There are no products listed under this category.
Sophos EMS · Silver Partner
See the email threats your gateway misses.
The Sophos Email Monitoring System adds a managed layer of email threat detection alongside your existing email security, feeding Sophos MDR. Buy a licence below, or ask us to size it.
Search for a specific product, or browse the options below.
Scans a copy of every message
Using journaling in Microsoft 365 or Google Workspace, EMS receives a copy of each inbound and outbound email and scans it. The original message is never changed and is delivered as normal.
Reports what got through
It delivers verdicts on suspicious or misclassified messages in Sophos Focus: what Sophos would have done, so you can see the gaps in your existing defences without changing anything.
Feeds Sophos MDR and XDR
Email telemetry flows into the Sophos Data Lake, so analysts can correlate email threats with endpoint, identity, and network data for faster detection and response.
Manual clawback on Microsoft 365
For M365, EMS can manually claw back a delivered message after analysis, so a malicious email that slipped through can still be pulled from inboxes.
Can I buy EMS on its own?+
Yes. Sophos EMS is available standalone, licensed by the number of mailboxes, or included at no extra charge with Sophos Workspace Protection. When it comes with Workspace Protection, EMS is not counted in that bundle's per-user licensing.
Does EMS block threats?+
No. EMS is monitoring and reporting only. It scans messages and gives verdicts, but it does not filter, block, or change delivery. For active protection, you want Sophos Email.
Do I need EMS if I already have Sophos Email?+
No. Sophos Email already provides active protection and feeds Sophos MDR and XDR, so it covers what EMS does and more. EMS is for organisations that keep a different email gateway.
Will EMS disrupt my mail?+
No. EMS uses journaling to receive a copy of each message. There are no MX record changes and no impact on delivery. Your existing email flow continues exactly as it is.
Which email services does EMS work with?+
Microsoft 365 and Google Workspace, and it complements third-party gateways such as Microsoft Defender for Office 365, Proofpoint, and Mimecast.
Buy Sophos EMS below Pick an option to add to cart, or request a quote for volume and monthly pricing.