If you simply need file-level AV, use solutions like SentinelOne, CrowdStrike Falcon, or Microsoft Defender for Endpoint (configured with Exchange exclusions). They do not provide spam filtering but will catch malware at the file system.

| Integration Type | How it works | |----------------|---------------| | Transport Agent (most common) | Inline scanning on Exchange Edge or Hub Transport servers before mailbox delivery. | | VSAPI (Virus Scanning API) | Native Exchange 2016/2019 API – works with mailbox store, journaling, and public folders. | | SMTP Gateway mode | Separate server running SMSMSE acting as SMTP forwarder. | | Cluster-aware | Supports DAG (Database Availability Group) and failover clusters. |

Warning: Installing unsupported security software on a production Exchange server is risky. Perform a full backup of Exchange and the System State first.

Symantec recognized that the future of email security does not reside on the mail server itself, but in the cloud. The direct successor to the on-premises Exchange software is Symantec Cloud Secure Web Gateway (Cloud SWG), formerly known as MessageLabs.

Cloud SWG offers several advantages over the legacy Exchange product: