<\/span><\/h3>\nThe engine immediately validates core email authentication standards:
\n* Sender Policy Framework (SPF):<\/strong> Verifies that the sending MTA IP address is authorized to originate email on behalf of the domain.
\n* DomainKeys Identified Mail (DKIM):<\/strong> Checks cryptographic signature integrity to guarantee headers have not been tampered with in transit.
\n* Domain-based Message Authentication, Reporting, and Conformance (DMARC):<\/strong> Enforces domain policy alignment between the RFC 5321 Envelope From<\/code> and the RFC 5322 Header From<\/code> addresses.<\/p>\nMessages that pass technical DMARC validation can still be fraudulent if sent from lookalike domains or compromised third-party accounts. Consequently, protocol validation serves as a baseline filter rather than a final verdict.<\/p>\n
<\/span>Stage 3: Communication Graphing and Sender Relationship Modeling<\/span><\/h3>\nCisco Identity Intelligence models the historical communication baseline of the organization. It establishes a dynamic relationship graph mapping internal users, external partners, vendors, and frequent contacts:
\n* Does the recipient routinely communicate with this external sender?
\n* Has this sender address ever sent invoices, banking updates, or executive inquiries in the past?
\n* Does the originating mail server match historical geographic and autonomous system number (ASN) patterns for this domain?<\/p>\n
Anomalies\u2014such as an email claiming to be from an internal legal executive arriving from an external infrastructure never before seen in company history\u2014are flagged instantly.<\/p>\n
<\/span>Stage 4: Natural Language Processing (NLP) and Anomaly Classification<\/span><\/h3>\nSpecialized Natural Language Processing (NLP) models scan subject lines and header metadata for behavioral markers of social engineering. The engine identifies high-risk conversational patterns, such as urgency cues, payroll change requests, gift card solicitations, and wire transfer instructions. These patterns are correlated with sender identity; a wire transfer request from an authenticated, established CFO mailbox is treated differently than the same request from an unverified external address.<\/p>\n
<\/span>Stage 5: Trust Score Synthesis and Policy Enforcement<\/span><\/h3>\nThe cloud service combines global threat telemetry from Cisco Talos (which monitors billions of daily email requests worldwide) with local relationship graphs to compute three distinct scores:
\n1. Message Authenticity:<\/strong> Measures conformance to technical sender standards.
\n2. Domain Reputation:<\/strong> Evaluates domain age, registrar patterns, typosquatting indicators, and Talos threat intelligence history.
\n3. Sender Legitimacy:<\/strong> Quantifies the historical reliability of the individual sender’s interaction with the specific recipient.<\/p>\n [ Inbound Email Metadata ]\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Sensor Ingestion \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Cryptographic Checks (SPF\/DKIM\/DMARC) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Identity Intelligence & Graph Engine \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Natural Language & Behavioral Models \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Trust Score Decision Engine \u2502\n \u2502 (Authenticity \/ Domain \/ Sender) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc \u25bc\n [ Deliver ] [ Tag \/ Prepend ] [ Block \/ Quarantine ]\n<\/code><\/pre>\nIf the aggregate trust score falls below the administrator’s designated risk threshold, enforcement policies trigger remediation actions such as prepending warning banners, quarantining, or dropping the message entirely.<\/p>\n
\n<\/span>Threat Vectors Mitigated: Attacks Prevented by Advanced Phishing Protection<\/span><\/h2>\nTraditional email filters focus heavily on attachments and known malicious links. Cisco Advanced Phishing Protection targets deceptive tactics that exploit human trust.<\/p>\n
<\/span>What is Business Email Compromise (BEC), and how does the platform stop it?<\/span><\/h3>\nBusiness Email Compromise (BEC) involves impersonating corporate executives, vendors, or trusted external partners to trick employees into executing wire transfers or redirecting payroll. Because BEC attacks rarely contain weaponized attachments or malware payloads, signature engines miss them. Cisco Advanced Phishing Protection mitigates BEC by comparing the sender’s identity against its local relationship graph. When an email claims executive authority but originates from non-executive infrastructure, it fails sender legitimacy checks and is blocked.<\/p>\n
<\/span>How does the engine identify Display Name Impersonation?<\/span><\/h3>\nIn display name spoofing, an attacker creates an external freemail account (such as john.doe.ceo@gmail.com<\/code>) and sets the display name to match a corporate VIP (e.g., “John Doe, CEO”). The email headers comply with SPF and DKIM because Gmail is an authorized sender for its own domain. Cisco\u2019s engine maintains an internal identity registry of organizational VIPs, board members, and executives. When the friendly display name matches an internal VIP but the envelope address resolves to an external, unrelated account, the system identifies the mismatch and intercepts the communication.<\/p>\n<\/span>How are Look-alike (Cousin) Domains and Typosquatting detected?<\/span><\/h3>\nAttackers often register deceptive domains that visually mimic legitimate brands by swapping characters (e.g., using arnazon.com<\/code> instead of amazon.com<\/code>, or substituting Latin letters with Cyrillic homoglyphs). Cisco\u2019s domain reputation engine evaluates incoming domain strings using Levenshtein distance algorithms, Punycode analysis, and domain age tracking. Domains registered recently or exhibiting slight orthographic variances from trusted partner domains are assigned a low domain reputation score and neutralized.<\/p>\n<\/span>Does the system protect against Account Takeover (ATO) and compromised vendor mailboxes?<\/span><\/h3>\nWhen an attacker compromises a legitimate partner or vendor account, the emails originate from authorized IP addresses and pass SPF\/DKIM\/DMARC checks. Cisco Advanced Phishing Protection detects compromised accounts through behavioral anomaly detection. If a vendor account that historically discussed software licensing suddenly issues an urgent wire transfer request with altered bank account routing details, the system flags the communication due to abnormal intent, atypical vocabulary, and unexpected routing paths.<\/p>\n
<\/span>How does the platform counter weaponized links and delayed-activation URLs?<\/span><\/h3>\nModern phishing actors often send benign URLs that redirect to credential harvesting sites only after passing through the perimeter gateway. Cisco Advanced Phishing Protection pairs with Cisco Talos and Outbreak Filters to perform time-of-click link evaluation and heuristic URL inspection. If a link shifts from benign to malicious post-delivery, the system’s retrospective telemetry alerts the gateway to claw the message back from user inboxes.<\/p>\n
\n<\/span>Cisco Advanced Phishing Protection vs. Microsoft Defender for Office 365<\/span><\/h2>\nOrganizations running cloud messaging environments frequently evaluate whether Cisco’s advanced anti-phishing capabilities provide necessary protection beyond native email security platforms such as Microsoft Defender for Office 365 (MDO Plan 1 \/ Plan 2). The following table compares both solutions across critical operational dimensions:<\/p>\n
\n\n\n| Capability \/ Metric<\/th>\n | Cisco Advanced Phishing Protection<\/th>\n | Microsoft Defender for Office 365 (MDO)<\/th>\n<\/tr>\n<\/thead>\n |
\n\nDetection Architecture<\/strong><\/td>\n| Multi-layered: Hybrid gateway sensors + cloud machine learning + API-based mailbox telemetry.<\/td>\n | Native cloud API and transport rule integration embedded within Microsoft Exchange Online.<\/td>\n<\/tr>\n | \nIdentity & BEC Modeling<\/strong><\/td>\n| Cisco Identity Intelligence models local sender-recipient relationship graphs and communication baselines.<\/td>\n | Microsoft Intelligent Security Graph and machine-learning anti-impersonation policies.<\/td>\n<\/tr>\n | \nThreat Intelligence Engine<\/strong><\/td>\n| Cisco Talos: Real-time global network, endpoint, web, and email threat telemetry.<\/td>\n | Microsoft Defender Threat Intelligence: Microsoft 365 ecosystem and Azure telemetry.<\/td>\n<\/tr>\n | \nDeployment Flexibility<\/strong><\/td>\n| Hybrid support: Integrates with Microsoft 365, Google Workspace, on-prem Exchange, and standalone SEGs.<\/td>\n | Cloud-native: Primarily optimized for Microsoft 365 environments; complex for heterogeneous MTAs.<\/td>\n<\/tr>\n | \nPost-Delivery Remediation<\/strong><\/td>\n| Mailbox Auto-Remediation (MAR) via Microsoft Graph API and Exchange Web Services.<\/td>\n | Zero-hour Auto Purge (ZAP) for automated post-delivery message removal.<\/td>\n<\/tr>\n | \nFalse-Positive Tuning<\/strong><\/td>\n| Granular trust scoring (authenticity, domain reputation, sender legitimacy) with customizable thresholds.<\/td>\n | Preset anti-phishing protection levels (Standard, Strict) and manual domain\/user exception lists.<\/td>\n<\/tr>\n | \nPrimary Enterprise Fit<\/strong><\/td>\n| Complex enterprise, hybrid, and defense-in-depth architectures requiring cross-vendor visibility.<\/td>\n | Organizations seeking an all-in-one, consolidated Microsoft security stack.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n While Microsoft Defender for Office 365 provides baseline security for Exchange Online mailboxes, Cisco Advanced Phishing Protection functions as an adaptive defense layer. It is well suited for enterprises with distributed, hybrid infrastructure or those that require relationship modeling to catch low-volume, highly targeted BEC fraud.<\/p>\n
\n<\/span>Step-by-Step Setup: Configuring Automated Mailbox Remediation and Clawback<\/span><\/h2>\nPost-delivery weaponization occurs when a message that appeared clean during perimeter inspection turns out to be malicious upon further analysis. Cisco Mailbox Auto-Remediation (MAR) enables administrators to configure automated threat retraction (clawback), removing malicious messages from user mailboxes without requiring manual Security Operations Center (SOC) intervention.<\/p>\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Step 1: Azure App Registration \u2502\n \u2502 (Configure Graph API Perms) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Step 2: Configure AsyncOS Profile\u2502\n \u2502 (Client ID, Secret, Tenant) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Step 3: Domain Mapping Setup \u2502\n \u2502 (Link Domains to M365 Tenant) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Step 4: Define Policy Actions \u2502\n \u2502 (Delete \/ Move to Junk) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Step 5: Audit & Validation \u2502\n \u2502 (Verify Remediation Reports) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n<\/span>Step 1: Register the Application and Entitlements in Microsoft Entra ID<\/span><\/h3>\nTo allow Cisco to search and purge delivered emails in Microsoft 365 mailboxes, register an API client application in Microsoft Entra ID (formerly Azure Active Directory):
\n1. Sign in to the Microsoft Entra Admin Center<\/strong>.
\n2. Navigate to App registrations<\/strong> > New registration<\/strong>. Name the application (e.g., Cisco-Secure-Email-MAR<\/code>) and complete registration.
\n3. Capture the Application (client) ID<\/strong> and Directory (tenant) ID<\/strong>.
\n4. Go to Certificates & secrets<\/strong> > New client secret<\/strong>. Generate a secret key and immediately record the Value<\/strong>.
\n5. Select API permissions<\/strong> > Add a permission<\/strong> > Microsoft Graph<\/strong> > Application permissions<\/strong>.
\n6. Add the following required scopes:
\n* Mail.ReadWrite<\/code> (Permits reading and deleting mail across all mailboxes).
\n* Mail.Read<\/code> (Allows the search engine to inspect target message headers).
\n* Mail.Send<\/code> (Enables forwarding notifications during clawback).
\n* Directory.Read.All<\/code> (Optional, required if validating mailbox mappings via LDAP synchronization).
\n7. Click Grant admin consent for [Organization Name]<\/strong> to confirm application authorization.<\/p>\n<\/span>Step 2: Establish the Cloud Account Profile on the Email Gateway<\/span><\/h3>\nLink the gateway appliance or cloud service to the newly provisioned Entra ID application:
\n1. Log in to the Cisco Secure Email Gateway management interface.
\n2. Navigate to System Administration<\/strong> > Account Settings<\/strong> (in AsyncOS 13.0 and newer).
\n3. Click Add Account Profile<\/strong> and designate the Account Type<\/strong> as Office 365 \/ Microsoft 365<\/strong>.
\n4. Enter the Tenant ID<\/strong>, Client ID<\/strong>, and Client Secret<\/strong> recorded in Step 1.
\n5. Click Test Connection<\/strong> to validate that the gateway can establish an authenticated TLS session with Microsoft Graph API endpoints.<\/p>\n<\/span>Step 3: Map Corporate Recipient Domains<\/span><\/h3>\nAssociate all incoming email domains intended for automated remediation with the authenticated profile:
\n1. Under Account Settings<\/strong>, locate the Domain Mapping<\/strong> sub-section.
\n2. Add your corporate recipient domains (e.g., example.com<\/code>, corp.example.com<\/code>).
\n3. Assign each domain to the active Microsoft 365 account profile created in Step 2.
\n4. Submit and commit your changes.<\/p>\n<\/span>Step 4: Configure Remediation Policies for Verdict Updates<\/span><\/h3>\nEstablish policy actions for instances when Cisco Talos or the Advanced Phishing Protection engine updates a delivered message\u2019s verdict from clean to malicious:
\n1. Navigate to Mail Policies<\/strong> > Incoming Mail Policies<\/strong>.
\n2. Select the targeted policy and locate the Advanced Phishing Protection<\/strong> or Advanced Malware Protection<\/strong> settings column.
\n3. Check the box to Enable Mailbox Auto Remediation<\/strong>.
\n4. Select the automated enforcement action to be executed when a verdict turns malicious:
\n* Delete:<\/strong> Permanently purges the email from the user’s inbox.
\n* Forward to Alternate Email and Delete:<\/strong> Sends a forensic copy to the SOC incident mailbox, then removes it from the user’s view.
\n* Move to Junk \/ Quarantine:<\/strong> Transits the message out of the inbox into the user’s Junk folder or centralized appliance quarantine.<\/p>\n<\/span>Step 5: Validate and Audit Auto-Remediation Execution<\/span><\/h3>\nMonitor automated actions to ensure clawbacks execute within seconds of threat detection:
\n1. Open the Cisco Secure Email interface and navigate to Reports<\/strong> > Remediation Report<\/strong> (or Monitor<\/strong> > Advanced Phishing Protection<\/strong>).
\n2. Review the Mailbox Auto Remediation<\/strong> tab to evaluate recent actions.
\n3. Verify that timestamps, recipient mailboxes, message Message-IDs, and deletion statuses reflect successful remediation without API throttling failures.<\/p>\n
\n<\/span>Licensing Structure, Subscription Tiers, and Ordering Information<\/span><\/h2>\nProcuring Cisco Advanced Phishing Protection involves term-based software subscriptions aligned with organizational user counts.<\/p>\n <\/span>What is the primary licensing metric for Cisco Advanced Phishing Protection?<\/span><\/h3>\nLicensing is based on the total number of active mailboxes protected within the organization. Tiered volume bands scale down the per-user cost as mailbox quantities increase (e.g., bands for 100\u2013999 users, 1,000\u20134,999 users, up to 10,000+ seats).<\/p>\n <\/span>What subscription terms and billing options are supported?<\/span><\/h3>\nCisco offers term-based subscriptions available in 1-year<\/strong>, 3-year<\/strong>, or 5-year<\/strong> agreements. Subscriptions can be prepaid upfront or billed through annual payment plans structured via Cisco Enterprise Agreements (EA).<\/p>\n<\/span>Can Advanced Phishing Protection be purchased as a standalone add-on?<\/span><\/h3>\nYes. Organizations operating on-premises or virtual Cisco Secure Email Gateways can acquire Cisco Advanced Phishing Protection (CAPP) as an \u00e0 la carte subscription add-on to augment existing software packages. It is also bundled natively within broader packages:
\n* Cisco Secure Email Premier Bundle:<\/strong> Integrates perimeter gateway filtering, Malware Defense, Domain Protection, and Phishing Defense.
\n* Cisco User Protection Suite:<\/strong> Unifies Cisco Duo access management, Secure Email Threat Defense, and Secure Endpoint into a single per-user SKU.
\n* Cisco Breach Protection Suite:<\/strong> Bundles email protection with Cisco XDR, Network Analytics, and Talos incident response services.<\/p>\n<\/span>What are the operational prerequisites prior to ordering?<\/span><\/h3>\nTo implement Cisco Advanced Phishing Protection, organizations must meet the following infrastructure baselines:
\n* An active Cisco Smart Account and Virtual Account within Cisco Software Central for Smart License registration.
\n* Cisco Secure Email Gateway running AsyncOS version 11.1 or later (AsyncOS 13.0+ is recommended for Microsoft Graph API Mailbox Auto-Remediation).
\n* Internet-facing egress connectivity (HTTPS on port 443) allowing sensors to forward metadata to the Cisco Advanced Phishing Protection cloud service.<\/p>\n <\/span>Which Product Authorization Identifiers (PIDs) are used for ordering?<\/span><\/h3>\nOrders are placed via authorized Cisco partners using the Cisco Commerce Workspace (CCW) under unified software subscription SKUs:
\n* Base Ordering SKU: SEC-EMAIL-SUB<\/code>
\n* Phishing Defense Subscription PID: Configured within the subscription builder as CAPP-LIC<\/code> or EMAIL-PHISH-DEF<\/code>
\n* Cloud API-native Deployment SKU: SETD-SUB<\/code> (Cisco Secure Email Threat Defense)<\/p>\n
\n<\/span>Technical Reference: Official Documentation, Architecture, and API Repositories<\/span><\/h2>\nFor network engineers, messaging architects, and security administrators, Cisco maintains formal technical reference materials and deployment specifications across several core repositories:<\/p>\n <\/span>System Architecture and Operating Specifications
| | | | | | | |