Question 1

How is this different from Microsoft Defender or our existing email filter?

Accepted Answer

Email filters and Defender work at delivery. They block emails they recognise as malicious based on known signatures. CyberCheck360 works at the click, the actual moment of risk. When a phishing link gets past your filter, and statistically some will, we isolate it in a remote cloud browser before anything reaches your device or network. We are post-delivery link protection, not a replacement for your email gateway.

Question 2

What happens when an employee clicks a phishing link?

Accepted Answer

Without link isolation, clicking a phishing link can execute malware on the device within seconds, harvest credentials from a fake login page, or give attackers a foothold into your network. With CyberCheck360, the link opens in our isolated cloud browser instead of the device. Whatever the site does, it happens in the cloud. The employee sees a block page and the device stays completely clean.

Question 3

Do email filters stop all phishing attacks?

Accepted Answer

No. Even the best email filters let through 1 to 5 percent of phishing attempts, because they rely on known signatures and reputation data. Polymorphic phishing links change their payload after delivery, so they appear clean at the time of scanning. Zero-day threats have no reputation at all. CyberCheck360 protects against what the filter misses by isolating every link at the moment of the click, not just at delivery.

Question 4

What is browser isolation and how does it work for email links?

Accepted Answer

Browser isolation runs the web content of a link in a remote cloud environment instead of on the user's device. The user sees and interacts with the page normally, but the actual code, scripts and files execute in our cloud. If the destination is malicious, the threat is fully contained. Nothing from the page can reach the device or the network. CyberCheck360 applies this specifically to email links, making it the most targeted and efficient form of protection for the highest-risk click in any organisation.

Question 5

Do users have to change how they work?

Accepted Answer

No. With Link Rewriting enabled, protection is completely invisible to users. They click email links exactly as they always have. Every click is automatically routed through our isolated cloud browser in the background. There is nothing to install on individual machines, no new interface to learn, and no behaviour change required from anyone in your organisation.

Question 6

What is the difference between the on-demand sandbox and Link Rewriting?

Accepted Answer

The on-demand sandbox is for deliberate checking. Your security team or IT staff paste a suspicious link or upload a file to investigate it before deciding what to do. Link Rewriting is automatic zero-trust protection for your whole organisation: every email link is rewritten at delivery so every click by every user is isolated automatically, with no action required. Most organisations start with the sandbox to experience isolation, then add Link Rewriting for full coverage.

Question 7

Can a user open a link in their local browser if they trust the sender?

Accepted Answer

Yes. When a user clicks a rewritten link, they see the destination URL, the domain age, and the safety verdict. If they recognise and trust the sender, they can raise a request to open the link locally. That request goes to the admin dashboard for approval. This keeps your security team in control without blocking users from doing their jobs.

Question 8

How long does deployment take?

Accepted Answer

The Outlook and Gmail add-ins deploy in minutes via your admin console with no changes to individual machines. Link Rewriting can be enabled org-wide by a single admin from the same console. Most organisations are fully live the same day they sign up. There is no infrastructure to provision and no engineering resource required.

Question 9

We already pay for Mimecast or Proofpoint. Why do we need this?

Accepted Answer

Mimecast and Proofpoint are detection-based. They scan emails against known threats at delivery. CyberCheck360 is isolation-based: it protects your users at the click, regardless of whether the threat was known at delivery. The two approaches solve different problems and work together. When a phishing email gets through your gateway, CyberCheck360 is what stops the click from causing damage.

Question 10

Does CyberCheck360 work with zero-trust security frameworks?

Accepted Answer

Yes. Link Rewriting is a direct implementation of the zero-trust principle applied to email links: never trust a link, always verify and isolate. Every link is treated as potentially malicious regardless of sender reputation or prior safe status. This aligns directly with NIST zero-trust architecture and is a natural fit for organisations adopting a zero-trust security model.

Question 11

Is this suitable for organisations without a dedicated security team?

Accepted Answer

Yes, this is exactly who we built it for. You do not need a SOC, a threat analyst, or a dedicated security engineer to run CyberCheck360. The sandbox gives your IT manager the ability to investigate suspicious links on demand. Link Rewriting protects every user automatically without anyone having to do anything. The admin dashboard gives visibility without requiring expertise to interpret it.

Question 12

Our security team needs a sandbox only, without the Outlook add-in.

Accepted Answer

We offer private managed sandbox environments for SOC teams and MSSPs who need link and file isolation at volume without the end-user email add-in experience. This is a custom arrangement, so reach out to our team and we will put together the right setup for your use case.

Feature	Essentials	InvestigatorBeta December 2026
Sessions per analyst / month	200	200
Session duration	10 min	Extendable to 30 min*
Minimum analyst licences	1	3
Isolated URL sandbox
Isolated file sandbox
Screenshots during the session
Safe file downloads inside the sandbox
Report export from the session log
Session log retention	30 days	90 days
Indicator enrichment	–
Threat intelligence lookups	–
Browser location selection	–
Report builder for incident write-ups	–

Buy CyberCheck360 Sandbox for your team

Essentials

Investigator

Private by default

EU hosted

Nothing to install

More than 25 analysts, or running an MSSP?