https://cybertoolchain.io/tools/sophos-email-security New releases and features in Sophos Email Security, tracked by The Cyber Toolchain. en Mon, 12 Oct 2026 00:00:00 GMT https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 12 Oct 2026 00:00:00 GMT Sophos Email 2026.41 adds an S/MIME Certificate Management API, URL export from quarantine (CSV/PDF), and enhanced custom branding workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the S/MIME Certificate Management API to programmatically manage S/MIME certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds URL export from the `URLs` tab in `Message Details` for quarantined messages, available in CSV and PDF formats with basic message details for identification. • Enhances the custom branding provisioning workflow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 26 Sep 2026 07:48:28 GMT Sophos Email Security now supports custom policies applied directly to distribution lists and shared mailboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables applying custom email protection policies directly to distribution lists and shared mailboxes, independent of policies assigned to individual list members.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 21 Sep 2026 00:00:00 GMT Sophos Email 2026.38 adds custom policies for distribution lists and shared mailboxes plus automated Microsoft 365 journal onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables custom protection policies to be applied directly to distribution lists and shared mailboxes, independently of individual member policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Automates Microsoft 365 journal rule creation and related settings during Sophos EMS onboarding, eliminating manual journal configuration after M365 permissions are authorized. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 05 Sep 2026 07:37:33 GMT Sophos Email Security adds Data Control notification recipients and automatic Intelix-based quarantine release. • Adds configurable notification recipients for Data Control rule actions. • Automatically releases quarantined emails from quarantine when an Intelix scan determines the email is not malicious or suspicious. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 31 Aug 2026 00:00:00 GMT Sophos Email adds Data Control notification recipients and automatic Intelix-based quarantine release. • Enables configuration of notification recipients for Data Control rule actions, so the right people are alerted when a Data Control policy triggers. • Automatically releases quarantined emails from quarantine when an Intelix scan determines the email is not malicious or suspicious, reducing manual triage of held mail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Tue, 11 Aug 2026 00:00:00 GMT Sophos Email 2026.32 adds customizable block/warning messages for unverified URLs and CSV/PDF export of per-message URL lists. • Adds CSV and PDF export of the URL list from the 'URLs' tab in Message Details, including basic message metadata to identify the source message. • Allows custom block and warning messages for unverified Time-of-Click (ToC) links to be configured separately from messages shown for risky URLs, enabling less alarming messaging for URLs that are unverified but not known to be malicious. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 18 May 2026 00:00:00 GMT Sophos Email Security 2026.20 adds AI header analysis, newly registered domain protection, and new premium tier capabilities. • Adds AI-powered summary generation for email headers and authentication results (SPF, DKIM, DMARC) to help assess message suspicion. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 16 Mar 2026 00:00:00 GMT Sophos Email Security 2026.11 adds AI email header analysis and TLS encryption filtering in Mailflow. • Adds `AI Analysis` feature to generate AI-powered summaries of email headers and authentication results (SPF, DKIM, DMARC) for quick threat assessment • Adds TLS encryption filtering support in Sophos Mailflow, allowing message filtering based on the encryption used between Sophos Email and Microsoft 365 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 02 Feb 2026 00:00:00 GMT Adds Post-Delivery Protection for Google to scan and claw back malicious emails in user inboxes. • New Post-Delivery Protection (PDP) capability for Google gateway domains, enabling automatic search and remediation of messages with malicious URLs or attachments after delivery. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 15 Dec 2025 00:00:00 GMT Sophos Email Security 2025.50 adds 'Copy of reported messages' feature and UAE region support. • Adds `Copy of reported messages` capability to let administrators specify mailboxes or distribution lists to receive copies of user-reported messages. • Adds support for the UAE data center as a selectable region for email hosting and encryption workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Wed, 02 Jul 2025 00:00:00 GMT Sophos Email Security 2025.26 adds Email Monitoring System and DMARC Manager for authentication control • Adds `Email Monitoring System` (EMS), a new monitor-only journal-based solution for Microsoft 365 and Google Workspace that provides deep visibility into email traffic without disrupting delivery. • Adds `DMARC Manager`, a new capability for comprehensive management of DMARC, SPF, and DKIM records (including SPF flattening), BIMI, MTA-STS, TLS-RPT, and automated DMARC alerts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 09 Jun 2025 00:00:00 GMT Sophos Email Security 2025.23 adds QR code scanning, SophosLabs reporting, BEC protection, and VIP impersonation management • Enables scanning of messages for malicious URLs and QR codes pointing to unsafe websites, malware, ransomware, or phishing sites • Adds SophosLabs Analysis Report providing verdicts on messages reported as threats or clean by users or admins • Introduces Business Email Compromise protection to manage defenses against account compromise and impersonation attacks • Adds capability to manage internal and external VIP lists for improved impersonation protection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 19 May 2025 00:00:00 GMT Sophos Email Security 2025.20 adds Rejection Logs view and editable descriptions for admin allow/block list entries. • `Rejected` button added to the `Read Report` menu to see messages rejected because the mailbox wasn't found • Ability to add or edit descriptions for entries in the Admin Allow/Block List via a new editing interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 24 Feb 2025 00:00:00 GMT New Custom Branding for encryption portals and Email Headers controls for encryption application. • Adds Custom Branding capability to customize the branding of encryption portal and encrypted messages (requires Portal Encryption Add-on). • Adds `Email Headers` feature allowing customers to control how encryption is applied to messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Wed, 04 Dec 2024 00:00:00 GMT Sophos Email Security 2024.48 adds language detection to anti-spam protection. • Adds language detection to prevent messages in languages not used for business. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 29 Jul 2024 00:00:00 GMT Sophos Email Security 2024.30 adds scheduled Executive Summary reports, QR Code Protection for malicious URLs, and spam reporting without blocking. • Adds `Executive Summary Report` feature allowing customers to schedule regular customized filtered reports at a set frequency for a specific date range. • Introduces `QR Code Protection` which scans for malicious URLs embedded in QR codes. • Enables users to report spam emails through smart banners without blocking the sender. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 12 Feb 2024 00:00:00 GMT Data control policy now supports granular search across subject, body, and attachment fields • Adds granular search capabilities to the Data control policy, allowing rules to match against `subject`, `message body`, `attachment name`, or `attachment content`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 20 Nov 2023 00:00:00 GMT Adds Multiselect Clawback from Message History and scheduled 24/7 Quarantine Summary to Sophos Email Security. • Adds Multiselect Clawback from Message History to manually claw back messages from M365 inboxes into post delivery quarantine. • Enhances quarantine summary to allow scheduling of summary messages for any hour of the day and any day of the week. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 16 Sep 2023 00:00:00 GMT New Sophos Email Clawback API and deeper MDR integration in v2023.37 • Adds the Sophos Email Clawback API to manually claw back messages from M365 inboxes into post delivery quarantine. • Enhances Sophos Email integration with Sophos MDR, supporting detections for account compromise, malware, malicious URL, impersonation, spam, data control, and post delivery protection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 26 Aug 2023 00:00:00 GMT Sophos Email Security 2023.34 adds SPF soft-fail checks, address modification in data control, and read-only user quarantine. • Adds 'Domain anomaly' option in Sender checks to boost security against unauthentic sender domains • Adds SPF soft failure check support for message authentication • Adds 'Modify address' option in Data control to change delivery address or CC/BCC emails • Adds ability to recover deleted outbound spam and inbound malware emails to quarantine for inspection • Adds Read-only user quarantine configuration allowing users to view but not release or delete quarantined emails Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 05 Aug 2023 00:00:00 GMT Adds Google Directory Sync and On-Demand Clawback for M365 messages in Sophos Email Security. • Adds Google Directory Synchronization to import users and groups from Google Directory into Sophos Email • Adds On-Demand Clawback feature to remove any message from M365 mailboxes via Message History with one click Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 15 Jul 2023 00:00:00 GMT New M365 mailflow tamper alerts, admin allow/block list access with CSV export and search, and wildcard support. • Adds Sophos Mailflow Tamper Alert and Remediation to monitor M365 rule modifications and auto-fix impacts on Sophos setup • Grants Admins visibility and management over user allow/block lists including new CSV export and advanced search capabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Wed, 05 Jul 2023 00:00:00 GMT Sophos Email Security 2023.25 adds SMTP Routing, Outbound Disclaimer, and Quarantine API capabilities. • Adds `SMTP Routing` to reroute inbound or outbound gateway messages directly to a mail server via A-record or FQDN • Adds `Outbound Disclaimer` to append disclaimers to plain text and HTML format outbound messages in Email Security policy • Adds `Quarantine API` to perform operations on messages in both email security quarantine and post delivery quarantine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 20 May 2023 00:00:00 GMT New Quarantine actions allow downloading attachments with stripping or re-attachment options • Adds ability to strip attachments from quarantined messages before download • Adds ability to re-attach attachments when forwarding quarantined messages for scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Sat, 22 Apr 2023 00:00:00 GMT Sophos Email Security 2023.16 adds 'Clone Email Policy' UI action. • Adds ability to clone any existing email policy in the console, placing the new copy directly above the source. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Wed, 22 Feb 2023 00:00:00 GMT Sophos Email Security 2023.07 adds Aggressive spam mode, Secure Message policy, compromised account detection, and header inspection capabilities. • Adds 'Aggressive mode' for anti-spam with a configurable catch rate slider (levels 1 to 5) in Email Security policies • Introduces the 'Secure Message policy', a new policy type that consolidates encryption, decryption, signing, and verification settings previously scattered in Global Settings • Adds 'Compromised account detection' based on traffic patterns, triggering alerts to enable MFA and force password changes • Adds ability to inspect and modify (add, edit, strip) message headers within Data control policies • Introduces vertical tabs for grouping related settings in the Email Security policy UI • Adds an 'Internal' tab in Sophos Email policies to group internal users, groups, and domains separately from external counterparts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 07 Nov 2022 00:00:00 GMT Sophos Email Security 2022.45 introduces Advanced Search in Message History with new filtering criteria and blocking options. • Adds `Advanced Search` to Message History allowing combinations of sender, recipient, subject, size, attachment type, attachment presence, and DSN code • Adds `block email address`, `block domain`, and `block IP address` links in Message Details • Adds a new `URL` tab in Message Details that lists unique URLs found in a message Breaking changes: • Email Encryption now strictly enforces TLS authentication; mail servers must be configured to accept TLS connections before Email Encryption is used. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Wed, 07 Sep 2022 00:00:00 GMT Interactive reporting adds clickable dashboard counts for drill-down to Message History, Intelix threats, and Data Control reports • Launches interactive reporting on the email security dashboard, allowing users to click any linked count to navigate directly to detailed reports. • Upgrades inbound and outbound activity summary charts with arrow visualizations showing scan categorization order in the email flow. • Adds clickable counts on Message Summary chart to navigate to Message History for further investigation of specific messages. • Enables export functionality for Message Summary data within the interactive reporting view. • Upgrades Data control (formerly DLP) summary chart to show breakdown of inbound and outbound messages with drill-down to detailed reports. • Adds clickable warned and blocked counts on Time of Click report to navigate to At Risk Users report listing risky sites clicked. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html https://docs.sophos.com/releasenotes/output/en-us/central/sc_email_rn.html Mon, 25 Jul 2022 00:00:00 GMT Sophos Email Security 2022.30 adds custom encryption branding and granular malware policy actions. • Allows customers with the portal encryption license to customize encrypted message branding using organization logos, contact info, and social media sign-in options for recipients • Enables distinct handling actions for confirmed malware, viruses, or malicious links, separating them from spam/bulk email policies • Adds separate action controls for SophosLabs Intelix Suspicious and Intelix Malicious email categories Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-email-security