In short: Sophos Email Monitoring System (EMS) adds post-delivery threat detection alongside Microsoft 365, Google Workspace or third-party email security, without changing mail flow. It finds missed phishing and BEC, lets admins and analysts claw messages back manually, and sends email telemetry to Sophos XDR and MDR. It is included with XDR, MDR and Workspace Protection, or sold standalone.
What is the Sophos Email Monitoring System?
Many organisations are happy with their main email filtering, often Microsoft Defender for Office 365 or Google Workspace's built-in protection, but know that some well-crafted phishing still gets through. Replacing the gateway is a big change. Sophos EMS is designed for that situation: it keeps your mail flow exactly as it is and adds Sophos's detection on top.
EMS analyses email that has already passed your existing defences, using Sophos's AI, machine learning and natural language models, and gives its own verdict on messages that were missed or misclassified. When it finds a threat, an administrator, a threat hunter or a Sophos MDR analyst can claw the message back from users' inboxes.
It is managed in Sophos Fusion and uses the same detection engines as Sophos Email.
How it works
- Connect your mail platform: EMS works alongside Microsoft 365, Google Workspace and third-party email security services
- Mail flow stays the same: no MX record change and no change to your current gateway or filtering
- Post-delivery analysis: EMS inspects mail that reached inboxes and flags phishing, BEC and other threats your existing tools missed
- Correlation: email telemetry is enriched with Sophos X-Ops threat intelligence and grouped with related detections in Sophos XDR and Sophos MDR
- Response: suspicious messages can be manually clawed back, and MDR analysts can block senders, domains and IP addresses
EMS vs Sophos Email
EMS shares Sophos Email's detection, but because it does not sit in the delivery path, some features only make sense in the full product. From Sophos's published comparison:
| Capability | Sophos EMS | Sophos Email |
|---|---|---|
| Anti-spam, malware, QR-code, sandbox, URL and NLP phishing and BEC detection | Included | Included |
| Impersonation checks (display name, lookalike domains) | Included | Included |
| Active phishing and BEC protection (blocking before delivery) | Not included | Included |
| Time-of-click URL rewriting | Not included | Included |
| Outbound DKIM signing and BATV | Not included | Included |
| Message encryption (TLS, S/MIME, push encryption) | Not included | Included |
| Microsoft 365 mail flow integration and quarantine release | Not included | Included |
| Post-delivery clawback | Manual only | Automatic or manual |
| Quarantine and allow and block lists | Admin only | Admin and user |
| Phishing simulation and awareness training | Not included | Included |
| XDR and MDR event reporting and response actions | Included | Included |
| Sophos DMARC Manager | Add-on | Add-on (included in Email Plus) |
In short, EMS is detection and response; Sophos Email is prevention, detection and response.
How to get EMS
- Included with Sophos XDR and Sophos MDR, so existing customers may already be entitled to it
- Included with Sophos Workspace Protection as one of the bundle's four components
- Standalone, for organisations that want the extra email layer only
- Licensing: counted by number of mailboxes; DMARC Manager is an optional add-on
Ask us for a quote, and we will check first whether your existing XDR, MDR or Workspace Protection subscription already covers it.
Who EMS suits
- Microsoft 365 customers using Microsoft Defender for Office 365 who want a second opinion without replacing it; see also Sophos MDR for Microsoft Defender
- Google Workspace customers who want more visibility of what reaches inboxes
- Organisations with a third-party email gateway that has no integration with Sophos XDR or MDR
- Sophos MDR customers who want analysts to see email context alongside endpoint, identity and network data
- Anyone in a long contract with their current email security who wants extra protection before renewal
If you are ready to replace your current filtering, Sophos Email blocks threats before delivery rather than after. For a comparison of approaches across vendors, see our email security guide on cloud-security.cloud.
How we help
We check your entitlement, connect EMS to your mail platform, and review the first detections with you so you can see what your current tools are missing. If you are on Sophos MDR, we make sure analysts have the response permissions they need.
Contact us to switch it on or for a quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Sophos EMS?
Sophos EMS (Email Monitoring System) is a Sophos service that analyses mail after it has passed your existing email security, flags missed phishing and BEC, supports manual clawback, and sends email telemetry to Sophos XDR and MDR.
Does Sophos Email Monitoring System change mail flow?
No. EMS works alongside Microsoft 365, Google Workspace or third-party email security without changing MX records or mail routing.
Is Sophos EMS included with Sophos MDR?
Yes. Sophos lists EMS as included with Sophos MDR and Sophos XDR, and with Sophos Workspace Protection. It is also sold standalone.
Can I use Sophos EMS with Microsoft Defender for Office 365?
Yes. That is one of its main uses: Defender for Office 365 keeps filtering mail, and EMS adds Sophos detection on top and shares findings with Sophos XDR or MDR.
What is the difference between Sophos EMS and Sophos Email?
Sophos Email sits in the mail path and blocks threats before delivery, with encryption, time-of-click URL protection and Phish Threat. EMS does not change mail flow; it detects threats after delivery and supports manual clawback.