What is meant by "Freezing"?

"Freezing" refers to the temporary holding of suspicious emails for a few minutes. This provides the filtering systems with a larger time window to perform a renewed scan with updated signatures and fingerprints after the freezing period ends.

What does ATP Freezing do?

ATP Freezing is a protective feature within Hornetsecurity Advanced Threat Protection that initially "freezes" incoming emails with potentially dangerous content and moves them to a quarantine area. Emails are not immediately forwarded to the user but first undergo a comprehensive analysis using various engines, such as sandboxing or AI-based link checking.

Frozen emails can be subjected to a detailed analysis within the sandbox within a few minutes and assigned an MD5 checksum, which can then be compared with other "frozen" emails of the same type.

During this time, access to the message is blocked for the recipient, so there is no risk from unknown or novel malware. Only when the analysis is complete and no risk is detected is the email released and delivered; if malware is actually found, the message remains blocked. The freezing process runs completely in the background for the user – they may only notice a delay in delivery. This method reliably protects companies from targeted attacks such as ransomware or sophisticated phishing campaigns, even when conventional antivirus scanners have not yet detected a threat.