How It Works

This system has two key components working together. First, a gateway computer system receives incoming electronic messages from a sender’s message system before they enter the recipient’s network perimeter. The gateway analyzes each message according to a set of warning criteria and modifies it—inserting management information, warnings, and triggers into the message content.

Second, a gatekeeper service running within the recipient’s environment receives the modified message, extracts the embedded trigger, and performs one or more actions based on what the trigger specifies. This two-stage architecture means the gateway can make intelligent decisions about message handling while the gatekeeper enforces those decisions inside the recipient’s network.

Available actions include delivering the message with inserted warnings, holding it in quarantine with notification to administrators, or routing it through additional security workflows.

What Makes It Different

• Two-stage architecture: a gateway outside the perimeter modifies messages, and a gatekeeper inside the perimeter acts on embedded triggers, enabling cross-organizational security enforcement.
• Pre-perimeter analysis: messages are analyzed and modified before they enter the recipient’s network, not after.
• Trigger-based actions: the gateway embeds triggers in modified messages that the gatekeeper extracts and acts upon, enabling sophisticated workflows.
• Message modification: inserts contextual warnings, security notices, and management information directly into email content while maintaining deliverability.

Why It Matters

Users are the last line of defense in email security, but they need context to make good decisions. This two-component system gives them that context—an external gateway adds intelligence to messages and an internal gatekeeper enforces it. The result is warning labels on suspicious emails, quarantine holds on risky content, and trigger-based actions that adapt to each message’s risk profile.

It’s the architecture that lets Shield operate across organizational boundaries, modifying and managing messages before they ever reach the inbox.