There are no products listed under this category.
Sophos Email Monitoring System (EMS)
See the email threats your current gateway missed.
Sophos EMS is a monitoring-only sensor that sits alongside the email security you already run, whether that is Microsoft Defender, Google, Proofpoint, or Mimecast. It scans a copy of every message, flags what slipped through, and feeds email threats into Sophos MDR and XDR, all without touching your mail flow.
Adding email visibility to MDR or XDR? Get a quote or call 1-833-283-7373.
Monitoring onlyNo impact on mail flow
Any gatewayWorks alongside yours
MDR & XDRFeeds email telemetry
Per mailboxOr with Workspace Protection
What EMS does, and what it does not.
EMS is a visibility layer, not a filter. Being clear on that is the whole point of choosing it.
Scans a copy of every message
Using journaling in Microsoft 365 or Google Workspace, EMS receives a copy of each inbound and outbound email and scans it. The original message is never changed and is delivered as normal.
Reports what got through
It delivers verdicts on suspicious or misclassified messages in Sophos Central: what Sophos would have done, so you can see the gaps in your existing defences without changing anything.
Feeds Sophos MDR and XDR
Email telemetry flows into the Sophos Data Lake, so analysts can correlate email threats with endpoint, identity, and network data for faster detection and response.
Manual clawback on Microsoft 365
For M365, EMS can manually claw back a delivered message after analysis, so a malicious email that slipped through can still be pulled from inboxes.
Important: EMS does not block or protect
EMS is monitoring and reporting only. It scans and gives verdicts, but it does not filter, block, or quarantine mail, and any policy actions you configure are not applied to messages. If you want Sophos to actively stop threats, that is Sophos Email, not EMS.
Sophos Email or Sophos EMS?
They solve different problems. Use this to tell which one you need.
| Sophos Emailactive gateway | Sophos EMSmonitoring only | |
|---|---|---|
| Blocks phishing, BEC, ransomware, spam | Yes | No, reports only |
| Changes or filters mail flow | Filters and can quarantine | No, delivery untouched |
| DLP, encryption, phishing training | Included | Not included |
| Feeds Sophos MDR and XDR | Yes | Yes |
| Manual clawback (M365) | Yes | Yes |
| Works alongside a third-party gateway | Replaces or layers over it | Sits alongside, keeps it in place |
| Best for | Making Sophos your email protection | Keeping your gateway, adding Sophos visibility to MDR/XDR |
A simple rule: if you already run Sophos Email, you do not need EMS, because Sophos Email already protects and feeds MDR and XDR. EMS is for organisations that keep a different email gateway but still want Sophos visibility.
Who EMS is for.
It fits a specific set of situations well.
You use a third-party gateway you are keeping
Microsoft Defender, Proofpoint, Mimecast, or Google, and you do not want to rip and replace it.
You run Sophos MDR or XDR
And want email threats folded into the same detection and response picture as your endpoints and identity.
You need forensic email visibility
For compliance or investigations, without altering how mail is delivered.
0
impact on mail delivery
Tell us your mailbox count and what gateway you run today. We will scope EMS, standalone or with Workspace Protection, quote it, and reply in two to three business days.
EMS questions.
Can I buy EMS on its own?
Yes. Sophos EMS is available standalone, licensed by the number of mailboxes, or included at no extra charge with Sophos Workspace Protection. When it comes with Workspace Protection, EMS is not counted in that bundle's per-user licensing.
Does EMS block threats?
No. EMS is monitoring and reporting only. It scans messages and gives verdicts, but it does not filter, block, or change delivery. For active protection, you want Sophos Email.
Do I need EMS if I already have Sophos Email?
No. Sophos Email already provides active protection and feeds Sophos MDR and XDR, so it covers what EMS does and more. EMS is for organisations that keep a different email gateway.
Will EMS disrupt my mail?
No. EMS uses journaling to receive a copy of each message. There are no MX record changes and no impact on delivery. Your existing email flow continues exactly as it is.
Which email services does EMS work with?
Microsoft 365 and Google Workspace, and it complements third-party gateways such as Microsoft Defender for Office 365, Proofpoint, and Mimecast.
Add Sophos email visibility without changing a thing.
Tell us your mailbox count and what gateway you run today. We will scope EMS, standalone or with Workspace Protection, quote it, and reply in two to three business days.