This is available with an Email Advanced license only and is turned on by default.
You can detect messages that pretend to be from well-known brands or very important people (VIPs) in your organization. You can add email addresses for VIPs in VIP management. See Impersonation Protection and VIP Management.
Set up Impersonation protection
In Impersonation protection, you can choose from the following actions to take when we detect these messages.
- Add banner: Add a banner to the message to help your users decide what action to take with the message. See Add banner.
- Quarantine: The message is held in quarantine. You can release quarantined messages when you're sure they're safe.
- Tag subject line: The message is tagged and delivered to the user. The tag appears at the start of the subject line in the message. You can customize the tag, using up to 30 characters.
- Delete: The message is deleted immediately.
If you choose to add a banner to suspect messages, you can select the actions the users see in the banner.
Choose from the following options:
- Block sender: The sender's email address is added to a block list.
- Report messages to Sophos: Users can report suspicious messages to SophosLabs. This helps us improve our impersonation detection.
If you turn on Report messages to Sophos, when users click Block sender in a message, they see an option to report the message to SophosLabs. This helps us improve our detection methods and learn about new threats.
For plain text messages, the banner is in text-only form, using the same content you set, and is shown at the beginning of the email body.