Sentaro is the best OAuth app security tool for lean EU IT teams on Microsoft 365 and Google Workspace. It is the only tool on this list that documents blocking consent phishing in the inbox, where the lure arrives, and also inventories, scores and revokes the grants themselves, with equal coverage of both platforms, no agents and a published price of $6 per protected account per month. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.
- Why Sentaro wins
- Full app and OAuth-grant inventory across Workspace and 365, scope-level risk per app and per user, and one-click revocation with no ticket (sentaro.com/en/vectors/app).
- Stops the grant before it exists
- Consent-phishing lures are blocked in mail flow, new grants are surfaced with their scopes, and lookalike apps impersonating known brands or AI tools are flagged before access is approved.
- Precise about scope
- Sentaro is not an SSPM, CASB or browser tool. It covers Microsoft 365 and Google Workspace (plus Slack and Teams for messages), not configuration posture in Salesforce or ServiceNow.
- Consider another tool only if…
- you need posture management across many business-critical SaaS platforms (AppOmni, Obsidian, Valence), click-time consent blocking in the browser (Push Security), or you already pay for Microsoft 365 E5 (Defender for Cloud Apps).
Quick picks
- Best overallSentaro Our pickConsent phishing blocked in the inbox, plus scope-level risk and one-click revocation on both Microsoft 365 and Workspace.
- Best click-time consent blockingPush SecurityWarns on and blocks OAuth consents in the browser, with a public price and EU data storage.
- Best native option for E5Microsoft Defender for Cloud AppsApp governance for OAuth apps is included in the licence, with automatic disruption of OAuth-based attacks.
- Best enterprise SSPMAppOmniAgentless posture management and threat detection across Salesforce, Microsoft 365, ServiceNow, Workday and more.
- Best with SaaS backupSpin.AI (SpinOne)OAuth app and browser-extension risk scoring with allowlists per OU, bundled with backup and ransomware recovery.
At a glance
- What we compared
- Tools that find, score and remove risky OAuth apps and third-party access in Microsoft 365 and Google Workspace
- Tools ranked
- 9 (Sentaro, Push Security, Microsoft Defender for Cloud Apps, AppOmni, Spin.AI, Nudge Security, Obsidian Security, Valence Security, Material Security)
- Audience
- EU organizations on Microsoft 365 or Google Workspace with a small IT team
- Method
- Seven weighted criteria, 0–10 editorial scores from public vendor documentation
- Last verified
- 21 October 2026
- Who wrote it
- Sentaro, which is one of the ranked products (disclosed)
OAuth app security tools compared
Highest score first. The first three columns follow the life of a grant: the lure that asks for it, the risk of the scopes it holds, and how it is removed. Vendor entries come from each vendor’s own pages, accessed 21 October 2026.
| Capability | Score | Consent phishing | Scope risk | Revocation | M365 and Workspace | Public price |
|---|---|---|---|---|---|---|
| Sentaro[1] | 8.6 | YesBlocked in mail flow | YesPer app and per user | YesOne click | YesBoth | Yes$6/account/month |
| Push Security[3] | 7.3 | YesBlocked at click time, in the browser | Not publicly documentedNot detailed | YesApp removal | YesBoth (IdP) | Yes$5/employee/month |
| Defender for Cloud Apps[4] | 7.0 | PartialDisrupts OAuth-based attacks | YesApp governance | YesDisable app | PartialMicrosoft-native; Workspace via connectors | PartialIn E5; Defender Suite $12 |
| AppOmni[7] | 7.0 | Not publicly documented | YesScopes and permissions | YesRevoke, disable | YesBoth, plus many SaaS | NoNot published |
| Spin.AI (SpinOne)[9] | 6.8 | Not publicly documented | YesApps and extensions scored | YesAllow/block per OU | YesBoth | Partial$5,000/year minimum |
| Nudge Security[12] | 6.7 | No | YesOAuth and integration risk | Not publicly documentedNot detailed | YesBoth | YesFrom $750/month |
| Obsidian Security[14] | 6.4 | PartialBrowser phishing defense | YesRightsize integrations | Yes | Not publicly documentedNot named on site | PartialFree to 1,000 users |
| Valence Security[16] | 6.1 | No | YesSaaS-to-SaaS connections | YesOne-click fixes | Not publicly documentedEntra and Okta named | NoNot published |
| Material Security[18] | 6.1 | Not publicly documented | PartialOAuth inventory (Workspace) | YesAdvanced tier | PartialOAuth Security is Workspace | YesFrom $4/user/month |
“Not documented”, “Not detailed” and “Not published” mean we could not find it on the vendor’s public pages, not that the capability is absent.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How we evaluated
The weights reflect a lean EU IT team on Microsoft 365 or Google Workspace, where most risky OAuth grants start with an email and most of the damage is to mail and files. Posture breadth across other SaaS platforms carries real weight, because that is where SSPM vendors are strongest.
| Criterion | Weight | Why it matters |
|---|---|---|
| Consent-phishing prevention | 20% | Consent phishing turns one click into standing access that survives a password reset. Stopping the lure before the grant exists is cheaper than cleaning up after. |
| Scope-level risk scoring | 15% | A calendar plugin and an app with full mailbox read access are not the same risk. Scoring by scope, per app and per user, tells you which grants matter. |
| Grant revocation | 15% | Visibility without removal leaves the risk in place. Revocation should be one action, not a ticket to another team. |
| Microsoft 365 and Google Workspace parity | 15% | Many EU organizations run both platforms, or move between them. Coverage should be equal, not native on one and partial on the other. |
| SaaS posture breadth | 15% | Configuration posture and integrations across Salesforce, ServiceNow, Slack and others. This is where SSPM platforms lead. |
| Deployment without agents | 10% | API-only tools cover every account from day one with no rollout to devices. |
| Published price and EU hosting | 10% | A list price on the vendor’s site, and documented EU hosting for an inventory of who granted what. |
Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Undocumented capabilities score 4–5, not zero.
The 9 best OAuth app security tools, ranked
Email-layer, browser, native and SSPM approaches are ranked on one scale here. Every entry shows seven criterion scores with the reason and source, then what the tool costs, how it deploys and where its data sits.
Sentaro
Our pickOverall score: 8.6out of 10Best for: EU teams on Microsoft 365 and Google Workspace that want OAuth risk and the phishing that creates it handled in one product.
Sentaro’s App vector, live since Q3 2026, inventories every app, AI tool and OAuth grant across Workspace and 365, scores risk per scope, per app and per user, and revokes risky grants via the Workspace and 365 admin SDKs with one click. Its Message vector, live since Q2 2026, blocks consent-phishing lures in mail flow, and lookalike apps impersonating known brands or AI tools are flagged before access is approved. Legitimate tools are surfaced, not blocked. Sentaro does not check SaaS configuration posture and is not a CASB or browser tool.[1]
- Consent-phishing prevention
- 10.0
- Scope-level risk scoring
- 10.0
- Grant revocation
- 10.0
- Microsoft 365 and Google Workspace parity
- 10.0
- Deployment without agents
- 10.0
- Published price and EU hosting
- 8.0
- SaaS posture breadth
- 2.0
Pros
- Blocks consent phishing in the inbox, before any grant exists
- Scope-level risk per app and per user, with one-click revocation
- Equal coverage of Microsoft 365 and Google Workspace
- Same product protects mail, Slack and Teams against phishing and BEC
- Published price, first account free
Cons
- Not an SSPM: no configuration checks in Salesforce, ServiceNow, Workday or similar
- No browser extension, so no click-time warning outside email
- SOC 2 and ISO 27001 certification in progress
- Pricing
- $6 per protected account per month, or $68 per year; first account free. Prices in USD.
- Deployment
- API via Microsoft 365 and Google Workspace admin SDKs; four minutes; no agents
- Platforms
- Microsoft 365, Google Workspace (Slack and Teams for message scoring)
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors in the DPA
Push Security
Best click-time controlOverall score: 7.3out of 10Best for: Teams that can force-install a browser extension and want to stop risky consents at the moment of the click.
Push Security’s browser extension sees OAuth consents as they happen, warns in real time, blocks consents and removes OAuth apps, alongside in-browser phishing detection (adversary-in-the-middle pages, cloned logins, BitB, ClickFix). It integrates with Google Workspace, Microsoft 365 and Okta, publishes its price and stores platform data in the EU. It does not filter email.[3]
- Consent-phishing prevention
- 9.0
- Scope-level risk scoring
- 6.0
- Grant revocation
- 8.0
- Microsoft 365 and Google Workspace parity
- 9.0
- Deployment without agents
- 4.0
- Published price and EU hosting
- 10.0
- SaaS posture breadth
- 4.0
Pros
- Stops a risky consent at the click
- Public price and documented EU storage
- SOC 2 Type II and ISO 27001 (vendor)
Cons
- Covers only managed browsers with the extension
- No inbox protection
- Scope-level scoring not detailed publicly
- Pricing
- Standard $5/employee/month annual or $6 monthly (up to 500); Enterprise custom
- Deployment
- Browser extension via MDM; “under a day” (vendor)
- Platforms
- Google Workspace, Microsoft 365, Okta; most major browsers
- Hosting
- EU (Dublin, backup Paris), per vendor
Microsoft Defender for Cloud Apps
Best native for E5Overall score: 7.0out of 10Best for: Microsoft 365 E5 and Defender Suite tenants that want OAuth app governance inside the Defender portal.
Microsoft Defender for Cloud Apps includes app governance, which inventories OAuth apps and their permissions and can disable risky apps; Microsoft’s product page also lists automatic disruption of OAuth-based attacks. App governance was folded into the MDCA licence in June 2023, per a third-party licensing guide. Coverage is native to Microsoft 365 and Entra ID, with app connectors that also cover Google Workspace and Salesforce OAuth apps according to the same guide.[4]
- Consent-phishing prevention
- 6.0
- Scope-level risk scoring
- 8.0
- Grant revocation
- 8.0
- Microsoft 365 and Google Workspace parity
- 6.0
- Deployment without agents
- 8.0
- Published price and EU hosting
- 6.0
- SaaS posture breadth
- 7.0
Pros
- Already paid for in E5 and EMS E5
- Integrated with Defender XDR incidents
- EU or UK data storage for EU/UK tenants
Cons
- Not in Business Premium or E3, per a third-party guide
- Does not filter the consent-phishing email itself
- Google Workspace coverage secondary to Microsoft
- Pricing
- Included in Microsoft 365 E5 and EMS E5; Microsoft Defender Suite $12/user/month (requires E3)
- Deployment
- Defender portal; API connectors and app governance
- Platforms
- Microsoft 365 and Entra ID native; connectors for other SaaS
- Hosting
- EU or UK data storage for EU/UK tenants
AppOmni
Best enterprise SSPMOverall score: 7.0out of 10Best for: Large enterprises that need posture management and threat detection across many business-critical SaaS platforms.
AppOmni connects agentlessly over API to sanctioned SaaS such as Salesforce, Microsoft 365, Google Workspace, ServiceNow, Workday, Okta, Slack and GitHub. It discovers third- and fourth-party SaaS and AI connections with their scopes and permissions, revokes access, disables risky integrations and feeds SOC tooling. Its footer lists SOC 2, FedRAMP Moderate and other attestations. Prices are not published.[7]
- Consent-phishing prevention
- 2.0
- Scope-level risk scoring
- 8.0
- Grant revocation
- 8.0
- Microsoft 365 and Google Workspace parity
- 9.0
- Deployment without agents
- 10.0
- Published price and EU hosting
- 3.0
- SaaS posture breadth
- 10.0
Pros
- Deepest posture coverage on this list
- Agentless
- FedRAMP Moderate (vendor footer)
Cons
- No consent-phishing or email protection
- No public prices
- EU hosting not documented
- Pricing
- Not published
- Deployment
- Agentless API
- Platforms
- Salesforce, Microsoft 365, Google Workspace, ServiceNow, Workday, Okta, Slack and more
- Hosting
- Not documented
Spin.AI (SpinOne)
Overall score: 6.8out of 10Best for: Google Workspace and Microsoft 365 shops that want OAuth and browser-extension risk control bundled with SaaS backup.
Spin.AI connects over API to Google Workspace, Microsoft 365, Salesforce and Slack to inventory and risk-score OAuth apps, and its SpinCRX module scores browser extensions. Admins allowlist or blocklist apps and extensions per organizational unit with approval workflows. The platform bundles backup and ransomware recovery. Spin.AI acquired DoControl in August 2026; DoControl keeps its brand.[9]
- Consent-phishing prevention
- 3.0
- Scope-level risk scoring
- 8.0
- Grant revocation
- 8.0
- Microsoft 365 and Google Workspace parity
- 9.0
- Deployment without agents
- 7.0
- Published price and EU hosting
- 5.0
- SaaS posture breadth
- 8.0
Pros
- OAuth and browser-extension risk in one place
- Backup and ransomware recovery included
- SOC 2 Type II (vendor)
Cons
- No consent-phishing or email protection
- $5,000 per year minimum
- EU region specifics not confirmed
- Pricing
- Minimum subscription $5,000/year; SpinSPM and SpinOne by quote
- Deployment
- API plus browser-extension management via MDM
- Platforms
- Google Workspace, Microsoft 365, Salesforce, Slack, Jira, Confluence
- Hosting
- AWS, GCP, Azure or BYOS for backups; EU region not confirmed
Nudge Security
Overall score: 6.7out of 10Best for: Teams that already have email security and want OAuth risk inside a broader SaaS governance program.
Nudge Security discovers SaaS and AI apps from email metadata through a read-only Microsoft 365 or Google Workspace API and lists OAuth and integration risk management as a core product, alongside SSPM for apps such as Okta, Salesforce and Zoom, identity governance and offboarding. The revocation workflow is not publicly detailed, and Nudge does not filter inbound email.[12]
- Consent-phishing prevention
- 2.0
- Scope-level risk scoring
- 8.0
- Grant revocation
- 5.0
- Microsoft 365 and Google Workspace parity
- 10.0
- Deployment without agents
- 10.0
- Published price and EU hosting
- 6.0
- SaaS posture breadth
- 8.0
Pros
- Agentless with two years of discovery history
- Broad governance beyond OAuth
- Public pricing
Cons
- No consent-phishing protection
- Revocation detail not public
- EU hosting not documented
- Pricing
- Essential $750/month (up to 150 users); Growth $5/user/month (150–1,500); billed annually
- Deployment
- Read-only API to Microsoft 365 or Google Workspace
- Platforms
- Microsoft 365, Google Workspace; SSPM for Okta, Salesforce, Zoom
- Hosting
- Not publicly documented
Obsidian Security
Overall score: 6.4out of 10Best for: Security teams that want integration and AI-agent risk control across SaaS, with a free tier to start.
Obsidian Security combines API integrations to third-party SaaS with a browser extension (launched May 2025) that finds apps, AI agents, integrations and extensions and stops credential submission to phishing pages. It rightsizes integration access, minimizes privilege and resolves unowned agents. A free tier covers discovery and spear-phish detection for up to 1,000 users. Obsidian raised an $85M Series D in August 2026.[14]
- Consent-phishing prevention
- 5.0
- Scope-level risk scoring
- 7.0
- Grant revocation
- 7.0
- Microsoft 365 and Google Workspace parity
- 5.0
- Deployment without agents
- 6.0
- Published price and EU hosting
- 6.0
- SaaS posture breadth
- 9.0
Pros
- Free tier up to 1,000 users
- Posture, identity threat detection and browser defense combined
- Strong AI-agent coverage
Cons
- Browser extension needed for part of the coverage
- Paid tiers by quote
- EU hosting not documented
- Pricing
- Free up to 1,000 users; Foundations and Advanced by quote
- Deployment
- API plus lightweight browser extension
- Platforms
- Third-party SaaS such as Salesforce, Snowflake, Workday, Slack
- Hosting
- Not documented
Valence Security
Overall score: 6.1out of 10Best for: Security teams that need to fix risky SaaS-to-SaaS connections together with business owners.
Valence Security discovers SaaS-to-SaaS and OAuth connections; its January 2025 discovery announcement, which we read via a search summary, describes read-only API and log analysis using IdP and CASB integrations, email metadata and browser logs, with no agents or network taps. It flags non-SSO accounts and remediates by choice: one-click fixes, automated triggers, tickets or outreach to business users. Its AI-SPM covers shadow AI tools and agents. Prices are not published.[16]
- Consent-phishing prevention
- 2.0
- Scope-level risk scoring
- 8.0
- Grant revocation
- 8.0
- Microsoft 365 and Google Workspace parity
- 5.0
- Deployment without agents
- 9.0
- Published price and EU hosting
- 3.0
- SaaS posture breadth
- 9.0
Pros
- Remediation that involves business owners
- Agentless discovery, including email metadata (per its 2025 announcement)
- SSPM and identity threat detection
Cons
- No consent-phishing protection
- No public prices
- EU hosting not documented
- Pricing
- Not published
- Deployment
- Agentless read-only API and log analysis
- Platforms
- Okta, Entra ID; collaboration and productivity apps
- Hosting
- Not documented
Material Security
Overall score: 6.1out of 10Best for: Google Workspace-heavy organizations that want email security, OAuth inventory and Drive data controls from one vendor.
Material Security protects Microsoft 365 and Google Workspace over API with email security, account-takeover containment and file security. Its OAuth Security module covers Google Workspace: OAuth app inventory is in the Essentials tier and agentic OAuth remediation in Advanced. Consent-phishing blocking is not specifically documented. Material publishes per-user prices plus a Shared Drive fee.[18]
- Consent-phishing prevention
- 5.0
- Scope-level risk scoring
- 6.0
- Grant revocation
- 7.0
- Microsoft 365 and Google Workspace parity
- 5.0
- Deployment without agents
- 10.0
- Published price and EU hosting
- 6.0
- SaaS posture breadth
- 5.0
Pros
- Email, OAuth and file security in one vendor
- Public per-user prices
- Self-serve free trial
Cons
- OAuth Security is Google Workspace only
- Shared Drive fee amount not shown
- No EU hosting region documented
- Pricing
- Essentials $4, Advanced $6 per user/month plus a Shared Drive fee; billed annually
- Deployment
- API (ICES)
- Platforms
- Microsoft 365, Google Workspace (OAuth Security: Google Workspace)
- Hosting
- No EU region documented; subprocessor list names Google Cloud, U.S.A.
How to choose an OAuth app security tool
Why OAuth grants need their own control
When an employee clicks “Allow” on a third-party app, Microsoft 365 or Google Workspace issues a token that lets the app read or act on their mail, calendar or files. A password reset alone does not revoke that grant. Most grants are harmless, but a meeting notetaker with full mailbox read access, an abandoned integration or a lookalike app approved through consent phishing all leave standing access that nobody is watching.
OAuth control is not the same as SSPM
SaaS security posture management (SSPM) platforms such as AppOmni, Obsidian and Valence check configuration across many SaaS platforms: sharing settings, admin roles, MFA enforcement and the integrations between apps. OAuth app security is a narrower question: which apps hold which grants in your Microsoft 365 or Google Workspace tenant, how risky they are, and how fast you can remove them. If your critical data lives in Salesforce, ServiceNow and Workday, you need an SSPM. If it lives mainly in mail and drives, OAuth control plus consent-phishing protection covers the main risk with far less to run.
| Approach | Where it acts | Examples |
|---|---|---|
| Email-layer plus tenant API | Blocks the lure in the inbox, then inventories, scores and revokes grants | Sentaro |
| Browser extension | Warns on or blocks the consent at click time on managed browsers | Push Security, Obsidian (in part) |
| Native suite governance | Inventories and disables apps inside the Microsoft stack | Microsoft Defender for Cloud Apps |
| SSPM over API | Posture and integration risk across many SaaS platforms | AppOmni, Valence Security, Spin.AI, Nudge Security |
What Microsoft and Google give you already
Admins can review OAuth grants by hand in Microsoft Entra (Enterprise applications) and in Google Admin (Security, API controls, App access control). That works for a quarterly review. It does not score grants by scope, alert on new ones as they appear, or stop the phishing email that asks for them. Microsoft Defender for Cloud Apps adds app governance, but is licensed in E5, EMS E5 or the Microsoft Defender Suite, not in Business Premium or E3, according to a third-party licensing guide.
Questions to ask every vendor
- Do you stop the consent-phishing email, the click, or only the grant after it exists?
- Do you score grants by scope, per app and per user?
- Can I revoke a grant from your console in one action, on both Microsoft 365 and Google Workspace?
- Do you flag lookalike apps that impersonate known brands or AI tools?
- What do you need installed, and on which devices?
- What does it cost for our headcount, and where is the grant inventory stored?
Also considered
Grip Security finds SaaS accounts and OAuth grants from email flows and identity providers and revokes access to unmanaged SaaS; prices are not published. DoControl, now part of Spin.AI, focuses on SaaS data oversharing and shadow-app remediation in Google Workspace-heavy companies. Both are credible for governance-led programs; neither documents email protection.
Certification and compliance status
A tool that holds your grant inventory should be checked too. Sentaro’s status, stated exactly:
- SOC 2
- In progressEvidence pack on request.
- ISO 27001
- In progress
- Google CASA
- Verified API integration
- DPA and subprocessor list
- Public
Frequently asked questions
What is the best OAuth app security tool for Microsoft 365 and Google Workspace?
Sentaro, for EU teams on either platform. It inventories every app and OAuth grant with scope-level risk per app and per user, revokes risky grants in one click via the admin SDKs, and blocks consent phishing in the inbox before a grant exists, at $6 per protected account per month. For posture management across many SaaS platforms, AppOmni or Obsidian go further.
What is OAuth consent phishing?
An attack that tricks a user into approving a malicious or lookalike app, often by email. The app receives an OAuth token for the user’s mail or files, and the access survives a password reset. Sentaro blocks consent-phishing lures in mail flow and flags lookalike apps impersonating known brands or AI tools before access is approved.
Is Sentaro an SSPM?
No. Sentaro inventories apps, AI tools and OAuth grants in Microsoft 365 and Google Workspace, scores their scopes and revokes risky grants, and protects mail, Slack and Teams against phishing. It does not check configuration posture in other SaaS platforms such as Salesforce or ServiceNow, which is what SSPM platforms such as AppOmni do.
How do I find all OAuth apps in Microsoft 365?
Manually, in Microsoft Entra under Enterprise applications, app by app. Continuously, with a tool that reads the tenant’s grants over API: Sentaro builds an inventory of every app and OAuth grant within 15 minutes of connecting, with scope-level risk. Microsoft Defender for Cloud Apps app governance does the same inside the Microsoft stack for E5 tenants.
How do I revoke an OAuth grant in Google Workspace?
In Google Admin, under Security, API controls and App access control, an admin can review and block apps. Sentaro revokes risky grants in one click from its console via the Workspace admin SDK, and does the same for Microsoft 365, so both platforms are handled the same way.
Do I need a browser extension to control OAuth apps?
No. API-based tools read grants directly from Microsoft 365 or Google Workspace and cover every account, including grants approved from unmanaged devices. Browser extensions, as in Push Security, add click-time warnings on managed browsers. Sentaro needs no extension and stops consent phishing earlier, in the email.
Sources and method
Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities, prices and ownership change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Sentaro: pricing
- Sentaro: Data Processing Agreement and subprocessor list
- Push Security: pricing, features, EU storage (accessed 2026-10-21)
- Microsoft: Defender for Cloud Apps product and pricing page (accessed 2026-10-21)
- Microsoft Learn: What is Defender for Cloud Apps (app governance) (accessed 2026-10-21)
- Microsoft Learn: Defender for Cloud Apps data storage location (accessed 2026-10-21)
- AppOmni: platform (accessed 2026-10-21)
- AppOmni: home page (accessed 2026-10-21)
- Spin.AI: pricing (accessed 2026-10-21)
- Spin.AI: platform (accessed 2026-10-21)
- Spin.AI: acquires DoControl (31 August 2026)
- Nudge Security: pricing and product list (accessed 2026-10-21)
- Nudge Security: product overview (accessed 2026-10-21)
- Obsidian Security: pricing (accessed 2026-10-21)
- Obsidian Security: home page (accessed 2026-10-21)
- Valence Security: platform (accessed 2026-10-21)
- Valence Security: SaaS discovery announcement (January 2025, via search result)
- Material Security: pricing (accessed 2026-10-21)
- Material Security: home page (accessed 2026-10-18)
- Grip Security: platform (accessed 2026-10-21)
- o365hq: Defender for Cloud Apps licensing, standalone vs E5 vs Defender Suite (third-party)
- Help Net Security: Obsidian Security browser extension (14 May 2025)
- Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)