SEGs use a combination of techniques such as content filtering, URL scanning, and attachment sandboxing to analyze incoming and outgoing emails. Advanced SEGs also incorporate machine learning and artificial intelligence to adapt to new threats. They typically operate at the SMTP level, intercepting emails before they reach the user's inbox.