Email security platforms compared

How to read this comparison

Every vendor claims to catch more threats than the next, and independent tests rarely match how your own mail flows. We do not publish rankings, ratings or catch rates. Instead, this page compares the things you can check before you buy and that decide whether a product suits you:

• How it connects: by API inside the tenant (integrated cloud email security), as a secure email gateway that your MX records point at, or both
• Which mail platforms it protects: Microsoft 365, Google Workspace, on-premises Exchange or other mail servers
• What else it covers: Teams, SharePoint, OneDrive, Google Drive, Slack and file-sharing apps
• Extras that change the shortlist: encryption, email DLP, DMARC management, continuity and archiving
• What the vendor includes: some vendors include or sell an incident response service; others leave triage to you
• Where it is managed: a console you already use for endpoint or backup is a real saving in time

Facts come from each vendor's own current material. Where a vendor does not publish something, we say it is confirmed at quote rather than guess. If you are still deciding between the two architectures, read ICES vs SEG first.

Email security platforms side by side

The first table covers how each platform connects and which mail systems it protects.

"Confirmed at quote" means the vendor does not publish it clearly enough for us to state it here; we check it against your set-up before you commit.

Extras compared: collaboration, encryption, DLP and DMARC

The second table covers the extras that most often decide a shortlist. A dash means the feature is not part of that product as the vendor describes it; most gaps can be filled by another product on this page.

Continuity and archiving are another split: Proofpoint Essentials includes continuity and a long-term archive in its higher packages, Trend Micro's gateway adds continuity in Essentials and Pro, and Check Point sells archiving as an add-on. API-only products rely on Microsoft or Google staying up. For the outbound side, see email DLP and send secure email; for your own domain, email authentication.

Platforms that protect Google Workspace (Gmail)

Google Workspace is often an afterthought in email security comparisons, but plenty of UK organisations run on Gmail. Gmail's own filtering and the settings in our Gmail security settings guide come first; then these are the layers we supply that support it:

Gateways in front of Gmail need Google's inbound gateway setting configured so that Gmail reads the real sender IP and can reject mail that did not come through the gateway. Our Google Workspace email security hub covers what Gmail includes edition by edition.

Choosing by what you already run

The best platform is often the one that fits the tools you already manage. A few patterns we see:

• Microsoft 365 with Business Premium or E3: configure Microsoft Defender for Office 365 properly first, then add an API layer such as Check Point, IRONSCALES or Vade if you are targeted by impersonation and invoice fraud
• Already on Acronis backup: Acronis Email Security adds Perception Point-powered filtering in the same console, or as part of Acronis Protected 365
• Bitdefender, ThreatDown or Trend Micro on your endpoints: each has an email product managed in the same console as the endpoint agent, which keeps alerts in one place
• Sophos Central users: Sophos Email sits beside Sophos endpoint and firewall, with DMARC Manager in Email Plus
• Google Workspace, or both platforms: pick a product that protects both, such as Check Point, IRONSCALES, FortiMail Workspace Security or Trend Micro
• On-premises or hybrid mail, or a need for continuity: a gateway such as Proofpoint Essentials, Symantec Email Security.cloud or Trend Micro's Cloud Email Gateway Protection
• Sending personal or financial data by email: add Echoworx or a platform with built-in encryption

For head-to-head detail on popular pairings, read IRONSCALES vs Proofpoint and IRONSCALES vs Avanan. Small firms should start with our email security for small business guide.

Questions to ask any email security vendor

Use these questions in any trial or demo. They expose the differences that marketing pages tend to blur:

1. Does it inspect mail before it reaches the inbox, or only remove it afterwards? Can I choose per policy?
2. Does it scan internal mail between my own users, and outbound mail?
3. Can it remove a message from every mailbox after delivery, automatically or with one click?
4. Which collaboration apps does it cover, and are they included or extra?
5. How does it detect payload-free business email compromise and supplier impersonation?
6. What happens to mail flow if the service has an outage?
7. Who triages user-reported messages and quarantine release requests: me, my IT provider or the vendor?
8. How are users counted: per user, per mailbox, shared mailboxes, leavers?
9. Where is my data processed and stored?

A short trial in monitor or detection mode, where the product reports what it would have caught without acting, is the most useful evidence you can collect. Check Point Email Security and Bitdefender Extended Email Security both describe a monitor mode; for other products we check what trial options the vendor offers.

How we help you choose and deploy

Because we supply several platforms, we can recommend the one that fits your mail platform, budget and existing tools rather than the only one we sell. We can:

• Review what Microsoft 365 or Google Workspace already gives you and how it is configured
• Shortlist two or three platforms against your requirements and arrange trials
• Deploy and tune the chosen product, including gateway lock-down where needed
• Check SPF, DKIM and DMARC for your domains while we are in the DNS
• Supply the licences alongside your other subscriptions and adjust them as staff join and leave

Pricing depends on the product, package and user numbers, so ask us for a quote. Contact us for an impartial recommendation.