Best tools · Google WorkspaceVictor TräffWritten by Victor Träff · Security expert and co-founder, Sentaro Reviewed

10 best email security tools for Google Workspace (2026)

The best email security for Google Workspace for EU teams in 2026 is Sentaro, which connects through the Google Workspace admin APIs in four minutes with no MX change, adds payload-free BEC and vendor-fraud detection on top of Gmail’s filtering, and inventories OAuth grants and AI tools in the same product for a published $6 per protected account per month. The other strong options are Material Security, Check Point Harmony Email & Collaboration and Gmail’s own built-in protection. We ranked 10 options from public documentation checked on 21 October 2026.

  • 10 options ranked
  • Gmail by edition
  • Weighted, sourced method
  • Last verified 21 October 2026
Start free with one accountSpeak to sales
Our recommendation

Sentaro is the best email security for Google Workspace for EU organizations that want more than Gmail’s filtering without a gateway: it connects through the Workspace admin APIs in four minutes with no MX change, catches fraud that carries no link or attachment, inventories every OAuth grant and AI tool with one-click revocation through the Workspace admin SDK, and costs a published $6 per protected account per month. It is a Google CASA verified API integration. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.

Why Sentaro wins
email fraud and third-party app access in one product, at a price on sentaro.com/en/pricing, hosted in Sweden on Microsoft Azure with a public DPA, and the same product covers Microsoft 365 if part of the group runs it.
Keep Gmail’s protection on
Google states Gmail’s AI-powered protections block more than 99.9% of spam, phishing and malware. Sentaro is designed to run with them, not replace them.
Consider another tool only if
you need archiving, encryption, backup or DMARC report management from the same vendor, or account-takeover detection live today (Sentaro’s is Q4 2026).

Quick picks

  • Best overall for EU teamsSentaro Our pickGmail API, four-minute setup, BEC plus OAuth grants in one product, $6 per account per month.
  • Best for Drive and post-compromise controlsMaterial SecurityWorkspace-first, published prices from $4, OAuth Security and Drive file controls.
  • Best for inline preventionCheck Point Harmony Email & CollaborationBlocks before the inbox via API and covers Google Drive and other SaaS apps.
  • Best free baselineGoogle Workspace built-in protectionIncluded in every edition; sandbox from Business Standard, investigation tool on Enterprise.
  • Best for detection engineersSublime SecurityOpen rules, self-hosting, free for the first 100 mailboxes.
  • Best for MSPsGuardzCheck Point-powered email security bundled with endpoint and identity in one MSP console.

At a glance

What we compared
Email security for Google Workspace (Gmail), including Google’s built-in protection as one entry
Options ranked
10: Sentaro, Material, Check Point, Gmail built-in, Abnormal, IRONSCALES, Sublime, Barracuda, Mimecast, Guardz
Audience
EU organizations on Google Workspace, or on both Workspace and Microsoft 365, with lean IT
Method
Seven weighted criteria, each scored 0–10 from public documentation; not documented scores 4–5
Last verified
21 October 2026 (Google Admin Help and vendor pages accessed 18–21 October 2026)
Written by
Sentaro, which makes one of the tools ranked here

Email security for Google Workspace compared

One row per option, in rank order. Setup times are the vendor’s own words. “Quote” means no public price.

CapabilityScoreHow it connects to GmailSetup (vendor-stated)Public priceOAuth appsEU hosting
Sentaro (our pick)[1]8.8Workspace admin APIs; no MX changeFour minutes$6 per account/month; first account freeYesInventory, risk, one-click revocationHosted in Sweden on Microsoft Azure; DPA public
Material Security[10]7.8APIAbout six minutes (customer quote)From $4 per user/month plus a Shared Drive feeYesOAuth Security for WorkspaceNo EU region documented (subprocessor list: U.S.A.)
Check Point Harmony Email[12]7.3API with inline preventionMinutesQuote (four tiers)YesShadow IT detectionIreland region option
Google Workspace built-in[4]7.2Native to GmailOn by default; advanced settings by adminIncluded (EUR 6.80–21.10 per user/month plans)PartialAdmin controls; detail not verifiedEurope data region, Business Standard and above
Abnormal AI[15]7.2API, no MX change60 secondsQuoteNot publicly documentedNot publicly documentedUS or EU (Ireland), by subscription
IRONSCALES[17]6.8API at mailbox levelMinutesQuote (tiers published)Not publicly documentedNot publicly documentedAWS USA and Germany (subprocessor list)
Sublime Security[19]6.6API; managed or self-hostedNot statedFirst 100 mailboxes free; Enterprise quoteNot publicly documentedNot publicly documentedEU (Dublin) managed region, or self-host
Barracuda[22]6.5API-first, no MX changeMinutesQuote (three plans)Not publicly documentedNot publicly documentedGateway: Frankfurt, London; API modules: US
Mimecast[24]5.6Gateway (MX) for Workspace; API product described for Microsoft 365Not stated for WorkspaceQuoteNot publicly documentedNot publicly documentedFrankfurt data centres (2018)
Guardz[26]5.5API (Check Point Harmony engine)Not statedQuote via MSPsNot publicly documentedNot publicly documentedNot publicly documented

Editorial scores using the criteria and weights below; based on public documentation, not lab tests. Last verified 21 October 2026.

  • Yes
  • Partial
  • No
  • On roadmap
  • Paid add-on
  • Not publicly documented
Try it on your own tenant. API connection in about four minutes, alongside what you run today. $6 per account / month.Start freeSpeak to sales →

What Gmail already protects, by Workspace edition

Before adding anything, know what your edition includes. These are from Google Workspace Admin Help “Supported editions” boxes, accessed 18 October 2026. Google’s advanced phishing and malware settings (encrypted and script attachments, shortened URLs, similar-domain and employee-name spoofing) show no edition restriction on their help page.

ProtectionWhat it doesEditions
Default Gmail filteringSpam, phishing and malware filtering; Google states it blocks more than 99.9%All
Advanced phishing and malware protectionAttachment, link and spoofing checks; warning banner, spam or quarantineNo edition restriction shown
Enhanced pre-delivery scanningDelays suspicious mail slightly for more checksNo edition restriction shown
Gmail Security SandboxDetonates attachments, incl. zip/rar contents; up to 3 minutes delayBusiness Standard and Plus, Enterprise Standard and Plus, Frontline Plus; not Business Starter
Security investigation toolSearch and remediate across the domainEnterprise Standard/Plus, Frontline Standard/Plus, Education Standard/Plus, Enterprise Essentials Plus
DLP for GmailOutbound data protection rulesEnterprise Standard/Plus, Frontline Standard/Plus, Education
Data regions (Europe)Choose where covered data is storedBusiness Standard and above; not Business Starter

What Google does not provide natively, per our review: awareness training, DMARC report management, a backup product (Vault is retention and eDiscovery), and a BEC or vendor-compromise behavioral model; Gmail’s BEC-related protections are spoofing and name-impersonation checks. On Business Starter and Business Standard, admins also lack the security investigation tool, which is where an API tool’s domain-wide remediation earns its place.

How we evaluated email security for Google Workspace

Workspace buyers ask two questions: what reaches inboxes past Gmail, and which third-party apps can read our data. So API depth, BEC and OAuth access carry most of the weight, alongside price and EU hosting. Breadth and maturity count at a lower weight; that is where the suites lead.

CriterionWeightWhy it matters
Gmail API deployment and in-Gmail remediation20%Connects through the Gmail and Workspace admin APIs, without an MX gateway, and can remove or quarantine delivered mail across the domain. Native counts, scored by edition.
Payload-free BEC and vendor fraud20%Fraud with no link or attachment, from lookalike or real supplier accounts, is what gets past spoofing and name checks.
OAuth apps and third-party access15%Workspace makes it easy for users to grant third-party apps access to mail and Drive. Consent phishing turns that into a takeover route.
Published price and total cost15%A published per-user price lets a lean team budget without a sales cycle. Included in the Workspace licence scores high.
Time to protection10%Vendor-stated time from signup to protection, and whether history is scanned.
EU hosting and DPA transparency10%Where mail data is processed and whether the DPA and subprocessor list are public.
Suite breadth and maturity10%Account takeover, DLP, archiving, training, DMARC, certifications. The incumbents win this one.

Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Sentaro’s roadmap features (Identity, Behavioral, Q4 2026) score as not available.

The 10 best email security tools for Google Workspace, ranked

Gmail’s own protection is ranked as one of the ten, so you can see where an add-on earns its price. Highest score first.

  1. Sentaro

    Our pickOverall score: 8.8out of 10

    Best for: EU teams on Google Workspace (or Workspace plus Microsoft 365) that want BEC, vendor fraud and OAuth risk covered on top of Gmail, at a published price.

    Sentaro is an API-based email and SaaS security platform built in Stockholm and hosted in Sweden on Microsoft Azure. An admin connects Workspace through the Google Workspace admin SDK in four minutes, with no agents and no MX change, and historical visibility follows within 15 minutes. The Message vector scores intent, sender identity and relationship history on inbound and internal mail before interaction, and labels the verdict in the mailbox; malicious messages are removed or quarantined automatically and similar messages across all mailboxes can be remediated in one action. The App vector gives a live inventory of every app, AI tool and OAuth grant with scope-level risk per user, blocks consent phishing, and revokes risky grants through the Workspace admin SDK.[1]

    Gmail API deployment and in-Gmail remediation
    10.0
    Payload-free BEC and vendor fraud
    8.0
    OAuth apps and third-party access
    10.0
    Published price and total cost
    10.0
    Time to protection
    10.0
    EU hosting and DPA transparency
    8.0
    Suite breadth and maturity
    4.0

    Pros

    • Gmail API connection in four minutes; no MX change, no agents.
    • Vendor-compromise, thread-hijack and payload-free BEC detection, with reasoning shown on every verdict in the console.
    • OAuth grants and AI tools inventoried within 15 minutes, with one-click revocation.
    • Published price; the same product covers Microsoft 365 tenants.

    Cons

    • Detection only: no gateway, archiving, encryption, backup or DMARC report management.
    • Account-takeover and session-anomaly detection reach general availability in Q4 2026.
    • SOC 2 and ISO 27001 certification in progress.
    Pricing
    $6 per protected account per month or $68 per year; first account free. Prices in USD.
    Deployment
    API via the Google Workspace and Microsoft 365 admin SDKs; no MX change, no agents
    Platforms
    Google Workspace, Microsoft 365; Slack and Teams listed as channels
    Hosting
    Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
    Google Workspace

  2. Material Security

    Workspace specialistOverall score: 7.8out of 10

    Best for: Workspace-heavy organizations that want Drive file controls, OAuth security and post-compromise containment at a published price.

    Material Security connects to Google Workspace and Microsoft 365 over API. Its OAuth Security product is documented for Google Workspace, with an OAuth app inventory in Essentials and agentic OAuth remediation in Advanced, and File Security covers sensitive-data exposure in Drive. It positions on protecting accounts after a compromise or after a malicious message gets through. A customer quoted on its home page says integration took about six minutes. Essentials is $4 and Advanced $6 per user per month plus a Shared Drive fee, billed annually.[10]

    Gmail API deployment and in-Gmail remediation
    9.0
    Payload-free BEC and vendor fraud
    7.0
    OAuth apps and third-party access
    9.0
    Published price and total cost
    9.0
    Time to protection
    8.0
    EU hosting and DPA transparency
    4.0
    Suite breadth and maturity
    7.0

    Pros

    • Built around Workspace: OAuth Security and Drive file controls.
    • Public prices from $4 per user per month.
    • Post-compromise containment and ATO Resilience add-on.

    Cons

    • No EU hosting region documented (its subprocessor list names Google Cloud in the U.S.A.); certifications not publicly documented.
    • Minimum annual Shared Drive fee; amount not shown.
    • Vendor-compromise detection not named.
    Pricing
    Essentials $4, Advanced $6 per user/month plus Shared Drive fee, billed annually; ATO Resilience +$3
    Deployment
    API (ICES)
    Platforms
    Google Workspace (incl. Drive), Microsoft 365
    Hosting
    No EU region documented; subprocessor list names Google Cloud, U.S.A.
    Sentaro vs Material Security Vendor site

  3. Check Point Harmony Email & Collaboration

    Overall score: 7.3out of 10

    Best for: Organizations that want blocking before the inbox via API, and Google Drive and other SaaS apps in the same product.

    Check Point Harmony Email & Collaboration (formerly Avanan) supports Gmail and Microsoft 365 over API with no MX change, and enforcement is configurable from monitor mode to inline prevention, inspecting mail before it reaches the inbox. Check Point describes 50+ AI engines, sandboxing and click-time URL protection. Shadow IT detection and account-takeover protection are in every tier; Google Drive, Box, Dropbox and Slack are covered in the collaboration tiers. The admin guide lists an Ireland data-residency region.[12]

    Gmail API deployment and in-Gmail remediation
    9.0
    Payload-free BEC and vendor fraud
    7.0
    OAuth apps and third-party access
    8.0
    Published price and total cost
    3.0
    Time to protection
    9.0
    EU hosting and DPA transparency
    7.0
    Suite breadth and maturity
    8.0

    Pros

    • Inline prevention through the API.
    • Google Drive, Slack, Box and Dropbox coverage.
    • Account takeover and shadow IT in every tier.

    Cons

    • No public prices.
    • Archiving, DMARC and training are add-ons.
    • Vendor-compromise detection not named.
    Pricing
    Quote-based; four tiers
    Deployment
    API with configurable inline prevention; no MX change
    Platforms
    Google Workspace, Microsoft 365 and major collaboration apps
    Hosting
    Regions include Ireland (EMEA), per the admin guide
    Sentaro vs Check Point Harmony Email Vendor site

  4. Google Workspace built-in protection

    Native baselineOverall score: 7.2out of 10

    Best for: Every Workspace tenant as the layer you keep; on its own, small teams on Business Standard or above with low fraud exposure.

    Gmail filters spam, phishing and malware for every edition, and Google states its AI-powered protections block more than 99.9% of it. Admins can turn on advanced phishing and malware protection (attachment, link and spoofing checks with banner, spam or quarantine actions) and enhanced pre-delivery scanning. The Security Sandbox needs Business Standard or above; the security investigation tool, which searches and remediates across the domain, needs an Enterprise or Frontline Standard/Plus edition. The Advanced Protection Program adds security-key enforcement for high-risk users.[3]

    Gmail API deployment and in-Gmail remediation
    8.0
    Payload-free BEC and vendor fraud
    5.0
    OAuth apps and third-party access
    5.0
    Published price and total cost
    10.0
    Time to protection
    9.0
    EU hosting and DPA transparency
    7.0
    Suite breadth and maturity
    7.0

    Pros

    • Included in every edition, nothing to install.
    • Sandbox from Business Standard; advanced phishing settings without edition restriction.
    • Europe data region option.

    Cons

    • Key tools depend on edition: no sandbox on Business Starter, no investigation tool below Enterprise.
    • Google documents BEC-related settings as spoofing and name checks; no behavioral model is documented.
    • No awareness training, DMARC report management or backup.
    Pricing
    Included; Business Starter EUR 6.80, Standard 13.60, Plus 21.10 per user/month (EU pricing page); Enterprise on quote
    Deployment
    Native to Gmail
    Platforms
    Google Workspace only
    Hosting
    Europe data region on Business Standard and above
    Sentaro vs Google Workspace security Vendor site

  5. Abnormal AI

    Overall score: 7.2out of 10

    Best for: Large enterprises on Workspace that want behavioral detection, account takeover and a long certification list.

    Abnormal AI supports Google Workspace and Microsoft 365 over API with no MX change; its product page says “Deploy in 60 seconds via API”. It builds a behavioral baseline for every employee and vendor and flags deviations using identity, behavioral and content signals. Account Takeover Protection and AI Phishing Coach are separate products, and its trust center lists ISO 27001, ISO 27701 and ISO 42001 certificates, a SOC 2 report and FedRAMP Moderate. Its public subprocessor list names AWS hosting in the US or the EU (Ireland), set by subscription. Prices are not published.[15]

    Gmail API deployment and in-Gmail remediation
    9.0
    Payload-free BEC and vendor fraud
    9.0
    OAuth apps and third-party access
    4.0
    Published price and total cost
    3.0
    Time to protection
    9.0
    EU hosting and DPA transparency
    7.0
    Suite breadth and maturity
    9.0

    Pros

    • Behavioral baselines for employees and vendors.
    • Account takeover as a product.
    • Broad certification portfolio.

    Cons

    • No public pricing.
    • EU (Ireland) hosting is a subscription choice; the US is the other listed location.
    • OAuth app coverage not documented.
    Pricing
    Quote-based
    Deployment
    API (ICES), no MX change
    Platforms
    Google Workspace, Microsoft 365
    Hosting
    AWS in the US or EU (Ireland), by subscription (subprocessor list)
    Sentaro vs Abnormal Security Vendor site

  6. IRONSCALES

    Overall score: 6.8out of 10

    Best for: SMBs and MSPs on Workspace that want simulation and training bundled with email security.

    IRONSCALES connects at mailbox level over API to Google Workspace and Microsoft 365 and says it “deploys in minutes, no MX changes”. It combines per-mailbox behavioral baselines with threat intelligence crowdsourced from other customers’ reports and remediates automatically after delivery. Tiers are published but every plan is quote-only; higher tiers add account takeover, encryption, DLP and human risk management.[17]

    Gmail API deployment and in-Gmail remediation
    9.0
    Payload-free BEC and vendor fraud
    8.0
    OAuth apps and third-party access
    4.0
    Published price and total cost
    4.0
    Time to protection
    9.0
    EU hosting and DPA transparency
    6.0
    Suite breadth and maturity
    7.0

    Pros

    • Training and simulation in the same vendor.
    • Community threat intelligence.
    • Multi-tenant console for MSPs.

    Cons

    • Prices on quote only.
    • Subprocessor list names AWS in both the USA and Germany without saying who is hosted where.
    • OAuth app coverage not documented.
    Pricing
    Quote-based; tiers published
    Deployment
    API at mailbox level
    Platforms
    Google Workspace, Microsoft 365
    Hosting
    Subprocessor list names AWS in the USA and AWS Europe (Germany)
    Sentaro vs IRONSCALES Vendor site

  7. Sublime Security

    Overall score: 6.6out of 10

    Best for: Security teams on Workspace that want transparent, editable detection rules or to self-host.

    Sublime connects to Google Workspace, Microsoft 365 and IMAP sources over API, as a managed cloud service or self-hosted in your own AWS or Azure account. Detection is written as code in its Message Query Language, with open rules on GitHub covering BEC, QR codes and lookalike domains, and AI agents that triage user reports and write and backtest rules. The managed cloud is free for the first 100 mailboxes.[19]

    Gmail API deployment and in-Gmail remediation
    9.0
    Payload-free BEC and vendor fraud
    7.0
    OAuth apps and third-party access
    4.0
    Published price and total cost
    7.0
    Time to protection
    5.0
    EU hosting and DPA transparency
    7.0
    Suite breadth and maturity
    5.0

    Pros

    • Open, auditable detection rules.
    • Free for the first 100 mailboxes.
    • Self-hosting for data control.

    Cons

    • Assumes staff who will work with rules.
    • Other subprocessor locations need checking in the DPA.
    • No suite extras.
    Pricing
    Managed cloud free for the first 100 mailboxes; Enterprise quote-based
    Deployment
    API; managed cloud or self-hosted
    Platforms
    Google Workspace, Microsoft 365, IMAP
    Hosting
    Managed-cloud regions include EU (Dublin) and UK (London); or self-host in your own AWS or Azure region
    Sentaro vs Sublime Security Vendor site

  8. Barracuda Email Protection

    Overall score: 6.5out of 10

    Best for: SMBs that want DMARC, encryption, archiving and training under one contract.

    Barracuda describes its Email Protection as API-first, without MX record changes, for Google Workspace and Microsoft 365, and “operational in minutes, not weeks”. Barracuda IQ analyses intent and identity anomalies, and its “Bailey” assistant explains detection decisions in plain language. Account takeover, DMARC reporting, encryption and DLP are listed in all three plans; archiving and training are in Premium Plus. Its backup add-on is described for Microsoft 365.[22]

    Gmail API deployment and in-Gmail remediation
    9.0
    Payload-free BEC and vendor fraud
    7.0
    OAuth apps and third-party access
    4.0
    Published price and total cost
    3.0
    Time to protection
    8.0
    EU hosting and DPA transparency
    5.0
    Suite breadth and maturity
    9.0

    Pros

    • DMARC, encryption and DLP in every plan.
    • Explainable verdicts (Bailey).
    • Account takeover in every plan.

    Cons

    • No public prices.
    • API modules (Impersonation Protection, Incident Response) are listed in US regions only.
    • Backup add-on is described for Microsoft 365.
    Pricing
    Quote-based; three plans
    Deployment
    API-first, no MX change
    Platforms
    Google Workspace, Microsoft 365
    Hosting
    Trust center: Email Gateway Defense in Frankfurt and London regions; Impersonation Protection and Incident Response in US regions
    Sentaro vs Barracuda Vendor site

  9. Mimecast

    Overall score: 5.6out of 10

    Best for: Organizations that want a gateway in front of Gmail with archiving and continuity from the same vendor.

    Mimecast lists Google Workspace among supported platforms. Its API product, Cloud Integrated, is described for Microsoft 365, so on Workspace plan for Cloud Gateway, its MX-based secure email gateway, unless Mimecast confirms an API option for your tenant. It names BEC and QR-code phishing, uses multiple AI/ML engines, sandboxing and on-click URL protection, and sells Email Archive, DMARC Analyzer and awareness training.[24]

    Gmail API deployment and in-Gmail remediation
    5.0
    Payload-free BEC and vendor fraud
    7.0
    OAuth apps and third-party access
    4.0
    Published price and total cost
    3.0
    Time to protection
    6.0
    EU hosting and DPA transparency
    6.0
    Suite breadth and maturity
    9.0

    Pros

    • Archive and continuity heritage.
    • Gateway and API options in one vendor.
    • Names QR-code phishing explicitly.

    Cons

    • On Workspace, plan for an MX gateway project.
    • No public prices.
    • Account takeover not documented.
    Pricing
    Quote-based
    Deployment
    Cloud Gateway (MX); Cloud Integrated (API) described for Microsoft 365
    Platforms
    Google Workspace, Microsoft 365, on-premises and hybrid Exchange
    Hosting
    Frankfurt data centres announced in 2018; current footprint not re-confirmed
    Sentaro vs Mimecast Vendor site

  10. Guardz

    Overall score: 5.5out of 10

    Best for: MSPs that want Workspace email security bundled with endpoint and identity protection in one console.

    Guardz is an MSP-only platform that connects Microsoft 365 or Google Workspace “through secure APIs”. Its email security is, in Guardz’s words, powered by Check Point Harmony: the Ultimate plan adds Check Point (Avanan) Advanced Email and Elite adds Complete Email with outbound DLP and encryption. Guardz describes “LLM-enhanced threat detection” and shows a SOC 2 Type II badge. Pricing is per user on request through MSPs, with a 14-day free trial.[26]

    Gmail API deployment and in-Gmail remediation
    8.0
    Payload-free BEC and vendor fraud
    7.0
    OAuth apps and third-party access
    4.0
    Published price and total cost
    3.0
    Time to protection
    5.0
    EU hosting and DPA transparency
    4.0
    Suite breadth and maturity
    6.0

    Pros

    • One MSP console for email, endpoint and identity.
    • Check Point Harmony email engine.
    • Free trial and NFR licences for MSPs.

    Cons

    • Sold only through MSPs.
    • No public prices or setup time.
    • EU hosting not documented.
    Pricing
    Quote-based per user via MSPs; 14-day free trial
    Deployment
    API (ICES)
    Platforms
    Google Workspace, Microsoft 365
    Hosting
    Not publicly documented
    Vendor site

How to choose email security for Google Workspace

Is Gmail’s built-in security enough for a business?

For spam, malware and most commodity phishing, Gmail is a strong baseline, and the advanced phishing settings are worth turning on in any edition. The gaps show up in three places: fraud that carries no link or attachment (a supplier changing bank details from their real, compromised account), third-party apps that users grant access to mail and Drive, and domain-wide remediation on editions without the security investigation tool. An API tool fills those without moving MX.

API or gateway for Gmail?

Most Workspace-focused tools now connect through Google’s APIs: Sentaro, Material, Check Point, Abnormal, IRONSCALES, Sublime, Barracuda and Guardz. They see internal mail and history, and you can disconnect them without touching DNS. A gateway in front of Gmail (Mimecast Cloud Gateway, for example) needs an MX change and makes Google’s own filtering see mail second; it makes sense mainly when you also want archiving or continuity from the gateway vendor.

Check your OAuth exposure first

Workspace lets users sign in to third-party apps with their Google account and grant scopes such as reading mail or Drive. Consent phishing abuses exactly that: no password is stolen, so MFA does not help. Ask each vendor whether it inventories existing grants, scores scopes, blocks consent lures in mail, and can revoke a grant without a ticket. Sentaro, Material and Check Point document this; the others on this list did not in public material.

Questions to ask every vendor

  • Which Google API scopes do you request, and is the integration Google CASA assessed?
  • Do you scan internal mail and existing history, or only new inbound mail?
  • What happens to a delivered message you flag: banner, move to spam, quarantine or delete, and across all mailboxes?
  • Do you cover OAuth grants and Drive, or mail only?
  • Where is mail content processed and stored, and which subprocessors receive any of it?
  • What is the list price per user, and what does it cost on Business Starter versus Enterprise?

Certification and compliance status

Sentaro’s own status, stated exactly.

Google CASA
Verified API integrationTier and assessment date not published.
SOC 2
In progressNo target date published. Evidence pack on request.
ISO 27001
In progressSentaro says it will announce it the day it is signed, and not before.
DPA and subprocessor list
PublicHosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.[2]

Frequently asked questions

What is the best email security for Google Workspace?

Sentaro, for EU organizations that want more than Gmail’s filtering without a gateway. It connects through the Workspace admin APIs in four minutes with no MX change, detects payload-free BEC and vendor fraud, inventories OAuth grants and AI tools with one-click revocation, and costs a published $6 per protected account per month. Material, Check Point and Gmail’s own protection follow. Sentaro publishes this list.

Is Gmail’s built-in protection enough for a business?

It is a strong baseline: Google states Gmail blocks more than 99.9% of spam, phishing and malware, and advanced phishing settings are available to admins. It does not include a BEC or vendor-compromise behavioral model, awareness training, DMARC report management or backup, and the sandbox and investigation tool depend on edition. Businesses exposed to payment fraud or consent phishing usually add an API tool.

Which Google Workspace editions include the Gmail Security Sandbox?

Per Google Workspace Admin Help (accessed 18 October 2026): Business Standard and Business Plus, Enterprise Standard and Enterprise Plus, and Frontline Plus. Business Starter does not include it. The sandbox detonates attachments, including files inside zip and rar archives, and can delay delivery by up to three minutes.

Do I need to change MX records to secure Gmail?

Not with an API-based tool. Sentaro, Material, Check Point, Abnormal, IRONSCALES, Sublime, Barracuda and Guardz connect through Google’s APIs and leave mail routing to Gmail. A secure email gateway in front of Gmail, such as Mimecast Cloud Gateway, needs an MX change.

How do I protect Google Workspace from OAuth consent phishing?

Review which third-party apps hold access to mail and Drive, restrict unverified apps in the Admin console, and use a tool that inventories grants, scores their scopes and can revoke them. Sentaro’s App vector blocks consent-phishing lures in mail flow, surfaces new grants with their scopes and revokes risky grants through the Workspace admin SDK; Material and Check Point also document OAuth or shadow IT controls.

Which Google Workspace email security tools are hosted in the EU?

Google offers a Europe data region on Business Standard and above. Sentaro is hosted in Sweden on Microsoft Azure and lists its subprocessors in a public DPA. Check Point documents an Ireland region, Abnormal’s subprocessor list offers EU (Ireland) hosting by subscription, Mimecast announced Frankfurt data centres in 2018, and Sublime offers an EU (Dublin) managed-cloud region or self-hosting. IRONSCALES lists AWS in both the USA and Germany, and Barracuda lists Frankfurt and London for its gateway but only US regions for its API modules. Material does not document an EU region; its subprocessor list names Google Cloud in the U.S.A.

How much does Google Workspace email security cost?

Gmail’s protection is included in Workspace (Business Starter EUR 6.80 to Business Plus EUR 21.10 per user per month on the EU pricing page). Among add-ons with public prices, Sentaro is $6 per protected account per month or $68 per year with the first account free, Material lists $4 and $6 per user per month plus a Shared Drive fee, and Sublime’s managed cloud is free for the first 100 mailboxes. The rest are quote-based.

Sources and method

Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.

  1. Sentaro pricing
  2. Sentaro Data Processing Agreement and subprocessor list
  3. Google Workspace Admin Help: Advanced phishing and malware protection
  4. Google Workspace pricing (accessed 2026-10-18)
  5. Google Workspace Admin Help: Data regions (accessed 2026-10-18)
  6. Google Workspace Admin Help: Gmail Security Sandbox (editions) (accessed 2026-10-18)
  7. Google Workspace: Security (accessed 2026-10-18)
  8. Google Workspace Admin Help: Security investigation tool (editions)
  9. Google Workspace Admin Help: Advanced Protection Program
  10. Material Security: Pricing (accessed 2026-10-18)
  11. Material Security: Home page (accessed 2026-10-18)
  12. Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
  13. Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)
  14. Check Point: Harmony Email & Collaboration admin guide, data residency
  15. Abnormal AI: Inbound Email Security (accessed 2026-10-18)
  16. Abnormal AI: Trust center (certifications)
  17. IRONSCALES: Home page (accessed 2026-10-18)
  18. IRONSCALES: Pricing (accessed 2026-10-18)
  19. Sublime Security docs: Installation (accessed 2026-10-18)
  20. Sublime Security docs: Quickstart (accessed 2026-10-18)
  21. GitHub: sublime-security/sublime-rules detection rules
  22. Barracuda: Email Protection (accessed 2026-10-18)
  23. Barracuda: Email Protection plans (accessed 2026-10-18)
  24. Mimecast: Email Security (accessed 2026-10-18)
  25. Datacentre News: Mimecast opens two Frankfurt data centres (2018)
  26. Guardz: Email security (accessed 2026-10-21)
  27. Guardz: Pricing (accessed 2026-10-21)
  28. Google Workspace Admin Help: Enhanced pre-delivery message scanning
  29. Abnormal AI: Subprocessors (updated 31 July 2026, accessed 2026-10-21)
  30. IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
  31. Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)
  32. Barracuda Trust Center: Data center locations (accessed 2026-10-21)
  33. Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)
RelatedEmail security for Google WorkspaceSentaro vs Google Workspace securitySentaro vs Material SecurityConsent phishingBest email security for Microsoft 365Best AI email securitySentaro pricing

Connect Google Workspace in four minutes.

API connection, no MX change. The first account is free.

Speak to salesStart free