Optional 24/7 analyst handling of suspicious-email reports and quarantine releasesAdd-on
Core automation remains in the product; analyst-led handling is separately positioned and quoted.
Check Point Incident Response as a Service
Optional DMARC, SPF, and DKIM managementAdd-on
Managed transition, monitoring, and operation of restrictive DMARC policy are not assumed in the core packages.
Check Point DMARC Management
Optional SaaS posture, risky-connection, and application-misconfiguration managementAdd-on
SSPM and SSPM Premium extend beyond threat inspection of the collaboration applications included in target packages.
Check Point SaaS Security Posture Management
Optional cloud email archiving, import, export, audit, and retentionAdd-on
The current pricing page lists Archiving under Additional Security Layers, and the archive page says to add it to Email Security.
Check Point Email Archiving
Optional deep and dark web credential monitoring with remediationAdd-on
This adjacent identity layer differs from the account-takeover anomaly protection included in the core package matrix.
Check Point Leaked Credential Monitoring
Optional phishing simulation and security-awareness trainingAdd-on
User reporting is core functionality, while simulations, targeted training, and the module library are an additional layer.
Check Point Security Awareness Training
API connection with monitor, post-delivery remediation, or pre-delivery mail-flow enforcementIncluded capability
These are enforcement modes for the same product. Protect (Inline) uses provider APIs and mail-flow rules; it is not an MX secure email gateway plan.
Behavioral account-takeover anomaly detection and account blocking in all core packagesIncluded capability
The package matrix includes account-takeover anomalies in all packages, and the administration guide documents user-behavior analysis and automatic or manual blocking.
Phishing, malware, URL, account-takeover, sandboxing, and CDR protection across all core packagesIncluded capability
The current matrix marks anti-phishing, anti-virus, URL protection and rewriting, account-takeover anomalies, Shadow IT, sandboxing, and Threat Extraction included in all four packages.
User phishing reports with administrator feedback and optional automated quarantineIncluded capability
The product ingests Microsoft, Gmail, dedicated-mailbox, and third-party-button reports and supports review, user notification, and automated workflows.
Data Loss Prevention included only in Complete Protect packagesPlan-dependent capability
The current feature matrix explicitly marks DLP not included in both Advanced Protect packages and included in both Complete Protect packages.
Plan: Email Only - Advanced Protect: Unavailable · Email Only - Complete Protect: Included · Email & Collaboration - Advanced Protect: Unavailable · Email & Collaboration - Complete Protect: Included
Threat protection for listed collaboration and file-sharing applications in Email & Collaboration packagesPlan-dependent capability
Email Only lists Microsoft 365 email and Gmail, while Email & Collaboration adds the published office, messaging, and file-sharing application set. DLP availability is modeled separately.
Plan: Email Only - Advanced Protect: Unavailable · Email Only - Complete Protect: Unavailable · Email & Collaboration - Advanced Protect: Included · Email & Collaboration - Complete Protect: Included
Separate Check Point platform, security-operations, and managed-service portfolioSeparate product
Shared portal access and portfolio integration do not make endpoint, mobile, SASE, browser, XDR, unified events, MDR, professional services, or other Infinity services part of the email package.
Check Point Platform and Managed Security Services
Native SIEM log delivery to supported collectors and formatsThird-party integration
Current documentation lists supported transports and structured log formats; public plan-level entitlement is not stated.
Splunk, Microsoft Sentinel, Google Chronicle, CrowdStrike NG-SIEM, and compatible collectors