In short: Vade for M365 is an AI-based email security service that adds a layer on top of Microsoft 365's built-in filtering. It connects to your tenant by API with no MX change, detects phishing, spear phishing and malware, and keeps scanning mailboxes to remove threats after delivery. It is licensed per protected user.
What Vade for M365 is
Vade for M365 is an email security service that adds a second, specialist layer of detection to Microsoft 365. Microsoft's built-in filtering stops a great deal of spam and known malware, but targeted phishing, convincing impersonation and brand-new malicious links still get through. Vade's AI analyses the origin, content and context of each message and the web pages its links lead to, and is continually trained on feedback from the very large number of mailboxes Vade protects.
It integrates with Microsoft 365 by API rather than acting as a gateway in front of it, so there is no MX record change and mail continues to flow through Microsoft as before.
Key capabilities
- Anti-phishing: machine learning analyses the behaviour and context of emails and web pages, and examines images, logos and QR codes, catching fake login pages and spoofed brands.
- Anti-spear phishing: anomaly detection and language-agnostic natural language processing spot impersonation of colleagues, suppliers and executives, including business email compromise attempts with no link or attachment, and can add a customisable warning banner.
- Anti-malware and ransomware: behavioural analysis of attachments, Office documents, PDFs and ZIP files, and of files linked from services such as OneDrive, SharePoint and WeTransfer.
- Auto-remediation: Vade keeps scanning mailboxes after delivery and removes messages that turn out to be malicious, even from inboxes.
- Email incident response: triage and remediate active threats and user-reported emails from one console, with one-click remediation.
- Contextual awareness training: a user who interacts with a phishing email is shown short, relevant training at that moment.
- Graymail sorting: low-priority notifications and newsletters are moved to separate folders to keep inboxes clear.
- Splunk integration: email logs can be exported to Splunk without custom development.
Core service and options
| Option | What it adds | Licensed by |
|---|---|---|
| Email Protection Service for M365 | The core detection, auto-remediation, incident response and graymail features above | Per user |
| Threat Intel and Investigation for M365 | Injects email and event logs into any SIEM, XDR or EDR, deconstructs files and attachments to collect forensic evidence safely, and gathers emails reported through the Outlook add-in in one place, with alerts so none are missed | Per user |
| Remote Browser Isolation for M365 | Opens risky links from email in a remote, isolated browser session streamed to the device as pixels, blocks malicious downloads and restricts form filling to stop credential theft, on desktop and mobile with no software to install | Per user |
Threat Intel and Investigation suits organisations with a security team or SIEM that want email in the same picture. Remote Browser Isolation suits organisations where staff must open links from outside senders all day, such as finance, HR and customer service teams.
How Vade for M365 is licensed
Vade for M365 is licensed per user, for each Microsoft 365 user whose mailbox you protect. The options are added per user on top of the core Email Protection Service. We confirm the billing term, renewal date and any minimum when we quote.
All of it sits on your Forever Systems account with your other subscriptions, and user numbers can be adjusted as your organisation changes. Prices depend on user numbers and options, so ask us for a quote.
Requirements and deployment
- Microsoft 365: an Exchange Online tenant and an administrator to authorise the connection
- No MX change: mail continues to route through Microsoft, so set-up does not interrupt delivery
- Report button: Vade's Outlook add-in lets users report suspicious emails for triage
- Optional SIEM: a Splunk or other SIEM, XDR or EDR destination if you take Threat Intel and Investigation
Because nothing changes in mail routing, it can be connected and tested quickly. We usually run it alongside your existing protection first, review what it catches, then switch on automatic remediation.
Who it suits and how we help
Vade for M365 suits Microsoft 365 organisations that want stronger phishing and impersonation protection without moving mail through a new gateway, and limited IT time to chase incidents. We connect it to your tenant, tune remediation and graymail settings, roll out the report button and handle the user reports and incidents with you. Compare alternatives in email security, including Hornetsecurity 365 Total Protection if you also need archiving, encryption or backup.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How does Vade for M365 connect to Microsoft 365?
It connects to your Microsoft 365 tenant by API, without an MX record change, so mail flow stays with Microsoft. It then scans messages and keeps re-checking mailboxes after delivery.
Can Vade remove a phishing email after it has been delivered?
Yes. Auto-remediation keeps scanning mailboxes and removes messages that are later found to be malicious, and administrators can also remediate reported emails from the console.
What is Vade Remote Browser Isolation?
An option that opens links from email in an isolated remote browser, so a malicious page never runs on the user's device. It blocks harmful downloads and restricts form filling to protect credentials.
Is Vade for M365 licensed per user or per mailbox?
Per user, counted on the Microsoft 365 users you protect. The Threat Intel and Investigation and Remote Browser Isolation options are licensed per user too, so you only choose user numbers and options, not an edition.