Overview

Mimecast Targeted Threat Protection (TTP) is a suite of advanced email security services designed to protect against sophisticated phishing, spearphishing, and targeted attacks. TTP consists of four core modules: URL Protect (real-time URL rewriting and click-time analysis), Attachment Protect (sandbox detonation of suspicious attachments), Impersonation Protect (BEC and whaling detection), and Internal Email Protect (scanning internal/outbound email for threats). As of November 2025, Mimecast enabled URL Pre-Delivery Action with Hold setting for all customers by default.

When to Use

When deploying or configuring implementing mimecast targeted attack protection capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Mimecast Email Security license with TTP add-on
Administrative access to Mimecast Administration Console

Overview

When to Use

When deploying or configuring implementing mimecast targeted attack protection capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Mimecast Email Security license with TTP add-on
Administrative access to Mimecast Administration Console

Module	Function	Key Capability
URL Protect	Rewrites and scans URLs at click time	Real-time sandbox, pre-delivery hold
Attachment Protect	Sandboxes suspicious attachments	Static + dynamic analysis
Impersonation Protect	Detects BEC/whaling attacks	VIP name matching, header analysis
Internal Email Protect	Scans internal/outbound email	Lateral phishing detection

Implementing Mimecast Targeted Attack Protection

Overview

When to Use

Prerequisites

Implementing Mimecast Targeted Attack Protection

Overview

When to Use

Prerequisites

Key Concepts

TTP Module Overview

Impersonation Protection Scenarios

URL Protect Modes

Workflow

Step 1: Configure URL Protect Policy

Step 2: Configure Attachment Protect Policy

Step 3: Configure Impersonation Protect

Step 4: Enable Internal Email Protect

Step 5: Create Test Group and Validate

Step 6: Deploy Organization-Wide and Tune

Tools & Resources

Validation

1password

Springboot Security

Security Review

Laravel Security

Security Review

Django Security