Product Updates

August 11 2026

Enhancements

All Customers

• Gateway Test Mode Availability. Gateway Test Mode is now available for eligible imported Microsoft 365 domains and verified user-added domains.

• URL Bypass Visibility. Message link details now indicate when a URL was bypassed, making it easier to understand how URL bypass rules affected message processing.

Gateway Mode Customers

• Policy Upgrade Experience Improvements. Businesses upgraded from Supplemental mode to Gateway Mode are now identified more clearly. The interface also provides a more consistent experience when the conversion is not yet complete.

Fixed Issues

• Minor bug fixes.

July 30 2026

Enhancements

All Customers

• Advantage Policy Upgrade from Supplemental to Gateway. Customers with an Advantage license can use a guided Policy Upgrade wizard to migrate from Supplemental mode to Gateway (Inline) mode. The wizard walks administrators through Base Policy and Policy Exception mappings, preserves supported No Verdict actions, and provides a summary for confirmation before the upgrade. To reduce conflicting changes, policy editing is restricted while the transition is in progress.

• Standard-to-Advantage License Upgrades. Business licenses, including proof-of-value variants, can now be upgraded from Standard to Advantage, enabling access to the Policy Upgrade workflow.

• Supplemental-to-Gateway Domain Migration. After completing the policy upgrade, administrators can convert Supplemental Journal domains to Primary Gateway, Primary with Additional Gateway, or Secondary Gateway domains. Journal messages continue to be accepted and processed until SMTP traffic for the domain is routed through Gateway Mode.

• Upgrade Readiness Validation. The upgrade is available only when Message Analysis is enabled for all traffic directions. If this requirement is not met, in-product guidance explains how to resolve the blocker.

Gateway Mode Customers

• IPv6 Support for Inbound SMTP Traffic. Gateway Mode now supports inbound SMTP traffic from IPv6 source addresses while maintaining existing IPv4 behavior.

• IPv6 Configuration and Reporting. Administrators can use IPv6 addresses and CIDR ranges in supported BCC, relay, allow and block list, outgoing allow list, policy and rule criteria, and message-view fields. IPv6 values are displayed correctly alongside IPv4 values.

• IPv6 Support in the Public API. Public API message searches and the clientIP, serverIP, and xOriginatingIP response fields now support IPv6 values.

• IPv6-Aware Connection and Security Controls. Connection rules, IP and CIDR matching, BCC and relay matching, outgoing allow-list enforcement, IP reputation, reverse DNS, SPF, DKIM, and DMARC validation now correctly handle IPv6 sender addresses.

Fixed Issues

• Minor bug fixes.

July 14 2026

Enhancements

All Customers

• Public API Client Expiry Notifications. Administrators now receive email notifications before Public API client credentials expire, helping reduce service disruptions caused by expired API keys.

• Detection Improvements. Secure Email Threat Defense now applies updated reclassification weighting more consistently across tenants. Newly created customer reclassifications can have stronger influence when determining convictions, while older historical reclassifications continue to follow prior behavior during the rollout period.

Fixed Issues

• Minor bug fixes.

June 30 2026

Enhancements

Gateway Mode Customers

• Pivot and search functionality has been added to the Blocked Connection Log drawers, enabling administrators to identify and troubleshoot blocked connections more quickly.

Fixed Issues

• Resolved an issue where Analysts could no longer edit Message Bypass Rules after rule management moved under Global Settings.

• Minor bug fixes

June 16 2026

Enhancements

Gateway Mode Customers

• Message Report Timeline Modification Events. Message modification events have been added to the message report timeline. Administrators can now view header, footer, note, and body modification activity as separate timeline entries.

• Blocked Connection Log Detail Drawers. New detail drawers are available for IP Reputation Block and Block List summaries, providing administrators with a paginated breakdown of blocked items for the selected time range.

Fixed Issues

• Minor bug fixes.

June 2 2026

Enhancements

Gateway Mode Customers

• Sender/Recipient Pair Policy Exceptions. Gateway policy exceptions can now be configured based on specific sender and recipient pairs, giving administrators more granular exception controls in Inline Mode.

• Outgoing Message Body Modification. Outgoing-mail policy configuration now supports the No Verdict category, allowing administrators to configure message modifications—such as legal disclaimers—for outgoing mail.

• Attachment Analysis Direction Controls. New Inline Mode controls are available for Incoming, Outgoing, and Internal Attachment Analysis, enabling administrators to tune analysis by traffic direction.

Journal Message Source Customers

• Legacy Message Rules Transition Experience. The Message Rules deprecation flow has been updated. Customers with recent Message Rules activity can continue to access the page and will see a product-wide migration banner, while inactive tenants will continue to have the legacy page hidden.

Fixed Issues

• Minor bug fixes.

May 19 2026

Enhancements

All Customers

• High-Impact Personnel (HIP) Detection Enhancement. HIP detection now extends impersonation protection to high-impact individuals referenced in email subjects and message bodies. This enhancement strengthens detection of Business Email Compromise (BEC)–style attacks that exploit trust, authority, or urgency.

• Improved Policy Audit Visibility. Policy Configuration now displays Last Edited By details, allowing administrators to quickly identify who last updated base policy entries.

Gateway Mode Customers

• Dual Ingest. Secure Email Threat Defense now supports dual ingest for Gateway and Inline customers, enabling coverage for internal (east/west) mail traffic alongside existing inline flows. Administrators can configure Microsoft 365 journaling so that internal messages are journaled to the Secure Email Threat Defense–provided journal address in the Mailflow configuration screen.

• Opportunistic TLS Configuration. Tenant-level controls are now available for Opportunistic TLS on Gateway connections, allowing administrators to manage TLS behavior based on their organization's compatibility needs.

Fixed Issues

• Minor bug fixes.

May 05 2026

Enhancements

All Customers

• On the Configuration > Global settings page, Content analysis is renamed Message analysis, and Attachment analysis is renamed Attachment analysis direction. These names better reflect the evolving use of these panels.

• Improved error messaging for download and email preview failures: The messages are more descriptive, making it easier to understand what went wrong.

• Expanded Message Search API response: Added new fields (SourceId, SplinteredId, DeliveredTo) to the Message Search API response; these fields are displayed when available, giving you richer data for reporting, investigation, and automation workflows.

• Similarity Techniques in Message Report: You can now see when a message was convicted based on similarity to a previously reclassified message, providing greater visibility into detection decisions.

Journal Message Source Customers

• Policy Exceptions by Recipient for Journal message sources: You can now apply recipient-based policy exceptions in Journal mode with more granular control over how messages are handled.

• Businesses in North America region: For Microsoft 365 journal message sources, we have made a change to how message direction is determined. This reconciles how Secure Email Threat Defense determines message direction with the Microsoft direction indicator. Secure Email Threat Defense now defaults to the direction determined by Microsoft using the X-MS-Exchange-Organization-ASDirectionalityType header. This change was already deployed in Australia, India, and Europe and will be made in additional regions at a future date.

• The rules under Administration > Message Rules are deprecated and will be removed on May 18, 2026. To retain functionality, you must recreate it using the new Policy exception rules under Configuration > Policy configuration.

SMTP/Inline Mode Customers/Gateway Mode Customers

• Updated onboarding and domain management for SMTP/Inline message sources (advantage license only)

  • The mail flow previously referred to as SMTP/Inline message sources is renamed Gateway Mode.

  • The new configurations allow you to set up Secure Email Threat Defense in Primary Gateway Mode, Primary with Additional Gateway Mode, Secondary Gateway Mode, and Gateway Test Mode.

  • Mail flow configuration changes can be applied at the domain level.

• Recipient Validation and Directory Harvest Attack Prevention (DHAP) are enabled for imported domains.

• Message Body Modification: Within the Base Policy, you can now add custom header and/or footer text to incoming or outgoing messages before they are delivered.

Fixed Issues

• Minor bug fixes.

April 21 2026

Enhancements

• For SMTP/Inline message sources: The Blocked Connection Logs page is updated with a new table that shows details about each blocked connection. To access these logs, go to Insights > Blocked Connection Logs.

• New in-product support case management. A new Support menu allows you to open a support case, record the screen, upload files, and view your case list directly within the product, providing a more seamless support experience.

• The UI screens for Administration pages are redesigned as part of Cisco's ongoing efforts to provide a more consistent experience across Cisco Security products.

• Detection updates: We now query text-less emails that contain text-based attachments, increasing visibility for attachment-heavy campaigns.

• NOTE: This change was temporarily rolled back on April 23, 2026.Businesses in North America region: For Microsoft 365 journal message sources, we have made a change to how message direction is determined. This reconciles how Secure Email Threat Defense determines message direction with the Microsoft direction indicator. Secure Email Threat Defense now defaults to the direction determined by Microsoft using the X-MS-Exchange-Organization-ASDirectionalityType header. This change was already deployed in Australia, India, and Europe and will be made in additional regions at a future date.

Fixed Issues

• Minor bug fixes.

April 07 2026

Enhancements

• New: Calendar Event Remediation for Microsoft 365 journal message sources (Read and Write mode). Calendar event remediation automatically remediates calendar events that are convicted as threats. To access and enable this feature, go to the Calendar panel at Configuration > Global settings.

• Email preview handling has been enhanced to provide better guidance when a preview cannot be displayed.

  • For Inline mode messages that were Dropped or moved to Admin Quarantine, the status now shows as Not Available.

  • View details shows an error message in a dedicated banner instead of the email body.

• Expanded suspicious email patterns routed to deeper LLM-based analysis. This improves threat detection by helping identify additional malicious campaigns and high-risk messages.

• Businesses in European region: For Microsoft 365 journal message sources, we have made a change to how message direction is determined. This reconciles how Secure Email Threat Defense determines message direction with the Microsoft direction indicator. Secure Email Threat Defense now defaults to the direction determined by Microsoft using the X-MS-Exchange-Organization-ASDirectionalityType header. This change was already deployed in Australia and India, and will be made in additional regions at a future date.

Fixed Issues

• Minor bug fixes.

March 25 2026

Enhancements

• Bulk remediation and reclassification is now possible from the UI. Previously, you could remediate or reclassify only 100 messages at a time. Bulk remediation allows you to remediate or reclassify all messages in a search result, up to a 50,000 message limit.

• Businesses in India region: For Microsoft 365 journal message sources, we have made a change to how message direction is determined. This reconciles how Secure Email Threat Defense determines message direction with the Microsoft direction indicator. Secure Email Threat Defense now defaults to the direction determined by Microsoft using the X-MS-Exchange-Organization-ASDirectionalityType header. This change was already deployed in Australia, and will be made in additional regions at a future date.

• Additional pages are redesigned as part of Cisco's ongoing efforts to provide a more consistent experience across Security products:

  • Account Selection

  • Downloads: Messages, EML, and Remediation Error Log

Fixed Issues

• Minor bug fixes.

March 10 2026

Enhancements

• On the Message Report, the Mailbox List section is renamed Recipient Status. The new Recipient Status table is updated based on different traffic directions and modes.

• For Microsoft 365 journal message sources, we have made a change to how message direction is determined. This reconciles how Secure Email Threat Defense determines message direction with the Microsoft direction indicator. Secure Email Threat Defense now defaults to the direction determined by Microsoft using the X-MS-Exchange-Organization-ASDirectionalityType header. This change is deployed in Australia for this release and will be made in additional regions at a future date.

Fixed Issues

• Minor bug fixes.

February 24 2026

Enhancements

• You can now filter by messages containing QR codes on the Messages page.

Fixed Issues

• Minor bug fixes.

February 10 2026

Enhancements

• SMTP/Inline Message source counfigurations now support secure outbound scanning and delivery:

  • Outgoing message sources and Outgoing policy configuration are enabled, providing visibility and control over outbound mail flow.

  • Allow IP list for outbound security allows you to specify trusted IP addresses for outbound messaging. SMTP server will only accept outbound traffic from trusted IPs and hostnames.

  • DKIM signing instructions are added to the Mail flow configuration page. These guidelines help you create domain-level DKIM signing keys and configure the necessary DNS records.

• We have removed the banners that allowed you to switch between the new page designs and the classic version. To review the improvements on the new screens, see the announcement documents posted when we rolled out the new designs:

  • Updates introduced in February 2025: https://www.cisco.com/c/dam/en/us/td/docs/security/email-threat-defense/migration/email-threat-defense-UI-changes.pdf

  • Updates introduced in May 2025: https://www.cisco.com/c/dam/en/us/td/docs/security/email-threat-defense/migration/email-threat-defense-UI-changes-2.pdf

  • We also want to remind you that with the new designs you can resize the columns on the Messages page. You can also adjust the page density and which columns are shown through the gear icon on the Messages table.

Fixed Issues

• Minor bug fixes.

January 27 2026

Enhancements

• Message Report error messaging is improved. When downloading a failed EML file, the UI now shows accurate and meaningful error information, improving clarity and troubleshooting.

• Per‑Mailbox Delivery Details: The Message Report now displays Delivery Status and Delivery Error details per mailbox, improving visibility into message delivery issues. (Applicable for SMTP/Inline Mode Only)

Fixed Issues

• Minor bug fixes.

December 16 2025

Enhancements

• Policy exceptions by sender are available for Journal message sources. These rules allow you to create exceptions to your base policy for specific senders. Policy exceptions can be created under Configuration > Policy settings.

• Deprecation of Message Rules: Allow List and Verdict Override

  The rules under Administration > Message Rules are deprecated and will be removed in a future release. Your rules are still available and functioning. You should recreate any Message Rule functionality using the new Policy exceptions rules under Configuration > Policy settings. Once new rules are created, they will take precedent over any existing Message Rules.

• Policy exception rules can now be ranked. Drag and drop the items in the list to reorder them.

• The Message Report is redesigned as part of Cisco's ongoing efforts to provide a more consistent experience across Security products. The refreshed look and feel now matches the rest of the Secure Email Threat Defense UI.

• In the Message Report, links that are contained in a QR code are now indicated with a QR code icon.

Fixed Issues

• XDR Ribbon Issue: You may have encountered an error while accessing certain response actions for observables. This issue arose due to changes in the XDR authentication requirements, which have now been addressed. If you continue to experience issues, re-authenticate the XDR ribbon to fix the problem.

• Minor bug fixes.

December 04 2025

Enhancements

• High Impact Personnel list improvements:

  • Click the number of impersonations in the last 30 days to pivot to a filtered list of the messages that were flagged as impersonations

  • Filter by Impersonated Users using the Messages page filter panel

• SMTP/Inline message sources:

  • The Quick message filter on the Dashboard has new items for Policy exceptions and Security mailbox

  • Status and Action are added to the SPF/DKIM/DMARC tooltips when applicable

Fixed Issues

• Minor bug fixes.

November 18 2025

Enhancements

• SMTP/Inline message sources: Sender Authentication information (SPF, DKIM, DMARC) including pass/fail, reason, and action is now included in the Messages page export.

Fixed Issues

• Minor bug fixes.

November 04 2025

Enhancements

• Cisco Secure Email Threat Defense Inline mode is introduced with this release. Secure Email Threat Defense Inline offers real-time inline scanning and remediation. Inline mode improves detection speed and remediation capabilities by processing messages as they flow through the mail system, detecting threats and stopping them before reaching the end-user.

  New customers onboarding with an Advantage license can set up their businesses with SMTP/Inline message sources. Options include receiving traffic via SMTP or SMTP Relay.

• URL bypass rules are new in this release. These rules can be configured to prevent specific URLs from being scanned. You can create these rules at Configuration > Global settings > URL rules.

• Bypass Analysis Rules for Phish Test & Security Mailbox are relocated from Administration > Message Rules to Configuration > Global settings > Message bypass rules. Any existing rules are migrated to the new location and will behave in the same manner as before.

• Spam and Graymail analysis defaults to On/Checked for newly created businesses.

• Message view improvements:

  • Improved column resizing for Verdict, Action, and Date columns.

  • User column resizing is maintained in-browser, preventing resets after browser refreshes.

  • Introduced a more compact date/time format to optimize screen space usage.

  • Improved adjustments for table density and column show/hide options from the gear icon on the messages table

• Documentation improvements:

  • User documentation is updated with new formatting and is now integrated with the UI.

  • Access the new documentation from the (?) menu in the top right corner of the UI.

Fixed Issues

• Minor bug fixes.

October 17 2025

Enhancements

• User Management Notifications. Notifications of user creation, changes, or user deletion by administrators are sent to a specified email address. To turn on these notifications, go to Administration > Business > Preferences.

• Messages page improvements

  • You can now show/hide the top graph charts.

  • You can now select Copy message ID from the ... menu at the end of a message row.

Fixed Issues

• Minor bug fixes.

October 07 2025

Fixed Issues

• Minor bug fixes.

September 23 2025

Enhancements

• The High Impact Personnel List can now contain up to 500 contacts. Additionally, the UI screens for the list are redesigned as part of Cisco's ongoing efforts to provide a more consistent experience across Cisco Security products.

Fixed Issues

• Minor bug fixes.

September 09 2025

Enhancements

• Ability to detect URLs in QR codes within the Log Export API for message event logs.

• Admins can reclassify messages as Spam or Graymail, even if scanning for Spam and Graymail is disabled in the global policy.

• Enhanced Remediation and Reclassification for API performance: batch processing support and improved stability to prevent timeouts

Fixed Issues

• Minor bug fixes.

August 26 2025

Enhancements

• Ability to resize columns on the Messages page.

• For users with multiple tenants, they are now listed in alphabetical order in the account selector.

Fixed Issues

• Minor bug fixes.