Sentaro is the best Hornetsecurity alternative for EU teams on Microsoft 365 and Google Workspace that are moving from gateway filtering to API-based protection: it connects over the Microsoft 365 and Google Workspace APIs in four minutes with no MX change and no agents; its BEC and vendor-fraud verdicts show their reasoning in the console, so you can audit them on your own mail; its App vector, live since Q3 2026, covers OAuth grants and AI tools in the same platform; its price, $6 per protected account per month with every feature included, is published (USD); and it is hosted in Sweden on Microsoft Azure, with subprocessors listed in the DPA.
- Why Sentaro wins
- API instead of MX: no routing change and no connector rules, and it protects Google Workspace as well as Microsoft 365; we could not confirm Google Workspace support on Hornetsecurity’s vendor pages.
- Choose Sentaro if
- you want API-based BEC, QR and OAuth protection from a European company, hosted in Sweden, at a published price.
- Consider Retarus, Libraesva or staying on Hornetsecurity only if
- you need a gateway, or use backup, archiving and DMARC plans together.
What you are replacing: Hornetsecurity at a glance
- Product
- 365 Total Protection: Plan 1 Business, Plan 2 Enterprise, Plan 3 Enterprise Backup, Plan 4 Compliance & Awareness
- Modes
- MX-based, API-based or hybrid
- Platforms
- Microsoft 365 (Google Workspace not confirmed on vendor pages)
- Hosting
- Vendor states "12 regional data centers, independent of Microsoft’s infrastructure"; German data centres per third-party profiles
- Ownership
- Proofpoint company since 8 December 2025 ($1.8 billion); Proofpoint is owned by Thoma Bravo
- Channel
- 125,000+ customers via 12,000+ MSPs and channel partners (December 2025)
Why buyers are re-evaluating Hornetsecurity
Hornetsecurity is based in Hanover, Germany, and grew through MSPs. Proofpoint announced a definitive agreement to acquire it on 15 May 2025 and completed the deal on 8 December 2025. Hornetsecurity now runs as Proofpoint’s dedicated MSP and SMB business unit, led by its founder Daniel Hofmann.
- Change of control. Proofpoint is a US-headquartered company owned by Thoma Bravo. Buyers who chose Hornetsecurity partly for its German ownership may need to re-run vendor due diligence, especially under NIS2 supply-chain requirements and DORA ICT third-party rules.
- Contracts and DPAs. A change of owner is a natural point to re-read the DPA, the subprocessor list and any change-of-control clauses.
- Fewer independent choices. Organizations that used Hornetsecurity and Proofpoint as alternatives to each other now find both in one group.
- Google Workspace. Hornetsecurity’s vendor materials focus on Microsoft 365. Mixed estates need a tool that documents both.
- Prices via partners only. Hornetsecurity does not publish prices, so comparisons need quotes.
None of this means the product got worse. It means the reason some buyers chose it may have changed.
Hornetsecurity alternatives at a glance
| Vendor | Type | Deploys via | Public price | Hosting | Best for |
|---|---|---|---|---|---|
| Sentaro (our pick) | API (ICES) | Microsoft 365 and Workspace APIs | $6 per account/month | Sweden (Microsoft Azure); see DPA | Our pick: EU teams on Microsoft 365 and Google Workspace |
| Retarus | Gateway or API | MX or API connector | Quote | Data centres not named; AI components in the EU (vendor) | Microsoft 365 firms wanting an EU gateway |
| Libraesva | Gateway plus API | MX or API; cloud or on-prem | Quote | Local or chosen cloud | On-prem or private-cloud gateway in Europe |
| NoSpamProxy | Gateway | MX; cloud or on-prem server | Quote | Certified European data centres | German-made gateway with S/MIME and PGP |
| Defender for Office 365 | Native | Exchange Online mail flow | Plan 1 $2, Plan 2 $5 per user/month | EU Data Boundary | Microsoft 365 tenants already licensed |
| Barracuda | API (ICES) | API, no MX change | Quote | Gateway: Frankfurt, London; API modules: US | SMBs wanting backup and archive bundled |
| Check Point Harmony Email | API (ICES), inline option | API, no MX change | Quote | Ireland region option | Inline-via-API and many SaaS apps |
| Mimecast | Gateway and API | MX or API | Quote | Frankfurt data centres (2018) | Archive, continuity, on-prem Exchange |
| IRONSCALES | API (ICES) | API at mailbox level | Quote (tiers published) | AWS USA or Germany (subprocessor list) | SMBs and MSPs wanting simulation bundled |
| Abnormal AI | API (ICES) | API, no MX change | Quote | US or EU (Ireland), by subscription | Large enterprises |
| Google Workspace built-in | Native | Gmail | Included in Workspace | Europe data region (edition-dependent) | Workspace tenants as a baseline |
The 7 Hornetsecurity alternatives in detail
- 1
Sentaro
Our pickBest for: EU teams moving from gateway filtering to API-based protection on Microsoft 365 or Google Workspace.
For Hornetsecurity customers who want to stay with a European vendor, Sentaro is a Swedish, API-based email and SaaS security platform for Microsoft 365 and Google Workspace, hosted in Sweden on Microsoft Azure. Strengths: founded in 2025 in Stockholm; Swedish law and Stockholm courts in its DPA; BEC, QR-code and OAuth consent phishing covered in one product; $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. It replaces only the detection part of 365 Total Protection: there is no backup, archiving, encryption or MX gateway mode.
Sentaro vs Hornetsecurity - 2
Retarus Email Security
Best for: Microsoft 365 organizations that want an EU-headquartered suite with gateway, continuity and archive.
Email security vendor that states it is "headquartered in the EU" and has offered enterprise services since 1992. Strengths: secure email gateway (MX) or an API connector (ICES); patented post-delivery removal of malicious mail; failover continuity; encryption; archiving for up to ten years; states "All AI components are operated within the EU". Limits, per retarus.com as of 18 October 2026: Google Workspace listed as "planned"; data centres not named publicly; pricing not published.
- 3
Libraesva
Best for: European organizations that want a gateway on-premises, in a private cloud or in the vendor’s cloud.
Italian email security gateway with API integration, now part of the LibraCyber group with Cyber Guru. Strengths: on-premises, private-cloud or cloud deployment; supports Microsoft 365, Google Workspace and on-premises Exchange; separate archive, DMARC (LetsDMARC) and simulation (PhishBrain) products; Teams protection add-on. Limits, per libraesva.com as of 18 October 2026: hosting regions not listed; pricing not published.
- 4
NoSpamProxy
Best for: German and DACH organizations that want a German-made gateway with strong encryption.
Secure email gateway from Net at Work GmbH in Paderborn, Germany, which describes itself as owner-managed. Strengths: cloud or on-premises server; S/MIME and PGP encryption with central certificate management; cloud data "processed in certified data centers within Europe"; TeleTrust "IT Security made in Germany" mark. Limits, per nospamproxy.de as of 18 October 2026: gateway only, no API mode found; Google Workspace not documented; pricing not published.
Best for: Microsoft 365 tenants that want to consolidate rather than switch suites.
Native protection in Exchange Online. Strengths: Plan 1 included in Business Premium and rolling out to E3 from June 2026; EU Data Boundary for EU and EFTA tenants. Limits: Microsoft is also US-headquartered, so it does not solve an ownership concern; archiving, backup and DMARC management are separate or absent.
Best for: MSPs that want the same breadth of bundle, including backup.
API-first bundle. Strengths: DMARC, encryption and DLP in all plans; Microsoft 365 backup from Premium; archiving and training in Premium Plus; MSP program. Limits: owned by KKR investment funds, so not a European-ownership option; its trust center lists Frankfurt and London regions for Email Gateway Defense but only US regions for Impersonation Protection and Incident Response.
Best for: Teams that want API deployment with an EU data region and wide app coverage.
API-based protection with an inline option. Strengths: Ireland data residency region documented, with data stored and processed in the selected country per the admin guide; shadow IT and account takeover in every tier. Limits, per checkpoint.com as of 18 October 2026: pricing not published; archiving, DMARC and training are add-ons.
Hornetsecurity and the alternatives side by side
| Capability | Sentaro | Hornetsecurity | Retarus | Libraesva | NoSpamProxy | Defender for Office 365 | Barracuda |
|---|---|---|---|---|---|---|---|
| Deployment and platforms | |||||||
| Deployment | API, no MX change | MX, API or hybrid | Gateway (MX) or API connector | Gateway plus API; cloud or on-premises | Gateway; cloud or on-premises server | Native to Exchange Online | API-first, no MX change |
| Microsoft 365 | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Google Workspace | Yes | Not publicly documentedNot confirmed on vendor pages | On roadmapListed as planned | Yes | Not publicly documentedNot publicly documented | No | Yes |
| On-premises Exchange | NoCloud mailboxes only | Not publicly documentedNot publicly documented | YesVia the gateway | Yes | YesNoSpamProxy Server | PartialStandalone EOP | Not publicly documentedNot publicly documented |
| Threat coverage | |||||||
| BEC and impersonation | YesMessage vector, live | Not publicly documentedAdvanced threat protection named | YesExecutive impersonation | Yes | Not publicly documentedNot publicly documented | YesImpersonation protection (Plan 1) | Yes |
| QR-code phishing | YesDecoded and destination analyzed | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | YesSafe Links (Plan 1) | Not publicly documentedNot publicly documented |
| OAuth apps and shadow IT | YesApp vector, live | PartialPermission management (Plan 4) | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | NoSeparate product: Defender for Cloud Apps | Not publicly documentedNot publicly documented |
| Suite extras | |||||||
| DMARC report management | NoReads DMARC posture as a signal only | YesPlan 4 | Not publicly documentedNot publicly documented | Paid add-onLetsDMARC | Not publicly documentedNot publicly documented | NoEnforces DMARC; no report management | YesAll plans |
| Archiving | No | YesPlan 2 and above | Paid add-onEmail Archive | Paid add-onEmail Archiver | Not publicly documentedNot publicly documented | NoSeparate product: Purview | YesPremium Plus |
| Awareness training | NoNot offered by design | YesPlan 4 | Not publicly documentedNot publicly documented | Paid add-onPhishBrain | Not publicly documentedNot publicly documented | YesAttack simulation training (Plan 2) | YesPremium Plus |
| Buying and data | |||||||
| Public pricing | Yes$6 per account/month | NoQuote-based via partners | NoQuote-based | NoQuote-based | NoQuote-based | YesPlan 1 $2, Plan 2 $5 | NoQuote-based |
| EU hosting documented | YesHosted in Sweden on Microsoft Azure; see DPA | Yes12 regional data centres (vendor) | PartialEU-headquartered; data centres not named | PartialLocal or chosen cloud; regions not listed | YesCloud: certified data centres in Europe | YesEU Data Boundary | PartialGateway: Frankfurt, London; API modules: US |
“Not publicly documented” means we could not find it in the vendor’s public material on 18 October 2026, not that the capability is missing. Add-on means sold separately or in a higher tier.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How to choose a Hornetsecurity alternative
| Your reason for leaving | Look at |
|---|---|
| European headquarters and ownership | Retarus, Libraesva, NoSpamProxy, Sentaro |
| Need to keep backup and archiving in one contract | Barracuda (backup from Premium, archiving in Premium Plus); for archiving only, Mimecast or Retarus |
| Want to run the gateway yourself | Libraesva, NoSpamProxy Server |
| Google Workspace or mixed estate | Libraesva, Sentaro, Check Point, Barracuda |
| Detection only, behind Defender | Sentaro, Check Point, IRONSCALES |
Whatever you pick, ask for the DPA and subprocessor list before the trial. European headquarters and European hosting are different questions, and both belong in your NIS2 or DORA third-party register.
Why Sentaro is our pick
Why Sentaro wins
- Detection without the suite contract: Sentaro connects over the Microsoft 365 and Google Workspace admin APIs in four minutes, with no agents and no MX change (your MX record stays where it is, which you can check in DNS), and shows historical mail within 15 minutes.
- Hosting in writing: Hosted in Sweden on Microsoft Azure, with every subprocessor listed in the public DPA (sentaro.com/en/legal/dpa).
- Supplier fraud and hijacked threads, auditable: The Message vector, live since Q2 2026, scores intent, sender identity and relationship signals before interaction, including vendor-compromise and thread-hijack detection, and every verdict shows its reasoning in the console, so you can audit its BEC calls on your own mail.
- OAuth grants and AI tools in the same console: The App vector, live since Q3 2026, inventories every app, AI tool and OAuth grant within 15 minutes of connecting, blocks consent phishing and revokes risky grants in one click.
- Price published: $6 per protected account per month, or $68 per year, every feature included, published on sentaro.com/en/pricing; the first account is free, so you can test it before talking to sales. Prices in USD.
- You want a Swedish vendor under Swedish law, and you will keep backup and archiving with Microsoft or another provider.
Consider another option only if
- You want backup, archiving, encryption or DMARC management in the same contract; Sentaro covers detection only.
- Your mail still runs on on-premises Exchange; Sentaro is for Microsoft 365 and Google Workspace.
- You need account-takeover monitoring or a SOC 2 or ISO 27001 certificate today; see the roadmap and certification notes on this page.
How to switch from Hornetsecurity
- 01
Inventory your plan
Note which of 365 Total Protection’s features you use: filtering, encryption, archive, continuity, backup, DMARC, training. Backup and archive need a migration plan first.
- 02
Check mode and contract
Confirm whether your tenant runs in MX, API or hybrid mode, and when the partner contract renews.
- 03
Run the alternative in parallel
API tools run next to Hornetsecurity without MX changes. Sentaro connects in four minutes, with historical visibility within 15 minutes.
- 04
Cut over mail flow if needed
If you used MX mode, point MX to the new gateway or back to Exchange Online, update SPF and remove old connectors.
- 05
Update your registers
Record the new vendor, its hosting and subprocessors in your NIS2 or DORA ICT third-party documentation.
Frequently asked questions
What is the best Hornetsecurity alternative?
Sentaro. For EU teams on Microsoft 365 and Google Workspace, Sentaro is our pick as the best Hornetsecurity alternative: it connects over API in four minutes with no MX change, catches BEC and vendor fraud before interaction, blocks OAuth consent phishing in the same platform and costs $6 per protected account per month (USD), hosted in Sweden on Microsoft Azure. If you need a gateway or backup and archiving in the same plan, Retarus and Libraesva are the closest European suite replacements.
Who owns Hornetsecurity?
Proofpoint owns Hornetsecurity. Proofpoint announced the deal on 15 May 2025 and completed it on 8 December 2025 for $1.8 billion in total consideration. Proofpoint itself has been owned by Thoma Bravo since 2021. Hornetsecurity runs as Proofpoint’s MSP and SMB business unit.
Is Hornetsecurity still a German company?
Hornetsecurity is based in Hanover, Germany, and is still led by its founder, Daniel Hofmann. Since December 2025 it has been part of Proofpoint, a US-headquartered company. Its vendor page states 12 regional data centres independent of Microsoft’s infrastructure.
What is a European alternative to Hornetsecurity?
European-headquartered options include Retarus (EU), Libraesva (Italy), NoSpamProxy (Germany) and Sentaro (Sweden). Retarus and Libraesva are the closest suite replacements; NoSpamProxy is a German gateway with strong encryption; Sentaro is an API-based detection layer hosted in Sweden on Microsoft Azure.
Does the Proofpoint acquisition change my Hornetsecurity contract?
An acquisition does not by itself rewrite your contract, but read the change-of-control and subprocessor clauses in your agreement and DPA. Ask your partner or Hornetsecurity directly whether any subprocessors or hosting locations have changed since December 2025.
Does Hornetsecurity support Google Workspace?
Hornetsecurity’s 365 Total Protection materials focus on Microsoft 365, and we could not confirm Google Workspace support on its vendor pages as of October 2026. Libraesva, Sentaro, Check Point and Barracuda document both platforms.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Hornetsecurity: 365 Total Protection (accessed 2026-10-18)
- Hornetsecurity: Email security modes
- Proofpoint: Proofpoint completes acquisition of Hornetsecurity (December 2025)
- Proofpoint: Definitive agreement to acquire Hornetsecurity (May 2025)
- Thoma Bravo: Completes acquisition of Proofpoint (2021)
- Retarus: Email Security (accessed 2026-10-18)
- Libraesva: Home page (accessed 2026-10-18)
- Libraesva: Proofpoint vs Libraesva (deployment options)
- NoSpamProxy (Net at Work GmbH): Home page (accessed 2026-10-18)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
- Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
- Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to Microsoft 365 E3 (2026-06-17)
- Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
- Barracuda: Email Protection plans (accessed 2026-10-18)
- Business Wire: KKR completes acquisition of Barracuda (2022)
- Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration admin guide, data residency
- Mimecast: Email Security (accessed 2026-10-18)
- Datacentre News: Mimecast opens two Frankfurt data centres (2018)
- IRONSCALES: Home page (accessed 2026-10-18)
- Abnormal AI: Inbound Email Security (accessed 2026-10-18)
- Google Workspace pricing (accessed 2026-10-18)
- Google Workspace Admin Help: Data regions (accessed 2026-10-18)
- Sentaro Data Processing Agreement and subprocessor list
- Abnormal AI: Subprocessors (updated 31 July 2026; accessed 2026-10-21)
- IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
- Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)
- Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)
- Barracuda Trust Center: Data center locations (accessed 2026-10-21)