topic Re: A phishing email bypassed the Check Point security controls in Email and Collaboration

A phishing email bypassed the Check Point security controls

Nishanthan — Tue, 23 Sep 2025 11:04:47 GMT

We are experiencing an issue with Harmony Email security and would like your assistance.

On 8th September, a phishing email was successfully blocked by Harmony Email.
On 19th September, a similar phishing email from a different sender was delivered to the customer’s mailbox.
The phishing email on 19th September was not blocked by Harmony Email and we were unable to find any related logs for this event.
Email tracing shows that the message hit the Microsoft external email header policy, but it did not trigger any Check Point policy enforcement.
Despite this, the email still reached the customer mailbox.

Concerns / Questions:

Why did Harmony Email fail to block the phishing email on 19th September?
Why are there no Harmony Email logs for this email?
Why was the message processed only under Microsoft’s external header policy and not evaluated by Check Point’s security controls?

Re: A phishing email bypassed the Check Point security controls

G_W_Albrecht — Tue, 23 Sep 2025 11:35:02 GMT

Do you have a SR# wuth CP TAC open already to get these questions answered?

Re: A phishing email bypassed the Check Point security controls

the_rock — Tue, 23 Sep 2025 12:46:30 GMT

For something like this, I would definitely open TAC case. In the meantime, are there any relevant logs you can send us?

Andy

Re: A phishing email bypassed the Check Point security controls

PhoneBoy — Tue, 23 Sep 2025 14:07:09 GMT

Specific instances of false positives/false negatives should be addressed via TAC.

Re: A phishing email bypassed the Check Point security controls

Nishanthan — Wed, 01 Oct 2025 04:42:33 GMT

We raised a service request, and their response was that “this user is not a protected user.” That part is correct, since the object in question is not an individual user but a Microsoft group. However, inside this group there are multiple protected users. The concern is why the email was still delivered to those protected users and not blocked. Additionally, we need to understand why the message was not automatically deleted from the inboxes of those protected users.

Re: A phishing email bypassed the Check Point security controls

the_rock — Wed, 01 Oct 2025 05:04:11 GMT

Definitely should have been deleted, agree.

Andy

Re: A phishing email bypassed the Check Point security controls

the_rock — Fri, 03 Oct 2025 02:06:09 GMT

Hey mate,

Any news about this? What did TAC say?

Best,

Andy