What is a limitation of using Cisco CES to protect users from email threats on corporate devices?

Cisco CES is not in the data path of personal email, so it cannot protect against threats from personal email even on corporate devices.

The client connector for Cisco CES must be used to redirect personal email to cloud$-$based security filters before delivering email on corporate$-$owned mobile endpoints.

Cisco CES cannot protect corporate email on personal, or BYOD, endpoints.

The Umbrella Roaming client must be used to intercept inbound email on personal mobile devices, and scan those emails according to the organization$$s shared CES policy.

Cisco CES supports auto$-$remediation using API with multiple email providers such as G$-$Mail to protect against malicious files, even after it has reached a user$$s mailbox.