---
title: "Which inbound email security product / Secure Email Gateway (SEG) does the Applicant use?"
url: https://insuranceposture.com/questions/email-security/inbound-email-security-product-secure-email-gateway-applicant
category: "Email security and phishing"
canonical_key: q_eml_008
evidence_state: attested
updated: 2026-08-24
---

# Which inbound email security product / Secure Email Gateway (SEG) does the Applicant use?

URL: https://insuranceposture.com/questions/email-security/inbound-email-security-product-secure-email-gateway-applicant
Section: Email security and phishing
Evidence state: Attested, not tenant-verifiable

As with the endpoint question, the vendor name is a shortcut the underwriter uses to infer capability. Name the tier or the shortcut works against you.

## What the carrier is actually asking

The carrier wants the product that filters your inbound mail, and increasingly the plan level. Where the answer is Microsoft, the difference between the included protection and the advanced plan is exactly the difference between the two previous questions on the form.

## Why it is underwritten

Underwriters cannot inspect your mail flow, so they use the product name to estimate detection quality and the tier to determine whether detonation and time-of-click protection are present at all. A bare vendor name invites a conservative assumption.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

The tenant shows which Microsoft plan is licensed and onboarded, and whether a third-party gateway sits in the mail path.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Microsoft 365 | Defender for Office 365 plan and its enabled policies | The specific plan, since the included protection and the advanced plan differ on exactly the capabilities carriers ask about |
| Microsoft 365 | Inbound mail flow connectors | Whether a third-party gateway is in front, which determines how the two layers interact |
| Microsoft 365 | Enhanced filtering configuration where a gateway is present | Configured, so Microsoft still evaluates the original sender rather than the gateway |
| Gateway vendor | Product, tier, and enabled modules | The gateway configuration. Attested |
| Managed service | Who monitors mail security alerts and when | Coverage hours, which strengthens this answer and the monitoring answer elsewhere |

**Layering is fine, blinding is not**

A third-party gateway in front of Microsoft is a common design and works well when enhanced filtering is configured. Without it, every message appears to arrive from the gateway, which degrades Microsoft's spoof and impersonation detection substantially. If you run both, check this setting.

## What a defensible yes requires

- The answer names the product and the plan or tier.
- Where two layers exist, both are named and the routing is configured so neither is blinded.
- The named product matches the capabilities claimed in the detonation and link protection answers.
- Who monitors the alerts is stated.
- Licensing covers the full mailbox count, consistent with the headcount reported elsewhere.

## How this answer goes wrong

The form says a premium product and the tenant is licensed for the base plan, so the detonation answer given two questions earlier is unsupported. Underwriters read these answers together, and internal inconsistency is the most common reason a submission generates additional questions.

## If this answer turns out to be wrong

Business email compromise is the highest-frequency cyber claim, so the mail controls described on the application are among the first things an adjuster reads back against it. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what counts as misrepresentation on a cyber application](https://insuranceposture.com/glossary/misrepresentation). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Is Microsoft 365 alone acceptable?

Yes, at the plan level that includes detonation and time-of-click link protection. Name the plan explicitly.

### Does a third-party gateway improve our submission?

It is neutral in most markets. What matters is capability and configuration, not the number of layers.

### What if we changed product recently?

Say so with the date. A recent migration explains gaps in historical evidence and is better volunteered than discovered.

### Do carriers verify this?

Not usually at underwriting. It surfaces during a claim, when the mail path is reconstructed from headers and the actual filtering layer becomes visible.

## Related questions

- [Is inbound email security (SEG) deployed with sandbox attachment detonation?](https://insuranceposture.com/questions/email-security/inbound-email-security-deployed-sandbox-attachment-detonation)
- [Is email filtering in place for inbound mail?](https://insuranceposture.com/questions/email-security/email-filtering-place-inbound-mail)
- [Which Endpoint Detection & Response (EDR) product does the Applicant use?](https://insuranceposture.com/questions/endpoint-and-patching/endpoint-detection-response-product-applicant)
- [Does the Applicant employ a sandboxing solution for investigating suspicious emails/attachments?](https://insuranceposture.com/questions/email-security/applicant-employ-sandboxing-solution-investigating-suspicious-emails-attachments)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.