Best tools · 2026Victor TräffWritten by Victor Träff · Security expert and co-founder, Sentaro Reviewed

10 best cloud email security solutions (API and ICES) for 2026

The best cloud email security solution for EU teams on Microsoft 365 and Google Workspace in 2026 is Sentaro, an API-based (ICES) platform that connects in four minutes with no MX change, reads internal and historical mail, and covers OAuth apps and AI tools at one published price. The other strong options are Check Point Harmony Email & Collaboration, Abnormal AI and IRONSCALES. We scored 10 API-based email security products on seven weighted criteria from vendor documentation checked on 21 October 2026.

  • 10 API-based tools scored
  • Weighted method published
  • Last verified 21 October 2026
  • No MX change required
Start free with one accountSpeak to sales
Our recommendation

Sentaro is the best cloud email security solution for EU teams on Microsoft 365 and Google Workspace. It is API-only by design, so there is no MX change and nothing to install; it is built for payload-free BEC and vendor compromise; and it puts OAuth grants and AI tools in the same console at one published price. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.

Why Sentaro wins
four-minute API connection with historical visibility in 15 minutes; Message vector verdicts on intent, sender and relationship signals, with the reasoning shown; App vector for OAuth and shadow AI; $6 per protected account per month, first account free (prices in USD); hosted in Sweden on Microsoft Azure.
Choose Sentaro if
you keep Microsoft’s or Google’s native filtering for bulk threats and want a second layer for targeted fraud and app risk without a project.
Consider another option only if
you need verdicts inside the Defender portal (Darktrace is a Microsoft ICES Vendor Ecosystem partner), inline prevention through the API today (Check Point), or account-takeover detection live now (Abnormal, Check Point).

Quick picks

  • Best overallSentaro Our pickAPI in four minutes, payload-free fraud detection, OAuth and AI tools, published price.
  • Best for inline API preventionCheck Point Harmony Email & CollaborationBlocks before the inbox through the API; eight collaboration apps.
  • Best for enterprise behavioral AIAbnormal AIPer-employee and per-vendor baselines plus account-takeover protection.
  • Best for verdicts in DefenderDarktrace / EMAILListed in Microsoft’s ICES Vendor Ecosystem; needs Plan 2 or E5.
  • Best for detection engineersSublime SecurityOpen rules, self-hosting, free to 100 mailboxes.

At a glance

What we compared
Cloud email security that connects to Microsoft 365 and/or Google Workspace over API (integrated cloud email security, ICES), including vendors that also offer inline or MX modes
Vendors scored
10, from Microsoft’s ICES ecosystem, the vendors AI answers name for “ICES vendors”, and the most-listed API products on ranking lists
Audience
EU teams on Microsoft 365 and Google Workspace adding an API layer next to native filtering, run by a small IT team
Method
Seven weighted criteria (sum 100), scored 0–10 per vendor from public documentation; undocumented scores low-middle
Last verified
21 October 2026
Publisher
Sentaro AB, Stockholm. Sentaro is one of the products ranked.
Neutral explainer
For definitions and a 16-vendor fact table without scores, see our ICES vendors compared guide.

The 10 best cloud email security solutions compared

Ranked by overall score. “Not publicly documented” means we did not find it in the vendor’s public material on 21 October 2026.

CapabilityScoreAPI modesPlatformsPublic pricePre-delivery option
Sentaro (our pick)[2]8.9API only, no MX changeMicrosoft 365, Google WorkspaceYes$6/account/monthPartialBlock or tag before interaction
Check Point Harmony[6]8.1API, monitor to inlineMicrosoft 365, Google WorkspaceNoQuoteYesInline via API
Abnormal AI[9]7.1APIMicrosoft 365, Google WorkspaceNoQuoteNot publicly documented
IRONSCALES[12]6.8API, alongside a gatewayMicrosoft 365, Google WorkspaceNoTiers published, prices on quoteNot publicly documented
Material Security[13]6.6APIMicrosoft 365, Google WorkspaceYesFrom $4/user/monthNot publicly documented
Cloudflare Email Security[15]6.5MX, API, journaling, mixedMicrosoft 365, Google WorkspaceNoPlans published, prices notYesMX/inline
Sublime Security[17]6.3API; managed or self-hostedMicrosoft 365, Google Workspace, IMAPPartialFree to 100 mailboxesNot publicly documented
Trend Micro[20]6.2API; inline add-onMicrosoft 365, Google WorkspaceNoQuotePaid add-onInline for Exchange Online
Darktrace / EMAIL[22]6.1API or API + journalingMicrosoft 365NoQuoteYesJournaling before inbox
FortiMail Workspace Security[23]5.7API (ICES)Microsoft 365, Google WorkspaceNoQuoteNot publicly documented

Prices in USD as published on 21 October 2026. Check each vendor’s current documentation before you buy.

  • Yes
  • Partial
  • No
  • On roadmap
  • Paid add-on
  • Not publicly documented
Try it on your own tenant. API connection in about four minutes, alongside what you run today. $6 per account / month.Start freeSpeak to sales →

How we evaluated cloud email security

Every product here already avoids the MX change, so the criteria focus on what separates API tools from each other for an EU team adding a layer next to Defender or Gmail’s built-in protection: what the engine catches that native filtering misses, how deep and fast the API connection is, and what can be verified before buying. Pre-delivery action and Defender-portal integration matter to some buyers and are weighted accordingly.

CriterionWeightWhy it matters
Behavioral detection of payload-free fraud22%The point of a second layer is the targeted fraud native filters pass: payment redirects, supplier bank-detail changes, hijacked threads. We score intent, relationship and vendor-compromise detection.
API depth and time to protection18%API tools differ in setup time, whether they read internal and historical mail, and whether a plan tier gates API mode.
Microsoft 365 and Google Workspace parity15%Several vendors document Microsoft 365 more fully than Google Workspace. Equal depth on both scores highest.
Collaboration and OAuth app coverage13%Cloud mail sits next to chat, file sharing and OAuth-connected apps. Consent phishing and shadow AI arrive through the same tenant.
Pricing transparency12%Published per-user prices let a small team compare before talking to sales.
EU hosting and data-handling disclosure10%An API tool reads mailbox content, so NIS2 and DORA buyers need the hosting region and subprocessor list in writing.
Pre-delivery action and Defender integration10%Some buyers want messages stopped before the inbox or verdicts inside the Defender portal (Microsoft’s ICES Vendor Ecosystem, which requires Plan 2 or E5).

Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Overall score = weighted average of the seven criteria. Capabilities we could not find publicly score 3–5.

The 10 best cloud email security solutions, ranked

Ten API-based products, highest score first. The pre-delivery and Defender-integration score is where Sentaro is weakest; it is shown on every entry so you can compare.

  1. Sentaro

    Our pickOverall score: 8.9out of 10

    Best for: EU teams on Microsoft 365 and Google Workspace that want an API layer for BEC, QR-code and consent phishing, plus OAuth and AI-tool visibility, at a published price.

    Sentaro is an ICES-category platform: it connects through the Microsoft 365 and Google Workspace admin APIs in four minutes and runs behind native filtering. Vord, Sentaro’s proprietary engine, reads every inbound and internal message for intent, sender identity and relationship history and reaches one explained verdict before interaction. The App vector inventories every app, AI tool and OAuth grant in the tenant. Hosted in Sweden on Microsoft Azure.[2]

    Behavioral detection of payload-free fraud
    9.0
    API depth and time to protection
    10.0
    Microsoft 365 and Google Workspace parity
    9.0
    Collaboration and OAuth app coverage
    9.0
    Pricing transparency
    10.0
    EU hosting and data-handling disclosure
    8.0
    Pre-delivery action and Defender integration
    6.0

    Pros

    • Four-minute API setup; MX record untouched; internal and historical mail covered.
    • Payload-free BEC and vendor-compromise detection, with the reasoning shown on every verdict in the console.
    • Email and OAuth/AI-tool risk in one product and one price.
    • Published price and published hosting; DPA and subprocessors public.

    Cons

    • Not part of Microsoft’s ICES Vendor Ecosystem, so verdicts are not shown inside the Defender portal.
    • Account takeover (Behavioral) and leaked-credential monitoring (Identity) are Q4 2026 roadmap.
    • SOC 2 and ISO 27001 certification in progress.
    Pricing
    $6 per protected account per month or $68 per year; first account free (USD)
    Deployment
    API via the Microsoft 365 and Google Workspace admin SDKs; no MX change
    Platforms
    Microsoft 365, Google Workspace, Slack, Teams
    Hosting
    Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
    More on Sentaro Vendor site

  2. Check Point Harmony Email & Collaboration

    Best for inline API preventionOverall score: 8.1out of 10

    Best for: Teams that want an API product that can block before the inbox and also covers file-sharing and chat apps.

    Check Point contrasts its approach with “API-only … after delivery” tools: enforcement is configurable from monitor mode to inline prevention through the API, so messages can be stopped before they reach the inbox without an MX change. It also covers Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox and ShareFile.[6]

    Behavioral detection of payload-free fraud
    8.0
    API depth and time to protection
    9.0
    Microsoft 365 and Google Workspace parity
    10.0
    Collaboration and OAuth app coverage
    9.0
    Pricing transparency
    4.0
    EU hosting and data-handling disclosure
    7.0
    Pre-delivery action and Defender integration
    9.0

    Pros

    • Inline prevention through the API.
    • Broadest collaboration-app coverage in this list.
    • Selectable Ireland data region.

    Cons

    • Quote-based pricing.
    • DMARC, archiving and training are add-ons.
    • QR-code phishing not named on the pages we checked.
    Pricing
    Quote-based (four published tiers)
    Deployment
    API with configurable inline prevention; no MX change
    Platforms
    Microsoft 365, Google Workspace, plus Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox
    Hosting
    Data residency regions include Ireland (EMEA), per the admin guide
    Sentaro vs Check Point Harmony Email Vendor site

  3. Abnormal AI

    Best for enterprise behavioral AIOverall score: 7.1out of 10

    Best for: Large enterprises that want behavioral email security with account-takeover protection and a long certification list.

    Abnormal AI builds a behavioral baseline for every employee and vendor and reads authentication events, calendar activity and internal threads. It deploys via API with no MX change; Abnormal states “Deploy in 60 seconds via API.” It does not state pre-delivery blocking, and its subprocessor list offers AWS hosting in the US or the EU (Ireland), set by subscription.[9]

    Behavioral detection of payload-free fraud
    9.0
    API depth and time to protection
    9.0
    Microsoft 365 and Google Workspace parity
    9.0
    Collaboration and OAuth app coverage
    5.0
    Pricing transparency
    3.0
    EU hosting and data-handling disclosure
    7.0
    Pre-delivery action and Defender integration
    4.0

    Pros

    • Behavioral baselines across employees and vendors.
    • Account-takeover protection available today.
    • Extensive certifications listed on its trust center.

    Cons

    • No public price.
    • EU (Ireland) hosting is a subscription choice; the US is the other listed location.
    • Pre-delivery blocking not stated by the vendor.
    Pricing
    Quote-based
    Deployment
    API (ICES); no MX change
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    AWS in the US or EU (Ireland), by subscription (subprocessor list)
    Sentaro vs Abnormal Security Vendor site

  4. IRONSCALES

    Best for SMB and MSP API securityOverall score: 6.8out of 10

    Best for: SMBs and MSPs that want an API layer next to their gateway, with crowdsourced intelligence and simulation bundled.

    IRONSCALES works at mailbox level over API and alongside an existing gateway. It combines per-mailbox behavioral baselines with threat intelligence crowdsourced from other customers’ reports, and remediates automatically after delivery.[11]

    Behavioral detection of payload-free fraud
    8.0
    API depth and time to protection
    9.0
    Microsoft 365 and Google Workspace parity
    8.0
    Collaboration and OAuth app coverage
    5.0
    Pricing transparency
    4.0
    EU hosting and data-handling disclosure
    6.0
    Pre-delivery action and Defender integration
    5.0

    Pros

    • Fast API deployment next to an existing gateway.
    • Crowdsourced threat intelligence.
    • Monthly, cancellable billing option.

    Cons

    • Prices not published.
    • Subprocessor list names AWS in both the USA and Germany without saying which customers are hosted where.
    • OAuth app coverage not documented.
    Pricing
    Quote-based (plan tiers published, prices not)
    Deployment
    API at mailbox level; works alongside a gateway
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    Subprocessor list names AWS in the USA and AWS Europe (Germany) for the primary application platform
    Sentaro vs IRONSCALES Vendor site

  5. Material Security

    Best for Google Workspace OAuth and DriveOverall score: 6.6out of 10

    Best for: Google Workspace-heavy organizations that want OAuth, Drive and post-compromise controls alongside inbound email security.

    Material Security is an API product for Microsoft 365 and Google Workspace focused on what happens after a malicious message lands or an account is compromised: message-level controls on sensitive content, OAuth app inventory and Drive exposure. It publishes per-user prices.[13]

    Behavioral detection of payload-free fraud
    6.0
    API depth and time to protection
    8.0
    Microsoft 365 and Google Workspace parity
    8.0
    Collaboration and OAuth app coverage
    7.0
    Pricing transparency
    8.0
    EU hosting and data-handling disclosure
    4.0
    Pre-delivery action and Defender integration
    4.0

    Pros

    • Published per-user pricing.
    • OAuth and Drive controls in the same product.
    • Self-serve free trial.

    Cons

    • Shared Drive fee amount not shown.
    • No EU hosting region documented; its subprocessor list names Google Cloud infrastructure in the U.S.A.
    • Account-takeover resilience is an add-on.
    Pricing
    Essentials $4, Advanced $6 per user/month plus a Shared Drive fee, billed annually
    Deployment
    API (ICES)
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    No EU region documented; subprocessor list names Google Cloud infrastructure in the U.S.A.
    Sentaro vs Material Security Vendor site

  6. Cloudflare Email Security

    Best for mixed deployment modesOverall score: 6.5out of 10

    Best for: Existing Cloudflare Zero Trust customers that want to combine MX, API and journaling modes.

    Formerly Area 1 Security, acquired by Cloudflare in 2022. It supports MX/inline, API and BCC/journaling deployments and a mixed inline-plus-API mode, with deep link crawling that includes QR codes. API and mixed modes require the Enterprise plan.[16]

    Behavioral detection of payload-free fraud
    7.0
    API depth and time to protection
    6.0
    Microsoft 365 and Google Workspace parity
    8.0
    Collaboration and OAuth app coverage
    5.0
    Pricing transparency
    4.0
    EU hosting and data-handling disclosure
    6.0
    Pre-delivery action and Defender integration
    9.0

    Pros

    • Every deployment mode, including mixed inline and API.
    • QR-code link crawling in all plans.
    • Bundles with Cloudflare Zero Trust and DNS.

    Cons

    • API mode needs the Enterprise plan.
    • No public prices.
    • Regional processing (US, Germany, India, Australia) only for MX/inline and BCC deployments; where data is stored is not stated.
    Pricing
    Quote-based annual contract per user
    Deployment
    MX/inline, API, or BCC/journaling
    Platforms
    Microsoft 365, Google Workspace, other providers via MX
    Hosting
    Email processing region selectable (US, Germany, India, Australia) for MX/inline and BCC deployments; storage location not stated
    Vendor site

  7. Sublime Security

    Best for detection engineersOverall score: 6.3out of 10

    Best for: SOC teams that want to inspect and write their own detection rules, managed or self-hosted.

    Sublime connects over API to Microsoft 365, Google Workspace and IMAP. Detections are written in its Message Query Language, with an open rule library on GitHub and AI agents that triage reports and draft new rules. The managed cloud is free for the first 100 mailboxes.[17]

    Behavioral detection of payload-free fraud
    7.0
    API depth and time to protection
    7.0
    Microsoft 365 and Google Workspace parity
    8.0
    Collaboration and OAuth app coverage
    3.0
    Pricing transparency
    7.0
    EU hosting and data-handling disclosure
    7.0
    Pre-delivery action and Defender integration
    4.0

    Pros

    • Open, inspectable detection rules.
    • Free tier up to 100 mailboxes.
    • Self-hosting option.

    Cons

    • Rules-first model needs detection-engineering time.
    • No collaboration or OAuth coverage documented.
    • Managed-cloud EU (Dublin) region documented, but other subprocessor locations need checking in the DPA.
    Pricing
    Managed cloud: first 100 mailboxes free; Enterprise quote-based
    Deployment
    API (ICES); managed cloud or self-hosted
    Platforms
    Microsoft 365, Google Workspace, IMAP
    Hosting
    Managed-cloud regions include EU (Dublin) and UK (London); or self-host in your own AWS or Azure region
    Sentaro vs Sublime Security Vendor site

  8. Trend Micro (TrendAI Vision One Email and Collaboration Security)

    Best for Trend Vision One customersOverall score: 6.2out of 10

    Best for: Organizations already on Trend Vision One that want email, collaboration and XDR in one console.

    Formerly Cloud App Security. Trend integrates over API without rerouting mail and offers an inline protection mode for Exchange Online through transport rules and connectors, with no MX change, under an add-on licence. Trend describes writing-style analysis for BEC and visual AI for lookalike sites.[19]

    Behavioral detection of payload-free fraud
    7.0
    API depth and time to protection
    6.0
    Microsoft 365 and Google Workspace parity
    8.0
    Collaboration and OAuth app coverage
    6.0
    Pricing transparency
    3.0
    EU hosting and data-handling disclosure
    4.0
    Pre-delivery action and Defender integration
    8.0

    Pros

    • API and inline modes, plus on-premises products from one vendor.
    • Part of the Vision One XDR console.
    • DLP with 200+ compliance templates.

    Cons

    • No public pricing.
    • Inline mode is a separate licence.
    • EU hosting not documented.
    Pricing
    Quote-based
    Deployment
    API without rerouting mail; inline mode for Exchange Online via transport rules (add-on); gateway also available
    Platforms
    Microsoft 365, Google Workspace, on-premises Exchange; Teams, SharePoint, OneDrive, Box, Dropbox
    Hosting
    Not publicly documented
    Vendor site

  9. Darktrace / EMAIL

    Best for verdicts in the Defender portalOverall score: 6.1out of 10

    Best for: Microsoft 365 organizations on Defender Plan 2 or E5 that want third-party verdicts inside the Defender portal.

    Darktrace’s behavioral AI “learns from your own organization’s activity and users, not a shared cross-customer model.” It deploys via API, or API plus journaling for Microsoft 365, which receives a copy in transport before the inbox. Microsoft Learn lists Darktrace in its ICES Vendor Ecosystem.[21]

    Behavioral detection of payload-free fraud
    8.0
    API depth and time to protection
    7.0
    Microsoft 365 and Google Workspace parity
    5.0
    Collaboration and OAuth app coverage
    6.0
    Pricing transparency
    3.0
    EU hosting and data-handling disclosure
    4.0
    Pre-delivery action and Defender integration
    8.0

    Pros

    • Verdicts surface in the Defender portal (Plan 2 or E5).
    • Per-organization behavioral model.
    • Collaboration coverage across Teams, Zoom and Slack.

    Cons

    • Google Workspace support not confirmed.
    • No public pricing.
    • EU hosting not documented.
    Pricing
    Quote-based
    Deployment
    API, or API plus journaling for Microsoft 365
    Platforms
    Microsoft 365 (Google Workspace not confirmed)
    Hosting
    Not publicly documented
    Vendor site

  10. FortiMail Workspace Security (Fortinet, formerly Perception Point)

    Best for Fortinet Security FabricOverall score: 5.7out of 10

    Best for: Fortinet customers that want ICES plus browser and collaboration-app security with managed incident response included.

    Fortinet acquired Perception Point in December 2024 and sells it as FortiMail Workspace Security, an ICES product for Microsoft 365 and Google Workspace that extends to browsers, Slack, Teams, Salesforce and Zendesk, with a 24x7 managed incident response service included. Fortinet states it uses machine learning, large language models and optical scanning.[23]

    Behavioral detection of payload-free fraud
    5.0
    API depth and time to protection
    6.0
    Microsoft 365 and Google Workspace parity
    8.0
    Collaboration and OAuth app coverage
    8.0
    Pricing transparency
    3.0
    EU hosting and data-handling disclosure
    4.0
    Pre-delivery action and Defender integration
    5.0

    Pros

    • 24x7 managed incident response included.
    • Coverage beyond email: browsers and business apps.
    • Security Fabric integration.

    Cons

    • Most detection line items not documented publicly.
    • Quote-only pricing.
    • Hosting locations not listed.
    Pricing
    Quote-based (per user per year for Cloud SaaS)
    Deployment
    API (ICES); FortiMail gateway, VM and appliance options separately
    Platforms
    Microsoft 365, Google Workspace; Teams, Slack, OneDrive, Dropbox, Salesforce, Zendesk, browsers
    Hosting
    Not publicly documented
    Vendor site

How to choose a cloud email security solution

Cloud email security, also called API-based email security or integrated cloud email security (ICES), connects to Microsoft 365 or Google Workspace through the platform’s APIs instead of sitting in front of the mail server. Native filtering still handles bulk spam and malware; the API layer looks at what got through, including mail between your own users.

API-only, inline via API, or mixed modes

ModeWhat happensWho offers it here
API, post-deliveryThe tool reads delivered mail through the API and removes or labels threatsIRONSCALES and Sublime document post-delivery remediation; Abnormal, Material and Darktrace (API-only mode) do not state pre-delivery blocking
Before interaction via APIVerdict lands before the user acts: blocked, quarantined or tagged inlineSentaro (block or tag before interaction), Check Point (inline prevention via API)
Journaling or transport rulesA copy or the message passes the vendor in transport, with no MX changeDarktrace (API + journaling), Trend Micro (inline add-on for Exchange Online)
MX/inline plus APIClassic gateway routing combined with API remediationCloudflare (Enterprise for API and mixed modes)

Does it work alongside Microsoft Defender for Office 365?

API-based products run after Microsoft’s built-in protection rather than in front of it, so they work alongside Defender for Office 365. Microsoft goes further for a short list of partners: its ICES Vendor Ecosystem passes partner verdicts into Defender’s quarantine, Threat Explorer and reports, and requires Defender for Office 365 Plan 2 or Microsoft 365 E5. As of Microsoft Learn’s July 2026 update, the listed partners are Darktrace, KnowBe4 and VIPRE. If you live in the Defender portal, weigh that; if you do not hold Plan 2, it does not apply.

Questions to ask every API email security vendor

  • Which API permissions do you request in Microsoft 365 and Google Workspace, and why each one?
  • Do you act before the user can interact with a message, or only after delivery?
  • Do you scan internal mail and historical mail, and how far back on day one?
  • Is API mode available on every plan, or only on a higher tier?
  • Do you cover OAuth grants and AI tools connected to the tenant, or only mail?
  • Where is mailbox content processed, how long is it retained, and who are your subprocessors?
  • What is the published price per mailbox?

For definitions, Microsoft’s ICES program and a 16-vendor fact table without scores, see our ICES vendors compared guide. If you are deciding whether to keep a gateway in front of mail at all, read our secure email gateway alternatives list.

Certification and compliance status

Sentaro’s status, stated exactly; we’ll update it the day each certificate is signed.

SOC 2
In progressNo target date published. Evidence pack on request.
ISO 27001
In progressNo target date published.
Google CASA
Verified API integration
DPA and subprocessor list
Public[3]

Frequently asked questions

What is the best cloud email security solution?

Sentaro, for EU teams on Microsoft 365 and Google Workspace. It is API-based (ICES), connects in four minutes with no MX change, reads internal and historical mail, targets payload-free BEC and vendor compromise, and covers OAuth apps and AI tools in the same product for $6 per protected account per month, first account free (prices in USD). Check Point Harmony and Abnormal AI are the next strongest on our method.

What is integrated cloud email security (ICES)?

Integrated cloud email security is the category of tools that protect Microsoft 365 or Google Workspace by connecting through the platform’s APIs rather than rerouting mail through a secure email gateway. ICES tools deploy without an MX change, run alongside native filtering, and can inspect internal and historical mail, which a gateway does not see.

Which are the best ICES vendors?

On our weighted method for EU teams: Sentaro (8.9), Check Point Harmony Email & Collaboration (8.1), Abnormal AI (7.1), IRONSCALES and Material Security (6.6), Cloudflare (6.3), Sublime Security and Trend Micro (6.2), Darktrace (6.1) and FortiMail Workspace Security (5.7). Microsoft separately lists Darktrace, KnowBe4 and VIPRE as ICES Vendor Ecosystem partners in Defender.

Is API-based email security better than a secure email gateway?

For organizations whose mail already lives in Microsoft 365 or Google Workspace, API-based tools are faster to deploy and see internal mail a gateway cannot. A gateway still makes sense if you need archiving, continuity, outbound encryption policies or on-premises Exchange support from the same product. Many teams move from a gateway to native filtering plus an API layer.

Do cloud email security tools work with Microsoft Defender for Office 365?

Yes. API-based products connect to the mailbox after Microsoft’s built-in protection has filtered mail, so they run alongside Defender for Office 365. Sentaro is designed to run with Defender and Google’s native filtering rather than replace them. Only Microsoft’s ICES Vendor Ecosystem partners pass their verdicts into the Defender portal, which requires Plan 2 or Microsoft 365 E5.

Which cloud email security vendors publish their prices?

In this list, Sentaro ($6 per protected account per month or $68 per year, first account free) and Material Security ($4 or $6 per user per month plus a Shared Drive fee) publish prices, and Sublime Security publishes a free managed tier for the first 100 mailboxes. The other seven quote on request.

Does an API-based tool read all our email?

It needs access to mailbox content to analyze it, which is why hosting and subprocessors matter. Sentaro says analysis is automated and nobody at Sentaro reads your mail in the course of providing the service; its public DPA states retention periods and lists its subprocessors. Ask every vendor for the same in writing.

Sources and method

Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities and prices change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.

  1. Sentaro pricing
  2. Sentaro: platform (deployment, Vord engine, vectors)
  3. Sentaro Data Processing Agreement and subprocessor list
  4. Microsoft Learn: Defender for Office 365 ICES Vendor Ecosystem (ms.date 17 Jul 2026)
  5. Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to Microsoft 365 E3 (2026-06-17)
  6. Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
  7. Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)
  8. Check Point: Harmony Email & Collaboration admin guide, data residency
  9. Abnormal AI: Inbound Email Security (accessed 2026-10-18)
  10. Abnormal AI: Subprocessors (updated 31 July 2026, accessed 2026-10-21)
  11. IRONSCALES: Home page (accessed 2026-10-18)
  12. IRONSCALES: Pricing (accessed 2026-10-18)
  13. Material Security: Pricing (accessed 2026-10-18)
  14. Material Security: home page (products, setup quote)
  15. Cloudflare docs: Email Security setup and deployment modes
  16. Cloudflare: Email Security product plans (Q3 2025)
  17. Sublime Security docs: Installation (accessed 2026-10-18)
  18. GitHub: sublime-security/sublime-rules detection rules
  19. Trend Micro: TrendAI Vision One Email and Collaboration Security (accessed 2026-10-18)
  20. Trend Micro docs: Inline protection settings for Exchange Online
  21. Darktrace: Darktrace / EMAIL (accessed 2026-10-18)
  22. Darktrace: Why API + journaling for Microsoft 365 (4 Nov 2025)
  23. Fortinet: FortiMail Workspace Security (formerly Perception Point)
  24. Fortinet: FortiMail Email and Workspace Security (accessed 2026-10-21)
  25. IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
  26. Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)
  27. Cloudflare docs: Email Security regional processing (accessed 2026-10-21)
  28. Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)
RelatedICES vendors comparedBest email security softwareBest secure email gateway alternativesAPI email security vs secure email gatewayEmail security for Microsoft 365Sentaro vs Abnormal SecurityPricing

Connect Sentaro over API in four minutes.

No MX change, no agents. The first account is free.

Speak to salesStart free