Help me understand the use case and sell Threat Extraction

[LucianLS]

Hi!

Having read a few articles and skimmed thru the Threat Prevention admin manual I seem to be missing the point of using Threat Extraction.

In my limited experience with dealing with spam(managing filters, quarantine), I haven't encountered a case where an email was both infected and containing actual useful information for the recipient.

In some cases, someone might have hijacked an account and added a malicious attachment or url to the original email. But if this is just a copy of already consumed information, it would not serve any purpose to the recipient (after Threat Extraction did its job), except to confuse them.

So I'm probably missing something but I don't know what.

[G_W_Albrecht]

TX takes the email attachment (usually Excel / Word files) and converts them to PDF without active content. This is then sent to the client instead of the original attachment.

[Martin_Raska]

TE - emulation takes time for any document you send to the user but TEX is on the fly, instant and the user gets information whatever it is. Doesn't matter what content it is, important is that it's safe and instant.

[the_rock]

Personally, I would think that in this instance, it would be worth thinking about using actual dedicated TE appliance, specifically for this purpose.

[PhoneBoy]

Whatever security controls you have in place, there is always the possibility of a false negative (i.e. something detected as "clean" that actually isn't).
If the email has an attachment and it's opened on the end user device, it can be game over.
Whether the attachment itself is actually useful or not is irrelevant.

Threat Extraction rewrites all document attachments in a manner that eliminates potentially malicious content.
It's very quick and ensures end users always receive safe content without waiting for Threat Emulation to render a verdict.
If it turns out the original document is needed, if Threat Emulation says the file is clean, end users can request it via a self-service portal.