We have deployed Cisco Secure Email Threat Defense in two customer environments. It is still in development as a new product. Some customer requirements, such as sending logs to a Syslog server, are limited as ETD only supports sending audit logs. Customers have requirements for other system logs as well, which should be developed from their side. Another customer request is to restrict the IPs that can log in, which cannot be done from Cisco Secure Email Threat Defense yet. Any user with login details can log in. We can restrict the IPs in Cloud Mail Gateways, but not from Cisco Secure Email Threat Defense. It would be beneficial to improve this feature. Cisco Secure Email Threat Defense can take actions, such as requesting O365 to quarantine mail. In that case, the customer requires notification to the recipient from Cisco Secure Email Threat Defense. This option would be valuable if available. The real-time threat intelligence of Cisco Secure Email Threat Defense is an AI-based classification. It took one to two months to optimize the classification, but we still experience some false positives. Reducing the learning period would be beneficial. The learning curve shows that in the beginning, there are numerous false positives. For one month, we had to reclassify the false positives manually until the system learned. Reducing the learning time would be much better. Additional features desired in the next release include IP restrictions and user logging IP restrictions, ensuring only the customer environment can log in to Cisco Secure Email Threat Defense. Logs forwarding needs improvement as currently it only has audit logs. In Cloud Mail Gateway, we can create an IPsec tunnel to forward logs. However, in Cisco Secure Email Threat Defense, there is no option, and we must do API integration to send logs. Only SIM can get logs; Syslog cannot retrieve them.
Senior Cybersecurity Engineer at a financial services firm with 11-50 employees
Real User
Top 5
Jul 29, 2025
Modernization is an area that could be improved for Cisco Secure Email Threat Defense, as some features have lagged behind newer competitors, potentially offering more advanced analysis capabilities. The initial setup is not straightforward and requires expertise and time to master configurations such as spoofing and DLP. More control over backend functionalities and simplifying rule management could enhance user experience. The product's complexity at times results in redundant rule sets that are difficult to untangle, highlighting the need for streamlined management systems and a more user-centric approach to system configuration. Furthermore, the pricing might deter new users who could opt for alternative, more cost-effective solutions.
The integration capability with other threat intelligence platforms is not optimal, as I have experienced difficulty in sending logs to our SIEM. Cisco Secure Email Threat Defense's flexibility could be enhanced while it mostly integrates with cloud solutions, but not on-premise. The behavioral analysis capability of Cisco Secure Email Threat Defense is not particularly helpful for identifying new, evolving threats within my company, as it keeps flagging legitimate emails as malicious. Regarding room for improvement, the significant number of false positives should be addressed. The solution does not adapt to behavioral analytics and does not make changes when it sees a pattern.
Principal Consulting Engineer, Founder, Own at Jolly Security Inc
Real User
Top 10
Jan 30, 2025
The physical appliance has been discontinued, although the platform still exists. Improvements here and there could be beneficial, however, there aren't too many needed. Some potential improvements could be customization and enhancements to cloud features. Other suggestions include a makeover of controls to make it more modern.
IT Professional at a construction company with 1,001-5,000 employees
Real User
Top 20
Jul 18, 2024
Cisco is a multi-product, diverse organization. Before it was acquired by Cisco, the company that developed Email Threat Defense focused on building purpose-built devices. After the acquisition, Cisco's multiple product lines and verticals made this just one of their many verticals, and we could see a shift in focus.
Learn what your peers think about Cisco Secure Email Threat Defense. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
Cisco Secure Email Cloud Mailbox can improve by adding advanced phishing, then the solution would become the best in the market. However, this could increase the price even more. Additionally, if CES with domain protection could be added it would be an even better solution.
Product Manager-Cyber Security & Networking Active at a tech services company with 501-1,000 employees
Reseller
Dec 14, 2021
The distributors provide an annual billing option, but we do not have a monthly billing option. Customers will benefit greatly from monthly billing because the majority of customers today use the cloud, be it Office 365, or Google Cloud. Monthly billing will be extremely beneficial. Maybe the end DLP can be a bit more granular in email security. DLP is already present, but it could be more in-depth.
Technical Support Executive at a tech company with 51-200 employees
Real User
Mar 4, 2021
Currently, Cisco Cloud Mailbox meets all of our requirements. If I had to say something, maybe they could have a more regular update schedule or perhaps hire more support engineers to get service faster.
Systems Administrator at a university with 10,001+ employees
Real User
Jun 28, 2020
The search area has room for improvement. When you go to the next page, it remains at the bottom of the current page that you're on. Also, under the reports section, it allows you to see any "convictions," but if you want to search for those convictions you have to remember when they all came in and go back and edit the search accordingly. You cannot click on the list of convictions to actually see if you had a spike at a certain time.
If Cisco could continue to develop integrations, whether it's internal tooling, Threat Grid, or AMP reporting which could be accessible via a single web page, that would be helpful. This would essentially add additional context on messages as well as files or links being detected. Potentially adding additional context on why certain messages are tagged as spam or malware. In our case, malware hasn't been detected yet, but spam certainly has been. Knowing what engines or which components of the message make it identifiable as spam, that could be useful. Additional context and reporting accessibly via the main dashboard would be great. There is still room for improvement in terms of integrations with other Cisco tools and non-Cisco tools. There is also some room for improvement needed in terms of the reporting.
Cisco's secure email threat defense is designed to provide comprehensive protection against email-based threats. With the increasing sophistication of cyber attacks, it is crucial for organizations to have a robust solution in place to safeguard their email communications.
The product offers advanced threat detection capabilities, leveraging machine learning algorithms and real-time analysis to identify and block malicious emails. It scans incoming and outgoing emails for suspicious...
We have deployed Cisco Secure Email Threat Defense in two customer environments. It is still in development as a new product. Some customer requirements, such as sending logs to a Syslog server, are limited as ETD only supports sending audit logs. Customers have requirements for other system logs as well, which should be developed from their side. Another customer request is to restrict the IPs that can log in, which cannot be done from Cisco Secure Email Threat Defense yet. Any user with login details can log in. We can restrict the IPs in Cloud Mail Gateways, but not from Cisco Secure Email Threat Defense. It would be beneficial to improve this feature. Cisco Secure Email Threat Defense can take actions, such as requesting O365 to quarantine mail. In that case, the customer requires notification to the recipient from Cisco Secure Email Threat Defense. This option would be valuable if available. The real-time threat intelligence of Cisco Secure Email Threat Defense is an AI-based classification. It took one to two months to optimize the classification, but we still experience some false positives. Reducing the learning period would be beneficial. The learning curve shows that in the beginning, there are numerous false positives. For one month, we had to reclassify the false positives manually until the system learned. Reducing the learning time would be much better. Additional features desired in the next release include IP restrictions and user logging IP restrictions, ensuring only the customer environment can log in to Cisco Secure Email Threat Defense. Logs forwarding needs improvement as currently it only has audit logs. In Cloud Mail Gateway, we can create an IPsec tunnel to forward logs. However, in Cisco Secure Email Threat Defense, there is no option, and we must do API integration to send logs. Only SIM can get logs; Syslog cannot retrieve them.
Modernization is an area that could be improved for Cisco Secure Email Threat Defense, as some features have lagged behind newer competitors, potentially offering more advanced analysis capabilities. The initial setup is not straightforward and requires expertise and time to master configurations such as spoofing and DLP. More control over backend functionalities and simplifying rule management could enhance user experience. The product's complexity at times results in redundant rule sets that are difficult to untangle, highlighting the need for streamlined management systems and a more user-centric approach to system configuration. Furthermore, the pricing might deter new users who could opt for alternative, more cost-effective solutions.
The integration capability with other threat intelligence platforms is not optimal, as I have experienced difficulty in sending logs to our SIEM. Cisco Secure Email Threat Defense's flexibility could be enhanced while it mostly integrates with cloud solutions, but not on-premise. The behavioral analysis capability of Cisco Secure Email Threat Defense is not particularly helpful for identifying new, evolving threats within my company, as it keeps flagging legitimate emails as malicious. Regarding room for improvement, the significant number of false positives should be addressed. The solution does not adapt to behavioral analytics and does not make changes when it sees a pattern.
The physical appliance has been discontinued, although the platform still exists. Improvements here and there could be beneficial, however, there aren't too many needed. Some potential improvements could be customization and enhancements to cloud features. Other suggestions include a makeover of controls to make it more modern.
Cisco is a multi-product, diverse organization. Before it was acquired by Cisco, the company that developed Email Threat Defense focused on building purpose-built devices. After the acquisition, Cisco's multiple product lines and verticals made this just one of their many verticals, and we could see a shift in focus.
The tool gives false positives and it needs to be more accurate. I would like to see AI as a new feature.
From a technical point of view, Cisco is far behind in terms of cybersecurity, and it has to improve very much.
We encounter issues while searching for missing emails. They should improve this particular feature.
The solution is a bit expensive. It could be cheaper.
I haven't found any weak points just yet. The pricing could always be better.
Cisco Secure Email Cloud Mailbox can improve by adding advanced phishing, then the solution would become the best in the market. However, this could increase the price even more. Additionally, if CES with domain protection could be added it would be an even better solution.
The distributors provide an annual billing option, but we do not have a monthly billing option. Customers will benefit greatly from monthly billing because the majority of customers today use the cloud, be it Office 365, or Google Cloud. Monthly billing will be extremely beneficial. Maybe the end DLP can be a bit more granular in email security. DLP is already present, but it could be more in-depth.
This solution could be improved by integration with Sandbox.
Currently, Cisco Cloud Mailbox meets all of our requirements. If I had to say something, maybe they could have a more regular update schedule or perhaps hire more support engineers to get service faster.
The search area has room for improvement. When you go to the next page, it remains at the bottom of the current page that you're on. Also, under the reports section, it allows you to see any "convictions," but if you want to search for those convictions you have to remember when they all came in and go back and edit the search accordingly. You cannot click on the list of convictions to actually see if you had a spike at a certain time.
If Cisco could continue to develop integrations, whether it's internal tooling, Threat Grid, or AMP reporting which could be accessible via a single web page, that would be helpful. This would essentially add additional context on messages as well as files or links being detected. Potentially adding additional context on why certain messages are tagged as spam or malware. In our case, malware hasn't been detected yet, but spam certainly has been. Knowing what engines or which components of the message make it identifiable as spam, that could be useful. Additional context and reporting accessibly via the main dashboard would be great. There is still room for improvement in terms of integrations with other Cisco tools and non-Cisco tools. There is also some room for improvement needed in terms of the reporting.