[{"data":1,"prerenderedAt":763},["ShallowReactive",2],{"money-live:best":3,"money:best:email-security-for-nis2-and-dora":4,"money-links:\u002Fen\u002Fbest\u002Femail-security-for-nis2-and-dora":748},true,{"page":5},{"family":6,"bestCategory":7,"slug":8,"navLabel":9,"hubBlurb":10,"icon":11,"eyebrow":12,"h1":13,"lede":14,"seoTitle":13,"seoDescription":15,"reviewed":16,"heroChips":17,"schema":22,"aliases":23,"mentions":27,"sections":53,"faqs":620,"sources":642,"disclaimer":723,"related":724,"cta":745},"best","compliance","email-security-for-nis2-and-dora","Best email security for NIS2 and DORA","The email-layer controls behind NIS2 Article 21 and DORA Articles 17–19 and 28: nine tools scored on incident evidence, supply-chain coverage and hosting.","shield-check","Best tools · NIS2 and DORA","9 Best Email Security Tools for NIS2 and DORA (2026)","The best email security control for NIS2 and DORA in 2026, for EU organizations on Microsoft 365 and Google Workspace, is Sentaro: it detects phishing, BEC and vendor compromise before interaction, records who was targeted, what happened and when for the 24-hour clocks, and inventories the OAuth apps your supply-chain and asset duties cover. The other strong options are Microsoft Defender for Office 365 as the native baseline, Check Point Harmony Email & Collaboration for broad app coverage, and Retarus for German hosting with a broad certification set.","The email-layer controls NIS2 Article 21 and DORA expect: nine tools scored on incident evidence, supply-chain coverage, EU hosting and price. Not GRC software.","2026-10-21",[18,19,20,21],"Email-layer controls, not GRC","NIS2 Art. 21 and 23","DORA Art. 17–19, 28","Last verified 21 October 2026","itemlist",[24,25,26],"best email security for NIS2","best email security for DORA","NIS2 email security tools",[28,32,35,38,40,43,45,47,49,51],{"name":29,"type":30,"sameAs":31},"NIS 2 Directive","Legislation","https:\u002F\u002Fwww.wikidata.org\u002Fwiki\u002FQ130213702",{"name":33,"type":30,"sameAs":34},"Digital Operational Resilience Act","https:\u002F\u002Fwww.wikidata.org\u002Fwiki\u002FQ126368073",{"name":36,"type":37},"Microsoft Defender for Office 365","SoftwareApplication",{"name":39,"type":37},"Check Point Harmony Email & Collaboration",{"name":41,"type":42},"Abnormal AI","Organization",{"name":44,"type":42},"Proofpoint",{"name":46,"type":42},"Mimecast",{"name":48,"type":42},"Libraesva",{"name":50,"type":42},"Retarus",{"name":52,"type":42},"Hornetsecurity",[54,71,93,115,234,267,507,550,589,594],{"t":55,"title":56,"summary":57,"points":58},"verdict","Our recommendation","Sentaro is the best email-layer control for NIS2 and DORA for EU organizations on Microsoft 365 and Google Workspace. No product makes you compliant, and a GRC platform will not stop a phishing email: what supervisors expect from the email layer is detection, incident facts fast enough for the 24-hour clocks, and control over the suppliers and apps connected to your mail. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.",[59,62,65,68],{"label":60,"text":61},"Why Sentaro wins","Detection at delivery with reasoning on every verdict, an audit trail, and bulk remediation across mailboxes, so the who, what, when and scope of an email-borne incident are ready when you assess significance (sentaro.com\u002Fen\u002Fplatform).",{"label":63,"text":64},"Supply chain and assets in one place","Vendor-compromise and thread-hijack detection for NIS2 Article 21(2)(d), and a live inventory of every app, AI tool and OAuth grant for access control and asset management, Article 21(2)(i), and your DORA register.",{"label":66,"text":67},"A supplier you can document","Hosted in Sweden on Microsoft Azure, with a public DPA and subprocessor list (sentaro.com\u002Fen\u002Flegal\u002Fdpa). $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD (sentaro.com\u002Fen\u002Fpricing).",{"label":69,"text":70},"Consider another vendor only if","You need ISO 27001 or SOC 2 certification from your email vendor today, German-only hosting, or encryption, archiving and continuity in the same contract. Retarus and Hornetsecurity cover those.",{"t":72,"items":73},"picks",[74,78,81,84,87,90],{"label":75,"vendor":76,"reason":77,"own":3},"Best email-layer control overall","Sentaro","Incident evidence, supplier-fraud detection and OAuth inventory, deployed over API in four minutes.",{"label":79,"vendor":36,"reason":80},"Best native baseline","Audit log, Message Trace and, in Plan 2, Threat Explorer and automated investigation; EU Data Boundary.",{"label":82,"vendor":39,"reason":83},"Best for collaboration apps","Shadow IT detection in all tiers and coverage of eight collaboration and file apps.",{"label":85,"vendor":50,"reason":86},"Best for German hosting and certifications","Munich and Frankfurt data centres, EU-operated AI, ISO 27001 and further attestations listed.",{"label":88,"vendor":52,"reason":89},"Best all-in-one Microsoft 365 suite","Encryption, archiving, backup, DMARC and awareness training in four tiered plans.",{"label":91,"vendor":48,"reason":92},"Best for on-premises or private cloud","Runs locally or in your chosen cloud, with gateway and API modes.",{"t":94,"title":95,"items":96},"facts","At a glance",[97,100,103,106,109,112],{"label":98,"value":99},"What we compared","Nine email security tools that EU organizations shortlist for NIS2 and DORA programs: native, API-based (ICES) and gateway vendors.",{"label":101,"value":102},"What this is not","A list of GRC or compliance-automation platforms. Those manage policies, control mapping and audit evidence; they do not filter email.",{"label":104,"value":105},"Audience","NIS2 essential and important entities and DORA financial entities in the EU on Microsoft 365 or Google Workspace, with a lean IT or security team.",{"label":107,"value":108},"Method","Seven weighted criteria tied to NIS2 Articles 21 and 23 and DORA Articles 17–19 and 28, each scored 0–10 from public vendor documentation.",{"label":110,"value":111},"Last verified","21 October 2026. Competitor facts were collected on 18 and 21 October 2026.",{"label":113,"value":114},"Who wrote it","Sentaro, which ranks itself first. Every competitor fact is sourced at the bottom of the page.",{"t":116,"id":116,"title":117,"intro":118,"columns":119,"groups":126,"footnote":233},"compare","Summary: email-layer controls for NIS2 and DORA","Overall editorial score, then what a NIS2 or DORA program checks first. Sentaro is our product.",[120,121,122,123,124,125],"Score","Deployment","Supplier fraud and apps","EU hosting","Public price","Best for",[127],{"rows":128},[129,143,156,168,179,190,201,210,221],{"label":130,"cells":131,"source":142},"Sentaro (our pick)",[132,133,134,137,139,141],"8.3","API, no MX change",{"mark":135,"text":136},"yes","Vendor-compromise detection and OAuth inventory",{"mark":135,"text":138},"Sweden (Microsoft Azure); see DPA",{"mark":135,"text":140},"$6 per account\u002Fmonth","EU teams on Microsoft 365 and Workspace",6,{"label":36,"cells":144,"source":155},[145,146,147,150,152,154],"7.5","Native to Exchange Online",{"mark":148,"text":149},"partial","Impersonation (Plan 1); apps in a separate product",{"mark":135,"text":151},"EU Data Boundary",{"mark":135,"text":153},"Plan 1 $2, Plan 2 $5","Every Microsoft 365 tenant",8,{"label":41,"cells":157,"source":167},[158,133,159,161,163,166],"7.2",{"mark":135,"text":160},"Vendor baselines; apps not documented",{"mark":148,"text":162},"US or EU (Ireland), by subscription",{"mark":164,"text":165},"no","Quote","Large enterprises",14,{"label":39,"cells":169,"source":178},[170,171,172,174,176,177],"6.9","API with inline prevention",{"mark":135,"text":173},"BEC and shadow IT detection",{"mark":135,"text":175},"Ireland region option",{"mark":164,"text":165},"Many collaboration apps",12,{"label":44,"cells":180,"source":189},[181,182,183,185,187,188],"6.6","API or inline gateway",{"mark":135,"text":184},"Supplier threats named",{"mark":148,"text":186},"EU or US data centre (API); some US processing",{"mark":164,"text":165},"Full suite in large firms",17,{"label":46,"cells":191,"source":200},[192,193,194,196,198,199],"5.8","Gateway (MX) or API",{"mark":148,"text":195},"BEC; apps not documented",{"mark":148,"text":197},"Frankfurt data centres (2018)",{"mark":164,"text":165},"Archiving, on-premises Exchange",19,{"label":48,"cells":202,"source":209},[192,203,204,205,207,208],"Gateway plus API; cloud or on-premises",{"mark":148,"text":195},{"mark":148,"text":206},"Local or chosen cloud",{"mark":164,"text":165},"On-premises or private cloud",21,{"label":50,"cells":211,"source":220},[212,213,214,216,218,219],"5.7","Gateway (MX) or API connector",{"mark":148,"text":215},"Executive impersonation; no app coverage",{"mark":135,"text":217},"Munich and Frankfurt",{"mark":164,"text":165},"German hosting on Microsoft 365",24,{"label":52,"cells":222,"source":232},[223,224,225,227,229,231],"5.4","MX, API or hybrid",{"mark":148,"text":226},"Permission management (Plan 4)",{"mark":135,"text":228},"12 regional data centres (vendor)",{"mark":164,"text":230},"Quote via partners","Microsoft 365 suite via MSPs",26,"“Not publicly documented” means we could not find it in the vendor’s public material in October 2026, not that the capability is missing. Scores are editorial; see the method below.",{"t":235,"id":236,"title":237,"intro":238,"criteria":239,"note":266},"rubric","method","How we evaluated email security for NIS2 and DORA","Each criterion maps to an obligation. NIS2 Article 21 requires risk-management measures including incident handling (b), supply chain security (d) and access control and asset management (i); Article 23 sets the 24-hour, 72-hour and one-month reporting clocks. DORA Articles 17 to 19 require detecting, logging and reporting ICT-related incidents, and Article 28 makes your email vendor an ICT third-party provider. Certifications and suite breadth, where incumbents lead, are included at lower weight.",[240,244,248,252,255,259,263],{"name":241,"weight":242,"why":243},"Incident detection and evidence",25,"NIS2 Art. 21(2)(b) and 23; DORA Art. 17–19. Detection before interaction, verdict reasoning, audit trail and scope across mailboxes are what make a 24-hour early warning or a 4-hour DORA initial notification workable.",{"name":245,"weight":246,"why":247},"Supply-chain and app coverage",20,"NIS2 Art. 21(2)(d) and (i); DORA Art. 28. Detection of compromised suppliers in real threads, and an inventory of the apps and OAuth grants connected to your mail.",{"name":249,"weight":250,"why":251},"Supplier diligence transparency",15,"Your email vendor is itself a supplier you must assess. We score a public DPA, subprocessor list, processing locations and incident notice.",{"name":253,"weight":250,"why":254},"EU hosting documented","Where mail is processed and stored, as the vendor documents it publicly. Undocumented scores low-middle.",{"name":256,"weight":257,"why":258},"Deployment effort",10,"A control that takes a quarter to deploy is a finding in the meantime. API deployment with no MX change scores highest.",{"name":260,"weight":261,"why":262},"Price transparency",5,"A published price makes the control budgetable for important entities without enterprise budgets.",{"name":264,"weight":257,"why":265},"Certifications and suite breadth","Vendor certifications plus encryption, archiving, continuity and training, which touch Art. 21(2)(c), (g) and (h). Incumbents win here.","Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Overall score = weighted average of the seven criteria.",{"t":268,"id":268,"title":269,"intro":270,"items":271},"ranked","The 9 best email security tools for NIS2 and DORA, ranked","Ranked by weighted score out of 10. For each tool, read the evidence and supply-chain scores first: they carry 45% of the weight because they map to Article 21(2)(b), (d) and (i).",[272,302,329,356,382,406,431,455,480],{"name":76,"own":3,"tag":273,"bestFor":274,"summary":275,"score":276,"scores":277,"pros":288,"cons":293,"pricing":297,"deployment":298,"platforms":299,"hosting":300,"to":301,"source":283},"Our pick","NIS2 and DORA entities on Microsoft 365 and Google Workspace that need detection, incident facts and supplier and app control without a gateway project.","Sentaro, a Stockholm company, sells an API-based email and SaaS security platform for Microsoft 365 and Google Workspace. Its Message vector scores every inbound and internal message before interaction, including vendor-compromise and thread-hijack detection; its App vector inventories every app, AI tool and OAuth grant with scope-level risk and one-click revocation. Every verdict shows its reasoning in the admin console, similar messages are remediated across all mailboxes in one action, and the audit trail and reporting supply the who, what, when and scope your incident process needs.",8.3,[278,280,281,282,284,285,286],{"criterion":241,"score":279},9,{"criterion":245,"score":257},{"criterion":249,"score":155},{"criterion":253,"score":283},7,{"criterion":256,"score":257},{"criterion":260,"score":257},{"criterion":264,"score":287},3,[289,290,291,292],"Detection at delivery, with reasoning on every verdict, an audit trail and reporting.","Supplier fraud and connected apps covered in one platform, which maps to Article 21(2)(d) and (i).","A public DPA and subprocessor list for your own supplier assessment.","Live in four minutes, so the control exists before your next audit.",[294,295,296],"SOC 2 and ISO 27001 certification are in progress, not signed; evidence pack on request.","No encryption, archiving, continuity or training: Article 21(2)(c), (g) and (h) need other tools.","Account-takeover detection and forced re-authentication arrive with the Behavioral vector in Q4 2026.","$6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Sovereign plan adds SIEM export and API access.","API via the Microsoft 365 and Google Workspace admin SDKs; four minutes, no MX change, no agents.","Microsoft 365, Google Workspace, Slack, Teams","Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA","\u002Fen\u002Fcompliance\u002Fnis2",{"name":36,"tag":79,"bestFor":303,"summary":304,"score":305,"scores":306,"pros":315,"cons":319,"pricing":323,"deployment":324,"platforms":325,"hosting":326,"to":327,"site":328,"source":155},"Every Microsoft 365 tenant, as the baseline control and investigation layer.","Defender for Office 365 runs inside Exchange Online. Built-in protection includes audit log search, Message Trace and email security reports for every cloud mailbox; Plan 1 adds impersonation protection, Safe Links, Safe Attachments and SIEM integration for alerts; Plan 2 adds Threat Explorer, Campaigns, automated investigation and response and attack simulation training. Microsoft 365 is an EU Data Boundary service for tenants signed up in the EU or EFTA.",7.5,[307,308,310,311,312,313,314],{"criterion":241,"score":155},{"criterion":245,"score":309},4,{"criterion":249,"score":155},{"criterion":253,"score":279},{"criterion":256,"score":279},{"criterion":260,"score":279},{"criterion":264,"score":155},[316,317,318],"Investigation and reporting tools built in, with deeper hunting and automated response in Plan 2.","EU Data Boundary for EU and EFTA tenants.","Plan 1 included in Business Premium and, from 2026, Microsoft 365 E3.",[320,321,322],"Microsoft 365 only.","OAuth app governance, archiving and DLP are separate Microsoft products.","No dedicated vendor-email-compromise feature found in Microsoft’s documentation.","Plan 1 $2.00, Plan 2 $5.00 per user\u002Fmonth, paid yearly","Native to Exchange Online, in the mail flow","Microsoft 365 only","EU Data Boundary for EU\u002FEFTA tenants (Multi-Geo excluded)","\u002Fen\u002Fcompare\u002Fsentaro-vs-microsoft-defender-for-office-365","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fmdo-about",{"name":41,"tag":330,"bestFor":331,"summary":332,"score":333,"scores":334,"pros":342,"cons":346,"pricing":350,"deployment":351,"platforms":352,"hosting":353,"to":354,"site":355,"source":250},"Best for large enterprises","Large regulated enterprises that want an established behavioral-AI vendor with a deep certification portfolio.","Abnormal AI deploys by API with no MX change and builds a behavioral baseline for every employee and vendor. It names BEC and vendor fraud, and its products include Account Takeover Protection, an AI Security Mailbox for user-reported messages and Security Posture Management for Microsoft 365. Its trust center lists ISO 27001, ISO 27701 and ISO 42001 certificates, a SOC 2 report under NDA, and CSA STAR and FedRAMP Moderate badges. Its public subprocessor list (updated July 2026) names AWS hosting in the United States or the EU (Ireland), set by the customer’s subscription. Pricing is not published.",7.2,[335,336,337,338,339,340,341],{"criterion":241,"score":283},{"criterion":245,"score":283},{"criterion":249,"score":283},{"criterion":253,"score":283},{"criterion":256,"score":279},{"criterion":260,"score":287},{"criterion":264,"score":279},[343,344,345],"The widest certification list in this ranking, per its trust center.","Behavioral baselines for employees and vendors.","API deployment with no MX change.",[347,348,349],"EU (Ireland) hosting is a subscription choice; the US is the other listed location.","Quote-based pricing.","OAuth app coverage not confirmed in public material.","Quote-based","API (ICES); no MX change","Microsoft 365, Google Workspace","AWS in the US or EU (Ireland), by subscription (subprocessor list)","\u002Fen\u002Fcompare\u002Fsentaro-vs-abnormal-security","https:\u002F\u002Fabnormal.ai",{"name":39,"tag":82,"bestFor":357,"summary":358,"score":359,"scores":360,"pros":368,"cons":372,"pricing":375,"deployment":376,"platforms":377,"hosting":378,"to":379,"site":380,"source":381},"Organizations whose NIS2 scope includes many collaboration and file-sharing apps besides email.","Check Point Harmony Email & Collaboration, formerly Avanan, connects by API with no MX change and can enforce from monitor mode to inline prevention. All tiers include account-takeover and shadow IT detection, with SaaS security posture management as an add-on, and it covers Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox and ShareFile. Its admin guide lists an Ireland data-residency region. Incident Response as a Service is sold as an add-on.",6.9,[361,362,363,364,365,366,367],{"criterion":241,"score":283},{"criterion":245,"score":155},{"criterion":249,"score":261},{"criterion":253,"score":283},{"criterion":256,"score":155},{"criterion":260,"score":287},{"criterion":264,"score":155},[369,370,371],"The broadest collaboration-app coverage in this list.","Shadow IT and account-takeover detection in every tier.","Inline prevention via API, before the inbox.",[348,373,374],"No public subprocessor list found.","Archiving, DMARC management and training are add-ons.","Quote-based (four published tiers)","API with configurable inline prevention; no MX change","Microsoft 365, Google Workspace and eight collaboration and file apps","Data residency regions include Ireland (EMEA)","\u002Fen\u002Fcompare\u002Fsentaro-vs-check-point-harmony-email","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F",13,{"name":44,"tag":383,"bestFor":384,"summary":385,"score":386,"scores":387,"pros":395,"cons":399,"pricing":350,"deployment":402,"platforms":352,"hosting":403,"to":404,"site":405,"source":189},"Best full suite","Large organizations that want email protection, DMARC, DLP, archiving and training under one vendor.","Proofpoint Core Email Protection deploys via API (Microsoft Graph, no MX change) or inline, names BEC and supplier threats, and sells Email Fraud Defense for DMARC and lookalike-domain takedown, Adaptive Email DLP, archiving, Account Takeover Protection and ZenGuide awareness training as add-ons. Proofpoint completed its acquisition of Hornetsecurity in December 2025. Its Core Email Protection API privacy sheet says tenants are assigned to an EU or US data centre, with some processing and storage in the US, and its subprocessor list names locations per product.",6.6,[388,389,390,391,392,393,394],{"criterion":241,"score":142},{"criterion":245,"score":283},{"criterion":249,"score":283},{"criterion":253,"score":142},{"criterion":256,"score":283},{"criterion":260,"score":287},{"criterion":264,"score":279},[396,397,398],"The deepest add-on catalog for Article 21 measures beyond detection.","API or inline deployment.","Supplier threats named on the product page.",[400,401,348],"Most capabilities beyond core protection are add-ons.","Some email data may be processed and stored in the US even for EU tenants (API privacy sheet, July 2026).","API via Microsoft Graph, or inline gateway","Core Email Protection API: EU or US data centre; some processing and storage in the US (privacy sheet, July 2026)","\u002Fen\u002Fcompare\u002Fsentaro-vs-proofpoint","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection",{"name":46,"tag":407,"bestFor":408,"summary":409,"score":410,"scores":411,"pros":419,"cons":423,"pricing":350,"deployment":426,"platforms":427,"hosting":428,"to":429,"site":430,"source":246},"Best for archiving","Organizations that need archiving and continuity, or run on-premises or hybrid Exchange.","Mimecast offers a cloud gateway (MX) and an API option, Cloud Integrated, for Microsoft 365. It names BEC and QR-code phishing, and sells DMARC Analyzer, Email Archive, awareness training and Incydr data protection. It opened two Frankfurt data centres in 2018; its current footprint was not re-confirmed from vendor documentation.",5.8,[412,413,414,415,416,417,418],{"criterion":241,"score":142},{"criterion":245,"score":261},{"criterion":249,"score":261},{"criterion":253,"score":142},{"criterion":256,"score":283},{"criterion":260,"score":287},{"criterion":264,"score":155},[420,421,422],"Archiving and on-premises or hybrid Exchange support.","Gateway and API options from one vendor.","DMARC and awareness products available.",[424,348,425],"Current EU data-centre list not publicly re-confirmed.","OAuth app coverage not documented.","Cloud Gateway (MX) or Cloud Integrated (API)","Microsoft 365, Google Workspace, on-premises and hybrid Exchange","Frankfurt data centres announced in 2018; current footprint not re-confirmed","\u002Fen\u002Fcompare\u002Fsentaro-vs-mimecast","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F",{"name":48,"tag":432,"bestFor":433,"summary":434,"score":410,"scores":435,"pros":443,"cons":447,"pricing":350,"deployment":450,"platforms":451,"hosting":452,"site":453,"source":454},"Best for on-premises","Organizations that must run email security on-premises or in a private cloud of their choice.","Libraesva, part of the Italian LibraCyber group, offers an email security gateway with API integration for Microsoft 365 and Google Workspace, deployable in its cloud, a private cloud or on-premises. It describes layered AI including “Adaptive Trust AI” for communication patterns, sandboxing inside the customer environment and one-click remediation across mailboxes, and sells Email Archiver, LetsDMARC and PhishBrain separately. Hosting regions are not listed.",[436,437,438,439,440,441,442],{"criterion":241,"score":142},{"criterion":245,"score":261},{"criterion":249,"score":261},{"criterion":253,"score":155},{"criterion":256,"score":142},{"criterion":260,"score":287},{"criterion":264,"score":142},[444,445,446],"On-premises and private-cloud deployment for strict data-location policies.","Gateway and API modes, including Google Workspace.","Archiving, DMARC and awareness products in the same group.",[448,449,348],"Security certifications not listed on the pages we checked.","Hosting regions for its cloud not published.","Gateway plus API integration; cloud, private cloud or on-premises","Microsoft 365, Google Workspace, on-premises Exchange","Runs locally or in your chosen cloud; regions not listed","https:\u002F\u002Fwww.libraesva.com\u002F",22,{"name":50,"tag":456,"bestFor":457,"summary":458,"score":459,"scores":460,"pros":468,"cons":472,"pricing":350,"deployment":476,"platforms":477,"hosting":478,"site":479,"source":220},"Best for German hosting","Regulated organizations on Microsoft 365 that require German hosting and EU-operated AI from an owner-managed EU vendor.","Retarus, an owner-managed Munich company founded in 1992, offers a secure email gateway and an API connector (ICES) for Microsoft 365. Its documentation names two German data centres, Munich and Frankfurt, and it says its AI components operate within the EU and customer data is not used externally for training. It sells encryption, archiving, continuity and a policy engine. Google Workspace is listed as planned.",5.7,[461,462,463,464,465,466,467],{"criterion":241,"score":261},{"criterion":245,"score":287},{"criterion":249,"score":142},{"criterion":253,"score":279},{"criterion":256,"score":261},{"criterion":260,"score":287},{"criterion":264,"score":279},[469,470,471],"German data centres named in its documentation, and EU-operated AI.","ISO 27001 certification and further attestations listed by the vendor.","Encryption, archiving and continuity from the same vendor.",[473,474,475],"Google Workspace listed as planned only.","BEC not named; no OAuth or app coverage.","Quote-based pricing; sold through VARs and integrators.","Secure email gateway (MX) or API connector (ICES)","Microsoft 365 (Google Workspace listed as planned)","Munich and Frankfurt, Germany","https:\u002F\u002Fwww.retarus.com\u002Femail-security\u002F",{"name":52,"tag":481,"bestFor":482,"summary":483,"score":484,"scores":485,"pros":493,"cons":497,"pricing":501,"deployment":502,"platforms":503,"hosting":504,"to":505,"site":506,"source":232},"Best all-in-one suite","Microsoft 365 organizations, usually through an MSP, that want filtering, encryption, archiving, backup and training in one tiered licence.","Hornetsecurity, based in Hanover and part of Proofpoint since December 2025, sells 365 Total Protection in four plans: filtering and encryption (Plan 1), AI-based advanced threat protection, continuity and archiving (Plan 2), Microsoft 365 backup (Plan 3), and awareness training, permission management and DMARC management (Plan 4). It offers MX, API and hybrid modes and states “12 regional data centers, independent of Microsoft’s infrastructure”.",5.4,[486,487,488,489,490,491,492],{"criterion":241,"score":261},{"criterion":245,"score":309},{"criterion":249,"score":261},{"criterion":253,"score":283},{"criterion":256,"score":142},{"criterion":260,"score":287},{"criterion":264,"score":155},[494,495,496],"Encryption, archiving, continuity and backup cover Article 21(2)(c) and (h) needs in one licence.","German heritage and regional data centres.","Large MSP channel for organizations that outsource IT.",[498,499,500],"Google Workspace not covered by 365 Total Protection.","BEC and supplier-fraud detection not explicitly documented.","Quote-based pricing through partners.","Quote-based, sold through partners","MX, API or hybrid modes","Microsoft 365","“12 regional data centers” (vendor); German data centres per third-party profiles","\u002Fen\u002Fcompare\u002Fsentaro-vs-hornetsecurity","https:\u002F\u002Fwww.hornetsecurity.com\u002Fen\u002F365-total-protection\u002F",{"t":508,"id":509,"title":510,"blocks":511},"prose","grc-vs-email","Email security vs NIS2 and DORA compliance software",[512,515,548],{"t":513,"text":514},"p","Search for “NIS2 compliance software” or “DORA compliance software” and you will find GRC and compliance-automation platforms such as Vanta, Drata or OneTrust. They map controls to frameworks, collect evidence, track policies and manage audits. They do not read a single email. Supervisors ask for both: a governed program, and controls that actually work. This page ranks the second kind for the email layer.",{"t":516,"rows":517},"table",[518,523,528,533,538,543],[519,520,521,522],"Obligation","What the email-layer control does","What GRC software does","What stays with you",[524,525,526,527],"NIS2 Art. 21(2)(b) incident handling; DORA Art. 17","Detects and blocks phishing, BEC and QR lures; records who, what, when and scope","Tracks the incident procedure and its evidence","Classification and response decisions",[529,530,531,532],"NIS2 Art. 21(2)(d) supply chain; DORA Art. 28","Flags compromised suppliers in real threads; inventories OAuth apps","Runs supplier questionnaires and the register","Contracts and risk acceptance",[534,535,536,537],"NIS2 Art. 21(2)(i) asset management","Lists every app, AI tool and grant connected to mail","Holds the asset register","Deciding what is sanctioned",[539,540,541,542],"NIS2 Art. 23; DORA Art. 19","Supplies the first facts for a 24-hour early warning or 4-hour initial notification","Templates and workflow for the report","Assessing significance and submitting",[544,545,546,547],"NIS2 Art. 20 management oversight","Reports on what the control blocked and found","Board dashboards across all controls","Approval and training of management",{"t":513,"text":549},"No product makes you compliant with NIS2 or DORA, and you should distrust any that claims to. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require; governance, risk analysis, contracts and documentation remain yours. This is general guidance, not legal advice.",{"t":508,"id":551,"title":552,"blocks":553},"clocks","The reporting clocks your email control has to keep up with",[554,576,578,581],{"t":516,"rows":555},[556,561,566,571],[557,558,559,560],"Regime","First notice","Next report","Final report",[562,563,564,565],"NIS2, Art. 23(4)","Early warning within 24 hours of becoming aware of a significant incident","Incident notification within 72 hours","Within one month of the incident notification",[567,568,569,570],"DORA, Delegated Reg. (EU) 2025\u002F301","Initial notification within 4 hours of classifying a major incident, no later than 24 hours from awareness","Intermediate report within 72 hours of the initial notification","Within one month of the latest intermediate report",[572,573,574,575],"Sweden, cybersäkerhetslagen (SFS 2025:1506)","As soon as possible, at the latest within 24 hours","Incident report within 72 hours","Within one month of the incident report; reports go to the CSIRT at FRA since 1 July 2026",{"t":513,"text":577},"DORA applies to financial entities as the sector-specific act, so its ICT risk and reporting rules take precedence over NIS2’s where they are at least equivalent. Every clock starts with awareness. An email control that only reports in a weekly digest, or that needs a mail-routing change before it sees anything, leaves you guessing on the first deadline.",{"t":579,"text":580},"h3","Questions to ask every email security vendor",{"t":582,"items":583},"ul",[584,585,586,587,588],"When you block or flag a message, can we see who received it, whether anyone clicked, when, and whether similar messages reached other mailboxes?","How long do you keep quarantined items and incident metadata, and can we export them into our own evidence store?","Which suppliers’ mailboxes and which OAuth apps can you see, and can you revoke a risky grant?","Send your DPA and subprocessor list: where is our mail processed, and how fast do you notify us of an incident on your side?","Which of your capabilities are live today, and which are on a roadmap?",{"t":590,"tone":591,"title":592,"text":593},"callout","roadmap","Roadmap: Identity and Behavioral vectors, Q4 2026","Everything scored on this page is live today: the Message vector (since Q2 2026) and the App vector (since Q3 2026). Identity (leaked credentials, lookalike-domain registration alerts) and Behavioral (anomalous-session scoring, forced re-authentication and session revocation, which touch NIS2 Article 21(2)(j)) reach general availability in Q4 2026, included at no added cost. They are not counted in Sentaro’s scores.",{"t":595,"intro":596,"items":597},"certs","Sentaro’s exact status, so you can weigh the certifications criterion yourself.",[598,603,606,610,616],{"label":599,"status":600,"state":601,"text":602},"SOC 2","In progress","progress","No target date published; Sentaro says it will announce it the day it is signed, and not before.",{"label":604,"status":600,"state":601,"text":605},"ISO 27001","Evidence pack for NIS2, DORA and SOC 2 diligence on request from hello@sentaro.com.",{"label":607,"status":608,"state":609},"Google CASA","Verified API integration","done",{"label":611,"status":612,"state":613,"text":614,"to":615},"DPA and subprocessor list","Public","info","Subprocessors, retention, 24-hour incident notice and exit terms.","\u002Fen\u002Flegal\u002Fdpa",{"label":617,"status":618,"state":613,"text":619,"to":301},"NIS2 and DORA","Readiness support","Built for the controls regulated EU firms are asked to evidence; not a compliance guarantee.",[621,624,627,630,633,636,639],{"q":622,"a":623},"What is the best email security for NIS2 and DORA?","Sentaro — it is our pick as the email-layer control for NIS2 and DORA for EU organizations on Microsoft 365 and Google Workspace. It detects phishing, BEC and vendor compromise before interaction, records the facts for your 24-hour clocks, inventories connected OAuth apps, and publishes its DPA and subprocessor list. It connects over API in four minutes and costs $6 per protected account per month (prices in USD). Sentaro publishes this list.",{"q":625,"a":626},"Does any email security tool make us NIS2 or DORA compliant?","No. No product makes you compliant with NIS2 or DORA, and you should distrust any that claims to. Compliance rests on governance, risk analysis, supplier management, incident processes and management oversight. An email security tool provides one set of controls and the evidence they produce.",{"q":628,"a":629},"What is the difference between NIS2 compliance software and email security?","NIS2 compliance software, usually a GRC platform, maps controls to the directive, collects evidence and manages audits. Email security is one of the controls it maps: it stops phishing and BEC and records what happened. You typically need both; neither replaces the other.",{"q":631,"a":632},"Which NIS2 Article 21 measures does email security support?","Most directly incident handling (21(2)(b)), supply chain security (21(2)(d)) and access control and asset management (21(2)(i)). It contributes data to risk analysis (a), effectiveness assessment (f) and cyber hygiene (g). Encryption, archiving and continuity tools touch (c) and (h); multi-factor authentication (j) sits in your identity stack.",{"q":634,"a":635},"How long should an email control keep incident evidence?","Neither NIS2 nor DORA sets one retention period for email incident data; your incident procedure and audit cycle decide it. Ask each vendor how long it keeps quarantined items and metadata and whether you can export them. Sentaro’s DPA keeps quarantined items and operational metadata for 180 days and harmless raw email for 14 days, so export anything you need longer into your own evidence store.",{"q":637,"a":638},"Should we pick an EU-hosted email security vendor for NIS2?","NIS2 does not require EU hosting, but your supplier assessment must cover where mail is processed. Read each vendor’s DPA rather than its marketing. Sentaro is hosted in Sweden on Microsoft Azure and lists its subprocessors, including some outside the EU, in its DPA; Retarus documents German data centres, and Abnormal’s subprocessor list offers an EU (Ireland) hosting location.",{"q":640,"a":641},"How were the NIS2 and DORA scores calculated?","Seven criteria tied to NIS2 and DORA: incident detection and evidence (25%), supply-chain and app coverage (20%), supplier diligence transparency (15%), EU hosting (15%), deployment effort (10%), certifications and suite breadth (10%) and price transparency (5%). Scores come from public vendor documentation as of 21 October 2026, not lab tests. Sentaro wrote the page and ranks itself first.",[643,646,649,652,655,658,661,664,666,669,672,674,677,680,683,686,689,691,694,696,699,701,704,706,709,712,714,717,720],{"label":644,"url":645},"Directive (EU) 2022\u002F2555 (NIS2), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj\u002Feng",{"label":647,"url":648},"Regulation (EU) 2022\u002F2554 (DORA), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj\u002Feng",{"label":650,"url":651},"Commission Delegated Regulation (EU) 2025\u002F301 (DORA incident reporting time limits), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg_del\u002F2025\u002F301\u002Foj\u002Feng",{"label":653,"url":654},"Cybersäkerhetslag (SFS 2025:1506)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2025-12\u002FSFS2025-1506.pdf",{"label":656,"url":657},"Förordning om ändring i cybersäkerhetsförordningen (SFS 2026:623)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2026-05\u002FSFS2026-623.pdf",{"label":659,"url":660},"Sentaro pricing","https:\u002F\u002Fsentaro.com\u002Fen\u002Fpricing",{"label":662,"url":663},"Sentaro Data Processing Agreement and subprocessor list","https:\u002F\u002Fsentaro.com\u002Fen\u002Flegal\u002Fdpa",{"label":665,"url":328},"Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)",{"label":667,"url":668},"Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365",{"label":670,"url":671},"Microsoft Learn: EU Data Boundary (accessed 2026-10-18)","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fprivacy\u002Feudb\u002Feu-data-boundary-learn",{"label":673,"url":380},"Check Point: Harmony Email & Collaboration (accessed 2026-10-18)",{"label":675,"url":676},"Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002Fpricing\u002F",{"label":678,"url":679},"Check Point: Harmony Email & Collaboration admin guide, data residency","https:\u002F\u002Fsc1.checkpoint.com\u002Fdocuments\u002FAvanan_Admin_Guide\u002FEmail_Security\u002FAdmin_Guide\u002FTopics\u002Factivating-hec\u002Faccessing-the-administrator-portal.html",{"label":681,"url":682},"Abnormal AI: Inbound Email Security (accessed 2026-10-18)","https:\u002F\u002Fabnormal.ai\u002Fproducts\u002Finbound-email-security",{"label":684,"url":685},"Abnormal AI: Trust center (certifications)","https:\u002F\u002Fabnormal.ai\u002Ftrust",{"label":687,"url":688},"Abnormal AI: Subprocessors (updated 31 July 2026, accessed 2026-10-21)","https:\u002F\u002Fabnormal.ai\u002Flegal\u002Fsubprocessors",{"label":690,"url":405},"Proofpoint: Core Email Protection (accessed 2026-10-18)",{"label":692,"url":693},"Proofpoint: Proofpoint completes acquisition of Hornetsecurity (December 2025)","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fnewsroom\u002Fpress-releases\u002Fproofpoint-completes-acquisition-hornetsecurity",{"label":695,"url":430},"Mimecast: Email Security (accessed 2026-10-18)",{"label":697,"url":698},"Datacentre News: Mimecast opens two Frankfurt data centres (2018)","https:\u002F\u002Fdatacentrenews.uk\u002Fstory\u002Fmimecast-bets-german-growth-two-new-data-centres",{"label":700,"url":453},"Libraesva: Home page (accessed 2026-10-18)",{"label":702,"url":703},"Libraesva: Proofpoint vs Libraesva (deployment options)","https:\u002F\u002Fwww.libraesva.com\u002Fcompare\u002Fproofpoint-vs-libraesva",{"label":705,"url":479},"Retarus: Email Security (accessed 2026-10-21)",{"label":707,"url":708},"Retarus docs: Email Security data center operations (Munich and Frankfurt)","https:\u002F\u002Fdocs.retarus.com\u002Fseg\u002Fretarus-email-security-data-center-operations-cust",{"label":710,"url":711},"Retarus blog: ISO 27001 certification (KPMG)","https:\u002F\u002Fwww.retarus.com\u002Fblog\u002Fde\u002F?p=28557",{"label":713,"url":506},"Hornetsecurity: 365 Total Protection (accessed 2026-10-21)",{"label":715,"url":716},"Hornetsecurity: Email security modes","https:\u002F\u002Fwww.hornetsecurity.com\u002Fen\u002Femail-security-modes\u002F",{"label":718,"url":719},"Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Flegal\u002Ftrust\u002Fdata-privacy-information-sheet-core-email-protection-api",{"label":721,"url":722},"Proofpoint: Third-party service providers and subprocessors (updated 14 October 2026; accessed 2026-10-21)","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Flegal\u002Ftrust\u002Fsubprocessors","Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities change; check each vendor’s current documentation. This is general guidance, not legal advice. Trademarks belong to their owners. Corrections: contact Sentaro.",[725,727,730,733,736,739,742],{"label":726,"to":301},"NIS2 and email security",{"label":728,"to":729},"DORA and email security","\u002Fen\u002Fcompliance\u002Fdora",{"label":731,"to":732},"NIS2 incident reporting","\u002Fen\u002Fcompliance\u002Fnis2-incident-reporting",{"label":734,"to":735},"Best email security for financial services","\u002Fen\u002Fbest\u002Femail-security-for-financial-services",{"label":737,"to":738},"Best email security for the public sector","\u002Fen\u002Fbest\u002Femail-security-for-public-sector",{"label":740,"to":741},"Compliance solution","\u002Fen\u002Fsolutions\u002Fcompliance",{"label":743,"to":744},"Pricing","\u002Fen\u002Fpricing",{"title":746,"note":747},"Have the facts before the 24-hour clock starts.","Connect Microsoft 365 or Google Workspace in four minutes. The first account is free.",{"links":749,"only":754,"labels":756},[750,752],{"label":751,"to":729},"DORA",{"label":753,"to":301},"NIS2",{"6":755},[301,729],{"\u002Fen\u002Fcompliance\u002Fnis2":753,"\u002Fen\u002Fcompare\u002Fsentaro-vs-microsoft-defender-for-office-365":757,"\u002Fen\u002Fcompare\u002Fsentaro-vs-abnormal-security":758,"\u002Fen\u002Fcompare\u002Fsentaro-vs-check-point-harmony-email":759,"\u002Fen\u002Fcompare\u002Fsentaro-vs-proofpoint":760,"\u002Fen\u002Fcompare\u002Fsentaro-vs-mimecast":761,"\u002Fen\u002Fcompare\u002Fsentaro-vs-hornetsecurity":762},"Sentaro vs Microsoft Defender for Office 365","Sentaro vs Abnormal Security","Sentaro vs Check Point Harmony Email","Sentaro vs Proofpoint","Sentaro vs Mimecast","Sentaro vs Hornetsecurity",1792761725096]