ITECS pairs Check Point email security with Petra Security ITDR—Identity Threat Detection and Response. Check Point filters malicious messages and flags email-account anomalies; Petra adds tenant-wide Microsoft 365 forensics and containment after identity compromise.
Technology partners
ITECS combines proven platforms around each client’s environment. Check Point supplies the email protection layer and Petra Security adds Microsoft 365 ITDR, while Sophos and SentinelOne support the broader endpoint and cybersecurity ecosystem our engineers can design, integrate, and manage.
Check Point
Petra Security
Sophos
SentinelOne
The two-layer model
Email security filters malicious content and can flag email-account anomalies. Petra extends that foundation with dedicated ITDR for tenant-wide Microsoft 365 identity activity, containment, and forensics after authentication. Together, the controls cover more of the attack path while keeping their different roles—and ITECS response ownership—clear.
Check Point
Check Point Email Security—formerly Harmony Email & Collaboration—inspects email and applies protection before the inbox, at click time, and after delivery. Its email-security scope also includes compromised-account anomaly detection.
Petra Security
Petra looks for evidence of successful identity compromise and helps contain and reconstruct attacker activity across Microsoft 365.
Petra does not replace email security. Check Point protects message content and includes email-account takeover signals. Petra adds dedicated, tenant-wide Microsoft 365 ITDR, attack-impact analysis, forensics, and remediation. ITECS manages the handoff and overlap between those controls. See Petra’s product distinction.
Microsoft’s 2025 Digital Defense Report release noted that identity attacks rose 32% in the first half of 2025, more than 97% were large-scale password attacks, and 80% of incidents its security teams investigated involved data theft or leakage. Read the Microsoft report.
Layer 1 · Check Point
Check Point Email Security uses API-based inspection to evaluate inbound, internal, and outgoing messages for phishing, business email compromise, malicious links, malware, data leakage, and email-account takeover signals. ITECS deploys the platform, aligns policies to your risk, manages operational workflows, and keeps protection tuned as threats and business needs change.
Analyze sender and correspondence behavior, message context, and Microsoft account activity to detect impersonation, BEC, and signs of a compromised email account.
Inspect files for known and zero-day threats, with sandboxing and content sanitization available according to the selected package.
Evaluate destinations when messages arrive and when users click, helping stop malicious sites that change after delivery.
Apply quarantine, outbound inspection, and data-loss controls that reflect licensing, business workflows, and compliance requirements.
What ITECS manages
Software alone does not decide your policy, investigate edge cases, or communicate with your team. ITECS turns the platform into a managed control with defined owners.
Review Check Point’s official Email Security platform guide for current capabilities. Check Point renamed Harmony Email & Collaboration to Check Point Email Security in March 2026. See the official naming update. Features vary by plan, so ITECS confirms the licensed scope during assessment.
Layer 2 · Petra Security
Petra Security monitors Microsoft 365 activity for evidence that an identity is already under attacker control. Its behavioral detections, containment actions, and forensic timelines help ITECS move from a suspicious sign-in to a documented response across Entra ID, Exchange Online, SharePoint, OneDrive, Teams, and registered applications.
Look beyond location alone to identify session hijacking, token theft, AiTM activity, suspicious app consent, and attacker behavior using valid credentials.
Support rapid session revocation, account locking, related-phish retraction, and removal of malicious persistence within the approved response scope.
Show which email, files, applications, and identity settings an attacker accessed or changed across the Microsoft 365 tenant.
Build a root-cause timeline with observed activity, impact, and remediation evidence for leadership, compliance, insurance, and incident review.
Historical visibility
6 months
Petra Scan can review up to six months of available Microsoft 365 audit history for past and active compromise evidence.
Petra documents root cause, attacker actions, affected resources, and response steps. Official scan guidance describes a typical 24–48-hour turnaround after onboarding and permission validation.
Lookback depth depends on audit data Microsoft was already recording; historical logs cannot be created retroactively. Containment actions and response hours depend on the service scope approved for your organization.
Attack-to-response view
Attackers do not follow product boundaries, so the operating model cannot either. This view shows which layer acts at each stage, where responsibilities overlap, and how ITECS connects prevention, identity response, and communication into one service path without pretending that one tool can cover every attack.
Responsibilities for Check Point, Petra Security, and ITECS at each attack stage
Attack stage
Check Point
Petra Security
ITECS managed response
The ITECS service
For Dallas-area and nationwide clients, ITECS owns the day-to-day work that turns vendor software into an operating security control: discovery, deployment, policy design, alert handling, escalation, containment coordination, reporting, and improvement. Response authority, service hours, integrations, and licensed features are documented before go-live so your team knows what happens next.
Scope the layers to the environment. The assessment does not assume a mandatory bundle: ITECS can recommend Check Point, Petra, or both based on your email platform, Microsoft 365 exposure, existing controls, and response needs. Final licensing and managed-service scope are confirmed in the proposal.
Map mail flow, Microsoft 365 identity controls, licensing, privileged roles, notification paths, and current incident ownership.
Connect the approved platforms, validate permissions, establish policies, document exclusions, and test escalation paths before broad rollout.
Review alerts, tune controls, coordinate containment, manage approved response actions, and keep client stakeholders informed.
Use incident timelines, tenant reports, and operating trends to recommend policy, training, identity, and broader security improvements.
Defense in depth
ITECS can align this service with your broader cybersecurity program, including endpoint detection and response, security awareness training, penetration testing, and readiness work for HIPAA or CMMC.
Common questions
Most buyers want to know where filtering ends, when ITDR begins, and who acts during an incident. These answers explain platform coverage, deployment, historical analysis, containment, and service scope so you can compare the approach against your current Microsoft 365 and email security controls.
Not every environment needs both on day one. Check Point and Petra can be assessed and scoped as separate layers based on platform, existing controls, and risk. Microsoft 365 organizations often benefit from combining email protection with post-authentication ITDR; the final recommendation and licensing are documented in your proposal.
No. Petra Security is Microsoft 365 Identity Threat Detection and Response, not an email content filter. Check Point protects email and collaboration content and also includes email-account anomaly and takeover signals. Petra adds dedicated tenant-wide identity detection, attack-impact analysis, forensics, and response after authentication.
Check Point Email Security supports Microsoft 365 and Gmail, with collaboration and data-protection coverage determined by the selected package. Petra Security is specific to Microsoft 365 and monitors relevant activity across Entra ID, Exchange Online, SharePoint, OneDrive, Teams, applications, and related audit logs.
Based on your approved response scope, containment can include revoking sessions, locking an account, retracting related phishing messages, and removing persistence such as malicious inbox rules, unauthorized applications, device registrations, or connectors. ITECS documents escalation, authorization, communication, and follow-through before go-live.
Petra Scan can analyze up to six months of Microsoft 365 audit history for evidence of past and active compromise. The available lookback depends on logs Microsoft was already recording, because historical audit data cannot be generated retroactively. Official guidance describes a typical 24–48-hour scan turnaround after onboarding.
ITECS assesses the environment, deploys the approved platforms, designs policies and escalation paths, validates alerts, coordinates authorized containment, manages tuning, and delivers operational or incident reporting. Licensed features, response hours, integrations, and decision authority are confirmed in the service scope for each client.
Build the surrounding controls
Email and identity controls work best as part of a broader defense. Explore the ITECS services that add endpoint visibility, firewall enforcement, employee readiness, and testing around this managed email security and ITDR program, using the same assessment-led approach and clear response ownership.
Compare endpoint protection, firewall management, email security, consulting, training, and compliance options.
Compare cybersecurity options
See the full ITECS managed security approach—Sophos MDR-backed 24/7 monitoring, layered defense, and MSSP positioning.
View cybersecurity overview
See how cybersecurity integrates with managed IT support, cloud, and strategic planning under one partner.
See managed IT plans
Review real outcomes that support security planning, executive buy-in, and budget justification.
See case studies
Get a prioritized view of your risk exposure, control gaps, and recommended next actions.
Run the assessment
Close the coverage gap
A short working session can map your current email flow, Microsoft 365 identity controls, response ownership, and reporting needs. ITECS will identify coverage gaps, explain which platform fits each risk, and outline a practical rollout without requiring you to replace controls that already work.
Start with a focused review of your current email and Microsoft 365 identity controls.