Business email compromise	Cisco Email ATP provides BEC detection capabilities using real-time behavior analysis and advanced machine learning to prevent breaches. It provides enhanced protection against CEO fraud/whaling and similar attacks. Behaviour analysis – Advanced Malware Protection (AMP) analyzes emails for threats such as zero-day exploits hidden in malicious attachments. Cisco Email ATP gives you advanced protection against spear phishing, ransomware, and other sophisticated attacks. AMP continues to watch, analyze, and record email attachments, regardless of the file’s disposition.
URL rewriting	The URL filtering service “rewrites” and performs checks on certain URLs in inbound emails. Rewriting allows Cisco to access the URL destination to validate that it is non-threatening. Any URL that is rewritten is checked every time an end-user clicks on it, to ensure the URL destination is not hosting malware, phishing, or spam threats. Threat detection also auto-adjusts based on URL reputation and URL category.
Domain fraud detection	Cousin domain – A security feature to identify cousin domain spoofing instances for the domain name which could be easily misspeled to make it look like an authorized/original domain. Domain age – Cisco Email ATP will also identify lookalike domains which are registered recently and are trying to launch an attack. Domain reputation – provides a reputation verdict for inbound emails based on the sender’s domain.
Safe print	Cisco Email ATP provides a safe view (safe-printed PDF version) of a message attachment (Microsoft documents) that is flagged as malicious or suspicious. The safe view of such a message attachment is delivered to the end-user and the original attachment is stripped from the message. This way, malicious attachments never get into your system.
Email data loss prevention	Cisco’s advanced security ensures it controls, monitors, detects, and blocks unauthorized flow of information from the organization.
User registration	Seamless integration using on-premise Active Directory / LDAP / SMTP Call-Ahead and Azure Active Directory Domain Services (AD DS).
Reports	Insight discovery and customized reports to track messages or view quarantine information.

Talos: Access to the world's largest threat database at no additional fee
External threat feeds (STIX and TAXII)	STIX and TAXII are not available for customer implementation.	Limited Only if SEG is licensed to participate in the Integrated Cyber Defense Exchange.
Cross-enterprise threat investigation and response	Limited Only cloud-based forensics is available with E5 licensing.	Limited Symantec Deep Insight is a separate subscription service with restrictions on usage link

Advanced phishing protection
Domain protection		Limited Email Fraud Protection does not offer the same level of service.
Web interaction tracking
Scanning URLs in attachments	Limited No scanning for non-Microsoft documents.
Shortened URL scanning
Anti-phishing, malicious URL detection, and AMP (in base offering)

DMARC, DKIM, and SPF analysis
Sender domain reputation filtering				Symantec only offers Ironport HAT-like functionality.
DNS-based authentication of named entities (DANE)

File retrospection
Retrospective message remediation in a cloud-based service
Macro and file-type filtering

Data loss prevention policy solution integrated into email gateway			Limited No DLP templates, only REGEX.
Sender control of encrypted envelopes via the sender portal

Dedicated cloud instance service per customer with dedicated IP addresses
Dedicated Office 365 and hybrid solution		N/A
Redundant secure email gateways in different data centers for each customer

DMARC
Bulk Mail

DMARC

Bulk Mail

Robust security: outbound message control

Data Loss Prevention

Email encryption

Threat intelligence and response

Phishing protection

Bundled services

Email authentication

Deep file analysis

Outbound protection

Cloud infrastructure

Security awareness