All incoming emails are checked and buffered before they are delivered to the actual mail server of your company. Unsolicited and infected emails are then hold in quarantine for each user in a user-specific quarantine folder. There they can be checked and classified manually. Manual classification improves the performance of the filter and is used to re-transmit false positives.

All good emails (ham) are delivered to the actual mail server prompt and without any delay. Additionally they are buffered for a certian amount of time on the Gibraltar Mailguard. Thus it is possible to manually re-classifiy also those emails which have not be identified correctly. Nevertheless, user interaction is typically not necessary because Gibraltar Mailguard is able to improve the efficiency of the filter self-dependent.