Team: Huntress Email Security (ES)
Product: Microsoft 365, Google Workspace
Summary: Frequently asked questions about the Early Access release of Huntress Email Security.

In this Article

General
Deployment
Detection and Remediation
Early Access Specifics
Data and Compliance

General

What is Huntress Email Security?

Huntress Email Security is an email security product that protects Microsoft 365 and Google Workspace mailboxes from phishing, business email compromise, and malware. It is built in partnership with Sublime Security and managed from the Huntress platform. Review [What is Huntress Email Security?] to learn more.

Is Huntress partnering with Sublime Security?

Yes. Sublime Security's detection engine powers Huntress Email Security. You manage ES entirely from the Huntress platform.

Who is Sublime Security?

The email security company whose detection engine powers ES. See [What is Sublime Security?] for more details.

How do I join Early Access?

Partners with an active, paid Huntress Managed ITDR subscription will see a prompt in the Huntress portal to join Email Security Early Access. Follow the prompt to enroll, then add a tenant and connect a message source.

Does this replace my Secure Email Gateway?

Not necessarily, and not automatically. ES is designed to run alongside existing email security, including a gateway. Many organizations eventually retire their gateway after seeing what ES catches that the gateway missed, but that is a decision to make with data in hand, not on day one.

What if I have Microsoft Defender for Office 365?

ES layers on top of your provider's native filtering rather than replacing it.

Does this replace Managed SAT?

No. They address different problems, and they work together. SAT trains learners to recognize attacks; ES detects and removes them.

If you run both, SAT phishing simulations are excluded from ES automatically for every tenant we provision, with no configuration needed on your part.

Where should feedback about the product be shared?

Please direct all ES feedback to our Huntress Feedback Portal.

Deployment

Do I need to change my MX records?

No. ES connects through an API integration authorized from the Huntress platform. Mail flow is unchanged.

Is there an agent to install?

No.

What permissions are required?

Global Administrator for Microsoft 365, or Super Admin for Google Workspace, to authorize the integration.

During Early Access, authorization grants permissions to Sublime's application in your tenant. If you audit enterprise applications or consent grants in Entra, you'll see a Sublime app listed. Huntress plans to move this into the Huntress tenant application, thereby removing the separate authorization step.

What if I don't have Global Admin in my customer's tenant?

You don't need it yourself. The authorization links generated when you add a message source can be shared with anyone who holds admin rights on the target tenant, so you can send the link to your customer to complete authorization on their end.

Can this break my mail flow?

No. ES is not a gateway; it doesn't sit between sender and recipient. Sublime connects to your tenant through APIs and quarantines flagged mail after delivery, so mail flow is never interrupted, during your trial or after it.

The realistic risk is a false positive that removes a legitimate message, which is why every new tenant begins in passive mode before enforcement and why remediation is reversible.

How long does onboarding take?

Onboarding is largely automatic and takes a little over a week end-to-end.

After you authorize the integration, mailbox syncing takes 10–15 minutes. Historical ingestion then runs automatically and completes in ~12 hours to two days, depending on tenant size, and you'll receive a notification when it finishes, inviting you to review the findings.

Your tenant stays in passive mode for 7 days after historical ingestion completes, then automatically transitions to enforcement mode. You can activate enforcement sooner, or opt out of the automatic transition and stay in passive mode indefinitely. See [Historical Ingestion, Passive Mode, and Enforcement].

Is historical ingestion automatic or partner-initiated?

Automatic. Historical ingestion begins automatically as soon as a message source is connected; no action is required. You'll receive a notification when it completes.

How long is Passive Mode? Can partners shorten, extend, or skip it?

Passive mode lasts 7 days from the moment historical ingestion completes, after which your tenant automatically moves to enforcement mode.

You have two controls:

• Activate enforcement mode now — skip the remainder of passive mode and begin remediating immediately.
• Opt out of auto-enablement — remain in passive mode indefinitely and choose your own moment to enable enforcement.

Both are available per tenant from the Email Security dashboard. ES defaults to enabling enforcement because a protected tenant is the intended end state, but the choice stays yours.

Is the transition to Enforcement automatic or partner-initiated, and is it configurable per tenant?

Automatic by default, and configurable per tenant. See above.

Are there any Microsoft 365 settings that conflict with ES?

Yes. When set to Dynamic Delivery, Microsoft Defender Safe Attachments interfere with ES scanning. The recommended setting is Block. Check this during onboarding. (Note to author: [VERIFY] confirm this applies to the Huntress implementation.)

Is Google Workspace supported in Early Access?

Yes.

Can ES detect email spoofing?

Yes, for inbound mail. ES evaluates message authentication, SPF, DKIM, and DMARC, along with sender and domain signals, to detect mail impersonating another company that arrives in your protected tenant.

It can't detect someone spoofing your own domain to send mail to third parties. That traffic never reaches your tenant, so ES has no visibility into it. Protecting your domain against outbound impersonation is a DMARC enforcement exercise rather than something ES addresses.

Detection and Remediation

Does a malicious message reach the inbox before it is removed?

Typically, yes, briefly. ES analyzes messages after the platform delivers them and removes malicious ones, usually within a short window. This is inherent to the API-based approach and is the trade-off that buys internal mail visibility and retroactive remediation. 

What is the difference between "quarantine" and "remediate"?

Nothing. They describe the same action. Huntress uses "remediate" for consistency with the rest of the platform; "quarantine" is the underlying platform term. Read [Remediation and Quarantine in Email Security].

Can a remediated message be recovered?

Yes. Remediation is reversible. On Microsoft 365, the default recovery window is 14 days, governed by your Exchange deleted-item retention setting. Note that this window is measured from when the message was received, not from when it was quarantined, so a message remediated retroactively may have less time remaining than you expect.

Are quarantine digests available? Who staffs the release approval workflow?

Quarantine digests are not available during Early Access. There are currently no notifications when a message is quarantined. You must review activity in the quarantine log in the Email Security dashboard.

If a digest is an important part of you or your customer's workflow, and if you have a preference on frequency or format, share it through the Huntress Feedback Portal.

There is no release approval queue. Releasing a quarantined message is fully self-service from the quarantine log.

Do partners have direct exclusion-management access?

Not during Early Access. If a legitimate message is being repeatedly flagged, contact Huntress Support, and we'll configure an exclusion for you.

Self-service exclusion management is planned to arrive during Early Access as an Exclude action alongside Undo in the quarantine log, scoped to a specific detection rule and sender combination, so you'll be able to stop a recurring false positive without broadly allowlisting a sender.

What happens to a message that was safe at delivery but weaponized later?

ES can act on messages retroactively, so a link that turns malicious after delivery can still be caught and the message removed.

Will ES flag our phishing simulations?

It will unless an exclusion is configured for your simulation provider. If you use Huntress Security Awareness Training (SAT), the exclusion is built in and automatically enabled for every new tenant out of the box.

For other simulation providers, including KnowBe4, Cofense, Proofpoint Security Awareness, HoxHunt, Microsoft Defender Attack Simulation, NINJIO, BullPhish, Adaptive Security, and Fable Security, pre-built exclusions exist but must be manually enabled.

Why does a message show detection rules, but wasn't remediated?

Because a flagged rule is not the same as a malicious verdict.

Sublime's detection works in tiers. Detection rules are the first pass; when one matches, the message is flagged for further analysis. Machine learning and agentic layers then evaluate the message and produce an attack verdict: malicious, spam, graymail, benign, and others.

ES acts only on a malicious verdict. Most flagged messages are resolved as spam, graymail, or benign and are intentionally left alone. Seeing rules listed in a message tells you what matched, not that the message was judged to be an attack.

Does ES filter spam?

No. ES targets attacks, phishing, business email compromise, and malware, and deliberately leaves spam and graymail in place even when detection rules match them. Continue to rely on your provider's native filtering for bulk mail.

Broader spam controls may be offered after general availability.

Can I see why a message was flagged?

Yes. The message detail view lists every detection rule that matched.

Coming shortly: SPF, DKIM, and DMARC authentication results displayed with the message, and a rendered preview showing how the email would have appeared in the inbox. Preview access is limited to the Admin and Security Engineer roles.

Note that verdicts are produced by Sublime's detection models. The rules listed show what matched, but the model inputs and weighting behind the final verdict are not exposed, so the rule list does not always fully explain the verdict.

Early Access Specifics

Will I get Huntress incident reports for email threats?

No. During Early Access, ES does not generate SOC escalations or incident reports. All ES activity is self-contained within the Email Security section of the Huntress platform. 

Does the Huntress SOC review ES detections?

No. ES detections are not exposed to the Huntress SOC during Early Access, and SOC-related functionality is planned for the general availability launch.

ES is built as a prevention product; messages with a malicious verdict are removed automatically rather than escalated for review, which is why you won't receive incident reports for email threats.

How do I report a false positive or a missed threat during EA?

Bugs, UI issues, incorrect copy, and anything not working as expected: report to Huntress Support. During Early Access, the team aims to fix issues within 24–48 hours of a report, so please flag issues early and of any size — including small copy problems.

False positives: release the message from the quarantine log, then report it so detection can be tuned. Exclusion configuration is handled by Support during Early Access.

Feature requests and product suggestions: Huntress Feedback Portal.

Huntress Managed SAT and ES Interaction

Can one Abuse Mailbox serve both products? If so, what is the supported configuration?

Not yet. SAT relies on a global address (report@phish.mycurricula.com), while Sublime expects the abuse mailbox to be a deliverable address within the tenant. The Abuse Mailbox functionality and workflows will come later in EA or closer to GA release.

Will SAT phishing simulation emails be flagged and remediated by ES?

We will automatically set up the Huntress SAT exclusions for every ES tenant we provision Sublime for, so SAT simulations should not be flagged as malicious.

If there is no supported configuration for running both products, what is the interim EA guidance?

Partners utilizing SAT should be able to use ES EA without issue. There is some work to do around user-reported emails; however, SOC triaging of user reports is not included in EA (and is intended for GA).

Data and Compliance

Where is Email Security data stored?

Vendor data is stored in a US East AWS data center.

How long does the vendor retain message data?

Data stored by the vendor is expunged after 30 days.

Full Message Data includes plaintext, HTML, and image previews of messages.

How long does Huntress retain message data?

Huntress data models and signals data have their own retention periods. The data stored here will only consist of metadata and headers.

All message data displayed on Huntress (plaintext, HTML, and image previews) is fetched directly from Sublime and cached on Huntress for 24 hours. The data in cache is encrypted at the application layer.