Vaikora › Blog › Product Updates

How Cyren email security works inside Microsoft 365 without an MX record change

Product Updates · Nov 9, 2026 · 4 min read

Most Microsoft 365 email security deployments require a routing change. You update your MX record to point mail through a third-party gateway, the gateway inspects traffic, then delivers clean mail onward. That approach adds latency, creates a new dependency in the delivery path, and requires coordination with DNS and mail administrators before you see any protection. Cyren's integration with Microsoft 365 skips that step entirely.

How the connection works

Cyren connects to Microsoft 365 through Microsoft Graph. No MX record change. No routing detour. Mail arrives at Microsoft's servers as it always has, and Cyren reads and acts on it through the Graph API, running analysis in a virtual machine inside the customer's own Azure subscription. That placement matters: the analysis environment is yours, the telemetry stays in your tenant, and results feed into your own Sentinel workspace.

The practical effect is that you can deploy Cyren without touching DNS, without coordinating a cutover window, and without introducing a new delivery hop that could affect deliverability metrics or create a failover gap.

What Cyren is actually inspecting

Cyren's detection runs on the GlobalView telemetry network, which processes over a billion email, URL, and file transactions a day. That volume produces signal about phishing infrastructure and malicious URLs during staging, before campaigns are actively weaponized. By the time a lure lands in a mailbox, Cyren has often already seen the infrastructure it references.

What that means operationally: a URL in a received message can be matched against known-malicious infrastructure that Cyren observed days earlier during campaign setup. The detection is not purely reactive to the content of the message itself.

Inspection covers:

• URLs embedded in message body and attachments
• File reputation for attachments, checked against GlobalView telemetry
• Phishing indicators including spoofed sender domains, header anomalies, and credential-harvesting page patterns
• Malicious infrastructure associations, including domains and IPs seen during pre-campaign staging

What your SOC sees in Sentinel

Cyren ships as a packaged solution through the Microsoft Sentinel Content Hub. The package includes the CCF connector, analytic rules, hunting queries, and workbooks. After installation, threat data from Cyren flows directly into Sentinel without custom pipeline work.

That means analysts get structured, queryable telemetry in the same workspace they use for everything else. Hunting queries let you pivot from an indicator seen in email to other activity in your environment. The workbooks surface volume, detection trends, and indicator breakdowns without requiring a separate dashboard product.

Indicators also push into CrowdStrike Falcon and SentinelOne, so a URL or file hash identified in email can automatically propagate to endpoint controls. If a user clicks a link on a managed device, the endpoint layer already knows about that indicator before the click resolves.

A concrete scenario

A finance team member receives a message with a PDF attachment. The PDF contains a URL pointing to a credential-harvesting page. The sending domain was registered four days earlier and Cyren observed it during infrastructure setup before any mail was sent.

By the time the message arrives in Microsoft 365, Cyren has already flagged the domain. Graph API access lets Cyren act on the message without MX routing. The URL is flagged in Sentinel, an analytic rule fires an alert, and the indicator propagates to SentinelOne on the user's endpoint. If the user opens the PDF and attempts to follow the link, endpoint enforcement has the domain on its block list.

The sequence runs without manual analyst intervention between detection and enforcement.

Vaikora's role if AI agents touch email

If your environment includes AI agents that read, summarize, or act on email (through tools like Microsoft Graph or an MCP server), Cyren's detection feeds into a different risk surface. An agent that ingests a message containing a malicious URL or prompt injection payload is a different kind of exposure than a human clicking a link.

Vaikora sits inline between AI agents and the tools or LLMs they call, enforcing an allow, block, modify, or require-approval decision before each action runs. Email content flagged by Cyren can inform Vaikora policy, so an agent attempting to fetch or act on a URL identified as malicious infrastructure hits an enforcement decision before the action executes.

What to check next

If you are running Microsoft 365 and want to understand your current coverage, start by confirming whether your existing email security solution requires MX routing and whether its indicators flow into your Sentinel workspace in a queryable form. Check whether detections propagate automatically to your endpoint controls or require manual export steps. The Cyren solution in the Sentinel Content Hub is a concrete reference point for what a fully integrated deployment looks like.

More from the Vaikora blog