A spam email did not trigger any detection on the Anti Spam scanners and was delivered to the users mailbox. The same email was later classified as spam when checked under the Spam Analysis Tool.

Symantec Anti Spam scanners are dynamic in nature and are updated regularly as per requirements of the threat landscape. New detection are added and obsolete detection may be removed as per requirements. Such updates may need propagation to take effect and there may be a small number of instances where some emails may be missed by the scanners while detection is either being created or is  propagating to take effect.

The same email when checked on the Spam Analysis Tool in the Email.Cloud portal, should now be classified as spam. This is a confirmation that the scanners have detection for the uploaded sample and the message will be flagged. Since the scanners already have detection available, the sample would not be accepted for investigation for false negative (missed spam) and no further action is required.