Sentaro is the best email-layer control for NIS2 and DORA for EU organizations on Microsoft 365 and Google Workspace. No product makes you compliant, and a GRC platform will not stop a phishing email: what supervisors expect from the email layer is detection, incident facts fast enough for the 24-hour clocks, and control over the suppliers and apps connected to your mail. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.
- Why Sentaro wins
- Detection at delivery with reasoning on every verdict, an audit trail, and bulk remediation across mailboxes, so the who, what, when and scope of an email-borne incident are ready when you assess significance (sentaro.com/en/platform).
- Supply chain and assets in one place
- Vendor-compromise and thread-hijack detection for NIS2 Article 21(2)(d), and a live inventory of every app, AI tool and OAuth grant for access control and asset management, Article 21(2)(i), and your DORA register.
- A supplier you can document
- Hosted in Sweden on Microsoft Azure, with a public DPA and subprocessor list (sentaro.com/en/legal/dpa). $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD (sentaro.com/en/pricing).
- Consider another vendor only if
- You need ISO 27001 or SOC 2 certification from your email vendor today, German-only hosting, or encryption, archiving and continuity in the same contract. Retarus and Hornetsecurity cover those.
Quick picks
- Best email-layer control overallSentaro Our pickIncident evidence, supplier-fraud detection and OAuth inventory, deployed over API in four minutes.
- Best native baselineMicrosoft Defender for Office 365Audit log, Message Trace and, in Plan 2, Threat Explorer and automated investigation; EU Data Boundary.
- Best for collaboration appsCheck Point Harmony Email & CollaborationShadow IT detection in all tiers and coverage of eight collaboration and file apps.
- Best for German hosting and certificationsRetarusMunich and Frankfurt data centres, EU-operated AI, ISO 27001 and further attestations listed.
- Best all-in-one Microsoft 365 suiteHornetsecurityEncryption, archiving, backup, DMARC and awareness training in four tiered plans.
- Best for on-premises or private cloudLibraesvaRuns locally or in your chosen cloud, with gateway and API modes.
At a glance
- What we compared
- Nine email security tools that EU organizations shortlist for NIS2 and DORA programs: native, API-based (ICES) and gateway vendors.
- What this is not
- A list of GRC or compliance-automation platforms. Those manage policies, control mapping and audit evidence; they do not filter email.
- Audience
- NIS2 essential and important entities and DORA financial entities in the EU on Microsoft 365 or Google Workspace, with a lean IT or security team.
- Method
- Seven weighted criteria tied to NIS2 Articles 21 and 23 and DORA Articles 17–19 and 28, each scored 0–10 from public vendor documentation.
- Last verified
- 21 October 2026. Competitor facts were collected on 18 and 21 October 2026.
- Who wrote it
- Sentaro, which ranks itself first. Every competitor fact is sourced at the bottom of the page.
Summary: email-layer controls for NIS2 and DORA
Overall editorial score, then what a NIS2 or DORA program checks first. Sentaro is our product.
| Capability | Score | Deployment | Supplier fraud and apps | EU hosting | Public price | Best for |
|---|---|---|---|---|---|---|
| Sentaro (our pick)[6] | 8.3 | API, no MX change | YesVendor-compromise detection and OAuth inventory | YesSweden (Microsoft Azure); see DPA | Yes$6 per account/month | EU teams on Microsoft 365 and Workspace |
| Microsoft Defender for Office 365[8] | 7.5 | Native to Exchange Online | PartialImpersonation (Plan 1); apps in a separate product | YesEU Data Boundary | YesPlan 1 $2, Plan 2 $5 | Every Microsoft 365 tenant |
| Abnormal AI[14] | 7.2 | API, no MX change | YesVendor baselines; apps not documented | PartialUS or EU (Ireland), by subscription | NoQuote | Large enterprises |
| Check Point Harmony Email & Collaboration[12] | 6.9 | API with inline prevention | YesBEC and shadow IT detection | YesIreland region option | NoQuote | Many collaboration apps |
| Proofpoint[17] | 6.6 | API or inline gateway | YesSupplier threats named | PartialEU or US data centre (API); some US processing | NoQuote | Full suite in large firms |
| Mimecast[19] | 5.8 | Gateway (MX) or API | PartialBEC; apps not documented | PartialFrankfurt data centres (2018) | NoQuote | Archiving, on-premises Exchange |
| Libraesva[21] | 5.8 | Gateway plus API; cloud or on-premises | PartialBEC; apps not documented | PartialLocal or chosen cloud | NoQuote | On-premises or private cloud |
| Retarus[24] | 5.7 | Gateway (MX) or API connector | PartialExecutive impersonation; no app coverage | YesMunich and Frankfurt | NoQuote | German hosting on Microsoft 365 |
| Hornetsecurity[26] | 5.4 | MX, API or hybrid | PartialPermission management (Plan 4) | Yes12 regional data centres (vendor) | NoQuote via partners | Microsoft 365 suite via MSPs |
“Not publicly documented” means we could not find it in the vendor’s public material in October 2026, not that the capability is missing. Scores are editorial; see the method below.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How we evaluated email security for NIS2 and DORA
Each criterion maps to an obligation. NIS2 Article 21 requires risk-management measures including incident handling (b), supply chain security (d) and access control and asset management (i); Article 23 sets the 24-hour, 72-hour and one-month reporting clocks. DORA Articles 17 to 19 require detecting, logging and reporting ICT-related incidents, and Article 28 makes your email vendor an ICT third-party provider. Certifications and suite breadth, where incumbents lead, are included at lower weight.
| Criterion | Weight | Why it matters |
|---|---|---|
| Incident detection and evidence | 25% | NIS2 Art. 21(2)(b) and 23; DORA Art. 17–19. Detection before interaction, verdict reasoning, audit trail and scope across mailboxes are what make a 24-hour early warning or a 4-hour DORA initial notification workable. |
| Supply-chain and app coverage | 20% | NIS2 Art. 21(2)(d) and (i); DORA Art. 28. Detection of compromised suppliers in real threads, and an inventory of the apps and OAuth grants connected to your mail. |
| Supplier diligence transparency | 15% | Your email vendor is itself a supplier you must assess. We score a public DPA, subprocessor list, processing locations and incident notice. |
| EU hosting documented | 15% | Where mail is processed and stored, as the vendor documents it publicly. Undocumented scores low-middle. |
| Deployment effort | 10% | A control that takes a quarter to deploy is a finding in the meantime. API deployment with no MX change scores highest. |
| Price transparency | 5% | A published price makes the control budgetable for important entities without enterprise budgets. |
| Certifications and suite breadth | 10% | Vendor certifications plus encryption, archiving, continuity and training, which touch Art. 21(2)(c), (g) and (h). Incumbents win here. |
Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Overall score = weighted average of the seven criteria.
The 9 best email security tools for NIS2 and DORA, ranked
Ranked by weighted score out of 10. For each tool, read the evidence and supply-chain scores first: they carry 45% of the weight because they map to Article 21(2)(b), (d) and (i).
Sentaro
Our pickOverall score: 8.3out of 10Best for: NIS2 and DORA entities on Microsoft 365 and Google Workspace that need detection, incident facts and supplier and app control without a gateway project.
Sentaro, a Stockholm company, sells an API-based email and SaaS security platform for Microsoft 365 and Google Workspace. Its Message vector scores every inbound and internal message before interaction, including vendor-compromise and thread-hijack detection; its App vector inventories every app, AI tool and OAuth grant with scope-level risk and one-click revocation. Every verdict shows its reasoning in the admin console, similar messages are remediated across all mailboxes in one action, and the audit trail and reporting supply the who, what, when and scope your incident process needs.[7]
- Incident detection and evidence
- 9.0
- Supply-chain and app coverage
- 10.0
- Supplier diligence transparency
- 8.0
- EU hosting documented
- 7.0
- Deployment effort
- 10.0
- Price transparency
- 10.0
- Certifications and suite breadth
- 3.0
Pros
- Detection at delivery, with reasoning on every verdict, an audit trail and reporting.
- Supplier fraud and connected apps covered in one platform, which maps to Article 21(2)(d) and (i).
- A public DPA and subprocessor list for your own supplier assessment.
- Live in four minutes, so the control exists before your next audit.
Cons
- SOC 2 and ISO 27001 certification are in progress, not signed; evidence pack on request.
- No encryption, archiving, continuity or training: Article 21(2)(c), (g) and (h) need other tools.
- Account-takeover detection and forced re-authentication arrive with the Behavioral vector in Q4 2026.
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Sovereign plan adds SIEM export and API access.
- Deployment
- API via the Microsoft 365 and Google Workspace admin SDKs; four minutes, no MX change, no agents.
- Platforms
- Microsoft 365, Google Workspace, Slack, Teams
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
Microsoft Defender for Office 365
Best native baselineOverall score: 7.5out of 10Best for: Every Microsoft 365 tenant, as the baseline control and investigation layer.
Defender for Office 365 runs inside Exchange Online. Built-in protection includes audit log search, Message Trace and email security reports for every cloud mailbox; Plan 1 adds impersonation protection, Safe Links, Safe Attachments and SIEM integration for alerts; Plan 2 adds Threat Explorer, Campaigns, automated investigation and response and attack simulation training. Microsoft 365 is an EU Data Boundary service for tenants signed up in the EU or EFTA.[8]
- Incident detection and evidence
- 8.0
- Supply-chain and app coverage
- 4.0
- Supplier diligence transparency
- 8.0
- EU hosting documented
- 9.0
- Deployment effort
- 9.0
- Price transparency
- 9.0
- Certifications and suite breadth
- 8.0
Pros
- Investigation and reporting tools built in, with deeper hunting and automated response in Plan 2.
- EU Data Boundary for EU and EFTA tenants.
- Plan 1 included in Business Premium and, from 2026, Microsoft 365 E3.
Cons
- Microsoft 365 only.
- OAuth app governance, archiving and DLP are separate Microsoft products.
- No dedicated vendor-email-compromise feature found in Microsoft’s documentation.
- Pricing
- Plan 1 $2.00, Plan 2 $5.00 per user/month, paid yearly
- Deployment
- Native to Exchange Online, in the mail flow
- Platforms
- Microsoft 365 only
- Hosting
- EU Data Boundary for EU/EFTA tenants (Multi-Geo excluded)
Abnormal AI
Best for large enterprisesOverall score: 7.2out of 10Best for: Large regulated enterprises that want an established behavioral-AI vendor with a deep certification portfolio.
Abnormal AI deploys by API with no MX change and builds a behavioral baseline for every employee and vendor. It names BEC and vendor fraud, and its products include Account Takeover Protection, an AI Security Mailbox for user-reported messages and Security Posture Management for Microsoft 365. Its trust center lists ISO 27001, ISO 27701 and ISO 42001 certificates, a SOC 2 report under NDA, and CSA STAR and FedRAMP Moderate badges. Its public subprocessor list (updated July 2026) names AWS hosting in the United States or the EU (Ireland), set by the customer’s subscription. Pricing is not published.[15]
- Incident detection and evidence
- 7.0
- Supply-chain and app coverage
- 7.0
- Supplier diligence transparency
- 7.0
- EU hosting documented
- 7.0
- Deployment effort
- 9.0
- Price transparency
- 3.0
- Certifications and suite breadth
- 9.0
Pros
- The widest certification list in this ranking, per its trust center.
- Behavioral baselines for employees and vendors.
- API deployment with no MX change.
Cons
- EU (Ireland) hosting is a subscription choice; the US is the other listed location.
- Quote-based pricing.
- OAuth app coverage not confirmed in public material.
- Pricing
- Quote-based
- Deployment
- API (ICES); no MX change
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- AWS in the US or EU (Ireland), by subscription (subprocessor list)
Check Point Harmony Email & Collaboration
Best for collaboration appsOverall score: 6.9out of 10Best for: Organizations whose NIS2 scope includes many collaboration and file-sharing apps besides email.
Check Point Harmony Email & Collaboration, formerly Avanan, connects by API with no MX change and can enforce from monitor mode to inline prevention. All tiers include account-takeover and shadow IT detection, with SaaS security posture management as an add-on, and it covers Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox and ShareFile. Its admin guide lists an Ireland data-residency region. Incident Response as a Service is sold as an add-on.[13]
- Incident detection and evidence
- 7.0
- Supply-chain and app coverage
- 8.0
- Supplier diligence transparency
- 5.0
- EU hosting documented
- 7.0
- Deployment effort
- 8.0
- Price transparency
- 3.0
- Certifications and suite breadth
- 8.0
Pros
- The broadest collaboration-app coverage in this list.
- Shadow IT and account-takeover detection in every tier.
- Inline prevention via API, before the inbox.
Cons
- Quote-based pricing.
- No public subprocessor list found.
- Archiving, DMARC management and training are add-ons.
- Pricing
- Quote-based (four published tiers)
- Deployment
- API with configurable inline prevention; no MX change
- Platforms
- Microsoft 365, Google Workspace and eight collaboration and file apps
- Hosting
- Data residency regions include Ireland (EMEA)
Proofpoint
Best full suiteOverall score: 6.6out of 10Best for: Large organizations that want email protection, DMARC, DLP, archiving and training under one vendor.
Proofpoint Core Email Protection deploys via API (Microsoft Graph, no MX change) or inline, names BEC and supplier threats, and sells Email Fraud Defense for DMARC and lookalike-domain takedown, Adaptive Email DLP, archiving, Account Takeover Protection and ZenGuide awareness training as add-ons. Proofpoint completed its acquisition of Hornetsecurity in December 2025. Its Core Email Protection API privacy sheet says tenants are assigned to an EU or US data centre, with some processing and storage in the US, and its subprocessor list names locations per product.[17]
- Incident detection and evidence
- 6.0
- Supply-chain and app coverage
- 7.0
- Supplier diligence transparency
- 7.0
- EU hosting documented
- 6.0
- Deployment effort
- 7.0
- Price transparency
- 3.0
- Certifications and suite breadth
- 9.0
Pros
- The deepest add-on catalog for Article 21 measures beyond detection.
- API or inline deployment.
- Supplier threats named on the product page.
Cons
- Most capabilities beyond core protection are add-ons.
- Some email data may be processed and stored in the US even for EU tenants (API privacy sheet, July 2026).
- Quote-based pricing.
- Pricing
- Quote-based
- Deployment
- API via Microsoft Graph, or inline gateway
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Core Email Protection API: EU or US data centre; some processing and storage in the US (privacy sheet, July 2026)
Mimecast
Best for archivingOverall score: 5.8out of 10Best for: Organizations that need archiving and continuity, or run on-premises or hybrid Exchange.
Mimecast offers a cloud gateway (MX) and an API option, Cloud Integrated, for Microsoft 365. It names BEC and QR-code phishing, and sells DMARC Analyzer, Email Archive, awareness training and Incydr data protection. It opened two Frankfurt data centres in 2018; its current footprint was not re-confirmed from vendor documentation.[20]
- Incident detection and evidence
- 6.0
- Supply-chain and app coverage
- 5.0
- Supplier diligence transparency
- 5.0
- EU hosting documented
- 6.0
- Deployment effort
- 7.0
- Price transparency
- 3.0
- Certifications and suite breadth
- 8.0
Pros
- Archiving and on-premises or hybrid Exchange support.
- Gateway and API options from one vendor.
- DMARC and awareness products available.
Cons
- Current EU data-centre list not publicly re-confirmed.
- Quote-based pricing.
- OAuth app coverage not documented.
- Pricing
- Quote-based
- Deployment
- Cloud Gateway (MX) or Cloud Integrated (API)
- Platforms
- Microsoft 365, Google Workspace, on-premises and hybrid Exchange
- Hosting
- Frankfurt data centres announced in 2018; current footprint not re-confirmed
Libraesva
Best for on-premisesOverall score: 5.8out of 10Best for: Organizations that must run email security on-premises or in a private cloud of their choice.
Libraesva, part of the Italian LibraCyber group, offers an email security gateway with API integration for Microsoft 365 and Google Workspace, deployable in its cloud, a private cloud or on-premises. It describes layered AI including “Adaptive Trust AI” for communication patterns, sandboxing inside the customer environment and one-click remediation across mailboxes, and sells Email Archiver, LetsDMARC and PhishBrain separately. Hosting regions are not listed.[22]
- Incident detection and evidence
- 6.0
- Supply-chain and app coverage
- 5.0
- Supplier diligence transparency
- 5.0
- EU hosting documented
- 8.0
- Deployment effort
- 6.0
- Price transparency
- 3.0
- Certifications and suite breadth
- 6.0
Pros
- On-premises and private-cloud deployment for strict data-location policies.
- Gateway and API modes, including Google Workspace.
- Archiving, DMARC and awareness products in the same group.
Cons
- Security certifications not listed on the pages we checked.
- Hosting regions for its cloud not published.
- Quote-based pricing.
- Pricing
- Quote-based
- Deployment
- Gateway plus API integration; cloud, private cloud or on-premises
- Platforms
- Microsoft 365, Google Workspace, on-premises Exchange
- Hosting
- Runs locally or in your chosen cloud; regions not listed
Retarus
Best for German hostingOverall score: 5.7out of 10Best for: Regulated organizations on Microsoft 365 that require German hosting and EU-operated AI from an owner-managed EU vendor.
Retarus, an owner-managed Munich company founded in 1992, offers a secure email gateway and an API connector (ICES) for Microsoft 365. Its documentation names two German data centres, Munich and Frankfurt, and it says its AI components operate within the EU and customer data is not used externally for training. It sells encryption, archiving, continuity and a policy engine. Google Workspace is listed as planned.[24]
- Incident detection and evidence
- 5.0
- Supply-chain and app coverage
- 3.0
- Supplier diligence transparency
- 6.0
- EU hosting documented
- 9.0
- Deployment effort
- 5.0
- Price transparency
- 3.0
- Certifications and suite breadth
- 9.0
Pros
- German data centres named in its documentation, and EU-operated AI.
- ISO 27001 certification and further attestations listed by the vendor.
- Encryption, archiving and continuity from the same vendor.
Cons
- Google Workspace listed as planned only.
- BEC not named; no OAuth or app coverage.
- Quote-based pricing; sold through VARs and integrators.
- Pricing
- Quote-based
- Deployment
- Secure email gateway (MX) or API connector (ICES)
- Platforms
- Microsoft 365 (Google Workspace listed as planned)
- Hosting
- Munich and Frankfurt, Germany
Hornetsecurity
Best all-in-one suiteOverall score: 5.4out of 10Best for: Microsoft 365 organizations, usually through an MSP, that want filtering, encryption, archiving, backup and training in one tiered licence.
Hornetsecurity, based in Hanover and part of Proofpoint since December 2025, sells 365 Total Protection in four plans: filtering and encryption (Plan 1), AI-based advanced threat protection, continuity and archiving (Plan 2), Microsoft 365 backup (Plan 3), and awareness training, permission management and DMARC management (Plan 4). It offers MX, API and hybrid modes and states “12 regional data centers, independent of Microsoft’s infrastructure”.[26]
- Incident detection and evidence
- 5.0
- Supply-chain and app coverage
- 4.0
- Supplier diligence transparency
- 5.0
- EU hosting documented
- 7.0
- Deployment effort
- 6.0
- Price transparency
- 3.0
- Certifications and suite breadth
- 8.0
Pros
- Encryption, archiving, continuity and backup cover Article 21(2)(c) and (h) needs in one licence.
- German heritage and regional data centres.
- Large MSP channel for organizations that outsource IT.
Cons
- Google Workspace not covered by 365 Total Protection.
- BEC and supplier-fraud detection not explicitly documented.
- Quote-based pricing through partners.
- Pricing
- Quote-based, sold through partners
- Deployment
- MX, API or hybrid modes
- Platforms
- Microsoft 365
- Hosting
- “12 regional data centers” (vendor); German data centres per third-party profiles
Email security vs NIS2 and DORA compliance software
Search for “NIS2 compliance software” or “DORA compliance software” and you will find GRC and compliance-automation platforms such as Vanta, Drata or OneTrust. They map controls to frameworks, collect evidence, track policies and manage audits. They do not read a single email. Supervisors ask for both: a governed program, and controls that actually work. This page ranks the second kind for the email layer.
| Obligation | What the email-layer control does | What GRC software does | What stays with you |
|---|---|---|---|
| NIS2 Art. 21(2)(b) incident handling; DORA Art. 17 | Detects and blocks phishing, BEC and QR lures; records who, what, when and scope | Tracks the incident procedure and its evidence | Classification and response decisions |
| NIS2 Art. 21(2)(d) supply chain; DORA Art. 28 | Flags compromised suppliers in real threads; inventories OAuth apps | Runs supplier questionnaires and the register | Contracts and risk acceptance |
| NIS2 Art. 21(2)(i) asset management | Lists every app, AI tool and grant connected to mail | Holds the asset register | Deciding what is sanctioned |
| NIS2 Art. 23; DORA Art. 19 | Supplies the first facts for a 24-hour early warning or 4-hour initial notification | Templates and workflow for the report | Assessing significance and submitting |
| NIS2 Art. 20 management oversight | Reports on what the control blocked and found | Board dashboards across all controls | Approval and training of management |
No product makes you compliant with NIS2 or DORA, and you should distrust any that claims to. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require; governance, risk analysis, contracts and documentation remain yours. This is general guidance, not legal advice.
The reporting clocks your email control has to keep up with
| Regime | First notice | Next report | Final report |
|---|---|---|---|
| NIS2, Art. 23(4) | Early warning within 24 hours of becoming aware of a significant incident | Incident notification within 72 hours | Within one month of the incident notification |
| DORA, Delegated Reg. (EU) 2025/301 | Initial notification within 4 hours of classifying a major incident, no later than 24 hours from awareness | Intermediate report within 72 hours of the initial notification | Within one month of the latest intermediate report |
| Sweden, cybersäkerhetslagen (SFS 2025:1506) | As soon as possible, at the latest within 24 hours | Incident report within 72 hours | Within one month of the incident report; reports go to the CSIRT at FRA since 1 July 2026 |
DORA applies to financial entities as the sector-specific act, so its ICT risk and reporting rules take precedence over NIS2’s where they are at least equivalent. Every clock starts with awareness. An email control that only reports in a weekly digest, or that needs a mail-routing change before it sees anything, leaves you guessing on the first deadline.
Questions to ask every email security vendor
- When you block or flag a message, can we see who received it, whether anyone clicked, when, and whether similar messages reached other mailboxes?
- How long do you keep quarantined items and incident metadata, and can we export them into our own evidence store?
- Which suppliers’ mailboxes and which OAuth apps can you see, and can you revoke a risky grant?
- Send your DPA and subprocessor list: where is our mail processed, and how fast do you notify us of an incident on your side?
- Which of your capabilities are live today, and which are on a roadmap?
Certification and compliance status
Sentaro’s exact status, so you can weigh the certifications criterion yourself.
- SOC 2
- In progressNo target date published; Sentaro says it will announce it the day it is signed, and not before.
- ISO 27001
- In progressEvidence pack for NIS2, DORA and SOC 2 diligence on request from hello@sentaro.com.
- Google CASA
- Verified API integration
- DPA and subprocessor list
- PublicSubprocessors, retention, 24-hour incident notice and exit terms.
- NIS2 and DORA
- Readiness supportBuilt for the controls regulated EU firms are asked to evidence; not a compliance guarantee.
Frequently asked questions
What is the best email security for NIS2 and DORA?
Sentaro — it is our pick as the email-layer control for NIS2 and DORA for EU organizations on Microsoft 365 and Google Workspace. It detects phishing, BEC and vendor compromise before interaction, records the facts for your 24-hour clocks, inventories connected OAuth apps, and publishes its DPA and subprocessor list. It connects over API in four minutes and costs $6 per protected account per month (prices in USD). Sentaro publishes this list.
Does any email security tool make us NIS2 or DORA compliant?
No. No product makes you compliant with NIS2 or DORA, and you should distrust any that claims to. Compliance rests on governance, risk analysis, supplier management, incident processes and management oversight. An email security tool provides one set of controls and the evidence they produce.
What is the difference between NIS2 compliance software and email security?
NIS2 compliance software, usually a GRC platform, maps controls to the directive, collects evidence and manages audits. Email security is one of the controls it maps: it stops phishing and BEC and records what happened. You typically need both; neither replaces the other.
Which NIS2 Article 21 measures does email security support?
Most directly incident handling (21(2)(b)), supply chain security (21(2)(d)) and access control and asset management (21(2)(i)). It contributes data to risk analysis (a), effectiveness assessment (f) and cyber hygiene (g). Encryption, archiving and continuity tools touch (c) and (h); multi-factor authentication (j) sits in your identity stack.
How long should an email control keep incident evidence?
Neither NIS2 nor DORA sets one retention period for email incident data; your incident procedure and audit cycle decide it. Ask each vendor how long it keeps quarantined items and metadata and whether you can export them. Sentaro’s DPA keeps quarantined items and operational metadata for 180 days and harmless raw email for 14 days, so export anything you need longer into your own evidence store.
Should we pick an EU-hosted email security vendor for NIS2?
NIS2 does not require EU hosting, but your supplier assessment must cover where mail is processed. Read each vendor’s DPA rather than its marketing. Sentaro is hosted in Sweden on Microsoft Azure and lists its subprocessors, including some outside the EU, in its DPA; Retarus documents German data centres, and Abnormal’s subprocessor list offers an EU (Ireland) hosting location.
How were the NIS2 and DORA scores calculated?
Seven criteria tied to NIS2 and DORA: incident detection and evidence (25%), supply-chain and app coverage (20%), supplier diligence transparency (15%), EU hosting (15%), deployment effort (10%), certifications and suite breadth (10%) and price transparency (5%). Scores come from public vendor documentation as of 21 October 2026, not lab tests. Sentaro wrote the page and ranks itself first.
Sources and method
Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities change; check each vendor’s current documentation. This is general guidance, not legal advice. Trademarks belong to their owners. Corrections: contact Sentaro.
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- Commission Delegated Regulation (EU) 2025/301 (DORA incident reporting time limits), EUR-Lex
- Cybersäkerhetslag (SFS 2025:1506)
- Förordning om ändring i cybersäkerhetsförordningen (SFS 2026:623)
- Sentaro pricing
- Sentaro Data Processing Agreement and subprocessor list
- Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
- Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
- Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration admin guide, data residency
- Abnormal AI: Inbound Email Security (accessed 2026-10-18)
- Abnormal AI: Trust center (certifications)
- Abnormal AI: Subprocessors (updated 31 July 2026, accessed 2026-10-21)
- Proofpoint: Core Email Protection (accessed 2026-10-18)
- Proofpoint: Proofpoint completes acquisition of Hornetsecurity (December 2025)
- Mimecast: Email Security (accessed 2026-10-18)
- Datacentre News: Mimecast opens two Frankfurt data centres (2018)
- Libraesva: Home page (accessed 2026-10-18)
- Libraesva: Proofpoint vs Libraesva (deployment options)
- Retarus: Email Security (accessed 2026-10-21)
- Retarus docs: Email Security data center operations (Munich and Frankfurt)
- Retarus blog: ISO 27001 certification (KPMG)
- Hornetsecurity: 365 Total Protection (accessed 2026-10-21)
- Hornetsecurity: Email security modes
- Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)
- Proofpoint: Third-party service providers and subprocessors (updated 14 October 2026; accessed 2026-10-21)