevention & message encryption
- Phish Threat included — phishing simulations and security awareness training for your users
- Self-service quarantine & sender controls for users
Sophos Email Plus
Everything in Sophos Email, plus post-delivery control
- DMARC Manager included — see exactly who is sending email as your domain, and stop spoofers trading on your name
- 90-day message history & quarantine (vs 30 days) — for investigations and compliance queries
- Message Replay — re-deliver mail that was accidentally deleted or temporarily rejected
- Contact Trace & Recall — if a malicious email gets forwarded internally, trace where it went and claw back every copy (Microsoft 365)
Pricing
Per user, per month. All prices exclude VAT. New accounts set up within one business day.
| Product | What it's for | Monthly (ex VAT) |
|---|---|---|
| Sophos Email | Full email security including Phish Threat awareness training | £3.00 |
| Sophos Email Plus | Everything above, plus DMARC Manager, 90-day history, Message Replay and Contact Trace & Recall | £4.50 |
| Portal Encryption add-on | Branded secure web portal for sending fully encrypted messages — recipients sign in to read and reply | £5.00 |
| DMARC Manager add-on | Domain spoofing visibility & DMARC conformance for Sophos Email customers (already included in Plus) | £1.00 |
| Email Monitoring System (EMS) | Monitoring of your email flow and domain health | £1.00 |
| Phish Threat (standalone) | Phishing simulation & awareness training on its own — for businesses keeping their existing email filter | £2.50 |
Which tier?
If your brand gets spoofed, you handle regulated data, or you've ever needed to hunt down a forwarded email — take Plus. The DMARC Manager alone costs £1.00 as an add-on, so the effective premium for the extra message-handling tools is 50p.
Everyone else: Sophos Email is complete protection, training included.
Why email protection works better inside the Sophos ecosystem
A phishing email is rarely the whole attack — it's the front door. The user clicks, malware lands on the laptop, and the attacker starts moving across the network. Three layers, three products — and if those products don't talk to each other, three separate alert queues that nobody joins together until it's too late.
Every Sophos product on this site reports into Sophos Central: one console, one policy engine, one timeline. Email telemetry feeds the same data lake as your endpoint and firewall events, so a campaign shows up as one story — the message that got through, the device it detonated on, and the network traffic it generated. That's what XDR investigations and Sophos' 24/7 MDR analysts actually run on.
- With endpoint protection: if a user clicks the one link that gets through, Intercept X stops the payload on the device, CryptoGuard rolls back any encryption, and the email that started it is clawed back from every other inbox it reached.
- With an XGS firewall: a device compromised via email turns its Security Heartbeat red and is automatically isolated from the network — the infection stops at one machine instead of becoming an incident.
- With MDR: Sophos' analysts see your email, endpoint and firewall telemetry together, 24/7 — and respond to the whole attack chain, not one symptom of it.
Endpoint Protection
Sophos Endpoint, EDR, XDR & MDR from £4.00 per user/month
XGS Firewalls
Sophos XGS hardware as a monthly subscription — no capital outlay
Protect the inbox. Then protect everything behind it.
Tell us how many mailboxes you have and what you run today — Microsoft 365, Google Workspace or your own mail platform — and we'll have protection live within one business day.
Why buy through us?
- Monthly billing, no upfront licence purchase
- Setup within one business day
- One supplier for hosting, firewall, endpoint and email
- UK-based support that already knows your environment