Sentaro is the best BEC protection tool for EU teams on Microsoft 365 and Google Workspace. Its Message vector reads intent ("payment redirects, credential prompts, requests for secrecy and artificial deadlines"), sender infrastructure and thread history, including "suppliers that suddenly change banking details", so it does not need a malicious link or file to flag fraud. It connects over API in four minutes with no MX change, and it costs a published $6 per protected account per month (USD). Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.
- Why Sentaro wins
- payload-free BEC and vendor-compromise detection, live since Q2 2026; every verdict shows its reasoning in the console; no MX change; a price you can read on sentaro.com/en/pricing before a sales call.
- Choose Sentaro if
- you run Microsoft 365 or Google Workspace, your finance and HR teams are the target, and you want BEC detection without a gateway project.
- Consider Abnormal, IRONSCALES or Proofpoint only if
- you need account-takeover detection live today or a single enterprise suite with training and DLP; Sentaro’s account-takeover coverage (Behavioral vector) arrives in Q4 2026.
- Add Trustpair or Eftsure if
- you pay many suppliers by bank transfer and want every payee account verified before money leaves, whatever the email said.
Quick picks
- Best overall for EU teams on Microsoft 365 and Google WorkspaceSentaro Our pickPayload-free BEC and vendor-fraud verdicts with reasoning, four-minute API setup, $6 per account per month.
- Best native optionMicrosoft Defender for Office 365Impersonation protection with mailbox intelligence in Plan 1, already included in Business Premium and, from 2026, E3.
- Best for large enterprisesAbnormal AIBehavioral baselines for every employee and vendor, plus a separate Account Takeover Protection product.
- Best for MSP-managed SMBsIRONSCALESAPI deployment in minutes, BEC and VIP impersonation detection, simulation and training in higher tiers.
- Best for SOC teams that write rulesSublime SecurityOpen BEC detection rules on GitHub and a free managed tier for the first 100 mailboxes.
- Best payment-step controlTrustpairValidates supplier bank accounts in 190 countries before payment; does not scan email.
At a glance
- What we compared
- 9 email security tools that detect BEC in the mailbox, plus 2 payment-verification controls that stop the money at the payment step
- Who it is for
- EU organizations on Microsoft 365 or Google Workspace with lean IT, finance teams paying suppliers by bank transfer, and regulated firms under NIS2 or DORA
- Method
- Seven weighted criteria (below), scored 0–10 from public vendor documentation; overall score = weighted average
- Last verified
- 21 October 2026
- Written by
- Sentaro. Sentaro is our product and is ranked first; every competitor fact is sourced at the bottom of the page
- Why BEC matters
- The FBI IC3 recorded $3.05bn in reported BEC losses in 2025[28]
BEC protection tools compared
One row per tool, in score order. “Not documented” means we could not find it in the vendor’s public material on 21 October 2026, not that it is missing.
| Capability | Score | How it stops BEC | Deployment | Platforms | Public price | EU hosting |
|---|---|---|---|---|---|---|
| Sentaro (our pick)[4] | 8.4 | Intent, sender and relationship signals; vendor-compromise and thread-hijack detection | API, no MX change, four minutes | Microsoft 365, Google Workspace | Yes$6 per account/month | YesHosted in Sweden on Microsoft Azure; see DPA |
| Abnormal AI[29] | 7.4 | Behavioral baseline for every employee and vendor | API, no MX change | Microsoft 365, Google Workspace | NoQuote-based | PartialUS or EU (Ireland), by subscription |
| IRONSCALES[30] | 7.3 | Behavioral baselines per mailbox plus community reports | API, no MX change | Microsoft 365, Google Workspace | PartialTiers published, prices on quote | PartialAWS USA and Germany (subprocessor list) |
| Microsoft Defender for Office 365[5] | 7.2 | User and domain impersonation with mailbox intelligence (Plan 1) | Native to Exchange Online | Microsoft 365 only | YesPlan 1 $2, Plan 2 $5 | YesEU Data Boundary |
| Check Point Harmony Email & Collaboration[13] | 7.0 | BEC named; inline prevention via API | API, monitor to inline | Microsoft 365, Google Workspace, collaboration apps | NoQuote-based | YesIreland region option |
| Sublime Security[17] | 6.9 | Open detection rules (22+ BEC rules) and AI agents | API; managed or self-hosted | Microsoft 365, Google Workspace, IMAP | PartialFirst 100 mailboxes free | PartialEU (Dublin) managed region, or self-host |
| Proofpoint[18] | 6.8 | Behavioral AI with Nexus threat intelligence; BEC and supplier threats | API or inline gateway | Microsoft 365, Google Workspace | NoQuote-based | PartialEU or US data centre (API); some US processing |
| Mimecast[19] | 6.3 | Anomaly detection with social graphing | Gateway (MX) or API | Microsoft 365, Google Workspace, Exchange | NoQuote-based | PartialFrankfurt (2018) |
| Fortra (Agari, Cloud Email Protection)[21] | 6.1 | Agari identity-deception detection; ML and LLM models (vendor) | API or gateway | Microsoft 365, Google Workspace, Exchange | NoQuote, tiered by users | Not publicly documentedNot documented |
| Trustpair[23] | 3.8 | Verifies supplier bank accounts before payment; no email scanning | ERP connectors; access in 24 hours | SAP, Oracle and other ERPs | NoQuote-based packages | Not publicly documentedNot documented |
| Eftsure[26] | 3.6 | Independent payee verification; no email scanning | Finance and AP systems; 1–3 weeks | Finance and ERP systems | NoOn request | Not publicly documentedNot documented |
Editorial scores using the criteria and weights below; based on public documentation, not lab tests.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How we evaluated BEC protection tools
BEC is fraud by conversation: a lookalike sender, a hijacked supplier thread, a request to change bank details. The criteria follow what stops that for an EU team running Microsoft 365 or Google Workspace with a small IT function. Breadth beyond the inbox is weighted too, because that is where suites and payment controls genuinely win.
| Criterion | Weight | Why it matters |
|---|---|---|
| Payload-free BEC and vendor-fraud detection | 25% | Most BEC emails carry no malware or link. A tool must read intent, sender identity and relationship history, including changed bank details and hijacked supplier threads. |
| Deployment effort and time to protection | 15% | A gateway project delays protection by weeks. API tools connect without moving MX and can run alongside native filtering. |
| Microsoft 365 and Google Workspace coverage | 10% | Many EU firms run Microsoft 365, Google Workspace or both, and BEC moves between them and chat. |
| Explainable verdicts for finance and auditors | 10% | Finance, auditors and NIS2 or DORA incident reports need to know why a message was stopped, not only that it was. |
| Price transparency for SMB and mid-market | 15% | A published price lets a mid-market buyer budget without a sales cycle; quote-only pricing scores lower. |
| EU hosting and DPA transparency | 10% | BEC detection reads mail content, so where it is processed and who the subprocessors are matters under GDPR. |
| Coverage beyond the inbox | 15% | Account takeover, payment verification and training stop the same fraud at other points. Suites and payment controls score highest here. |
Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Each score has a one-line reason in our source file, and every vendor fact is listed under Sources. Unknown capabilities score as “not documented” (4–5), never as missing.
The 11 best BEC protection tools, ranked
Sentaro
Our pickOverall score: 8.4out of 10Best for: EU teams on Microsoft 365 and Google Workspace that want strong BEC and phishing protection without a gateway project.
Sentaro is an API-based email and SaaS security platform for Microsoft 365 and Google Workspace, built in Stockholm. Its Message vector scores every inbound and internal message before interaction on intent, sender identity and relationship context. For BEC that means display-name mismatches, newly registered lookalike domains at first contact, reply-chain reuse, injected replies and suppliers that suddenly change banking details. Finance- and HR-facing lookalikes can be blocked domain-wide.[4]
- Payload-free BEC and vendor-fraud detection
- 9.0
- Deployment effort and time to protection
- 10.0
- Microsoft 365 and Google Workspace coverage
- 9.0
- Explainable verdicts for finance and auditors
- 8.0
- Price transparency for SMB and mid-market
- 10.0
- EU hosting and DPA transparency
- 8.0
- Coverage beyond the inbox
- 4.0
Pros
- Catches BEC without a payload: payment redirects, secrecy requests, artificial deadlines and changed supplier bank details.
- Vendor-compromise and thread-hijack detection on internal and historical mail, not just inbound.
- Connects in four minutes over the Microsoft 365 and Google Workspace APIs; your MX record stays where it is.
- Every verdict shows its reasoning in the console, and similar messages across all mailboxes are remediated in one action.
- Published price with every feature included.
Cons
- Account-takeover and session-anomaly detection (Behavioral vector) reach general availability in Q4 2026.
- No payment verification, archiving, encryption or awareness training.
- SOC 2 and ISO 27001 certification in progress, not yet signed.
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.
- Deployment
- API via the Microsoft 365 and Google Workspace admin SDKs; no MX change, no agents
- Platforms
- Microsoft 365, Google Workspace, Slack, Teams
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
Abnormal AI
Best for large enterprisesOverall score: 7.4out of 10Best for: Large enterprises that want behavioral BEC detection and account-takeover protection from one enterprise vendor.
Abnormal AI (formerly Abnormal Security) is an API-based platform that builds a behavioral baseline for every employee and vendor and flags deviations using identity, behavioral and content signals. It names BEC and vendor fraud, sells Account Takeover Protection as a separate product, and states that more than 30% of the Fortune 500 are customers.[9]
- Payload-free BEC and vendor-fraud detection
- 9.0
- Deployment effort and time to protection
- 9.0
- Microsoft 365 and Google Workspace coverage
- 9.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 3.0
- EU hosting and DPA transparency
- 7.0
- Coverage beyond the inbox
- 8.0
Pros
- Behavioral baselines for vendors as well as employees, aimed squarely at vendor fraud.
- Account Takeover Protection available today.
- Lists ISO 27001, ISO 27701, ISO 42001, SOC 2 Type II and FedRAMP Moderate on its trust center (abnormal.ai/trust, checked 21 October 2026).
Cons
- Pricing not published.
- Hosting is AWS in the US or the EU (Ireland), set by subscription; confirm the EU option in the contract.
- Enterprise-focused sales motion.
- Pricing
- Quote-based
- Deployment
- API (ICES); no MX change
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- AWS in the US or EU (Ireland), by subscription (subprocessor list)
IRONSCALES
Best for MSP-managed SMBsOverall score: 7.3out of 10Best for: SMBs and MSPs that want BEC detection, simulation and training from one vendor with a multi-tenant console.
IRONSCALES is an API-based email security platform that builds behavioral baselines for every mailbox and adds community threat intelligence from other customers’ reports. It names BEC and VIP impersonation, QR lures and account takeover in its higher tiers, and states it is trusted by 3,000+ MSPs.[12]
- Payload-free BEC and vendor-fraud detection
- 8.0
- Deployment effort and time to protection
- 9.0
- Microsoft 365 and Google Workspace coverage
- 9.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 5.0
- EU hosting and DPA transparency
- 6.0
- Coverage beyond the inbox
- 8.0
Pros
- Behavioral baselines plus community reports from a large SMB and MSP base.
- Account takeover, training, encryption and DLP available in higher tiers.
- Multi-tenant console with per-tenant policies for MSPs.
Cons
- Prices are on quote even though tiers are published.
- Subprocessor list names AWS in both the USA and Germany without saying which customers are hosted where.
- Pricing
- Quote-based; plan tiers published, prices not
- Deployment
- API at mailbox level; works alongside a gateway
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Subprocessor list names AWS in the USA and AWS Europe (Germany)
Microsoft Defender for Office 365
Best native optionOverall score: 7.2out of 10Best for: Microsoft 365 tenants that already hold Business Premium or E3 and want impersonation protection switched on first.
Defender for Office 365 is Microsoft’s native protection in Exchange Online. Plan 1 adds user and domain impersonation protection with mailbox intelligence (a contact graph), Safe Links and Safe Attachments. Plan 2 adds Threat Explorer, automated investigation and response, and attack simulation training. Microsoft documents no dedicated vendor-email-compromise feature.[5]
- Payload-free BEC and vendor-fraud detection
- 6.0
- Deployment effort and time to protection
- 9.0
- Microsoft 365 and Google Workspace coverage
- 5.0
- Explainable verdicts for finance and auditors
- 6.0
- Price transparency for SMB and mid-market
- 9.0
- EU hosting and DPA transparency
- 8.0
- Coverage beyond the inbox
- 7.0
Pros
- Already paid for in Business Premium and, from 2026, Microsoft 365 and Office 365 E3.
- No connector: covers Teams, SharePoint and OneDrive in the same policies.
- EU Data Boundary for tenants signed up in the EU or EFTA.
Cons
- Microsoft 365 only.
- No dedicated vendor-email-compromise feature documented.
- Account-risk signals need Entra ID P2, a separate license.
- Pricing
- Plan 1 $2, Plan 2 $5 per user/month, annual (USD)
- Deployment
- Native to Exchange Online, in the mail flow
- Platforms
- Microsoft 365 only
- Hosting
- EU Data Boundary for EU/EFTA tenants (Multi-Geo excluded)
Check Point Harmony Email & Collaboration
Overall score: 7.0out of 10Best for: Organizations that want BEC blocked before the inbox via API and protection across many collaboration apps.
Check Point Harmony Email & Collaboration (formerly Avanan) connects over API and can enforce from monitor mode up to inline prevention, inspecting mail before it reaches the inbox. It names BEC, includes account-takeover protection and shadow IT detection in all tiers, and covers Teams, Slack, OneDrive, SharePoint, Google Drive, Box and Dropbox.[14]
- Payload-free BEC and vendor-fraud detection
- 7.0
- Deployment effort and time to protection
- 9.0
- Microsoft 365 and Google Workspace coverage
- 10.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 3.0
- EU hosting and DPA transparency
- 7.0
- Coverage beyond the inbox
- 8.0
Pros
- Inline prevention through the API, not only post-delivery clean-up.
- Widest collaboration-app coverage in this list.
- Documented EU data region (Ireland).
Cons
- Pricing not published.
- Vendor-email-compromise specifics not documented.
- Pricing
- Quote-based (four published tiers)
- Deployment
- API with configurable inline prevention; no MX change
- Platforms
- Microsoft 365, Google Workspace, Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox
- Hosting
- Data residency regions include Ireland
Sublime Security
Best for rule-writing SOCsOverall score: 6.9out of 10Best for: Security teams that want to read, write and tune their own BEC detection rules.
Sublime Security is an API-based platform built on detection-as-code: rules written in its Message Query Language, with an open-source rule library on GitHub that includes more than 22 rules named for BEC. AI agents triage user reports and draft new rules. The managed cloud is free for the first 100 mailboxes, and you can self-host in your own AWS or Azure account.[17]
- Payload-free BEC and vendor-fraud detection
- 7.0
- Deployment effort and time to protection
- 7.0
- Microsoft 365 and Google Workspace coverage
- 9.0
- Explainable verdicts for finance and auditors
- 9.0
- Price transparency for SMB and mid-market
- 7.0
- EU hosting and DPA transparency
- 7.0
- Coverage beyond the inbox
- 4.0
Pros
- The most transparent detection logic in this list: open rules you can read and change.
- Free managed tier for up to 100 mailboxes.
- Managed cloud offers an EU (Dublin) region; self-hosting lets you choose any cloud region.
Cons
- Gets the most value from a team that writes and tunes rules.
- Account takeover and training not documented.
- Pricing
- Managed cloud free for the first 100 mailboxes; Enterprise quote-based
- Deployment
- API (ICES); managed cloud or self-hosted
- Platforms
- Microsoft 365, Google Workspace, IMAP
- Hosting
- Managed-cloud regions include EU (Dublin) and UK (London); or self-host in your own AWS or Azure region
Proofpoint
Overall score: 6.8out of 10Best for: Large enterprises that want BEC detection inside a full suite with DMARC, DLP, archiving and training add-ons.
Proofpoint Core Email Protection deploys via API (Microsoft Graph, no MX change) or inline. It names BEC and supplier threats, uses multi-model behavioral AI tied to Proofpoint Nexus threat intelligence, and owns Tessian (acquired 2023). Account Takeover Protection, Email Fraud Defense (DMARC and lookalike domains), DLP, archiving and ZenGuide training are sold as add-ons.[18]
- Payload-free BEC and vendor-fraud detection
- 8.0
- Deployment effort and time to protection
- 7.0
- Microsoft 365 and Google Workspace coverage
- 8.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 3.0
- EU hosting and DPA transparency
- 6.0
- Coverage beyond the inbox
- 9.0
Pros
- Deepest add-on portfolio: account takeover, DMARC and domain fraud, DLP, archiving, training.
- API or inline deployment from one vendor.
Cons
- Pricing not published.
- Some email data may be processed and stored in the US even for EU tenants, per its API privacy sheet (July 2026).
- Most BEC-adjacent controls are add-ons.
- Pricing
- Quote-based
- Deployment
- API (via Microsoft Graph) or inline gateway
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Core Email Protection API: EU or US data centre; some processing and storage in the US (privacy sheet, July 2026)
Mimecast
Overall score: 6.3out of 10Best for: Organizations that also need archiving, continuity or on-premises Exchange support from their BEC vendor.
Mimecast offers a Cloud Gateway (MX) and a Cloud Integrated API product. It features BEC, uses anomaly detection with social graphing and computer vision for brand and login-page impersonation, and supports on-premises and hybrid Exchange. Archive, DMARC Analyzer and awareness training are available.[19]
- Payload-free BEC and vendor-fraud detection
- 7.0
- Deployment effort and time to protection
- 7.0
- Microsoft 365 and Google Workspace coverage
- 9.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 3.0
- EU hosting and DPA transparency
- 6.0
- Coverage beyond the inbox
- 7.0
Pros
- Gateway or API in one vendor.
- Supports on-premises and hybrid Exchange.
- Long archive and continuity heritage.
Cons
- Pricing not published.
- Account-takeover coverage not documented.
- Pricing
- Quote-based
- Deployment
- Cloud Gateway (MX) or Cloud Integrated (API)
- Platforms
- Microsoft 365, Google Workspace, on-premises and hybrid Exchange
- Hosting
- Frankfurt data centres announced in 2018; current footprint not re-confirmed
Fortra (Agari, Cloud Email Protection)
Overall score: 6.1out of 10Best for: Enterprises that want BEC detection together with DMARC enforcement (Agari) and content-aware DLP (Clearswift).
Fortra combines Agari’s identity-deception and BEC detection, Cloud Email Protection (an API product launched in December 2023 that Fortra says uses machine learning, LLMs and neural networks) and the Clearswift gateway. QR-code detection was added in July 2024. Several of these facts come from search results because fortra.com blocks automated fetches.[21]
- Payload-free BEC and vendor-fraud detection
- 7.0
- Deployment effort and time to protection
- 6.0
- Microsoft 365 and Google Workspace coverage
- 9.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 3.0
- EU hosting and DPA transparency
- 4.0
- Coverage beyond the inbox
- 8.0
Pros
- BEC detection and DMARC enforcement from the same vendor.
- Clearswift adaptive-redaction DLP and an on-premises gateway option.
Cons
- Pricing not published; EU hosting not documented.
- Several products to assemble rather than one.
- Pricing
- Quote-based, tiered by number of users
- Deployment
- API (Cloud Email Protection) or gateway (Clearswift)
- Platforms
- Microsoft 365, Google Workspace, on-premises Exchange
- Hosting
- Not publicly documented
Trustpair
Best payment-step controlOverall score: 3.8out of 10Best for: Large finance teams that want every supplier bank account validated before payment, as a control behind email security.
Trustpair is not an email security tool: it does not scan email. It validates supplier bank accounts in 190 countries, monitors vendor master data and verifies payment files through ERP, P2P and treasury integrations such as SAP and Oracle. If a BEC email does persuade someone to change a supplier’s bank details, Trustpair is designed to flag the payment. Basware (owned by Accel-KKR) acquired Trustpair in 2026.[24]
- Payload-free BEC and vendor-fraud detection
- 1.0
- Deployment effort and time to protection
- 5.0
- Microsoft 365 and Google Workspace coverage
- 0.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 3.0
- EU hosting and DPA transparency
- 5.0
- Coverage beyond the inbox
- 9.0
Pros
- Stops the money even when the email got through.
- Account validation across 190 countries; up to $1M liability in its packages.
- SOC 2 Type 2, SOC 1 Type 2 and ISO 27001 listed on its home page.
Cons
- No email detection: it complements, not replaces, BEC protection in the mailbox.
- A finance-systems project, with pricing on quote.
- Pricing
- Quote-based packages with a fixed number of vendor evaluations per year
- Deployment
- ERP, P2P and TMS integrations via API, SFTP and 20+ connectors
- Platforms
- SAP, Oracle and other ERPs
- Hosting
- Not publicly documented
Eftsure
Overall score: 3.6out of 10Best for: Accounts-payable teams that want independent payee verification backed by a financial guarantee.
Eftsure is a payment-fraud control, not an email filter: no email scanning is documented. It independently verifies payees and bank accounts, re-verifies them continuously and stops payments to unverified payees, and offers the Eftsure Guarantee of up to $1M for customers signed after 10 March 2025. It announced the acquisition of Relish (US) in September 2026 and is reported to have acquired Sis ID (France) in 2025.[27]
- Payload-free BEC and vendor-fraud detection
- 1.0
- Deployment effort and time to protection
- 4.0
- Microsoft 365 and Google Workspace coverage
- 0.0
- Explainable verdicts for finance and auditors
- 5.0
- Price transparency for SMB and mid-market
- 3.0
- EU hosting and DPA transparency
- 4.0
- Coverage beyond the inbox
- 9.0
Pros
- Financial guarantee of up to $1M for eligible customers.
- Continuous re-verification of payee details.
Cons
- No email detection.
- EU hosting not documented; pricing on request.
- Pricing
- On request; scales with annual spend and new vendors per month; all features included
- Deployment
- Finance and AP system integration; 1–3 weeks to anomaly verification
- Platforms
- Finance, AP and ERP systems
- Hosting
- AWS, region not stated
How to choose BEC protection for Microsoft 365 and Google Workspace
BEC works because nothing in the email looks technically malicious. A typical case: a supplier’s mailbox is compromised, the attacker replies inside a real invoice thread, and asks finance to pay the next invoice to a new account. There is no link to rewrite and no file to sandbox. That is why the heaviest weight in our rubric is on payload-free detection.
Three layers stop BEC, and they are not interchangeable
- Native filtering (Microsoft Defender for Office 365, Gmail’s built-in protection) blocks spoofing and bulk phishing and is already on in your tenant.
- An API detection layer (Sentaro, Abnormal AI, IRONSCALES, Sublime Security, Check Point) reads intent and relationship history inside the mailbox, including internal and historical mail, and removes what native filtering lets through.
- A payment-step control (Trustpair, Eftsure) verifies the bank account before money moves, so a convincing email still cannot redirect a payment.
Most EU mid-market teams need the first two. Teams that pay many suppliers by bank transfer add the third. A good BEC tool should make the second layer cheap and fast enough that you do not have to choose.
Questions to ask every BEC vendor, including us
- Show me a BEC verdict on a message with no link or attachment. What signals decided it?
- Do you detect changed bank details inside an existing supplier thread, and do you scan internal mail?
- Do you need an MX change, and how long until protection starts on our live tenant?
- Do you cover Google Workspace as well as Microsoft 365, and Teams or Slack?
- What is the price per mailbox, in writing, and which features cost extra?
- Where is mail content processed, and which subprocessors see it? Send the DPA.
- Is account-takeover detection live today or on a roadmap?
Where BEC protection fits NIS2 and DORA
NIS2 and DORA ask in-scope firms to manage ICT risk and report significant incidents on tight deadlines. A BEC tool does not make you compliant with either. What it can provide is the email-layer control, the incident evidence (who received what, when, and what was done) and the vendor documentation for your supply-chain register. Sentaro is built for the controls regulated EU firms are asked to evidence.
Certification and compliance status
Exact states as Sentaro publishes them. We will update this the day anything changes.
- SOC 2
- In progressCertification in progress. Evidence pack on request.
- ISO 27001
- In progressCertification in progress; no target date published.
- Google CASA
- Verified API integration
- DPA and subprocessor list
- PublicLists every subprocessor with its location and role.
Frequently asked questions
What is the best BEC protection tool?
Sentaro, for EU teams on Microsoft 365 and Google Workspace. It detects business email compromise without needing a malicious link or attachment, by scoring intent, sender identity and relationship history, including suppliers that suddenly change banking details. It connects over API in four minutes with no MX change and costs $6 per protected account per month (USD). Sentaro publishes this list. If you need account-takeover detection live today, Abnormal AI and IRONSCALES document it.
Does Microsoft Defender for Office 365 stop business email compromise?
Partly. Plan 1 adds user and domain impersonation protection with mailbox intelligence, which catches many spoofed-executive and lookalike-domain messages. Microsoft documents no dedicated vendor-email-compromise feature, so messages sent from a real but compromised supplier account are where an API layer such as Sentaro adds the most. Defender stays on underneath; Sentaro is designed to run with it.
Can BEC be detected without a link or attachment?
Yes, and it has to be, because most BEC carries neither. Detection relies on intent (a payment request, secrecy, an artificial deadline), sender signals (display-name mismatch, newly registered lookalike domain) and relationship context (a known supplier suddenly changing bank details, a reply injected into an old thread). Sentaro’s Message vector treats payload-free BEC as a core design target.
What is the difference between BEC and vendor email compromise?
Business email compromise is the umbrella term for fraud by email impersonation or account misuse. Vendor email compromise (VEC) is the variant where the attacker controls or imitates a real supplier, usually inside an existing invoice thread, to redirect a payment. VEC is harder to catch because the sender may be genuine, which is why thread and relationship history matter.
Do I need a payment-verification tool like Trustpair or Eftsure as well?
If you pay many suppliers by bank transfer, it is a sensible second control. Trustpair and Eftsure do not scan email; they verify the bank account before payment, so they stop the money even if a fraudulent email convinced someone. Email-layer BEC protection stops the request from reaching finance in the first place. The two work together.
How much does BEC protection cost?
Among the email tools here, only some publish prices: Sentaro charges $6 per protected account per month or $68 per year, with the first account free; Defender for Office 365 Plan 1 is $2 and Plan 2 $5 per user per month; Sublime Security is free to 100 mailboxes on its managed cloud. Abnormal AI, Proofpoint, Mimecast, Check Point, IRONSCALES and Fortra quote on request. Prices in USD as of 21 October 2026.
How fast can BEC protection be deployed?
API-based tools are the fastest because nothing in your mail routing changes. Sentaro connects in four minutes with historical visibility within 15 minutes; Abnormal AI states 60 seconds; IRONSCALES and Check Point state minutes. Gateways that need an MX change take longer to plan. Payment-verification tools take days to weeks because they integrate with finance systems.
Sources and method
Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Sentaro is our product. Competitor facts come from each vendor’s public pages listed below; capabilities change, so check current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Sentaro pricing
- Sentaro Data Processing Agreement and subprocessor list
- Sentaro: Platform (deployment, Vord engine)
- Sentaro: Message vector (BEC, vendor compromise, thread hijack)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
- Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
- Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to Microsoft 365 E3 (2026-06-17)
- Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
- Abnormal AI: Inbound Email Security (accessed 2026-10-18)
- Abnormal AI: Trust center (certifications)
- IRONSCALES: Home page (accessed 2026-10-18)
- IRONSCALES: Pricing (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration admin guide, data residency
- Sublime Security docs: Installation (accessed 2026-10-18)
- GitHub: sublime-security/sublime-rules detection rules
- Proofpoint: Core Email Protection (accessed 2026-10-18)
- Mimecast: Email Security (accessed 2026-10-18)
- Datacentre News: Mimecast opens two Frankfurt data centres (2018)
- Fortra: Cloud Email Protection (accessed 2026-10-21)
- Fortra: New Cloud Email Protection features, QR code detection (July 2024)
- Trustpair: Home page (accessed 2026-10-21)
- Trustpair: Pricing (accessed 2026-10-21)
- ITPro: Basware to acquire Trustpair (2026)
- Eftsure: Home page (accessed 2026-10-21)
- Eftsure: Pricing (accessed 2026-10-21)
- FBI IC3: Internet Crime Report 2025
- Abnormal AI: Subprocessors (updated 31 July 2026; accessed 2026-10-21)
- IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
- Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)
- Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)