What is included in Bitdefender GravityZone Security for Email Add-On?

Secure email gateway – Pre-delivery filtering of inbound mail before it reaches mailboxes.
API mailbox protection – Post-delivery scanning that retracts threats already sitting in inboxes.
Email authentication – Built-in SPF and DMARC checks against spoofed sender domains.
Live Email Tracker – Search, preview, release or delete individual messages during investigations.
End-user quarantine digest – Scheduled digests let staff release held mail themselves.
Important – No mailbox backup or archiving; filtering does not retain mail.

What are the main benefits of Bitdefender GravityZone Security for Email Add-On?

This is the email protection layer for the GravityZone platform, administered from the same cloud console as endpoint protection rather than from a separate mail security portal. Bitdefender retired the original Security for Email platform on 31 January 2026 and now delivers this protection through GravityZone Extended Email Security, which combines gateway filtering with API-based mailbox protection.

One console – Email and endpoint alerts sit in one platform.
Fast rollout – API connection to Microsoft 365 needs no mail rerouting.
BEC protection – Detects impersonation and payment fraud that spam filters miss.
Fewer helpdesk tickets – Users release their own held mail from digests.
Outbound scanning – Protects sender reputation and reduces blacklisting of your domain.
Multi-tenant management – Providers act on threats across several customers at once.

Best antivirus? Why Windows Defender alone is not enough
Explains why the protection built into the operating system leaves gaps that a dedicated security product has to close.

Which company size is Bitdefender GravityZone Security for Email Add-On suitable for?

The add-on scales from a handful of mailboxes to multi-tenant environments, but the reason to buy it changes with company size. Small companies buy it to stop invoice fraud; larger organisations buy it because they have to prove what happened to a specific message.

Does Bitdefender GravityZone Security for Email Add-On meet the requirements of Swiss cybersecurity legislation?

The reporting obligation under the revised Information Security Act applies to operators of critical infrastructure, not to every Swiss company, so most small firms are affected only indirectly through the customers they supply. Operators in scope must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. The Live Email Tracker supports that deadline in a concrete way: it shows which mailboxes received a specific message, when it arrived and what verdict the filters gave it, which is roughly the set of facts a first report needs. What the add-on does not provide is the rest of the picture. It holds no endpoint telemetry, no evidence that an attacker was removed from the network, and no long-term archive of the affected mail, so an organisation subject to reporting still needs endpoint detection and a retention plan beside it. This text is general product information and not legal advice; assess your own obligations with a qualified adviser.

Does Bitdefender GravityZone Security for Email Add-On meet the requirements of European cybersecurity legislation?

No product creates NIS 2 compliance, because the directive addresses organisational measures rather than tools. NIS 2 asks for risk analysis and security policies, incident handling, business continuity, supply chain security, and the use of cryptography where appropriate. This add-on contributes to two of those categories: it handles incidents on the email vector by filtering, quarantining and retracting messages, and it supports supply chain security by authenticating mail that arrives from suppliers and partners. It contributes nothing to business continuity, nothing to cryptography beyond transport encryption, and nothing to the governance, training and documentation obligations that account for most of the workload. Treat it as one measure inside a wider programme, not as an answer to the directive.

Does Bitdefender GravityZone Security for Email Add-On help with security questionnaires from large customers?

Yes, for the email section of a questionnaire, and only that section. It answers items on inbound malware and phishing filtering, sender authentication with SPF and DMARC, quarantine handling and who may release a message, outbound scanning, separation of administrator roles, and audit logging of console actions — all of which can be exported as a report rather than written by hand. It does not answer items on endpoint protection, vulnerability and patch management, device encryption, mailbox retention periods, or security awareness training, and a questionnaire will usually ask about all of those. Where several items are open at once, moving up to a higher GravityZone tier that already contains patch management and encryption is normally cheaper and easier to evidence than adding a second vendor, because every report then comes from one console with one set of timestamps.

What is the difference between GravityZone Security for Email and GravityZone Extended Email Security?

The decisive difference is where the product inspects mail. The retired Security for Email platform filtered only at the gateway, so a message that got past the filter was beyond its reach the moment it landed in a mailbox. Extended Email Security keeps the gateway and adds an API connection to Microsoft 365 that continues scanning after delivery and can pull a message back out of every mailbox that received it. The second difference is simply availability, since the legacy platform was shut down on 31 January 2026.

Which limitations should you know before buying?

Post-delivery detection and message retraction depend on the API integration with Microsoft 365, so an organisation running a different mail platform gets gateway filtering only and loses the ability to pull a delivered message back. The gateway path still requires MX record and smart host changes, which means a planned maintenance window and DNS propagation rather than a switch you flip in the morning. The add-on filters mail but does not archive or back it up, so it cannot satisfy a retention requirement and cannot restore a mailbox after a deletion. It is an add-on and requires a GravityZone base product such as Business Security, Business Security Premium, Business Security Enterprise, EDR Cloud or an MDR licence, so on its own it protects nothing on your endpoints.

Planning Office 2024 Backups for Businesses the Right Way
Covers how to back up Outlook PST files, templates and the Windows system so that mail data survives a deletion or an outage.

Frequently asked questions about Bitdefender GravityZone Security for Email Add-On

Can it run alongside an email gateway that is already in place?

Yes. The API-based protection connects directly to Microsoft 365 and can be enabled within minutes even when another secure email gateway is already filtering inbound mail, because it works after delivery rather than in the mail path. This makes it possible to evaluate detection quality in a live environment without touching MX records first.

Does it replace the filtering built into Microsoft 365?

It layers on top of it rather than replacing it. The add-on applies its own filter set to every message and adds impersonation detection based on a synchronised user population, which is the class of attack that gets through when a message carries no attachment and no malicious link.