implementing-mimecast-targeted-attack-protection

name	implementing-mimecast-targeted-attack-protection
description	Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment Protect, Impersonation Protect, and Internal Email Protect to defend against advanced phishing and spearphishing attacks. Use when deploying mimecast targeted threat protection including url protect, attachment protect,.
domain	cybersecurity
subdomain	phishing-defense
tags	["mimecast","email-security","targeted-threat-protection","url-protect","impersonation","attachment-sandboxing","phishing"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"]

Implementing Mimecast Targeted Attack Protection

Overview

Mimecast Targeted Threat Protection (TTP) is a suite of advanced email security services designed to protect against sophisticated phishing, spearphishing, and targeted attacks. TTP consists of four core modules: URL Protect (real-time URL rewriting and click-time analysis), Attachment Protect (sandbox detonation of suspicious attachments), Impersonation Protect (BEC and whaling detection), and Internal Email Protect (scanning internal/outbound email for threats). As of November 2025, Mimecast enabled URL Pre-Delivery Action with Hold setting for all customers by default.

When to Use

Trigger phrases:

• "implementing mimecast targeted attack protection"

• "Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment Pro"

• When deploying or configuring implementing mimecast targeted attack protection capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Mimecast Email Security license with TTP add-on
• Administrative access to Mimecast Administration Console
• Microsoft 365 or Google Workspace environment
• MX records configured to route through Mimecast
• Understanding of email authentication (SPF, DKIM, DMARC)

Key Concepts

This section covers key concepts for implementing mimecast targeted attack protection.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

TTP Module Overview

Module	Function	Key Capability
URL Protect	Rewrites and scans URLs at click time	Real-time sandbox, pre-delivery hold
Attachment Protect	Sandboxes suspicious attachments	Static + dynamic analysis
Impersonation Protect	Detects BEC/whaling attacks	VIP name matching, header analysis
Internal Email Protect	Scans internal/outbound email	Lateral phishing detection

Impersonation Protection Scenarios