With the widespread adoption of cloud email services, security vendors are collaborating with cloud providers to offer faster and more seamless ways of rolling out security solutions like API-driven one-click deployment. These new methods of deployment can install in seconds, reduce the risk of email disruption and scale without any additional configurations.
Third-party SEGs (Secure Email Gateways) traditionally provided the foundation for email security and operations, operating via an on-premises or virtual appliance or a cloud service. SEGs process and screen all email traffic according to a set of pre-defined rules to protect against phishing attacks. In order to implement, these solutions require organizations to reroute their mail exchange (MX) record to direct emails towards the SEG.
In recent years Microsoft and Google have leveled up their security significantly, making valuable extensions to foundational email security. However, it is just that, foundational. The current email threat landscape has led to more sophisticated malware delivery techniques and social engineering tactics, creating demand for advanced email security solutions that can collaborate with native vendors and combine diverse approaches to provide in-depth defense – for example, the established partnership between Darktrace and Microsoft. Indeed, Gartner reported that the industry is moving towards a combination of native provider security and API-based vendors, allowing for full-breadth coverage of the variety of use cases.
API-driven deployment
With cloud email services now ubiquitous for almost every business, it makes sense for email security vendors to leverage these cloud services for deployment. Because these products co-exist with, rather than replace, the in-built security of cloud email, they don’t require rerouting the domain name services mail exchanger (DNS MX) record. Instead, vendors can offer seamless delivery of their products by using APIs, which integrate fully via cloud applications without affecting the email delivery path – making installation and uninstallation straightforward while offering uninterrupted workflows.
And communication doesn’t stop at email; in the world of hybrid work, email is just one of the tools employees use to connect and send sensitive information. APIs allow security solutions to integrate with other collaboration tools – including Microsoft Teams, Slack, Salesforce and Dropbox – to allow for full visibility of an organization beyond just the inbox.
API + Journaling
While APIs are unmistakably the future of deployment, they can also be easily augmented. That’s where API+Journaling comes in. Where API-only analyzes emails after they have passed through initial cloud security, and has the ability to quarantine or return them to the inbox post-delivery, API with added journaling in Microsoft 365 takes the raw email data before it enters the inbox to analyze in parallel with the provider’s native security.
As both scenarios take place at machine speed the difference is often imperceptible, but there can be instances where API-only is marginally slower – in certain cases even a second can be detrimental when dealing with such a critical communication platform as email. For these organizations, journaling reduces latency to ensure best in class detection speeds, as much as 30 times faster than API-only.
Darktrace/Email: Flexible Deployment to Suit You
In a crowded market for ICES vendors, those who can offer flexible deployment will remain ahead of the game. Organizations should be able to choose from speedy deployment using API-only, or longer deployment with journaling – with the option to deploy via cloud or on-premise.
Darktrace/Email offers the best of both worlds – giving customers the choice of deployment via API or API+Journaling in Microsoft 365 to meet their organization’s needs. Equally, they can choose to deploy fully via cloud or fully on premise, whichever best suits their team setup. Either way, there’s no change to the email path. With 1-click deployment that installs in seconds, or 5-minute deployment with added journaling – it can scale from just a handful of inboxes to tens of thousands, without any re-routing or additional configurations aside from accepting permissions.
Added features increase the efficiency of workflows to benefit teams – such as the ability to recuperate a delivered message from a user’s inbox post-delivery, whether it is in bulk or a single email. Seamless integration within the email application creates an intuitive user experience, introducing non-invasive banners and simple AI analysis inside the inbox.
Security teams can also get a clearer picture of how effective their current email solution is, as emails aren’t stopped by the SEG before reaching the provider – allowing for improved visibility from first deployment.
Darktrace works with email providers to take advantage of their native security and combine it with our Self-Learning AI, offering flexibility without compromising on speed of deployment. This approach enhances detection by leveraging the same API connections to gather additional context from other SaaS applications like Microsoft Teams and SharePoint – hardening defenses across the organization.
Look out for your first newsletter, coming soon.
