Advanced threat protection is a defensive layer that inspects files, links, and behavior beyond a simple list of already known bad programs.
It is a product or service around the mailbox and the endpoint, not the name of a particular intruder.
How it works
The layer may open a suspicious attachment in a sealed test environment, rewrite a link in a mail message, or flag a laptop that suddenly encrypts many shared files.
It looks for actions that resemble an intrusion even when the file has never been seen before.
A company that relies only on yesterday's list can miss a new lure sent to the finance desk that morning.
The extra layer adds delay and sometimes blocks a legitimate file, so someone must be able to release a false stop quickly.
Concrete examples
- A mail gateway detonates an invoice attachment in isolation and drops it when the test environment starts an unexpected process.
- A laptop agent warns that a user account is reading far more personnel files than that clerk has ever opened.
- A link in a supplier message is rewritten so the click is checked again at the moment the employee actually opens it.
Protective measures
- Pilot the layer on the finance mailbox before you turn it on for the whole company, and measure what it blocks.
- Give the help desk a fast way to release a file that the layer stopped and that a manager confirms is real.
- Keep the classic signature list as well, because the behavior layer does not replace a known bad file you can already name.
- Review the alerts each day so a warning about mass file changes is not left unread until Monday.
Related articles
Readers who want more on a corporate mail gateway should open What is a computer virus? next.
For day to day work on a corporate mail gateway, add What is adware? to the same reading list.
People who look after a corporate mail gateway compare this explanation with What is anti virus scanning?.