Sophos Email Monitoring System

Sophos EMS (Email Monitoring System), also known as "Email Sensor", is designed to complement and strengthen your existing email security from other providers. This flexible, non-intrusive tool enhances visibility and supports remediation for customers using Microsoft Defender for Microsoft 365, Google Workspace Security, or other third-party email security services.

EMS acts as a secondary layer of email security. It receives journaled copies of messages that may have passed existing security checks and been delivered to end users. EMS scans these messages and logs the results, but doesn't take any action on them. You can configure policy actions, but these actions aren't applied to the messages. EMS is designed for monitoring and reporting only, and it generates detailed reports in Sophos Central.

EMS also seamlessly integrates with Sophos' MDR and XDR systems, empowering security teams with a deeper understanding of potential threats. Through API integration, EMS offers its M365 customers the manual clawback capability.