| name | implementing-mimecast-targeted-attack-protection |
| description | Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect to defend against advanced phishing and spearphishing attacks. Use when deploying mimecast targeted threat protection including url protect, attachment protect,. |
| domain | cybersecurity |
| subdomain | phishing-defense |
| tags | ["mimecast","email-security","targeted-threat-protection","url-protect","impersonation","attachment-sandboxing","phishing"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"] |
Implementing Mimecast Targeted Attack Protection
Overview
Mimecast Targeted Threat Protection (TTP) is a suite of advanced email security services designed to protect against sophisticated phishing, spearphishing, and targeted attacks. TTP consists of four core modules: URL Protect (real-time URL rewriting and click-time analysis), Attachment Protect (sandbox detonation of suspicious attachments), Impersonation Protect (BEC and whaling detection), and Internal Email Protect (scanning internal/outbound email for threats). As of November 2025, Mimecast enabled URL Pre-Delivery Action with Hold setting for all customers by default.
When to Use
Trigger phrases:
-
"implementing mimecast targeted attack protection"
-
"Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment Pro"
-
When deploying or configuring implementing mimecast targeted attack protection capabilities in your environment
-
When establishing security controls aligned to compliance requirements
-
When building or improving security architecture for this domain
-
When conducting security assessments that require this implementation
Prerequisites
- Mimecast Email Security license with TTP add-on
- Administrative access to Mimecast Administration Console
- Microsoft 365 or Google Workspace environment
- MX records configured to route through Mimecast
- Understanding of email authentication (SPF, DKIM, DMARC)
Key Concepts
This section covers key concepts for implementing mimecast targeted attack protection.
- Ensure all prerequisites are met before proceeding
- Follow the documented workflow steps in sequence
- Record results and any anomalies encountered during this phase
TTP Module Overview
| Module | Function | Key Capability |
|---|
| URL Protect | Rewrites and scans URLs at click time | Real-time sandbox, pre-delivery hold |
| Attachment Protect | Sandboxes suspicious attachments | Static + dynamic analysis |
| Impersonation Protect | Detects BEC/whaling attacks | VIP name matching, header analysis |
| Internal Email Protect | Scans internal/outbound email | Lateral phishing detection |
Impersonation Protection Scenarios
