Bitdefender GravityZone Security for Exchange Servers

What is included in Bitdefender GravityZone Security for Exchange Servers?

Exchange Protection module – Installs with Bitdefender Endpoint Security Tools on the mail server.
Antimalware scanning – Checks message bodies and attachments in the transport path.
Antispam and antiphishing – Multi-layer filters backed by the Bitdefender Global Protective Network.
Content and attachment filtering – Custom rules for subjects, bodies, file types and names.
Exchange quarantine – Blocked messages held centrally and released from Control Center.
Important – No coverage for Exchange Online or Microsoft 365 mailboxes.

What are the main benefits of Bitdefender GravityZone Security for Exchange Servers?

Bitdefender GravityZone Security for Exchange Servers is an email security module for on-premises Microsoft Exchange, delivered through the Bitdefender Endpoint Security Tools agent installed on the mail server itself. Policies, quarantine and reporting run in GravityZone Control Center, the same console used for endpoint protection.

No mail rerouting – Filtering happens on the server, MX records stay unchanged.
Internal mail scanned – Catches threats sent between your own internal mailboxes.
Information Store scans – On-demand scanning of the Exchange mailbox databases.
DAG compatible – Works on Database Availability Group members without extra components.
Single console – Mail and endpoint events land in one report set.
Conflict handling – The built-in Exchange antimalware agent is disabled automatically.

Best antivirus? Why Windows Defender alone is not enough
Explains where the protection built into Microsoft products stops and what a dedicated security product adds on top of it.

Which company size is Bitdefender GravityZone Security for Exchange Servers suitable for?

The deciding factor is not headcount but architecture: this product is only relevant if you still run Microsoft Exchange on your own servers. A company of any size that has moved its mailboxes to Microsoft 365 gets nothing from it.

Does Bitdefender GravityZone Security for Exchange Servers meet the requirements of Swiss cybersecurity legislation?

Since 1 April 2025 the revised Information Security Act obliges operators of critical infrastructure in Switzerland, such as energy and drinking water suppliers, transport companies, data centres and cantonal and municipal administrations, to report cyberattacks, while most ordinary companies below the size and sector thresholds are not affected. Organisations in scope must submit an initial report to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering the attack, and have 14 days to complete it. For the mail side of such a report, Exchange Protection is useful because every detection, quarantined message and policy change is recorded in GravityZone Control Center, so you can answer when a malicious message arrived, which mailboxes received it and what action was taken, instead of reconstructing this from raw Exchange transport logs under time pressure. What it does not do is equally clear: it sees nothing outside the Exchange transport path, it has no incident case management, it does not notify BACS for you, and it provides no evidence about endpoints, accounts or cloud mailboxes unless separate GravityZone components are licensed. This text is not legal advice, and whether your organisation falls under the reporting obligation should be clarified with your own legal counsel.

Does Bitdefender GravityZone Security for Exchange Servers meet the requirements of European cybersecurity legislation?

No product creates NIS 2 compliance, because the directive places obligations on the organisation and its management, not on a piece of software. NIS 2 requires risk management measures across categories such as incident handling, business continuity and backup, supply chain security, security in the acquisition and maintenance of network and information systems, policies on the use of cryptography, and multi-factor authentication. Security for Exchange Servers contributes to two of these in a concrete way: it is a technical control on the mail path, and its quarantine and event records feed the incident handling process with evidence about email-borne attacks. It contributes nothing to business continuity and backup, nothing to supply chain security, nothing to cryptography or multi-factor authentication, and it does not cover cloud mailboxes at all. Organisations in scope will therefore need to combine it with endpoint protection, a tested backup, identity controls and a documented incident process to address the remaining measure categories.

Does Bitdefender GravityZone Security for Exchange Servers help with security questionnaires from large customers?

Yes, but only for the email section, which is typically a handful of items out of a hundred. It lets you answer that inbound and outbound mail is scanned for malware, spam and phishing; that filtering happens on the mail server itself through Exchange transport agents rather than at a third-party service; that blocked messages go to a central quarantine with a controlled release process; that policies are managed centrally with role-based console access; and that threat activity on the mail path can be exported as a report covering a defined period. It will not answer the items that carry the most weight in a supplier assessment: endpoint protection and detection and response, patch management and evidence of patch levels, disk encryption, multi-factor authentication and identity management, backup and restore testing, data classification, and protection of any mailboxes that already live in Microsoft 365. To close those gaps, moving up within the same family is usually cheaper and less work than mixing vendors, because everything stays in one console and one reporting set: GravityZone Business Security Premium or Business Security Enterprise cover endpoint protection and detection, and Bitdefender offers patch management and full disk encryption as add-ons to those packages.

Planning Office 2024 Backups for Businesses the Right Way
Covers how to back up files, Outlook PST archives, templates and the Windows system, which is the gap an email filter alone does not close.

What is the difference between GravityZone Security for Exchange Servers and GravityZone Extended Email Security?

The decisive difference is where the filtering happens and which mail platform it can protect. Security for Exchange Servers runs as a module of the Bitdefender agent on your own Exchange server and inspects mail inside the transport path, so it also sees internal traffic and needs no change to mail routing. Extended Email Security is Bitdefender's separate email platform for Microsoft 365 and Google Workspace, deployed either as a gateway in front of the mail flow or through an API-based integration, and it can also sit in front of an on-premises or hybrid Exchange environment. If your buyers still search for GravityZone Security for Email, that is the older platform that Extended Email Security replaced. Choose by architecture, not by feature list: mailboxes on your own Exchange server point to this product, mailboxes in the cloud point to Extended Email Security.

Which limitations should you know before buying?

The most important one is platform scope: this product protects Microsoft Exchange running on your own servers and does nothing for mailboxes that have already moved to Exchange Online, so a hybrid environment is only half covered and the cloud side needs a separate Bitdefender product. It is a mail-path control and nothing more, which means no endpoint detection and response, no patch management, no disk encryption and no mailbox backup, so a mailbox that is compromised through a stolen password rather than an attachment is outside its reach entirely. It also requires GravityZone Control Center to be in place before the module can be deployed, and if you are not already a GravityZone customer that console has to be set up first, either as the Bitdefender-hosted cloud service or as an on-premises virtual appliance, the latter being the relevant option when management data has to stay in your own datacentre. The most common follow-up purchase is therefore not more email security but the endpoint side of the same platform, because auditors and large customers ask about endpoints long before they ask about mail filtering.

Windows Server 2025 vs. 2022 vs. 2019: Is It Worth Upgrading?
Useful if your Exchange server is running on an older Windows Server release and you need to plan the underlying platform before the security layer.

Frequently asked questions about Bitdefender GravityZone Security for Exchange Servers

Which Exchange versions and server roles are supported?

Bitdefender supports Exchange Server 2019, 2016 and 2013, in each case with the Edge Transport or the Mailbox role, and only the features compatible with the detected role are installed. Deployment is also compatible with Database Availability Groups, so members of a DAG do not need a separate approach. Exchange Server 2010 was dropped from Exchange Protection on 30 April 2026 and is no longer supported.

Where do blocked emails go and who can release them?

Messages stopped by the antimalware, antispam or content filters are held in the Exchange quarantine and are visible on the quarantine page of GravityZone Control Center. An administrator can restore a message to the original recipient or release it, and because console access is role-based you can decide who is allowed to do that. This matters in practice because false positives on business mail need a fast, auditable release path rather than a support ticket to the mail administrator.

Does it also scan mail sent between internal colleagues?

Yes. Bitdefender states that the product secures the entire Exchange environment, including user, room, equipment and shared mailboxes, against both external and internal threats. This is the practical advantage over a pure perimeter gateway, which only inspects mail crossing the network boundary and never sees a malicious attachment forwarded from one internal mailbox to another after an account has been taken over.