In short: Email security software filters incoming email for phishing, malware, spam and impersonation before or after it reaches the inbox. Products work either as a secure email gateway that changes your MX records, or through an API connection to Microsoft 365 or Google Workspace. Most are licensed per user or per mailbox, often with archiving and encryption as add-ons.
What is email security software?
Email is still the most common way attacks start: phishing links that harvest passwords, attachments carrying malware, and business email compromise, where a criminal impersonates a supplier or director to divert a payment. Microsoft 365 and Google Workspace include their own filtering, but many organisations add a specialist layer to catch more of what gets through.
There are two main designs:
- Secure email gateways sit in front of your mailboxes. You point your MX records at the service, which filters every message before delivering it. Examples include Proofpoint Essentials, Hornetsecurity and Symantec Email Safeguard.
- API-based (integrated cloud) email security connects directly to Microsoft 365 or Google Workspace without changing MX records. It inspects messages after the built-in filter and can remove threats even after delivery. Examples include Avanan (Check Point Harmony Email and Collaboration), IRONSCALES, Vade, Perception Point and Sophos Email.
Some products also protect Teams, SharePoint, OneDrive, Slack and Google Drive, where malicious files and links increasingly turn up.
Email security: vendors and products we supply
- Acronis: Backup, disaster recovery, EDR, email security, RMM and protected servers on one platform.
- Acronis Email Archiving: Immutable Microsoft 365 email archive with legal hold and eDiscovery.
- Acronis Email Security: Anti-phishing, BEC and zero-day email protection, billed monthly.
- Acronis Protected 365: Seven Microsoft 365 protection capabilities from one Acronis console.
- Bitdefender: GravityZone endpoint protection, EDR, email security, patching and encryption from one console.
- Bitdefender Extended Email Security: MX gateway and Microsoft 365 API email protection with post-delivery remediation.
- Check Point: Endpoint, email, SASE, mobile, browser, WAF and MDR licences in one Check Point Portal tenant.
- Check Point Harmony Email & Collaboration: API-based email and collaboration security (formerly Avanan), licensed per user.
- Cynet: One-agent security platform with EDR, XDR, deception and 24x7 CyOps MDR, licensed per endpoint.
- Cynet All-in-One platform: Protect, Elite and All-in-One packages compared, licensed per endpoint.
- EasyDMARC: Managed DMARC, SPF, DKIM, BIMI and MTA-STS, licensed per domain.
- Guardz: Managed identity, email, endpoint and awareness security for small businesses, with 24/7 MDR.
- Guardz Managed security plans: Pro, Ultimate and Elite plans compared, run for you and licensed per user.
- Hornetsecurity: Microsoft 365 email security, archiving, backup and compliance, per user.
- Hornetsecurity 365 Total Protection: Plans 1 to 4: Microsoft 365 email security, archiving, backup and compliance.
- Hornetsecurity Advanced Threat Protection: Sandboxing, Secure Links and fraud detection for targeted email attacks.
- Hornetsecurity AI Email Security Analyst: Instant AI analysis of emails users report as suspicious.
- Hornetsecurity AI Recipient Validation: Outlook warnings that stop misdirected emails and data leaks.
- Hornetsecurity Email Archiving: Tamper-proof, searchable email archive with auditor access, per user.
- Hornetsecurity Email Continuity Service: Keeps email flowing during mail server outages, per user.
- Hornetsecurity Hornet.email: Secure hosted mailboxes on your domain, alongside Microsoft 365.
- Hornetsecurity Spam and Malware Protection: Multi-layer spam, malware and phishing filtering, per user.
- Hornetsecurity Teams Protection: Malicious link detection and clean-up for Microsoft Teams chats.
- IRONSCALES: AI email security, awareness training, DMARC and encryption for Microsoft 365.
- IRONSCALES Email Protect: AI anti-phishing and BEC protection for Microsoft 365 and Google Workspace.
- Perception Point: Email, browser and Microsoft 365 collaboration security with managed incident response.
- Perception Point Advanced Email Security: Dynamic scanning of all email for Microsoft 365 and Google Workspace, per user.
- Perception Point Microsoft Collaboration Security: Threat scanning for SharePoint, OneDrive and Teams, per user.
- Proofpoint: Proofpoint Essentials email security, archiving and awareness training, per user.
- Proofpoint Essentials: Email filtering, encryption, continuity and archiving packages, per user.
- Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
- Sophos Email: Cloud email security for Microsoft 365 and Google Workspace, licensed per mailbox.
- Symantec: Email Safeguard.cloud: cloud email filtering for spam, malware and phishing, per user.
- Symantec Email Safeguard.cloud: Cloud email gateway: spam, malware, phishing and BEC filtering with content and image control.
- ThreatDown: Malwarebytes business security: endpoint protection, EDR, MDR, patching and more, billed monthly.
- ThreatDown Email Security: AI phishing detection and auto-remediation for cloud mailboxes, no MX changes, per mailbox.
- Trend Micro: TrendAI Vision One endpoint, email, XDR and ZTSA, plus Worry-Free for smaller businesses.
- Trend Micro Email and Collaboration Security: Cloud email gateway, API inbox protection and XDR for Microsoft 365 and Google Workspace.
- Trend Micro Worry-Free: Per-user endpoint, email and XDR suites for small businesses, up to Co-Managed XDR.
- Vade: AI email security for Microsoft 365 with no MX change and post-delivery removal.
- Vade for M365: AI anti-phishing and malware protection for Microsoft 365, no MX change.
- Valimail: Automated DMARC, SPF and DKIM per domain, with BIMI and MTA-STS in Pro.
What to look for
- Impersonation and BEC detection: spotting lookalike domains, display-name spoofing and unusual payment requests
- Link and attachment analysis: time-of-click URL checks and sandboxing
- Post-delivery remediation: pulling a malicious message from every inbox once it is identified
- User reporting: a report button that feeds the system and your IT team
- Add-ons you may need: email encryption, archiving, continuity during outages, DMARC management and security awareness training
- Admin effort: how much quarantine management falls on your team
How email security is licensed
Email security is almost always licensed per user or per mailbox. Watch how shared mailboxes, distribution lists and service accounts are counted, because vendors treat them differently. Products are commonly sold in tiers, with higher packages adding encryption, data loss prevention, archiving or training. Monthly and annual terms are both widely available. See per-user vs per-device licensing for counting tips.
Before renewing, check how many mailboxes you are actually paying for against how many exist. Leavers' mailboxes and old shared mailboxes often remain licensed long after they are needed.
How to choose
- Review what is getting through today: ask users and check your reported phishing.
- Decide between gateway and API. API products are quick to deploy and catch threats after delivery; gateways give you control before mail arrives and can add continuity.
- Check which collaboration apps need protection as well as email.
- Confirm how quarantines and false positives are handled day to day.
- Run a trial in monitor mode: many API products can show what they would have caught before you switch them on.
Our specialist sites cover Avanan, Cisco Secure Email and Sophos Email, and Cloud Security explains the wider picture.
Finally, think about the people who manage it. Whoever releases quarantined messages and handles user reports will use the console every day, so make sure it is quick to search, explains why each message was blocked and lets users safely release their own low-risk mail where policy allows.
How we help
We help you compare products against the threats you actually see, set them up alongside Microsoft 365 or Google Workspace and tune policies so legitimate mail keeps flowing. Licences sit on your Forever Systems account with your other subscriptions. Contact us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft 365's built-in email filtering enough?
It blocks a great deal, but targeted phishing and impersonation still get through. A specialist layer adds stronger impersonation detection, post-delivery removal and better reporting. Whether you need one depends on your risk.
What is the difference between a secure email gateway and API email security?
A gateway filters mail before it reaches your mail service, which means changing MX records. API security connects to Microsoft 365 or Google Workspace directly and inspects mail inside the mailbox, removing threats even after delivery.
Do shared mailboxes need a licence?
It depends on the vendor. Some protect unlicensed shared mailboxes free, others count every protected mailbox. We check this when we quote.
Can email security protect Teams and SharePoint?
Several API-based products also scan Teams, SharePoint, OneDrive, Google Drive and Slack for malicious files and links.