Sophos Email Security

No entries match these filters. Clear filters

1. 2026.41Released October 12, 2026 Oct 12, 2026 · issue 109

   Sophos Email 2026.41 adds an S/MIMES/MIMEAn email encryption and signing standard that uses X.509 certificates to authenticate senders and protect message contents; cyber tools use it to verify identity and enforce confidentiality over standard mail protocols. Certificate Management API, URL export from quarantine (CSV/PDF), and enhanced custom branding workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Export detected URLs from a quarantined message to CSV for further investigation or evidence gathering.
   📍In Sophos Central, open the quarantined message in Message Details, navigate to the URLs tab, and select Export — choosing CSV or PDF as the output format.
   • Adds the S/MIME Certificate Management API to programmatically manage S/MIME certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds URL export from the URLs tab in Message Details for quarantined messages, available in CSV and PDF formats with basic message details for identification.
   • Enhances the custom branding provisioning workflow.
   • Adds the S/MIME Certificate Management API to programmatically manage S/MIME certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds URL export from the URLs tab in Message Details for quarantined messages, available in CSV and PDF formats with basic message details for identification.

   1 more in Everything

2. changelog Sep 26, 2026 · issue 086

   Sophos Email Security now supports custom policies applied directly to distribution lists and shared mailboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3. 2026.38Released September 21, 2026 Sep 21, 2026 · issue 083

   Sophos Email 2026.38 adds custom policies for distribution lists and shared mailboxes plus automated Microsoft 365 journal onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Enables custom protection policies to be applied directly to distribution lists and shared mailboxes, independently of individual member policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Automates Microsoft 365 journal rule creation and related settings during Sophos EMS onboarding, eliminating manual journal configuration after M365 permissions are authorized.
   • Enables custom protection policies to be applied directly to distribution lists and shared mailboxes, independently of individual member policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. changelog Sep 5, 2026 · issue 065

   Sophos Email Security adds Data Control notification recipients and automatic Intelix-based quarantine release.

   └──▷ HOW TO FIND IT
   Enable automatic quarantine release so emails cleared by Intelix are freed without manual review, reducing analyst workload.
   📍In Sophos Central, go to Email Security › Policies › Scan Attachments with Intelix, enable Automatically release from quarantine for emails Intelix determines are not malicious or suspicious.
   • Adds configurable notification recipients for Data Control rule actions.
   • Automatically releases quarantined emails from quarantine when an Intelix scan determines the email is not malicious or suspicious.
   • Automatically releases quarantined emails from quarantine when an Intelix scan determines the email is not malicious or suspicious.

   1 more in Everything

5. 2026.35Released August 31, 2026 Aug 31, 2026 · issue 062

   Sophos Email adds Data Control notification recipients and automatic Intelix-based quarantine release.

   └──▷ HOW TO FIND IT
   Configure automatic quarantine release so emails cleared by Intelix are freed without manual intervention — reducing analyst queue depth for low-risk holds.
   📍In the Sophos Central console, go to Email Security › Policies › Data Control, open or create a rule, set the action to Quarantine, then under Scan attachments with Intelix enable automatic release so emails assessed as not malicious or suspicious are released automatically. Under Notifications, add the recipient addresses that should be alerted when the rule triggers.
   • Enables configuration of notification recipients for Data Control rule actions, so the right people are alerted when a Data Control policy triggers.
   • Automatically releases quarantined emails from quarantine when an Intelix scan determines the email is not malicious or suspicious, reducing manual triage of held mail.

   2 details in Everything

6. 2026.32Released August 11, 2026 Aug 11, 2026 · issue 048

   Sophos Email 2026.32 adds customizable block/warning messages for unverified URLs and CSV/PDF export of per-message URL lists.

   • Adds CSV and PDF export of the URL list from the URLs tab in Message Details, including basic message metadata to identify the source message.
   • Allows custom block and warning messages for unverified Time-of-Click (ToC) links to be configured separately from messages shown for risky URLs, enabling less alarming messaging for URLs that are unverified but not known to be malicious.

   2 details in Everything

7. 2026.26Released July 2, 2026 Jul 2, 2026 · release notes

   Sophos Email Security 2026.26 adds AI-powered header and auth analysis summaries to quarantine list pages

   • Adds AI Analysis summary of email headers and authentication results (SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit., DMARC) to quarantine list pages

   1 detail in Everything

8. 2026.20Released May 18, 2026 May 18, 2026 · release notes

   Sophos Email Security 2026.20 adds AI header analysis, newly registered domain protection, and new premium tier capabilities.

   • Adds AI-powered summary generation for email headers and authentication results (SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit., DMARC) to help assess message suspicion.

   1 detail in Everything

9. 2026.11Released March 16, 2026 Mar 16, 2026 · release notes

   Sophos Email Security 2026.11 adds AI email header analysis and TLS encryption filtering in Mailflow.

   • Adds AI Analysis feature to generate AI-powered summaries of email headers and authentication results (SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit., DMARC) for quick threat assessment
   • Adds TLS encryption filtering support in Sophos Mailflow, allowing message filtering based on the encryption used between Sophos Email and Microsoft 365

   2 details in Everything

10. 2026.05Released February 2, 2026 Feb 2, 2026 · release notes

    Adds Post-Delivery Protection for Google to scan and claw back malicious emails in user inboxes.

    • New Post-Delivery Protection (PDP) capability for Google gateway domains, enabling automatic search and remediation of messages with malicious URLs or attachments after delivery.

    1 detail in Everything

11. 2025.50Released December 15, 2025 Dec 15, 2025 · release notes

    Sophos Email Security 2025.50 adds Copy of reported messages feature and UAE region support.

    • Adds Copy of reported messages capability to let administrators specify mailboxes or distribution lists to receive copies of user-reported messages.
    • Adds support for the UAE data center as a selectable region for email hosting and encryption workflows.

    2 details in Everything

12. 2025.26Released July 2, 2025 Jul 2, 2025 · release notes

    Sophos Email Security 2025.26 adds Email Monitoring System and DMARC Manager for authentication control

    • Adds Email Monitoring System (EMS), a new monitor-only journal-based solution for Microsoft 365 and Google Workspace that provides deep visibility into email traffic without disrupting delivery.
    • Adds DMARC Manager, a new capability for comprehensive management of DMARC, SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders., and DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. records (including SPF flattening), BIMI, MTA-STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets., TLS-RPT, and automated DMARC alerts.

    2 details in Everything

13. 2025.23Released June 9, 2025 Jun 9, 2025 · release notes

    Sophos Email Security 2025.23 adds QR code scanning, SophosLabs reporting, BEC protection, and VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. impersonation management

    └──▷ HOW TO FIND IT
    View SophosLabs verdicts on reported messages via the report interface
    📍Navigate to Reports › SophosLabs Analysis Report in the console
    Manage VIP lists to refine impersonation protection policies
    📍Go to Protection Settings › Impersonation Protection › VIP Lists to add or remove entries
    • Enables scanning of messages for malicious URLs and QR codes pointing to unsafe websites, malware, ransomware, or phishing sites
    • Adds SophosLabs Analysis Report providing verdicts on messages reported as threats or clean by users or admins
    • Introduces Business Email Compromise protection to manage defenses against account compromise and impersonation attacks
    • Adds capability to manage internal and external VIP lists for improved impersonation protection

    4 details in Everything

14. 2025.20Released May 19, 2025 May 19, 2025 · release notes

    Sophos Email Security 2025.20 adds Rejection Logs view and editable descriptions for admin allow/block list entries.

    └──▷ HOW TO FIND IT
    Quickly identify bounce-back errors for missing mailboxes in recent delivery reports.
    📍In the console, go to Reports and click the Rejected button under Read Report.
    Add context to allowlist entries to help team members understand why specific senders are trusted.
    📍Navigate to Admin › Allow/Block List, select an entry, and use the new edit field for descriptions.
    • Rejected button added to the Read Report menu to see messages rejected because the mailbox wasn't found
    • Ability to add or edit descriptions for entries in the Admin Allow/Block List via a new editing interface

    2 details in Everything

15. 2025.08Released February 24, 2025 Feb 24, 2025 · release notes

    New Custom Branding for encryption portals and Email Headers controls for encryption application.

    └──▷ HOW TO FIND IT
    Customize the look and feel of your encrypted message portal for branding consistency.
    📍In the Sophos Central console, navigate to Email Security › Encryption Settings and enable Custom Branding to upload your logo and color scheme.
    Adjust how encryption metadata is handled in outbound messages via policy settings.
    📍In the Sophos Central console, go to Email Security › Encryption Settings › Email Headers and configure the header application rules.
    • Adds Custom Branding capability to customize the branding of encryption portal and encrypted messages (requires Portal Encryption Add-on).
    • Adds Email Headers feature allowing customers to control how encryption is applied to messages.

    2 details in Everything

16. 2024.48Released December 04, 2024 Dec 4, 2024 · release notes

    Sophos Email Security 2024.48 adds language detection to anti-spam protection.

    • Adds language detection to prevent messages in languages not used for business.

    1 detail in Everything

17. 2024.30Released July 29, 2024 Jul 29, 2024 · release notes

    Sophos Email Security 2024.30 adds scheduled Executive Summary reports, QR Code Protection for malicious URLs, and spam reporting without blocking.

    └──▷ HOW TO FIND IT
    Configure a scheduled executive summary report via the UI for recurring security insights.
    📍In the console, go to Reports › Executive Summary and configure the schedule frequency and date range.
    Enable QR code scanning to detect malicious links hidden in images.
    📍In the console, go to Protection › URL Protection and enable QR Code Protection.
    Allow end-users to flag spam without blocking senders using smart banners.
    📍In the console, go to Settings › End-user message settings and enable reporting spam through smart banners.
    • Adds Executive Summary Report feature allowing customers to schedule regular customized filtered reports at a set frequency for a specific date range.
    • Introduces QR Code Protection which scans for malicious URLs embedded in QR codes.
    • Enables users to report spam emails through smart banners without blocking the sender.

    3 details in Everything

18. 2024.06Released February 12, 2024 Feb 12, 2024 · release notes

    Data control policy now supports granular search across subject, body, and attachment fields

19. 2023.46Released November 20, 2023 Nov 20, 2023 · release notes

    Adds Multiselect Clawback from Message History and scheduled 24/7 Quarantine Summary to Sophos Email Security.

    └──▷ HOW TO FIND IT
    Manually recall specific sent emails from M365 inboxes to isolate them in quarantine for investigation or containment.
    📍In the console, go to Post Delivery Protection › Message History and use Multiselect Clawback
    Receive a daily digest of quarantined items at a convenient time rather than real-time alerts.
    📍In the console, go to Quarantine Settings and configure the Schedule to send summaries at any hour/day.
    • Adds Multiselect Clawback from Message History to manually claw back messages from M365 inboxes into post delivery quarantine.
    • Enhances quarantine summary to allow scheduling of summary messages for any hour of the day and any day of the week.

    2 details in Everything

20. 2023.37Released September 16, 2023 Sep 16, 2023 · release notes

    New Sophos Email Clawback API and deeper MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. integration in v2023.37

    • Adds the Sophos Email Clawback API to manually claw back messages from M365 inboxes into post delivery quarantine.
    • Enhances Sophos Email integration with Sophos MDR, supporting detections for account compromise, malware, malicious URL, impersonation, spam, data control, and post delivery protection.

    2 details in Everything

21. 2023.34Released August 26, 2023 Aug 26, 2023 · release notes

    Sophos Email Security 2023.34 adds SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. soft-fail checks, address modification in data control, and read-only user quarantine.

    • Adds Domain anomaly option in Sender checks to boost security against unauthentic sender domains
    • Adds SPF soft failure check support for message authentication
    • Adds Modify address option in Data control to change delivery address or CC/BCC emails
    • Adds ability to recover deleted outbound spam and inbound malware emails to quarantine for inspection
    • Adds Read-only user quarantine configuration allowing users to view but not release or delete quarantined emails

    5 details in Everything

22. 2023.31Released August 05, 2023 Aug 5, 2023 · release notes

    Adds Google Directory Sync and On-Demand Clawback for M365 messages in Sophos Email Security.

    └──▷ HOW TO FIND IT
    Quickly retract a mistakenly sent sensitive message from M365 mailboxes using the new clawback capability.
    📍In Message History, select the target message and click the Clawback button
    • Adds Google Directory Synchronization to import users and groups from Google Directory into Sophos Email
    • Adds On-Demand Clawback feature to remove any message from M365 mailboxes via Message History with one click

    2 details in Everything

23. 2023.28Released July 15, 2023 Jul 15, 2023 · release notes

    New M365 mailflow tamper alerts, admin allow/block list access with CSV export and search, and wildcard support.

    └──▷ HOW TO FIND IT
    Monitor and remediate unauthorized changes to Microsoft 365 mailflow rules that affect Sophos Email Security.
    📍N/A - Monitored via Sophos Central dashboard alerts
    Export the allow/block list for a specific user for offline analysis.
    📍Use the new CSV export option in the Admin Allow/Block List view
    Search across admin and user allow/block lists using wildcards to find broad patterns.
    📍Use advanced search with wildcard support in the Admin Allow/Block List interface
    • Adds Sophos Mailflow Tamper Alert and Remediation to monitor M365 rule modifications and auto-fix impacts on Sophos setup
    • Grants Admins visibility and management over user allow/block lists including new CSV export and advanced search capabilities

    2 details in Everything

24. 2023.25Released July 05, 2023 Jul 5, 2023 · release notes

    Sophos Email Security 2023.25 adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. Routing, Outbound Disclaimer, and Quarantine API capabilities.

    • Adds SMTP Routing to reroute inbound or outbound gateway messages directly to a mail server via A-record or FQDN
    • Adds Outbound Disclaimer to append disclaimers to plain text and HTML format outbound messages in Email Security policy
    • Adds Quarantine API to perform operations on messages in both email security quarantine and post delivery quarantine

    3 details in Everything

25. 2023.19Released May 20, 2023 May 20, 2023 · release notes

    New Quarantine actions allow downloading attachments with stripping or re-attachment options

    └──▷ HOW TO FIND IT
    Securely share a message with a user by stripping sensitive attachments before download.
    📍In the Quarantine view, select a message and choose Strip attachments and download.
    • Adds ability to strip attachments from quarantined messages before download
    • Adds ability to re-attach attachments when forwarding quarantined messages for scanning

    2 details in Everything

26. 2023.16Released April 22, 2023 Apr 22, 2023 · release notes

    Sophos Email Security 2023.16 adds Clone Email Policy UI action.

    └──▷ HOW TO FIND IT
    Create a variation of an existing email policy without retyping settings by cloning it in the console.
    📍In the Sophos Central console, navigate to Policy › Email Policies, select an existing policy, and choose Clone.
    • Adds ability to clone any existing email policy in the console, placing the new copy directly above the source.

    1 detail in Everything

27. 2023.07Released February 22, 2023 Feb 22, 2023 · release notes

    Sophos Email Security 2023.07 adds Aggressive spam mode, Secure Message policy, compromised account detection, and header inspection capabilities.

    • Adds Aggressive mode for anti-spam with a configurable catch rate slider (levels 1 to 5) in Email Security policies
    • Introduces the Secure Message policy, a new policy type that consolidates encryption, decryption, signing, and verification settings previously scattered in Global Settings
    • Adds Compromised account detection based on traffic patterns, triggering alerts to enable MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and force password changes
    • Adds ability to inspect and modify (add, edit, strip) message headers within Data control policies
    • Introduces vertical tabs for grouping related settings in the Email Security policy UI

    +1 more show less

    • Adds an Internal tab in Sophos Email policies to group internal users, groups, and domains separately from external counterparts

    6 details in Everything

28. 2022.45Released on November 7, 2022 Nov 7, 2022 · release notes

    Sophos Email Security 2022.45 introduces Advanced Search in Message History with new filtering criteria and blocking options.

    • Adds Advanced Search to Message History allowing combinations of sender, recipient, subject, size, attachment type, attachment presence, and DSN code
    • Adds block email address, block domain, and block IP address links in Message Details
    • Adds a new URL tab in Message Details that lists unique URLs found in a message

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Email Encryption now strictly enforces TLS authentication; mail servers must be configured to accept TLS connections before Email Encryption is used.
29. 2022.42Released on October 17, 2022 Oct 17, 2022 · release notes

    Sophos Email Security adds Message History API to Data Lake and External policy tab.

    └──▷ HOW TO FIND IT
    Configure policy to apply to specific external domains using the new UI tab.
    📍In Email Security policies, navigate to the new External tab and add target domains/mailboxes.
    • Adds Message History API endpoint making all historical email data available in the Sophos Data Lake
    • Adds new Live Discover queries to access expanded email dataset from the Data Lake
    • Adds External tab in Email Security and Data control policy interface to target external domains/mailboxes

    3 details in Everything

30. 2022.36Released on September 7, 2022 Sep 7, 2022 · release notes

    Interactive reporting adds clickable dashboard counts for drill-down to Message History, Intelix threats, and Data Control reports

    └──▷ HOW TO FIND IT
    Drill down from dashboard statistics to detailed message history for a specific threat category
    📍In the email security dashboard, click the count on the Intelix threat chart to open the detailed report, then click Message Summary and export the data.
    Investigate users who clicked risky links via the Time of Click report
    📍On the dashboard Time of Click report, click the warned count to navigate to the At Risk Users report and view the list of risky sites.
    • Launches interactive reporting on the email security dashboard, allowing users to click any linked count to navigate directly to detailed reports.
    • Upgrades inbound and outbound activity summary charts with arrow visualizations showing scan categorization order in the email flow.
    • Adds clickable counts on Message Summary chart to navigate to Message History for further investigation of specific messages.
    • Enables export functionality for Message Summary data within the interactive reporting view.
    • Upgrades Data control (formerly DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.) summary chart to show breakdown of inbound and outbound messages with drill-down to detailed reports.

    +1 more show less

    • Adds clickable warned and blocked counts on Time of Click report to navigate to At Risk Users report listing risky sites clicked.

    6 details in Everything

31. 2022.30Released on July 25, 2022 Jul 25, 2022 · release notes

    Sophos Email Security 2022.30 adds custom encryption branding and granular malware policy actions.

    └──▷ HOW TO FIND IT
    Branding encrypted messages with corporate identity and allowing social login for recipients.
    📍Apply via provisioning form obtained from account manager or partner
    Configuring separate malware actions distinct from spam policies.
    📍See Email Filtering in documentation for policy configuration steps
    Adding Intelix-detectected emails to user quarantine reports.
    📍See Intelix Threat Analysis in documentation for setting quarantined email visibility
    • Allows customers with the portal encryption license to customize encrypted message branding using organization logos, contact info, and social media sign-in options for recipients
    • Enables distinct handling actions for confirmed malware, viruses, or malicious links, separating them from spam/bulk email policies
    • Adds separate action controls for SophosLabs Intelix Suspicious and Intelix Malicious email categories

    3 details in Everything