How does CES differ from a traditional secure email gateway?

Old-style gateways work off signatures, sender reputation and blocklists. CES looks at behaviour, wording, intent and identity, so it can flag a message that reads as legitimate but shows the fingerprints of social engineering or a hijacked account.