Bitdefender email security: GravityZone Extended Email Security

What GravityZone Extended Email Security is

GravityZone Extended Email Security (EES) is Bitdefender's cloud email protection product. It brings two approaches together in one product: a secure email gateway that filters mail before it reaches your mail system, and mailbox protection for Microsoft 365 that keeps watching after delivery. Both are configured and reported in the GravityZone console, so email incidents can be investigated alongside the endpoint alerts Bitdefender already shows you.

EES is designed as an add-on to a GravityZone base licence, such as Bitdefender's Business Security plans, GravityZone EDR, Bitdefender MDR or the GravityZone Cloud MSP Security licence that service providers like us use. Our distributor catalogue also lists GravityZone Email Security as a standalone module, and Bitdefender allows a standalone deployment when needed, so a Bitdefender endpoint licence is helpful but we can confirm alternatives.

Our sister site's guide to Bitdefender GravityZone covers the endpoint platform it sits beside.

Bitdefender deployment models

The main decision with Bitdefender email security is how it connects:

With the API model, EES can retract a message later found to be malicious from every mailbox in the organisation, which is the post-delivery remediation that defines integrated cloud email security. The perimeter model is a classic secure email gateway. Running both is the hybrid approach discussed in our ICES vs SEG comparison. A monitor mode lets you see what would be caught before enforcement is switched on.

What is included

Bitdefender lists these capabilities for Extended Email Security:

• Threat protection: phishing, impersonation, business email compromise, ransomware and zero-day threats
• Layered analysis: a large set of filters combined with machine learning and Bitdefender's threat intelligence
• Authentication checks: SPF and DMARC checks on inbound mail to catch spoofed senders
• Graymail filtering: newsletters and bulk mail separated from important messages
• Outbound scanning: outgoing mail checked for malware, spam and signs of a compromised account
• User quarantine digest: users can release their own legitimate mail within policies you set
• Microsoft 365 integration: Entra ID directory sync and organisation-wide retraction of malicious messages
• Central policies and reporting: everything managed in the GravityZone console

Inbound SPF and DMARC checks protect your users from spoofed senders; they do not stop criminals spoofing your domain to others. That needs your own records in order: see email authentication and email spoofing.

Bitdefender email security set-up

Set-up depends on the model you choose. A typical rollout with us looks like this:

1. Confirm the base GravityZone licence and add Extended Email Security to it.
2. For the Microsoft 365 API model, a Microsoft 365 global administrator grants consent to the Bitdefender application; nothing changes in your DNS.
3. For the perimeter model, add your domains in GravityZone, configure where clean mail is delivered and set up outbound routing if you want outbound scanning.
4. Start in monitor mode and review what EES would have caught, adjusting allow lists for legitimate senders such as finance and marketing systems.
5. Switch on enforcement and the user quarantine digest.
6. For the perimeter model, change the MX records at a quiet time, then restrict your mail system so it only accepts inbound mail from the gateway, so attackers cannot bypass it.
7. Check SPF, DKIM and DMARC for your domains, updating SPF if outbound mail now leaves through Bitdefender.

The lock-down step in a perimeter deployment is the one most often missed. Without it, attackers who find your Microsoft 365 or other mail host can deliver straight to it and skip the filter.

Google Workspace and other mail platforms

Bitdefender's mailbox (API) integration is for Microsoft 365. If you use Google Workspace or another mail platform, the perimeter (MX) model is the route to consider, and we confirm against Bitdefender's current documentation whether it suits your set-up before you commit.

If Gmail protection by API matters to you, compare Check Point Email Security, IRONSCALES, Vade for Google Workspace or Trend Micro email security, all covered on our Google Workspace email security hub.

Perimeter, API or both: how to choose

Bitdefender lets you choose the model per organisation, and the right answer depends on your mail platform and what you want to stop:

• Choose the Microsoft 365 API model if you run Microsoft 365, want protection live quickly with no DNS change, and value removing messages from every mailbox after delivery. It also sees internal mail between your users, which a gateway does not.
• Choose the perimeter model if you run a mail platform other than Microsoft 365, want threats stopped before they reach any mailbox, or want outbound mail scanned on its way out.
• Choose both if you are on Microsoft 365 and want pre-delivery filtering plus post-delivery clean-up from one vendor, managed in one console.

Whichever you start with, the other can be added later without changing vendor. If your organisation is heavily targeted by impersonation and invoice fraud, the API model's post-delivery view is usually the more valuable of the two; if you mainly want to cut spam and malware volume, the perimeter model does that before mail reaches your users.

How Bitdefender email security is licensed

Extended Email Security is licensed as an add-on to your GravityZone base licence and billed monthly through your Forever Systems account. Bitdefender does not publish the counting unit on its product material, and shared mailboxes and service accounts can affect it, so we check your tenant and confirm exactly what is counted before quoting.

Pricing depends on the deployment model and numbers, so ask us for a quote. The commercial detail is on our licensing site's Bitdefender Extended Email Security licensing page.

Who it suits and how we help

Bitdefender email security suits organisations already using GravityZone that want email and endpoint security in one console, and Microsoft 365 users who want stronger protection than the built-in filtering without rerouting mail. The option to add a perimeter gateway later, without changing vendor, is useful if requirements grow.

We can set it up, run the monitor phase with you, tune policies and help with quarantine release requests. Compare it with the other platforms in our email security solutions comparison, then contact us for a quote.