[{"data":1,"prerenderedAt":739},["ShallowReactive",2],{"money-live:best":3,"money:best:cloud-email-security":4,"money-links:\u002Fen\u002Fbest\u002Fcloud-email-security":718},true,{"page":5},{"family":6,"bestCategory":7,"slug":8,"navLabel":9,"hubBlurb":10,"icon":11,"eyebrow":12,"h1":13,"lede":14,"seoTitle":15,"seoDescription":16,"reviewed":17,"aliases":18,"heroChips":22,"about":27,"mentions":31,"sections":42,"faqs":592,"sources":614,"disclaimer":693,"related":694,"cta":715},"best","email","cloud-email-security","Best cloud email security","The 10 best cloud email security (API-based, ICES) solutions for Microsoft 365 and Google Workspace, scored on a published method. Sentaro is our pick.","plug","Best tools · 2026","10 best cloud email security solutions (API and ICES) for 2026","The best cloud email security solution for EU teams on Microsoft 365 and Google Workspace in 2026 is Sentaro, an API-based (ICES) platform that connects in four minutes with no MX change, reads internal and historical mail, and covers OAuth apps and AI tools at one published price. The other strong options are Check Point Harmony Email & Collaboration, Abnormal AI and IRONSCALES. We scored 10 API-based email security products on seven weighted criteria from vendor documentation checked on 21 October 2026.","10 best cloud email security solutions (2026)","The 10 best cloud-based, API (ICES) email security solutions for Microsoft 365 and Google Workspace in 2026, scored on a published method. Our pick: Sentaro.","2026-10-21",[19,20,21],"cloud email security","API-based email security","cloud-based email security",[23,24,25,26],"10 API-based tools scored","Weighted method published","Last verified 21 October 2026","No MX change required",[28],{"name":29,"type":30},"Integrated cloud email security","Thing",[32,35,38,40],{"name":33,"type":34},"Check Point Harmony Email & Collaboration","SoftwareApplication",{"name":36,"type":37},"Abnormal AI","Organization",{"name":39,"type":37},"Darktrace",{"name":41,"type":34},"Microsoft Defender for Office 365",[43,57,78,104,214,244,514,566,571],{"t":44,"title":45,"summary":46,"points":47},"verdict","Our recommendation","Sentaro is the best cloud email security solution for EU teams on Microsoft 365 and Google Workspace. It is API-only by design, so there is no MX change and nothing to install; it is built for payload-free BEC and vendor compromise; and it puts OAuth grants and AI tools in the same console at one published price. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.",[48,51,54],{"label":49,"text":50},"Why Sentaro wins","four-minute API connection with historical visibility in 15 minutes; Message vector verdicts on intent, sender and relationship signals, with the reasoning shown; App vector for OAuth and shadow AI; $6 per protected account per month, first account free (prices in USD); hosted in Sweden on Microsoft Azure.",{"label":52,"text":53},"Choose Sentaro if","you keep Microsoft’s or Google’s native filtering for bulk threats and want a second layer for targeted fraud and app risk without a project.",{"label":55,"text":56},"Consider another option only if","you need verdicts inside the Defender portal (Darktrace is a Microsoft ICES Vendor Ecosystem partner), inline prevention through the API today (Check Point), or account-takeover detection live now (Abnormal, Check Point).",{"t":58,"items":59},"picks",[60,64,67,70,74],{"label":61,"vendor":62,"reason":63,"own":3},"Best overall","Sentaro","API in four minutes, payload-free fraud detection, OAuth and AI tools, published price.",{"label":65,"vendor":33,"reason":66},"Best for inline API prevention","Blocks before the inbox through the API; eight collaboration apps.",{"label":68,"vendor":36,"reason":69},"Best for enterprise behavioral AI","Per-employee and per-vendor baselines plus account-takeover protection.",{"label":71,"vendor":72,"reason":73},"Best for verdicts in Defender","Darktrace \u002F EMAIL","Listed in Microsoft’s ICES Vendor Ecosystem; needs Plan 2 or E5.",{"label":75,"vendor":76,"reason":77},"Best for detection engineers","Sublime Security","Open rules, self-hosting, free to 100 mailboxes.",{"t":79,"id":80,"title":81,"items":82},"facts","at-a-glance","At a glance",[83,86,89,92,95,98,101],{"label":84,"value":85},"What we compared","Cloud email security that connects to Microsoft 365 and\u002For Google Workspace over API (integrated cloud email security, ICES), including vendors that also offer inline or MX modes",{"label":87,"value":88},"Vendors scored","10, from Microsoft’s ICES ecosystem, the vendors AI answers name for “ICES vendors”, and the most-listed API products on ranking lists",{"label":90,"value":91},"Audience","EU teams on Microsoft 365 and Google Workspace adding an API layer next to native filtering, run by a small IT team",{"label":93,"value":94},"Method","Seven weighted criteria (sum 100), scored 0–10 per vendor from public documentation; undocumented scores low-middle",{"label":96,"value":97},"Last verified","21 October 2026",{"label":99,"value":100},"Publisher","Sentaro AB, Stockholm. Sentaro is one of the products ranked.",{"label":102,"value":103},"Neutral explainer","For definitions and a 16-vendor fact table without scores, see our ICES vendors compared guide.",{"t":105,"id":106,"title":107,"intro":108,"columns":109,"groups":115,"footnote":213},"compare","summary","The 10 best cloud email security solutions compared","Ranked by overall score. “Not publicly documented” means we did not find it in the vendor’s public material on 21 October 2026.",[110,111,112,113,114],"Score","API modes","Platforms","Public price","Pre-delivery option",[116],{"rows":117},[118,131,142,150,159,167,177,186,196,205],{"label":119,"cells":120,"source":130},"Sentaro (our pick)",[121,122,123,124,127],"8.9","API only, no MX change","Microsoft 365, Google Workspace",{"mark":125,"text":126},"yes","$6\u002Faccount\u002Fmonth",{"mark":128,"text":129},"partial","Block or tag before interaction",2,{"label":132,"cells":133,"source":141},"Check Point Harmony",[134,135,123,136,139],"8.1","API, monitor to inline",{"mark":137,"text":138},"no","Quote",{"mark":125,"text":140},"Inline via API",6,{"label":36,"cells":143,"source":149},[144,145,123,146,147],"7.1","API",{"mark":137,"text":138},{"mark":148},"unknown",9,{"label":151,"cells":152,"source":158},"IRONSCALES",[153,154,123,155,157],"6.8","API, alongside a gateway",{"mark":137,"text":156},"Tiers published, prices on quote",{"mark":148},12,{"label":160,"cells":161,"source":166},"Material Security",[162,145,123,163,165],"6.6",{"mark":125,"text":164},"From $4\u002Fuser\u002Fmonth",{"mark":148},13,{"label":168,"cells":169,"source":176},"Cloudflare Email Security",[170,171,123,172,174],"6.5","MX, API, journaling, mixed",{"mark":137,"text":173},"Plans published, prices not",{"mark":125,"text":175},"MX\u002Finline",15,{"label":76,"cells":178,"source":185},[179,180,181,182,184],"6.3","API; managed or self-hosted","Microsoft 365, Google Workspace, IMAP",{"mark":128,"text":183},"Free to 100 mailboxes",{"mark":148},17,{"label":187,"cells":188,"source":195},"Trend Micro",[189,190,123,191,192],"6.2","API; inline add-on",{"mark":137,"text":138},{"mark":193,"text":194},"addon","Inline for Exchange Online",20,{"label":72,"cells":197,"source":204},[198,199,200,201,202],"6.1","API or API + journaling","Microsoft 365",{"mark":137,"text":138},{"mark":125,"text":203},"Journaling before inbox",22,{"label":206,"cells":207,"source":212},"FortiMail Workspace Security",[208,209,123,210,211],"5.7","API (ICES)",{"mark":137,"text":138},{"mark":148},23,"Prices in USD as published on 21 October 2026. Check each vendor’s current documentation before you buy.",{"t":215,"id":216,"title":217,"intro":218,"criteria":219,"note":243},"rubric","method","How we evaluated cloud email security","Every product here already avoids the MX change, so the criteria focus on what separates API tools from each other for an EU team adding a layer next to Defender or Gmail’s built-in protection: what the engine catches that native filtering misses, how deep and fast the API connection is, and what can be verified before buying. Pre-delivery action and Defender-portal integration matter to some buyers and are weighted accordingly.",[220,223,227,230,233,236,240],{"name":221,"weight":204,"why":222},"Behavioral detection of payload-free fraud","The point of a second layer is the targeted fraud native filters pass: payment redirects, supplier bank-detail changes, hijacked threads. We score intent, relationship and vendor-compromise detection.",{"name":224,"weight":225,"why":226},"API depth and time to protection",18,"API tools differ in setup time, whether they read internal and historical mail, and whether a plan tier gates API mode.",{"name":228,"weight":176,"why":229},"Microsoft 365 and Google Workspace parity","Several vendors document Microsoft 365 more fully than Google Workspace. Equal depth on both scores highest.",{"name":231,"weight":166,"why":232},"Collaboration and OAuth app coverage","Cloud mail sits next to chat, file sharing and OAuth-connected apps. Consent phishing and shadow AI arrive through the same tenant.",{"name":234,"weight":158,"why":235},"Pricing transparency","Published per-user prices let a small team compare before talking to sales.",{"name":237,"weight":238,"why":239},"EU hosting and data-handling disclosure",10,"An API tool reads mailbox content, so NIS2 and DORA buyers need the hosting region and subprocessor list in writing.",{"name":241,"weight":238,"why":242},"Pre-delivery action and Defender integration","Some buyers want messages stopped before the inbox or verdicts inside the Defender portal (Microsoft’s ICES Vendor Ecosystem, which requires Plan 2 or E5).","Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Overall score = weighted average of the seven criteria. Capabilities we could not find publicly score 3–5.",{"t":245,"id":246,"title":247,"intro":248,"items":249},"ranked","list","The 10 best cloud email security solutions, ranked","Ten API-based products, highest score first. The pre-delivery and Defender-integration score is where Sentaro is weakest; it is shown on every entry so you can compare.",[250,279,307,334,361,386,413,438,465,488],{"name":62,"own":3,"tag":251,"bestFor":252,"summary":253,"score":254,"scores":255,"pros":264,"cons":269,"deployment":273,"platforms":274,"pricing":275,"hosting":276,"to":277,"site":278,"source":130},"Our pick","EU teams on Microsoft 365 and Google Workspace that want an API layer for BEC, QR-code and consent phishing, plus OAuth and AI-tool visibility, at a published price.","Sentaro is an ICES-category platform: it connects through the Microsoft 365 and Google Workspace admin APIs in four minutes and runs behind native filtering. Vord, Sentaro’s proprietary engine, reads every inbound and internal message for intent, sender identity and relationship history and reaches one explained verdict before interaction. The App vector inventories every app, AI tool and OAuth grant in the tenant. Hosted in Sweden on Microsoft Azure.",8.9,[256,257,258,259,260,261,263],{"criterion":221,"score":149},{"criterion":224,"score":238},{"criterion":228,"score":149},{"criterion":231,"score":149},{"criterion":234,"score":238},{"criterion":237,"score":262},8,{"criterion":241,"score":141},[265,266,267,268],"Four-minute API setup; MX record untouched; internal and historical mail covered.","Payload-free BEC and vendor-compromise detection, with the reasoning shown on every verdict in the console.","Email and OAuth\u002FAI-tool risk in one product and one price.","Published price and published hosting; DPA and subprocessors public.",[270,271,272],"Not part of Microsoft’s ICES Vendor Ecosystem, so verdicts are not shown inside the Defender portal.","Account takeover (Behavioral) and leaked-credential monitoring (Identity) are Q4 2026 roadmap.","SOC 2 and ISO 27001 certification in progress.","API via the Microsoft 365 and Google Workspace admin SDKs; no MX change","Microsoft 365, Google Workspace, Slack, Teams","$6 per protected account per month or $68 per year; first account free (USD)","Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA","\u002Fen\u002Fplatform","https:\u002F\u002Fsentaro.com",{"name":33,"tag":65,"bestFor":280,"summary":281,"score":282,"scores":283,"pros":293,"cons":297,"deployment":301,"platforms":302,"pricing":303,"hosting":304,"to":305,"site":306,"source":141},"Teams that want an API product that can block before the inbox and also covers file-sharing and chat apps.","Check Point contrasts its approach with “API-only … after delivery” tools: enforcement is configurable from monitor mode to inline prevention through the API, so messages can be stopped before they reach the inbox without an MX change. It also covers Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox and ShareFile.",8.1,[284,285,286,287,288,290,292],{"criterion":221,"score":262},{"criterion":224,"score":149},{"criterion":228,"score":238},{"criterion":231,"score":149},{"criterion":234,"score":289},4,{"criterion":237,"score":291},7,{"criterion":241,"score":149},[294,295,296],"Inline prevention through the API.","Broadest collaboration-app coverage in this list.","Selectable Ireland data region.",[298,299,300],"Quote-based pricing.","DMARC, archiving and training are add-ons.","QR-code phishing not named on the pages we checked.","API with configurable inline prevention; no MX change","Microsoft 365, Google Workspace, plus Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox","Quote-based (four published tiers)","Data residency regions include Ireland (EMEA), per the admin guide","\u002Fen\u002Fcompare\u002Fsentaro-vs-check-point-harmony-email","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F",{"name":36,"tag":68,"bestFor":308,"summary":309,"score":310,"scores":311,"pros":321,"cons":325,"deployment":329,"platforms":123,"pricing":330,"hosting":331,"to":332,"site":333,"source":149},"Large enterprises that want behavioral email security with account-takeover protection and a long certification list.","Abnormal AI builds a behavioral baseline for every employee and vendor and reads authentication events, calendar activity and internal threads. It deploys via API with no MX change; Abnormal states “Deploy in 60 seconds via API.” It does not state pre-delivery blocking, and its subprocessor list offers AWS hosting in the US or the EU (Ireland), set by subscription.",7.1,[312,313,314,315,317,319,320],{"criterion":221,"score":149},{"criterion":224,"score":149},{"criterion":228,"score":149},{"criterion":231,"score":316},5,{"criterion":234,"score":318},3,{"criterion":237,"score":291},{"criterion":241,"score":289},[322,323,324],"Behavioral baselines across employees and vendors.","Account-takeover protection available today.","Extensive certifications listed on its trust center.",[326,327,328],"No public price.","EU (Ireland) hosting is a subscription choice; the US is the other listed location.","Pre-delivery blocking not stated by the vendor.","API (ICES); no MX change","Quote-based","AWS in the US or EU (Ireland), by subscription (subprocessor list)","\u002Fen\u002Fcompare\u002Fsentaro-vs-abnormal-security","https:\u002F\u002Fabnormal.ai",{"name":151,"tag":335,"bestFor":336,"summary":337,"score":338,"scores":339,"pros":347,"cons":351,"deployment":355,"platforms":123,"pricing":356,"hosting":357,"to":358,"site":359,"source":360},"Best for SMB and MSP API security","SMBs and MSPs that want an API layer next to their gateway, with crowdsourced intelligence and simulation bundled.","IRONSCALES works at mailbox level over API and alongside an existing gateway. It combines per-mailbox behavioral baselines with threat intelligence crowdsourced from other customers’ reports, and remediates automatically after delivery.",6.8,[340,341,342,343,344,345,346],{"criterion":221,"score":262},{"criterion":224,"score":149},{"criterion":228,"score":262},{"criterion":231,"score":316},{"criterion":234,"score":289},{"criterion":237,"score":141},{"criterion":241,"score":316},[348,349,350],"Fast API deployment next to an existing gateway.","Crowdsourced threat intelligence.","Monthly, cancellable billing option.",[352,353,354],"Prices not published.","Subprocessor list names AWS in both the USA and Germany without saying which customers are hosted where.","OAuth app coverage not documented.","API at mailbox level; works alongside a gateway","Quote-based (plan tiers published, prices not)","Subprocessor list names AWS in the USA and AWS Europe (Germany) for the primary application platform","\u002Fen\u002Fcompare\u002Fsentaro-vs-ironscales","https:\u002F\u002Fironscales.com\u002F",11,{"name":160,"tag":362,"bestFor":363,"summary":364,"score":365,"scores":366,"pros":374,"cons":378,"deployment":209,"platforms":123,"pricing":382,"hosting":383,"to":384,"site":385,"source":166},"Best for Google Workspace OAuth and Drive","Google Workspace-heavy organizations that want OAuth, Drive and post-compromise controls alongside inbound email security.","Material Security is an API product for Microsoft 365 and Google Workspace focused on what happens after a malicious message lands or an account is compromised: message-level controls on sensitive content, OAuth app inventory and Drive exposure. It publishes per-user prices.",6.6,[367,368,369,370,371,372,373],{"criterion":221,"score":141},{"criterion":224,"score":262},{"criterion":228,"score":262},{"criterion":231,"score":291},{"criterion":234,"score":262},{"criterion":237,"score":289},{"criterion":241,"score":289},[375,376,377],"Published per-user pricing.","OAuth and Drive controls in the same product.","Self-serve free trial.",[379,380,381],"Shared Drive fee amount not shown.","No EU hosting region documented; its subprocessor list names Google Cloud infrastructure in the U.S.A.","Account-takeover resilience is an add-on.","Essentials $4, Advanced $6 per user\u002Fmonth plus a Shared Drive fee, billed annually","No EU region documented; subprocessor list names Google Cloud infrastructure in the U.S.A.","\u002Fen\u002Fcompare\u002Fsentaro-vs-material-security","https:\u002F\u002Fmaterial.security\u002F",{"name":168,"tag":387,"bestFor":388,"summary":389,"score":390,"scores":391,"pros":399,"cons":403,"deployment":407,"platforms":408,"pricing":409,"hosting":410,"site":411,"source":412},"Best for mixed deployment modes","Existing Cloudflare Zero Trust customers that want to combine MX, API and journaling modes.","Formerly Area 1 Security, acquired by Cloudflare in 2022. It supports MX\u002Finline, API and BCC\u002Fjournaling deployments and a mixed inline-plus-API mode, with deep link crawling that includes QR codes. API and mixed modes require the Enterprise plan.",6.5,[392,393,394,395,396,397,398],{"criterion":221,"score":291},{"criterion":224,"score":141},{"criterion":228,"score":262},{"criterion":231,"score":316},{"criterion":234,"score":289},{"criterion":237,"score":141},{"criterion":241,"score":149},[400,401,402],"Every deployment mode, including mixed inline and API.","QR-code link crawling in all plans.","Bundles with Cloudflare Zero Trust and DNS.",[404,405,406],"API mode needs the Enterprise plan.","No public prices.","Regional processing (US, Germany, India, Australia) only for MX\u002Finline and BCC deployments; where data is stored is not stated.","MX\u002Finline, API, or BCC\u002Fjournaling","Microsoft 365, Google Workspace, other providers via MX","Quote-based annual contract per user","Email processing region selectable (US, Germany, India, Australia) for MX\u002Finline and BCC deployments; storage location not stated","https:\u002F\u002Fwww.cloudflare.com\u002Fzero-trust\u002Fproducts\u002Femail-security\u002F",16,{"name":76,"tag":75,"bestFor":414,"summary":415,"score":416,"scores":417,"pros":425,"cons":429,"deployment":433,"platforms":181,"pricing":434,"hosting":435,"to":436,"site":437,"source":185},"SOC teams that want to inspect and write their own detection rules, managed or self-hosted.","Sublime connects over API to Microsoft 365, Google Workspace and IMAP. Detections are written in its Message Query Language, with an open rule library on GitHub and AI agents that triage reports and draft new rules. The managed cloud is free for the first 100 mailboxes.",6.3,[418,419,420,421,422,423,424],{"criterion":221,"score":291},{"criterion":224,"score":291},{"criterion":228,"score":262},{"criterion":231,"score":318},{"criterion":234,"score":291},{"criterion":237,"score":291},{"criterion":241,"score":289},[426,427,428],"Open, inspectable detection rules.","Free tier up to 100 mailboxes.","Self-hosting option.",[430,431,432],"Rules-first model needs detection-engineering time.","No collaboration or OAuth coverage documented.","Managed-cloud EU (Dublin) region documented, but other subprocessor locations need checking in the DPA.","API (ICES); managed cloud or self-hosted","Managed cloud: first 100 mailboxes free; Enterprise quote-based","Managed-cloud regions include EU (Dublin) and UK (London); or self-host in your own AWS or Azure region","\u002Fen\u002Fcompare\u002Fsentaro-vs-sublime-security","https:\u002F\u002Fsublime.security",{"name":439,"tag":440,"bestFor":441,"summary":442,"score":443,"scores":444,"pros":452,"cons":456,"deployment":460,"platforms":461,"pricing":330,"hosting":462,"site":463,"source":464},"Trend Micro (TrendAI Vision One Email and Collaboration Security)","Best for Trend Vision One customers","Organizations already on Trend Vision One that want email, collaboration and XDR in one console.","Formerly Cloud App Security. Trend integrates over API without rerouting mail and offers an inline protection mode for Exchange Online through transport rules and connectors, with no MX change, under an add-on licence. Trend describes writing-style analysis for BEC and visual AI for lookalike sites.",6.2,[445,446,447,448,449,450,451],{"criterion":221,"score":291},{"criterion":224,"score":141},{"criterion":228,"score":262},{"criterion":231,"score":141},{"criterion":234,"score":318},{"criterion":237,"score":289},{"criterion":241,"score":262},[453,454,455],"API and inline modes, plus on-premises products from one vendor.","Part of the Vision One XDR console.","DLP with 200+ compliance templates.",[457,458,459],"No public pricing.","Inline mode is a separate licence.","EU hosting not documented.","API without rerouting mail; inline mode for Exchange Online via transport rules (add-on); gateway also available","Microsoft 365, Google Workspace, on-premises Exchange; Teams, SharePoint, OneDrive, Box, Dropbox","Not publicly documented","https:\u002F\u002Fwww.trendaisecurity.com\u002Fen-us\u002Fplatform\u002Femail-security",19,{"name":72,"tag":466,"bestFor":467,"summary":468,"score":469,"scores":470,"pros":478,"cons":482,"deployment":484,"platforms":485,"pricing":330,"hosting":462,"site":486,"source":487},"Best for verdicts in the Defender portal","Microsoft 365 organizations on Defender Plan 2 or E5 that want third-party verdicts inside the Defender portal.","Darktrace’s behavioral AI “learns from your own organization’s activity and users, not a shared cross-customer model.” It deploys via API, or API plus journaling for Microsoft 365, which receives a copy in transport before the inbox. Microsoft Learn lists Darktrace in its ICES Vendor Ecosystem.",6.1,[471,472,473,474,475,476,477],{"criterion":221,"score":262},{"criterion":224,"score":291},{"criterion":228,"score":316},{"criterion":231,"score":141},{"criterion":234,"score":318},{"criterion":237,"score":289},{"criterion":241,"score":262},[479,480,481],"Verdicts surface in the Defender portal (Plan 2 or E5).","Per-organization behavioral model.","Collaboration coverage across Teams, Zoom and Slack.",[483,457,459],"Google Workspace support not confirmed.","API, or API plus journaling for Microsoft 365","Microsoft 365 (Google Workspace not confirmed)","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail",21,{"name":489,"tag":490,"bestFor":491,"summary":492,"score":493,"scores":494,"pros":502,"cons":506,"deployment":510,"platforms":511,"pricing":512,"hosting":462,"site":513,"source":212},"FortiMail Workspace Security (Fortinet, formerly Perception Point)","Best for Fortinet Security Fabric","Fortinet customers that want ICES plus browser and collaboration-app security with managed incident response included.","Fortinet acquired Perception Point in December 2024 and sells it as FortiMail Workspace Security, an ICES product for Microsoft 365 and Google Workspace that extends to browsers, Slack, Teams, Salesforce and Zendesk, with a 24x7 managed incident response service included. Fortinet states it uses machine learning, large language models and optical scanning.",5.7,[495,496,497,498,499,500,501],{"criterion":221,"score":316},{"criterion":224,"score":141},{"criterion":228,"score":262},{"criterion":231,"score":262},{"criterion":234,"score":318},{"criterion":237,"score":289},{"criterion":241,"score":316},[503,504,505],"24x7 managed incident response included.","Coverage beyond email: browsers and business apps.","Security Fabric integration.",[507,508,509],"Most detection line items not documented publicly.","Quote-only pricing.","Hosting locations not listed.","API (ICES); FortiMail gateway, VM and appliance options separately","Microsoft 365, Google Workspace; Teams, Slack, OneDrive, Dropbox, Salesforce, Zendesk, browsers","Quote-based (per user per year for Cloud SaaS)","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Ffortimail-workspace-security",{"t":515,"id":516,"title":517,"blocks":518},"prose","how-to-choose","How to choose a cloud email security solution",[519,522,525,548,550,552,554,564],{"t":520,"text":521},"p","Cloud email security, also called API-based email security or integrated cloud email security (ICES), connects to Microsoft 365 or Google Workspace through the platform’s APIs instead of sitting in front of the mail server. Native filtering still handles bulk spam and malware; the API layer looks at what got through, including mail between your own users.",{"t":523,"text":524},"h3","API-only, inline via API, or mixed modes",{"t":526,"rows":527},"table",[528,532,536,540,544],[529,530,531],"Mode","What happens","Who offers it here",[533,534,535],"API, post-delivery","The tool reads delivered mail through the API and removes or labels threats","IRONSCALES and Sublime document post-delivery remediation; Abnormal, Material and Darktrace (API-only mode) do not state pre-delivery blocking",[537,538,539],"Before interaction via API","Verdict lands before the user acts: blocked, quarantined or tagged inline","Sentaro (block or tag before interaction), Check Point (inline prevention via API)",[541,542,543],"Journaling or transport rules","A copy or the message passes the vendor in transport, with no MX change","Darktrace (API + journaling), Trend Micro (inline add-on for Exchange Online)",[545,546,547],"MX\u002Finline plus API","Classic gateway routing combined with API remediation","Cloudflare (Enterprise for API and mixed modes)",{"t":523,"text":549},"Does it work alongside Microsoft Defender for Office 365?",{"t":520,"text":551},"API-based products run after Microsoft’s built-in protection rather than in front of it, so they work alongside Defender for Office 365. Microsoft goes further for a short list of partners: its ICES Vendor Ecosystem passes partner verdicts into Defender’s quarantine, Threat Explorer and reports, and requires Defender for Office 365 Plan 2 or Microsoft 365 E5. As of Microsoft Learn’s July 2026 update, the listed partners are Darktrace, KnowBe4 and VIPRE. If you live in the Defender portal, weigh that; if you do not hold Plan 2, it does not apply.",{"t":523,"text":553},"Questions to ask every API email security vendor",{"t":555,"items":556},"ul",[557,558,559,560,561,562,563],"Which API permissions do you request in Microsoft 365 and Google Workspace, and why each one?","Do you act before the user can interact with a message, or only after delivery?","Do you scan internal mail and historical mail, and how far back on day one?","Is API mode available on every plan, or only on a higher tier?","Do you cover OAuth grants and AI tools connected to the tenant, or only mail?","Where is mailbox content processed, how long is it retained, and who are your subprocessors?","What is the published price per mailbox?",{"t":520,"text":565},"For definitions, Microsoft’s ICES program and a 16-vendor fact table without scores, see our ICES vendors compared guide. If you are deciding whether to keep a gateway in front of mail at all, read our secure email gateway alternatives list.",{"t":567,"tone":568,"title":569,"text":570},"callout","roadmap","Roadmap: Identity and Behavioral, Q4 2026","Everything compared on this page is live today: the Message vector (since Q2 2026) and the App vector (since Q3 2026). Identity (leaked credentials, lookalike-domain registration alerts) and Behavioral (account-takeover and session anomalies, forwarding-rule abuse, forced re-authentication and session revocation) reach general availability in Q4 2026, included at no added cost. Until then Sentaro does not offer account-takeover detection, so if you need it live today, weigh that against the vendors that document it.",{"t":572,"intro":573,"items":574},"certs","Sentaro’s status, stated exactly; we’ll update it the day each certificate is signed.",[575,580,583,587],{"label":576,"status":577,"state":578,"text":579},"SOC 2","In progress","progress","No target date published. Evidence pack on request.",{"label":581,"status":577,"state":578,"text":582},"ISO 27001","No target date published.",{"label":584,"status":585,"state":586},"Google CASA","Verified API integration","done",{"label":588,"status":589,"state":590,"to":591,"source":318},"DPA and subprocessor list","Public","info","\u002Fen\u002Flegal\u002Fdpa",[593,596,599,602,605,608,611],{"q":594,"a":595},"What is the best cloud email security solution?","Sentaro, for EU teams on Microsoft 365 and Google Workspace. It is API-based (ICES), connects in four minutes with no MX change, reads internal and historical mail, targets payload-free BEC and vendor compromise, and covers OAuth apps and AI tools in the same product for $6 per protected account per month, first account free (prices in USD). Check Point Harmony and Abnormal AI are the next strongest on our method.",{"q":597,"a":598},"What is integrated cloud email security (ICES)?","Integrated cloud email security is the category of tools that protect Microsoft 365 or Google Workspace by connecting through the platform’s APIs rather than rerouting mail through a secure email gateway. ICES tools deploy without an MX change, run alongside native filtering, and can inspect internal and historical mail, which a gateway does not see.",{"q":600,"a":601},"Which are the best ICES vendors?","On our weighted method for EU teams: Sentaro (8.9), Check Point Harmony Email & Collaboration (8.1), Abnormal AI (7.1), IRONSCALES and Material Security (6.6), Cloudflare (6.3), Sublime Security and Trend Micro (6.2), Darktrace (6.1) and FortiMail Workspace Security (5.7). Microsoft separately lists Darktrace, KnowBe4 and VIPRE as ICES Vendor Ecosystem partners in Defender.",{"q":603,"a":604},"Is API-based email security better than a secure email gateway?","For organizations whose mail already lives in Microsoft 365 or Google Workspace, API-based tools are faster to deploy and see internal mail a gateway cannot. A gateway still makes sense if you need archiving, continuity, outbound encryption policies or on-premises Exchange support from the same product. Many teams move from a gateway to native filtering plus an API layer.",{"q":606,"a":607},"Do cloud email security tools work with Microsoft Defender for Office 365?","Yes. API-based products connect to the mailbox after Microsoft’s built-in protection has filtered mail, so they run alongside Defender for Office 365. Sentaro is designed to run with Defender and Google’s native filtering rather than replace them. Only Microsoft’s ICES Vendor Ecosystem partners pass their verdicts into the Defender portal, which requires Plan 2 or Microsoft 365 E5.",{"q":609,"a":610},"Which cloud email security vendors publish their prices?","In this list, Sentaro ($6 per protected account per month or $68 per year, first account free) and Material Security ($4 or $6 per user per month plus a Shared Drive fee) publish prices, and Sublime Security publishes a free managed tier for the first 100 mailboxes. The other seven quote on request.",{"q":612,"a":613},"Does an API-based tool read all our email?","It needs access to mailbox content to analyze it, which is why hosting and subprocessors matter. Sentaro says analysis is automated and nobody at Sentaro reads your mail in the course of providing the service; its public DPA states retention periods and lists its subprocessors. Ask every vendor for the same in writing.",[615,618,621,624,627,630,632,635,638,641,644,646,649,652,654,657,660,663,666,668,671,673,676,678,681,684,687,690],{"label":616,"url":617},"Sentaro pricing","https:\u002F\u002Fsentaro.com\u002Fen\u002Fpricing",{"label":619,"url":620},"Sentaro: platform (deployment, Vord engine, vectors)","https:\u002F\u002Fsentaro.com\u002Fen\u002Fplatform",{"label":622,"url":623},"Sentaro Data Processing Agreement and subprocessor list","https:\u002F\u002Fsentaro.com\u002Fen\u002Flegal\u002Fdpa",{"label":625,"url":626},"Microsoft Learn: Defender for Office 365 ICES Vendor Ecosystem (ms.date 17 Jul 2026)","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fmdo-ices-vendor-ecosystem",{"label":628,"url":629},"Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to Microsoft 365 E3 (2026-06-17)","https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftdefenderforoffice365blog\u002Fmicrosoft-defender-for-office-365-plan-1-is-now-rolling-out-to-microsoft-365-e3-\u002F4527287",{"label":631,"url":306},"Check Point: Harmony Email & Collaboration (accessed 2026-10-18)",{"label":633,"url":634},"Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002Fpricing\u002F",{"label":636,"url":637},"Check Point: Harmony Email & Collaboration admin guide, data residency","https:\u002F\u002Fsc1.checkpoint.com\u002Fdocuments\u002FAvanan_Admin_Guide\u002FEmail_Security\u002FAdmin_Guide\u002FTopics\u002Factivating-hec\u002Faccessing-the-administrator-portal.html",{"label":639,"url":640},"Abnormal AI: Inbound Email Security (accessed 2026-10-18)","https:\u002F\u002Fabnormal.ai\u002Fproducts\u002Finbound-email-security",{"label":642,"url":643},"Abnormal AI: Subprocessors (updated 31 July 2026, accessed 2026-10-21)","https:\u002F\u002Fabnormal.ai\u002Flegal\u002Fsubprocessors",{"label":645,"url":359},"IRONSCALES: Home page (accessed 2026-10-18)",{"label":647,"url":648},"IRONSCALES: Pricing (accessed 2026-10-18)","https:\u002F\u002Fironscales.com\u002Fpricing",{"label":650,"url":651},"Material Security: Pricing (accessed 2026-10-18)","https:\u002F\u002Fmaterial.security\u002Fpricing",{"label":653,"url":385},"Material Security: home page (products, setup quote)",{"label":655,"url":656},"Cloudflare docs: Email Security setup and deployment modes","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Femail-security\u002Fsetup",{"label":658,"url":659},"Cloudflare: Email Security product plans (Q3 2025)","https:\u002F\u002Fcf-assets.www.cloudflare.com\u002Fslt3lc6tev37\u002F4aNtRlkqF8PXmqXzzipPBE\u002F638c8457f1f192e98f2fac62207dce39\u002FEmail-Security-Product-Plans-Q3-2025.pdf",{"label":661,"url":662},"Sublime Security docs: Installation (accessed 2026-10-18)","https:\u002F\u002Fdocs.sublime.security\u002Fdocs\u002Finstallation",{"label":664,"url":665},"GitHub: sublime-security\u002Fsublime-rules detection rules","https:\u002F\u002Fgithub.com\u002Fsublime-security\u002Fsublime-rules\u002Ftree\u002Fmain\u002Fdetection-rules",{"label":667,"url":463},"Trend Micro: TrendAI Vision One Email and Collaboration Security (accessed 2026-10-18)",{"label":669,"url":670},"Trend Micro docs: Inline protection settings for Exchange Online","https:\u002F\u002Fdocs.trendmicro.com\u002Fen-us\u002Fdocumentation\u002Farticle\u002Ftrend-vision-one-inline-settings-exchange",{"label":672,"url":486},"Darktrace: Darktrace \u002F EMAIL (accessed 2026-10-18)",{"label":674,"url":675},"Darktrace: Why API + journaling for Microsoft 365 (4 Nov 2025)","https:\u002F\u002Fdarktrace.com\u002Fblog\u002Fwhy-api-journaling-delivers-faster-sla-backed-email-security-for-microsoft-365",{"label":677,"url":513},"Fortinet: FortiMail Workspace Security (formerly Perception Point)",{"label":679,"url":680},"Fortinet: FortiMail Email and Workspace Security (accessed 2026-10-21)","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Femail-security",{"label":682,"url":683},"IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)","https:\u002F\u002Fironscales.com\u002Fhubfs\u002FPDFs\u002FIRONSCALES%20Sub%20Processors.pdf",{"label":685,"url":686},"Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)","https:\u002F\u002Fmaterial.security\u002Fsubprocessors",{"label":688,"url":689},"Cloudflare docs: Email Security regional processing (accessed 2026-10-21)","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Femail-security\u002Freference\u002Fregional-processing\u002F",{"label":691,"url":692},"Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)","https:\u002F\u002Fdocs.sublime.security\u002Fdocs\u002Fsublime-managed","Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities and prices change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.",[695,698,701,704,707,710,712],{"label":696,"to":697},"ICES vendors compared","\u002Fen\u002Fcompare\u002Fices-vendors-compared",{"label":699,"to":700},"Best email security software","\u002Fen\u002Fbest\u002Femail-security-software",{"label":702,"to":703},"Best secure email gateway alternatives","\u002Fen\u002Fbest\u002Fsecure-email-gateway-alternatives",{"label":705,"to":706},"API email security vs secure email gateway","\u002Fen\u002Fcompare\u002Fapi-email-security-vs-secure-email-gateway",{"label":708,"to":709},"Email security for Microsoft 365","\u002Fen\u002Fplatforms\u002Fmicrosoft-365-email-security",{"label":711,"to":332},"Sentaro vs Abnormal Security",{"label":713,"to":714},"Pricing","\u002Fen\u002Fpricing",{"title":716,"note":717},"Connect Sentaro over API in four minutes.","No MX change, no agents. The first account is free.",{"links":719,"only":732,"labels":734},[720,722,723,726,727,730],{"label":721,"to":703},"secure email gateway alternatives",{"label":696,"to":697},{"label":724,"to":725},"Google Workspace","\u002Fen\u002Fplatforms\u002Fgoogle-workspace-email-security",{"label":200,"to":709},{"label":728,"to":729},"Integrated Cloud Email Security","\u002Fen\u002Fglossary\u002Fintegrated-cloud-email-security",{"label":731,"to":729},"ICES",{"6":733},[729,709,725,697,703],{"\u002Fen\u002Fcompare\u002Fsentaro-vs-check-point-harmony-email":735,"\u002Fen\u002Fcompare\u002Fsentaro-vs-abnormal-security":711,"\u002Fen\u002Fcompare\u002Fsentaro-vs-ironscales":736,"\u002Fen\u002Fcompare\u002Fsentaro-vs-material-security":737,"\u002Fen\u002Fcompare\u002Fsentaro-vs-sublime-security":738},"Sentaro vs Check Point Harmony Email","Sentaro vs IRONSCALES","Sentaro vs Material Security","Sentaro vs Sublime Security",1792761724230]