Email security for business, compared

Why business email needs more than a spam filter

Email reaches every member of staff directly, which is why criminals use it so often to get into an organisation. The attacks that cause real losses are rarely the obvious ones a basic spam filter was built for:

• Credential phishing: links to fake Microsoft or Google sign-in pages, often hidden behind file-sharing links, QR codes or legitimate hosting services
• Business email compromise: payload-free messages that impersonate a director, supplier or solicitor to redirect a payment, covered in our guide to the BEC attack
• Invoice fraud: genuine-looking invoices or "our bank details have changed" emails, see invoice fraud
• Account takeover: a real mailbox signed in to by an attacker and used to phish colleagues and customers, see email account takeover
• Malware and ransomware: attachments and links built to evade signature scanning, see ransomware email
• Spoofing and impersonation: mail that pretends to come from your own domain or a lookalike, see email spoofing

No single product catches everything, so good protection layers prevention, fast removal of anything that gets through, protection for the identities behind each mailbox and staff who know how to report what looks wrong. Our advanced email threat protection hub maps each threat to the control that stops it. For the wider background, read our sister site's email security guide.

What Microsoft 365 and Google Workspace already include

Before buying anything, it is worth knowing what you already pay for.

Microsoft 365. Every cloud mailbox gets Microsoft's built-in protection, long known as Exchange Online Protection: anti-malware, anti-spam, spoof protection, quarantine and zero-hour auto purge. Microsoft Defender for Office 365 Plan 1 adds Safe Links, Safe Attachments and impersonation protection, and Microsoft includes it in subscriptions such as Microsoft 365 Business Premium and Microsoft 365 E3. Plan 2, in subscriptions such as Microsoft 365 E5, adds Threat Explorer, automated investigation and response and attack simulation. Our Microsoft 365 phishing protection guide covers the anti-phishing policies, and our sister site explains Microsoft Defender for Office 365 plan by plan.

Google Workspace. Gmail filters spam, phishing and malware for every edition, and administrators can switch on advanced phishing and malware protection for attachments, links and external images, and spoofing and authentication. Google's Security Sandbox, which opens attachments in a virtual environment to look for malicious behaviour, is supported in Business Standard, Business Plus, Enterprise Standard, Enterprise Plus and Frontline Plus. Our Google Workspace email security hub and the admin walk-through of Gmail security settings cover what to turn on.

For many organisations the best first step is configuring these properly. A third-party layer earns its place when you are targeted by invoice fraud and impersonation, run Google Workspace alongside Microsoft 365, share files through Slack or other collaboration apps, or want encryption, continuity or archiving from one supplier.

Two architectures: ICES and secure email gateways

Third-party email security connects in one of two ways, and the difference matters more than any single feature.

Read the explainers on integrated cloud email security and the secure email gateway, or go straight to ICES vs SEG for the side-by-side decision. Several vendors now offer both, and some organisations run one of each.

Email security platforms we supply

We supply a range of email security platforms, so we can recommend what fits your mail platform and what you already own rather than one product for everyone. They are described factually from each vendor's own material; we do not publish rankings or catch rates.

The full comparison, with collaboration app coverage, encryption, DLP and DMARC options, is on email security platforms compared. Two common head-to-heads have their own pages: IRONSCALES vs Proofpoint and IRONSCALES vs Avanan.

Protecting your domain and the data you send

Inbound filtering protects your staff from other people's mail. Three outbound controls protect your customers, your reputation and the personal data you hold:

• Email authentication: SPF, DKIM and DMARC stop criminals sending as your domain, and MTA-STS enforces encrypted delivery to it. Start with our email authentication hub, and see DMARC on our sister site
• Sender requirements: Gmail, Outlook.com and Yahoo now expect authenticated mail from organisations that send in volume, explained in our guide to the Google bulk sender guidelines
• Encryption: UK GDPR requires appropriate security for personal data, which often means encrypting what you email outside the organisation. See how to send secure email, including from Gmail
• Email DLP: rules that catch sensitive data and misdirected messages before they leave, and can trigger encryption automatically. See email DLP

The NCSC retired its free Mail Check service on 31 March 2026, so organisations that relied on it for DMARC reports now need their own reporting tool. Several of the platforms above include one, and Valimail specialises in it.

How to choose

These questions narrow the field quickly:

1. Which mail platform are you on: Microsoft 365, Google Workspace, both, or a server of your own?
2. What does your current licence already include, and is it configured well?
3. Do you need continuity, archiving or encryption from the same product, or are those covered elsewhere?
4. Do attacks reach you through Teams, Slack or shared files as well as email?
5. Do you already use Acronis, Bitdefender, Sophos, ThreatDown or Trend Micro elsewhere, so email could sit in the same console?
6. Who will look at alerts and user-reported phishing: your team, an IT provider or a vendor service?
7. Can the product run in a monitoring mode first, so you see what it would catch from your own mail?

The answers usually point to one architecture, then to two or three products worth trialling side by side.

How we help

We are vendor-independent and supply the platforms on this page, so we can compare them on your own mail rather than on a datasheet, whether you run Microsoft 365, Google Workspace or both. We can:

• Review your mail flow, Microsoft 365 or Google Workspace settings and SPF, DKIM and DMARC records
• Recommend whether configuration alone, an API layer, a gateway or a combination fits your risks
• Run a trial of an extra layer in monitoring mode alongside your existing protection, where the product supports it
• Deploy, tune and license the option you choose, with licence counts and package contents confirmed at quote

Pricing depends on the product, the package and the number of users, mailboxes or domains, so ask us for a quote. Contact us to talk through your email security.