For cloud-only Microsoft 365 and Google Workspace tenants, the API model wins, and Sentaro is the best API option for EU teams. A gateway is best at stopping known-bad mail before it ever reaches the tenant, and it works with any mail server, including on-premises Exchange. An API-based tool is best at seeing what a gateway cannot: internal mail, historical mail, mail from compromised trusted accounts, and the mailbox context needed to judge payload-free fraud. Cloud-only Microsoft 365 and Google Workspace tenants can run native filtering plus an API layer; hybrid and on-premises estates are where a gateway still fits best.
- Why Sentaro wins
- each reason can be checked: it connects over API in four minutes with no MX change and no agents, so your MX record does not move; it reads mailbox history and shows the reasoning behind every BEC and vendor-compromise verdict, so you can audit it on your own mail; its App vector, live since Q3 2026, covers OAuth apps and shadow AI in the same platform; its price, $6 per protected account per month with every feature included, is published on sentaro.com/en/pricing (USD); and it is hosted in Sweden on Microsoft Azure, with subprocessors in its public DPA.
- Choose Sentaro if
- you are an EU team fully on Microsoft 365 or Google Workspace and your residual risk is targeted phishing, BEC, vendor fraud and risky OAuth grants.
- Consider a gateway only if
- you run on-premises or hybrid Exchange, need policy enforcement before mail touches the tenant, or depend on gateway features such as continuity, journaling or outbound relay.
- Both fit if
- you have a gateway you cannot remove yet. Sentaro runs behind a gateway, so you can add it before removing the other.
How mail flows through a secure email gateway
A typical inbound path with a cloud gateway in front of Microsoft 365.
- 01
Sender looks up your MX record
Your domain’s MX record points to the gateway, not to Microsoft or Google.
- 02
Gateway receives and scans
The gateway checks reputation, authentication, content, links and attachments, often with sandboxing and URL rewriting.
- 03
Gateway relays clean mail
Mail that passes is relayed to Microsoft 365 or Google Workspace through a connector.
- 04
Native filtering runs again
The cloud platform applies its own filtering. In Microsoft 365, Enhanced Filtering for Connectors helps it see the original sender behind the gateway.
- 05
Delivery
The message lands in the mailbox. From here the gateway no longer sees it, unless the vendor adds an API or journaling component for post-delivery removal.
How mail flows with API-based email security (ICES)
MX records stay pointed at Microsoft 365 or Google Workspace.
- 01
Admin grants API access
An administrator authorizes the vendor’s app in the tenant, typically via Microsoft Graph or the Google Workspace admin APIs. No DNS change.
- 02
Native filtering runs first
Microsoft or Google filtering handles bulk spam and known malware as usual.
- 03
The vendor is notified or reads the message
Depending on the vendor and mode, analysis happens before the message is visible to the user, or immediately after delivery.
- 04
Verdict and action inside the mailbox
The vendor moves, quarantines, deletes or labels the message through the API, and can remediate the same message across every mailbox.
- 05
Continuous context
Because it lives in the tenant, the tool also sees internal mail, historical mail and, for some vendors, sign-ins, OAuth grants and mailbox rules.
SEG vs API-based email security, side by side
Category-level differences. Individual products vary; several vendors now sell both modes.
| Capability | Secure email gateway | API-based (ICES) |
|---|---|---|
| Deployment | ||
| DNS / MX change | YesRequired | NoNot required |
| Typical setup time | Depends on MX propagation (DNS TTL) and connector configuration | Vendor-stated examples: Abnormal “Deploy in 60 seconds via API”; Proofpoint “Deploy via API in 48 hours” |
| Works with on-premises Exchange | Yes | PartialBuilt for cloud mail platforms; some vendors support other sources |
| Rollback | Change MX back, wait for propagation | Revoke the app’s access |
| Visibility | ||
| Inbound mail from outside | Yes | Yes |
| Internal (east-west) mail | PartialOnly if internal mail is routed through it | Yes |
| Historical mail already in mailboxes | No | Yes |
| Mailbox and relationship history | PartialWhat passes through it | Yes |
| OAuth grants, sign-ins, mailbox rules | No | PartialVendor-dependent |
| Enforcement | ||
| Blocks before the tenant receives mail | Yes | No |
| Acts before the user sees mail | Yes | PartialSome vendors inline via API or journaling; others post-delivery |
| Removes mail after delivery | PartialOnly with an added API component | Yes |
| Same message removed from every mailbox | Partial | Yes |
| Overlap with native filtering | ||
| Relationship to Defender / Gmail filtering | Runs before it; filtering can overlap | Runs after it, as an added layer |
| Main design limit | Sees only mail routed through it, so post-delivery and internal context is limited | In post-delivery mode, a short window between delivery and removal |
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Is API-based email security inline or post-delivery?
It depends on the vendor, and the differences are worth asking about. Darktrace documents that its API-only mode for Microsoft 365 works post-delivery via Graph notifications, while its recommended API plus journaling mode receives a copy in transport before the inbox. Check Point says Harmony Email & Collaboration inspects messages before they reach the inbox and can be set from monitor mode to inline prevention. Cloudflare Email Security supports MX/inline, API and BCC/journaling, and a mixed inline plus API mode. Trend Micro documents an inline mode for Exchange Online, licensed as an add-on, built on transport rules and connectors without an MX change.
The question to ask any vendor is concrete: on my tenant, how many seconds pass between a message arriving and your action, and can a user open it in that window? Ask for the number from a trial, not from a diagram.
Why many vendors now sell both
The line between categories has blurred. Mimecast sells a Cloud Gateway (an inline MX gateway) and Cloud Integrated (API, no MX change). Proofpoint says its Core Email Protection deploys "via API or inline". Hornetsecurity offers MX, API and hybrid modes. Barracuda’s current Email Protection page describes an API-first deployment, while its Email Gateway Defense documentation still requires an MX change. Libraesva combines a gateway with API remediation.
| Vendor | Gateway / MX mode | API mode | Source |
|---|---|---|---|
| Mimecast | Cloud Gateway | Cloud Integrated | mimecast.com |
| Proofpoint | Inline | API via Microsoft Graph | proofpoint.com |
| Hornetsecurity | MX-based | API-based, plus hybrid | hornetsecurity.com |
| Cloudflare Email Security | MX/Inline | API, BCC/Journaling, mixed | developers.cloudflare.com |
| Barracuda | Email Gateway Defense (MX) | Email Protection (API-first) | barracuda.com |
| Check Point Harmony Email | None needed | API, inline or monitor | checkpoint.com |
| Abnormal, Sublime, IRONSCALES, Material | None | API | Vendor sites |
Why payload-free attacks favor the API model
Payload and reputation checks look at links, attachments, sender reputation and authentication. Business email compromise can carry none of those. For example, a request to change supplier bank details, sent from a real but compromised supplier mailbox, passes authentication and contains only text. The FBI IC3 Internet Crime Report 2025 records $3.05bn in reported BEC losses in 2025.
Catching that message needs mailbox context: has this supplier ever changed banking details before, was this reply injected into an existing thread, is the tone unusual for this relationship? An API-based tool reads mailbox history to answer those questions, while a gateway sees only the mail routed through it. That is the main technical argument for the API category.
Moving from a gateway to native filtering plus an API layer
- 01
Add the API layer behind the gateway
Connect the API tool while the gateway stays in place. No mail-flow change yet.
- 02
Measure for four to eight weeks
Count what the API layer catches after the gateway. That number is your residual risk.
- 03
Inventory gateway-only features
List continuity, outbound relay, encryption, archiving and DLP you rely on, and find a home for each.
- 04
Tighten native filtering
In Microsoft 365, apply Standard or Strict preset security policies; in Google Workspace, review Gmail safety settings.
- 05
Cut MX over
Point MX back at Microsoft or Google, keep the gateway contract for one overlap period, then retire it.
Why Sentaro is the better choice than both
Sentaro is an API-based email security platform for Microsoft 365 and Google Workspace, hosted in Sweden on Microsoft Azure (subprocessors are listed in the DPA at /en/legal/dpa). It is our pick over a gateway, and over other API tools, for EU teams on cloud mail. It runs alongside Microsoft Defender, Google’s built-in protection and existing gateways rather than replacing them; Sentaro says most of its customers retire the gateway later.
- Four-minute deployment. Connects through the Google Workspace and Microsoft 365 admin SDKs; no MX changes, no agents; historical visibility within 15 minutes. Rollback is revoking the app.
- Scored before interaction. Every inbound and internal message is scored by Vord, Sentaro’s proprietary engine, and either blocked or tagged inline in the mailbox.
- Built for payload-free fraud. The Message vector reads intent, sender identity, reply-chain context and suppliers that suddenly change banking details, which is exactly the context a gateway does not have.
- More than mail. The App vector inventories every app, AI tool and OAuth grant in the tenant, with scope-level risk and one-click revocation.
- One published price. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
One published example: a 400-seat Nordic payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. Where Sentaro does not fit: it does not offer gateway features such as continuity, archiving or encryption, and it is built for Microsoft 365 and Google Workspace, not on-premises Exchange.
Frequently asked questions
What is the best API-based email security for Microsoft 365 and Google Workspace?
Sentaro, for EU teams. It connects over API in four minutes with no MX changes and no agents, scores every inbound and internal message before interaction, and targets payload-free BEC and vendor compromise. The same platform inventories OAuth apps and AI tools. It is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month; the first account is free. Prices in USD.
Which is better, API-based email security or a secure email gateway?
For cloud-only Microsoft 365 and Google Workspace tenants, API-based email security: it deploys without DNS changes, sees internal and historical mail, and has the mailbox context needed for payload-free fraud. A gateway still fits on-premises or hybrid Exchange, or where you depend on continuity, outbound relay or archiving.
What is the difference between a secure email gateway and API-based email security?
A secure email gateway receives your mail first because your MX record points to it, scans it, and relays clean mail to your mail platform. API-based email security connects to Microsoft 365 or Google Workspace through their APIs, leaves MX records alone, and analyzes and acts on mail inside the tenant, including internal and historical mail.
Is ICES the same as API-based email security?
Mostly. Integrated cloud email security (ICES) is the analyst term for email security that integrates with a cloud mail platform via API rather than sitting in the MX path. Microsoft also uses the term for its ICES Vendor Ecosystem; as of July 2026, Microsoft Learn lists three approved vendors (Darktrace, KnowBe4 and VIPRE) whose verdicts flow into Defender for Office 365 Plan 2.
Do I still need a secure email gateway with Microsoft 365?
Not always. Microsoft 365 includes built-in protection for every cloud mailbox, and Defender for Office 365 adds Safe Links, Safe Attachments and impersonation protection. Cloud-only organizations can add an API layer instead. A gateway still makes sense for on-premises or hybrid Exchange, or if you rely on its continuity, outbound or archiving features.
Can API-based email security block email before it reaches the inbox?
Some products can. Check Point and Trend Micro describe inline modes that work without an MX change, and Darktrace recommends API plus journaling for pre-inbox analysis. Other API tools remediate shortly after delivery. Ask each vendor how long the window is on your own tenant.
Can I run a gateway and an API tool together?
Yes. The API tool sits behind the gateway and native filtering and acts on what reaches the mailbox. That also gives you data on whether the gateway is still earning its cost.
Is API access to my mailboxes a security risk?
Any tool with mailbox access is a high-value target, whether it reads mail through MX or through an API. Review the permission scopes the vendor requests, its certifications, its subprocessors and where data is stored, and confirm you can revoke access in one step.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Microsoft Learn: Built-in security features for all cloud mailboxes (connectors, Enhanced Filtering)
- Microsoft Learn: Defender for Office 365 ICES Vendor Ecosystem
- Darktrace: why API + journaling for Microsoft 365 (4 Nov 2025)
- Check Point: Harmony Email & Collaboration
- Cloudflare: Email Security deployment options
- Trend Micro: Vision One inline protection for Exchange Online
- Mimecast: Email Security (Cloud Gateway and Cloud Integrated)
- Proofpoint: Core Email Protection
- Hornetsecurity: email security modes
- Abnormal AI: Inbound Email Security (setup claim)
- Libraesva: email security
- Barracuda: Email Protection
- Barracuda Campus: Email Gateway Defense MX configuration
- FBI IC3: Internet Crime Report 2025