Check Point vendor post contrasts its Unified Quarantine with Proofpoint's entry into Microsoft ICES ecosystem
A Check Point blog post positions its Email Security quarantine management against Proofpoint's integration with Microsoft's Integrated Cloud Email Security (ICES) vendor ecosystem. The post is vendor marketing and contains no vulnerability, threat actor, malware or incident information. It states that within ICES, Microsoft Defender applies enforcement based on submitted verdicts, verdict severity and configured policies, following highest-severity verdict precedence, so a third-party clean classification does not override a Microsoft malicious verdict. Check Point argues its Unified Quarantine, offered since 2023, merges Microsoft-native and Check Point quarantines into one administrative experience and allows administrator-configured policies to automatically restore eligible messages it classifies as safe, including some Microsoft marked as high-confidence phishing. It also notes that in a deployment combining a Secure Email Gateway with an API integration, messages blocked pre-delivery by the SEG may not appear in Defender's unified quarantine. The post recalls that Microsoft announced the ICES Vendor Ecosystem in June 2025.
Remediação
No patching or detection action is required. Teams running layered email security should document where quarantined messages are managed in gateway-plus-API deployments and review which engine's verdict prevails, noting that automatic restoration of messages flagged as high-confidence phishing by a second engine introduces a risk of releasing real phishing to users.
Linha do tempo
-
Check Point vendor post contrasts its Unified Quarantine with Proofpoint's entry into Microsoft ICES ecosystem
ler a análise desta fonte ocultar
A Check Point blog post positions its Email Security quarantine management against Proofpoint's integration with Microsoft's Integrated Cloud Email Security (ICES) vendor ecosystem. The post is vendor marketing and contains no vulnerability, threat actor, malware or incident information. It states that within ICES, Microsoft Defender applies enforcement based on submitted verdicts, verdict severity and configured policies, following highest-severity verdict precedence, so a third-party clean classification does not override a Microsoft malicious verdict. Check Point argues its Unified Quarantine, offered since 2023, merges Microsoft-native and Check Point quarantines into one administrative experience and allows administrator-configured policies to automatically restore eligible messages it classifies as safe, including some Microsoft marked as high-confidence phishing. It also notes that in a deployment combining a Secure Email Gateway with an API integration, messages blocked pre-delivery by the SEG may not appear in Defender's unified quarantine. The post recalls that Microsoft announced the ICES Vendor Ecosystem in June 2025.
Remediation
No patching or detection action is required. Teams running layered email security should document where quarantined messages are managed in gateway-plus-API deployments and review which engine's verdict prevails, noting that automatic restoration of messages flagged as high-confidence phishing by a second engine introduces a risk of releasing real phishing to users.