In short
Google Workspace email security starts with Gmail's built-in spam, malware and phishing filtering, which cannot be turned off. Admins can add advanced phishing and malware protection, and on Business Standard and above the Security Sandbox and Enhanced Safe Browsing. API products such as Check Point, IRONSCALES and Vade, or a gateway, add a second layer.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Is Google Workspace email secure?
Google Workspace gives Gmail a strong baseline. According to Google's admin documentation:
- Spam scanning cannot be switched off. Gmail scans every message for spam and you cannot turn it off; admins can only customise it.
- Every message is scanned for malware, whether or not you change any attachment settings.
- Phishing warnings and spam moves are the default. Gmail shows warnings and moves untrustworthy messages to spam.
- Unauthenticated mail is flagged with a question mark next to the sender's name when you turn on the spoofing and authentication protections.
- External recipient warnings are on by default, reminding people when a thread includes someone outside the organisation.
- TLS is attempted for every message, so mail is encrypted in transit whenever the other server supports it.
What Google does not do by default is apply its stricter options. The Security Sandbox and Enhanced Safe Browsing are off by default, the advanced phishing and malware protections default to a warning rather than spam or quarantine, automatic forwarding to any address is allowed by default, and authentication for your own domain needs DNS records that only you can publish. All of these need an admin to act. Our step-by-step guide to Gmail security settings covers each one.
The honest answer, then, is that Google Workspace is secure as a platform, but how secure your mail is depends on configuration, your edition and how much targeted fraud you attract.
What your Google Workspace edition changes
Some of Gmail's most useful protections are tied to the edition you hold. Google lists the following on its help pages:
| Protection | What it does | Editions Google lists |
|---|---|---|
| Advanced phishing and malware protection | Extra checks on attachments, links, external images, spoofing and authentication, with warn, spam or quarantine actions | Available in the Admin console; no edition restriction shown on Google's page |
| Gmail Security Sandbox | Runs attachments (executables, Office files, PDFs, including inside archives) in a virtual environment to find unknown malware | Frontline Plus; Business Standard and Business Plus; Enterprise Standard and Enterprise Plus |
| Gmail Enhanced Safe Browsing | Extra checks for harmful content before delivery, using Enhanced Safe Browsing activity | Business Standard and Business Plus; Enterprise Standard and Enterprise Plus |
| Email quarantine | Admin quarantines for incoming or outgoing mail matching your rules | Part of the Moderation Tool; set up by a super administrator |
| Hosted S/MIME and client-side encryption | Message-level encryption | Edition-dependent; see sending secure email in Gmail |
So an organisation on Business Starter has Gmail's core filtering and the advanced settings, but not the Security Sandbox or Enhanced Safe Browsing. Check your edition in the Admin console before planning. We do not sell Google Workspace licences; we help you get the most from the edition you have and add protection around it.
Not sure which edition fits? Ask us
Tell us what you need and we will help you choose the right edition.
Where Gmail's own protection runs out
Gmail's filters are very good at volume threats. The attacks that tend to do the most damage look different:
- Payload-free fraud. A message from a lookalike or compromised supplier asking to change bank details carries no link or attachment to scan. See invoice fraud and BEC attacks.
- Mail from a hijacked account. Once an attacker controls a real mailbox, inside your organisation or at a supplier, the mail authenticates correctly. See email account takeover.
- Clean-up across many mailboxes. Gmail's warnings and spam moves happen per message; removing a campaign from every inbox after the fact is something API products specialise in.
- Mixed estates. Many organisations run Google Workspace alongside Microsoft 365, Slack or Teams and want one policy and one quarantine across them.
- DMARC reporting. Google can sign and check mail, but reading aggregate reports for your own domains needs a separate tool, especially since the NCSC retired Mail Check on 31 March 2026.
These are the gaps that integrated cloud email security products are built for.
Email security products that protect Gmail
These are the products we supply that their vendors list as supporting Google Workspace:
| Product | How it protects Gmail | Worth knowing | Read more |
|---|---|---|---|
| Check Point Email Security (formerly Harmony Email & Collaboration, originally Avanan) | API connection to the Google Workspace tenant; no MX change | Also protects Google Drive, and Microsoft 365, Slack and file-sharing apps from the same console | Check Point Harmony UK |
| IRONSCALES | API at mailbox level; no MX change | Automatic removal from affected mailboxes; also extends to Google Chat | IRONSCALES |
| Vade for Google Workspace | API-based anti-phishing and anti-malware | Vade, now part of Proofpoint, lists a Google Workspace product alongside Vade for M365 | Vade |
| FortiMail Workspace Security (formerly Perception Point) | Integrated cloud email security for Google Workspace and Microsoft 365 | Browser and collaboration components can be added | Perception Point |
| Acronis Email Security | Cloud-native deployment without MX changes | Powered by Perception Point; suits organisations already backing up Google Workspace with Acronis | Acronis Email Security |
| TrendAI Vision One Email and Collaboration Security (Trend Micro) | API with an optional inline mode for Gmail, or an MX gateway | Pro covers a user across both API and gateway | Trend Micro email security |
| Sophos Email | MX gateway in front of Gmail (Sophos's API integration is for Microsoft 365) | Email Plus adds DMARC Manager | Sophos Email |
| Proofpoint Essentials | Cloud gateway via MX change | Packages add encryption, DLP, continuity and archiving | Proofpoint Essentials |
| Symantec Email Safeguard.cloud (built on Email Security.cloud) | Cloud gateway via MX change | Inbound and outbound content and image control | Symantec Email Security.cloud |
| Echoworx | Encryption layer routed from Google Workspace over SMTP, with a Gmail add-on | For sending sensitive mail securely, not inbound filtering | Echoworx |
Some products we supply, such as ThreatDown Email Security and Bitdefender's email security, are positioned around Microsoft 365; we confirm current Google Workspace support at quote rather than assume it. Our email security platforms page compares the whole range.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
API layer or gateway in front of Gmail?
There are two ways to add protection to Google Workspace, and they behave differently:
| API (integrated) product | Gateway in front of Gmail | |
|---|---|---|
| How it connects | Admin grants access to the Google Workspace tenant | MX records point at the gateway, which passes mail to Gmail |
| When it inspects | After Gmail's own filtering, before or just after the inbox | Before mail reaches Google |
| Internal Gmail-to-Gmail mail | Can inspect it | Usually does not see it |
| Removing mail after delivery | Yes, from every affected mailbox | Limited |
| Continuity and archiving | Depends on the product | Often included or available |
| Gmail settings to change | None beyond granting access | Add the gateway in Gmail's Inbound gateway setting so Google sees the real sender, and lock delivery to the gateway |
An API product is usually the simpler fit for Google Workspace because nothing changes in mail routing and it can see internal mail. A gateway makes sense if you need continuity, policy-based encryption at the edge or one filter for several mail systems. ICES vs SEG walks through the decision.
Authentication for Google Workspace domains
Protecting other people from mail that pretends to be you is a separate job from filtering what arrives:
- SPF: publish a record that includes Google's mail servers and every other service that sends as your domain. See SPF record.
- DKIM: generate a key in the Admin console (Apps > Google Workspace > Gmail > Authenticate email); Google recommends 2048-bit keys where your DNS host supports them. See DKIM.
- DMARC: publish a record, monitor the reports and work up to quarantine or reject. Our sister site's DMARC guide explains the record.
- Sender rules: Gmail's own requirements for anyone sending to Gmail users have applied since 1 February 2024, with stricter rules above 5,000 messages a day. See Google bulk sender guidelines.
Our email authentication hub covers MTA-STS and BIMI too, and the managed DMARC services we supply.
How we help Google Workspace organisations
Forever Systems works with organisations on Google Workspace, Microsoft 365 or both. We can:
- Review your Gmail safety, spam and compliance settings against Google's recommendations and your edition
- Switch on the advanced phishing and malware protections, sandboxing where your edition has it, and sensible forwarding rules
- Get SPF, DKIM and DMARC right for every domain and every service that sends as you
- Where the vendor offers a trial, run an API product in monitor mode to show what Gmail is missing, before you commit
- Quote and deploy the layer that fits, with pricing confirmed at quote
Contact us to talk about protecting Gmail.
Explore Google Workspace
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
Is Google Workspace email secure?
Gmail for business has strong built-in spam, malware and phishing filtering that cannot be turned off, and it attempts TLS for every message. Its stricter protections, such as advanced phishing settings and the Security Sandbox, need an admin to switch them on, and some depend on your edition. Targeted payment fraud and compromised accounts can still get through, which is where a second layer helps.
What is the best email security for Google Workspace?
It depends on your threats and estate. API products such as Check Point Email Security, IRONSCALES, Vade for Google Workspace and FortiMail Workspace Security add AI detection and automatic removal with no MX change; gateways such as Proofpoint Essentials or Sophos Email suit organisations that want continuity or one filter for several systems. We compare them without ranking them and can help you trial one where the vendor offers a trial.
Which Google Workspace editions include the Gmail Security Sandbox?
Google lists Frontline Plus, Business Standard and Business Plus, and Enterprise Standard and Enterprise Plus. It is off by default, so an admin needs to turn it on for all attachments or for rules you define.
Does Google Workspace need third-party email security?
Not necessarily. A well-configured Gmail tenant with authentication in place is a good baseline for many small organisations. A third-party layer makes sense if you are targeted by invoice fraud or impersonation, want messages removed from every mailbox automatically, or run Google Workspace alongside Microsoft 365.
Can I use a secure email gateway with Gmail?
Yes. You point your MX records at the gateway, add its servers to Gmail's Inbound gateway setting so Google can see the true sender, and restrict delivery so mail only arrives through the gateway. Proofpoint Essentials, Sophos Email, Symantec Email Safeguard.cloud and Trend Micro's gateway all work this way.
Still have a question about Google Workspace email security?
Ask us and a member of our team will reply by email.