Skip to content

Synchronized Security

Synchronized Security monitors outbound mail, and takes action if 5 or more emails that are classified as spam, or contain viruses are sent from a mailbox within a 10 minute period.

Synchronized Security is only available if you have a Sophos Endpoint license and a Sophos Email license.

You can turn the Synchronized Security feature on and off from My Products > General Settings > Synchronized Security.

The blocking process works like this:

  1. The originating mailbox is identified.
  2. The owner of the mailbox is identified, along with any devices assigned to the owner of the mailbox.
  3. The mailbox is blocked from sending emails for 1 hour. After 1 hour, the mailbox is unblocked automatically. You can't unblock it any sooner.

    Lockout periods increase every time the blocking process is triggered. The amount of time the mailbox is blocked for is doubled every time the spam threshold is reached. The previous block period needs to end before another can start. These timed blocks can't be removed and you have to let them expire.

    After 6 times, the mailbox will be blocked permanently, and the owner will not be able to send any email from that mailbox. If you believe a permanently blocked mailbox should be unblocked, please contact Sophos support. See Sophos Support .

  4. Sophos Anti-Virus runs an on-demand scan on the devices linked to the mailbox.

  5. An alert is sent to the administrator saying that the sender has been blocked.
  6. The events report is updated to show that the mailbox has been blocked.


If Synchronized Security is turned off, this will only disable the endpoint scan. The senders of outgoing spam and virus emails will still be blocked.