An SEG inspects and filters email traffic for potentially malicious, dangerous, or inappropriate content. They do so using a combination of signature analysis — looking for known malware — and machine learning.
SEGs typically operate using one of two methods: DNS MX record or API integration.