In short
Vade for M365 is an API-based email security service for Microsoft 365. It analyses each email and the pages its links lead to, catches phishing, spear phishing and malware that Microsoft's filters miss, and removes threats from mailboxes after delivery. It needs no MX change, is licensed per user, and Vade is now part of Proofpoint.
Get a quote for Vade for M365
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What Vade for M365 is
Vade for M365 is an email security service built specifically for Microsoft 365. Rather than sitting in front of your mail as a gateway, it connects to your tenant through Microsoft's API, so there is no MX record change and mail continues to flow through Microsoft exactly as before. Vade's engine then examines messages after Microsoft's own protection has run, looking for the targeted phishing and impersonation that built-in filtering can let through.
Vade, formerly Vade Secure, is a French email security specialist that has been part of Proofpoint since December 2025. The product names Vade for M365 and Vade for Google Workspace are unchanged, and both are still listed on Vade's own site, vadesecure.com.
The approach is the integrated cloud email security model: inspect inside the tenant, use AI rather than signatures alone, and fix problems after delivery when a threat is only recognised later.
What Vade for M365 does
Vade lists these capabilities for Vade for M365:
- Anti-phishing: machine learning and computer vision analyse the behaviour, context and appearance of emails and web pages to identify fake sign-in pages and brand impersonation
- Anti-spear-phishing: anomaly detection and natural language processing look for impersonation attempts and the patterns of business email compromise, including messages with no link or attachment
- Anti-malware: predictive algorithms and heuristic analysis of behaviour and code catch malware and ransomware in email, attachments and hosted files
- Auto-remediation: Vade keeps scanning mailboxes and automatically removes messages later found to be malicious, even from inboxes
- Email incident response: triage and remediate active threats and user-reported emails from one console
- Contextual training: when a user interacts with a phishing email, they are shown short, relevant training at that moment
- Graymail classification: newsletters, social media and app notifications are sorted into separate folders to keep inboxes focused
- Splunk integration: email logs can be exported to Splunk without custom development
Vade describes its analysis as language-agnostic, which matters for UK organisations that deal with suppliers and customers abroad. Its feedback loop also learns from messages users report.
Vade for Google Workspace
Vade also lists Vade for Google Workspace, an email security product designed for Gmail. It applies the same AI detection with a few differences that suit Google's platform:
- Inline protection: Vade says it scans email before delivery, so threats are stopped before they reach users without disrupting normal mail flow
- Auto-remediation: it keeps scanning after delivery and removes newly identified threats from inboxes, and administrators can remediate with one click
- Spear-phishing detection: models designed to cut false positives on impersonation emails
- Graymail classification: low-priority mail sorted out of the main inbox
- Threat Intel and Investigation and Remote Browser Isolation: the same options as for Microsoft 365
If your organisation runs on Gmail, start with Google's own controls in our Gmail security settings guide, then compare Vade with the other options on our Google Workspace email security hub. The distributor catalogue we supply Vade from lists Vade for M365, so if you want Vade for Google Workspace, ask us and we will confirm whether we can supply it before you plan around it.
Options: Threat Intel and Investigation, and Remote Browser Isolation
The core service can be extended with two options, which we supply per user:
| Option | What it adds | Suits |
|---|---|---|
| Email Protection Service (core) | Anti-phishing, anti-spear-phishing, anti-malware, auto-remediation, incident response and graymail | Every customer |
| Threat Intel and Investigation | Triage and remediate user-reported emails, deconstruct files to collect forensic evidence safely, and send live logs to a SIEM, SOAR or XDR | Organisations with a security team, SIEM or IT provider that investigates incidents |
| Remote Browser Isolation | Opens links from email in an isolated browser session on a remote server rather than on the user's device, to contain zero-day attacks that start in email and play out in the browser | Finance, HR and customer service teams who must open links from outside senders all day |
Remote Browser Isolation is a useful answer to the hardest phishing cases: links to pages that look clean when scanned and turn malicious later. It complements, rather than replaces, phishing protection controls such as phishing-resistant MFA.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How Vade fits with Microsoft's own protection
Every Microsoft 365 mailbox already has Exchange Online Protection, and many plans include Defender for Office 365 Plan 1. Vade is designed to sit alongside them, not replace them:
- Microsoft's filtering runs first and removes bulk spam and known-bad mail.
- Vade analyses what remains, with its own AI models and threat intelligence.
- Messages Vade judges malicious are moved or removed; suspicious ones can carry a warning banner.
- Vade keeps re-checking delivered mail and removes anything later identified as a threat.
- Users report suspicious messages with Vade's Outlook add-in, and administrators triage them in one place.
Configure Microsoft's anti-phishing policies sensibly first; our Microsoft 365 phishing protection guide explains how. Running two engines means one occasionally catches what the other misses, which is the point of a second layer.
Vade for M365 vs Microsoft Defender for Office 365
Buyers often ask whether Vade replaces Microsoft's own advanced protection. It does not need to; the two overlap in places and differ in others:
| Microsoft Defender for Office 365 | Vade for M365 | |
|---|---|---|
| What it is | Microsoft's own advanced protection; Plan 1 comes with Business Premium and E3, Plan 2 with E5 | A third-party AI layer connected by API |
| Where it runs | Inside Microsoft's mail flow | After Microsoft's filtering, inside the tenant |
| Impersonation | Impersonation protection and mailbox intelligence (Plan 1) | Anti-spear-phishing with anomaly detection and natural language processing |
| Links | Safe Links (Plan 1) | Link and web page analysis; optional Remote Browser Isolation |
| After delivery | Zero-hour auto purge in every mailbox; automated investigation and response in Plan 2 | Auto-remediation that keeps re-scanning mailboxes |
| Bulk and low-priority mail | Bulk mail filtering by bulk complaint level | Graymail folders for newsletters, social media and app notifications |
| Google Workspace | No | Through Vade for Google Workspace |
Most organisations that buy Vade keep their Microsoft protection switched on and use Vade as a second opinion. Our sister site covers Microsoft Defender for Office 365 plan by plan, and our Microsoft 365 phishing protection guide shows the policies to set first.
Is Vade for M365 the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Vade for M365 is licensed
In the distributor catalogue we supply from, Vade for M365 is licensed per user, for each Microsoft 365 user whose mailbox you protect. Threat Intel and Investigation and Remote Browser Isolation are added per user on top of the core service. We confirm the billing term, renewal date and any minimum when we quote, and user numbers can be adjusted as your organisation changes.
Pricing depends on user numbers and options, so ask us for a quote. The commercial detail is on our licensing site's Vade for M365 licensing page.
Who it suits and the alternatives
Vade for M365 suits Microsoft 365 organisations that want stronger phishing and impersonation protection without rerouting mail through a gateway, and that want inboxes kept tidy with graymail sorting. It is particularly practical for small IT teams, because auto-remediation removes threats from every inbox rather than relying on users to delete them.
If you need encryption, continuity or an archive as well, compare a gateway such as Proofpoint Essentials. If you want collaboration app coverage, look at Check Point Email Security or Trend Micro. If you are weighing two mailbox-level products, our IRONSCALES vs Avanan comparison shows the questions to ask. The full list is in our email security solutions comparison.
How we help
We can connect Vade to your tenant, agree with you which threats are removed automatically, roll out the report button and tune graymail and warning banners so they help rather than annoy. We also review your SPF, DKIM and DMARC records, because Vade protects inbound mail but does not stop criminals spoofing your own domain; see email authentication.
Ask us for a quote with your user count and the options you are interested in. Contact us to discuss Vade.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is Vade for M365?
Vade for M365 is an AI-based email security service for Microsoft 365. It connects to your tenant by API, analyses the content and context of each email and the pages its links lead to, and removes phishing, spear-phishing and malware messages, including after delivery.
Does Vade for M365 need an MX record change?
No. Vade lists no MX changes for Vade for M365: it connects to Microsoft 365 by API, so mail continues to route through Microsoft and set-up does not interrupt delivery.
Who owns Vade?
Vade has been part of Proofpoint since December 2025. The Vade for M365 and Vade for Google Workspace products are still listed under the Vade name.
Does Vade work with Google Workspace?
Vade makes a separate product, Vade for Google Workspace, which scans Gmail inline before delivery and removes newly found threats afterwards. Our distributor catalogue lists Vade for M365, so ask us and we will confirm whether we can supply the Google Workspace version.
Can Vade remove a phishing email after it has been delivered?
Yes. Auto-remediation keeps scanning mailboxes and removes messages later found to be malicious, and administrators can remediate reported emails from the console.
How is Vade for M365 licensed?
Per user in the distributor catalogue we supply from, with Threat Intel and Investigation and Remote Browser Isolation added per user. Ask us for a quote.
Still have a question about Vade for M365?
Ask us and a member of our team will reply by email.
More email security guides
Acronis Email SecurityPerception Point-powered email filtering for Microsoft 365, Google Workspace and more, managed in Acronis Cyber Platform.ICES explainedHow API-based email security connects after Microsoft's or Google's filtering.Microsoft 365Anti-phishing policies, preset policies, Safe Links, user reporting and when to add a third-party layer.Google WorkspaceGmail's built-in protection, what your edition adds, and the third-party layers that protect Gmail.