Does CES protect against account takeover?

Yes. CES watches identity signals and unusual sender behaviour, so a hijacked internal mailbox firing out fake invoices or odd requests gets caught, even though the email comes from a real account.