[{"data":1,"prerenderedAt":413},["ShallowReactive",2],{"money-live:best":3,"money:compare:api-email-security-vs-secure-email-gateway":4,"money-links:\u002Fen\u002Fcompare\u002Fapi-email-security-vs-secure-email-gateway":389},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":12,"seoDescription":14,"reviewed":15,"heroChips":16,"sections":21,"faqs":296,"sources":321,"disclaimer":364,"related":365},"compare","api-email-security-vs-secure-email-gateway","API email security vs secure email gateway","How mail actually flows through a gateway and through an API-based ICES, what each can see, and when to run both.","network","Buyer guide","API email security vs secure email gateway (SEG)","A secure email gateway (SEG) filters mail in front of your mailboxes after you point your MX record at it, while API-based email security, also called integrated cloud email security (ICES), connects to Microsoft 365 or Google Workspace through their APIs with no MX change and acts inside the tenant; for cloud tenants the API model wins, and the best API option for EU teams is Sentaro. Sentaro connects in four minutes with no MX change and is hosted in Sweden on Microsoft Azure. Several vendors now offer both modes.","API-based email security (ICES) vs secure email gateway: mail flow step by step, visibility, inline vs post-delivery, failure modes, and when to run both.","2026-10-18",[17,18,19,20],"SEG: MX record change","API\u002FICES: no MX change","Inline vs post-delivery","Our pick: Sentaro",[22,39,44,64,83,188,198,247,255,273,289,293],{"t":23,"title":24,"summary":25,"points":26},"verdict","Our recommendation: API, and Sentaro","For cloud-only Microsoft 365 and Google Workspace tenants, the API model wins, and Sentaro is the best API option for EU teams. A gateway is best at stopping known-bad mail before it ever reaches the tenant, and it works with any mail server, including on-premises Exchange. An API-based tool is best at seeing what a gateway cannot: internal mail, historical mail, mail from compromised trusted accounts, and the mailbox context needed to judge payload-free fraud. Cloud-only Microsoft 365 and Google Workspace tenants can run native filtering plus an API layer; hybrid and on-premises estates are where a gateway still fits best.",[27,30,33,36],{"label":28,"text":29},"Why Sentaro wins","each reason can be checked: it connects over API in four minutes with no MX change and no agents, so your MX record does not move; it reads mailbox history and shows the reasoning behind every BEC and vendor-compromise verdict, so you can audit it on your own mail; its App vector, live since Q3 2026, covers OAuth apps and shadow AI in the same platform; its price, $6 per protected account per month with every feature included, is published on sentaro.com\u002Fen\u002Fpricing (USD); and it is hosted in Sweden on Microsoft Azure, with subprocessors in its public DPA.",{"label":31,"text":32},"Choose Sentaro if","you are an EU team fully on Microsoft 365 or Google Workspace and your residual risk is targeted phishing, BEC, vendor fraud and risky OAuth grants.",{"label":34,"text":35},"Consider a gateway only if","you run on-premises or hybrid Exchange, need policy enforcement before mail touches the tenant, or depend on gateway features such as continuity, journaling or outbound relay.",{"label":37,"text":38},"Both fit if","you have a gateway you cannot remove yet. Sentaro runs behind a gateway, so you can add it before removing the other.",{"t":40,"tone":41,"title":42,"text":43},"callout","info","Who wrote this guide","Sentaro publishes this guide and recommends itself; competitor facts are public and sourced as of 18 October 2026.",{"t":45,"title":46,"intro":47,"items":48},"steps","How mail flows through a secure email gateway","A typical inbound path with a cloud gateway in front of Microsoft 365.",[49,52,55,58,61],{"title":50,"text":51},"Sender looks up your MX record","Your domain’s MX record points to the gateway, not to Microsoft or Google.",{"title":53,"text":54},"Gateway receives and scans","The gateway checks reputation, authentication, content, links and attachments, often with sandboxing and URL rewriting.",{"title":56,"text":57},"Gateway relays clean mail","Mail that passes is relayed to Microsoft 365 or Google Workspace through a connector.",{"title":59,"text":60},"Native filtering runs again","The cloud platform applies its own filtering. In Microsoft 365, Enhanced Filtering for Connectors helps it see the original sender behind the gateway.",{"title":62,"text":63},"Delivery","The message lands in the mailbox. From here the gateway no longer sees it, unless the vendor adds an API or journaling component for post-delivery removal.",{"t":45,"title":65,"intro":66,"items":67},"How mail flows with API-based email security (ICES)","MX records stay pointed at Microsoft 365 or Google Workspace.",[68,71,74,77,80],{"title":69,"text":70},"Admin grants API access","An administrator authorizes the vendor’s app in the tenant, typically via Microsoft Graph or the Google Workspace admin APIs. No DNS change.",{"title":72,"text":73},"Native filtering runs first","Microsoft or Google filtering handles bulk spam and known malware as usual.",{"title":75,"text":76},"The vendor is notified or reads the message","Depending on the vendor and mode, analysis happens before the message is visible to the user, or immediately after delivery.",{"title":78,"text":79},"Verdict and action inside the mailbox","The vendor moves, quarantines, deletes or labels the message through the API, and can remediate the same message across every mailbox.",{"title":81,"text":82},"Continuous context","Because it lives in the tenant, the tool also sees internal mail, historical mail and, for some vendors, sign-ins, OAuth grants and mailbox rules.",{"t":6,"title":84,"intro":85,"columns":86,"groups":89},"SEG vs API-based email security, side by side","Category-level differences. Individual products vary; several vendors now sell both modes.",[87,88],"Secure email gateway","API-based (ICES)",[90,119,150,175],{"label":91,"rows":92},"Deployment",[93,102,107,114],{"label":94,"cells":95},"DNS \u002F MX change",[96,99],{"mark":97,"text":98},"yes","Required",{"mark":100,"text":101},"no","Not required",{"label":103,"cells":104},"Typical setup time",[105,106],"Depends on MX propagation (DNS TTL) and connector configuration","Vendor-stated examples: Abnormal “Deploy in 60 seconds via API”; Proofpoint “Deploy via API in 48 hours”",{"label":108,"cells":109},"Works with on-premises Exchange",[110,111],{"mark":97},{"mark":112,"text":113},"partial","Built for cloud mail platforms; some vendors support other sources",{"label":115,"cells":116},"Rollback",[117,118],"Change MX back, wait for propagation","Revoke the app’s access",{"label":120,"rows":121},"Visibility",[122,127,133,138,144],{"label":123,"cells":124},"Inbound mail from outside",[125,126],{"mark":97},{"mark":97},{"label":128,"cells":129},"Internal (east-west) mail",[130,132],{"mark":112,"text":131},"Only if internal mail is routed through it",{"mark":97},{"label":134,"cells":135},"Historical mail already in mailboxes",[136,137],{"mark":100},{"mark":97},{"label":139,"cells":140},"Mailbox and relationship history",[141,143],{"mark":112,"text":142},"What passes through it",{"mark":97},{"label":145,"cells":146},"OAuth grants, sign-ins, mailbox rules",[147,148],{"mark":100},{"mark":112,"text":149},"Vendor-dependent",{"label":151,"rows":152},"Enforcement",[153,158,164,170],{"label":154,"cells":155},"Blocks before the tenant receives mail",[156,157],{"mark":97},{"mark":100},{"label":159,"cells":160},"Acts before the user sees mail",[161,162],{"mark":97},{"mark":112,"text":163},"Some vendors inline via API or journaling; others post-delivery",{"label":165,"cells":166},"Removes mail after delivery",[167,169],{"mark":112,"text":168},"Only with an added API component",{"mark":97},{"label":171,"cells":172},"Same message removed from every mailbox",[173,174],{"mark":112},{"mark":97},{"label":176,"rows":177},"Overlap with native filtering",[178,183],{"label":179,"cells":180},"Relationship to Defender \u002F Gmail filtering",[181,182],"Runs before it; filtering can overlap","Runs after it, as an added layer",{"label":184,"cells":185},"Main design limit",[186,187],"Sees only mail routed through it, so post-delivery and internal context is limited","In post-delivery mode, a short window between delivery and removal",{"t":189,"id":190,"title":191,"blocks":192},"prose","inline","Is API-based email security inline or post-delivery?",[193,196],{"t":194,"text":195},"p","It depends on the vendor, and the differences are worth asking about. Darktrace documents that its API-only mode for Microsoft 365 works post-delivery via Graph notifications, while its recommended API plus journaling mode receives a copy in transport before the inbox. Check Point says Harmony Email & Collaboration inspects messages before they reach the inbox and can be set from monitor mode to inline prevention. Cloudflare Email Security supports MX\u002Finline, API and BCC\u002Fjournaling, and a mixed inline plus API mode. Trend Micro documents an inline mode for Exchange Online, licensed as an add-on, built on transport rules and connectors without an MX change.",{"t":194,"text":197},"The question to ask any vendor is concrete: on my tenant, how many seconds pass between a message arriving and your action, and can a user open it in that window? Ask for the number from a trial, not from a diagram.",{"t":189,"id":199,"title":200,"blocks":201},"hybrid","Why many vendors now sell both",[202,204],{"t":194,"text":203},"The line between categories has blurred. Mimecast sells a Cloud Gateway (an inline MX gateway) and Cloud Integrated (API, no MX change). Proofpoint says its Core Email Protection deploys \"via API or inline\". Hornetsecurity offers MX, API and hybrid modes. Barracuda’s current Email Protection page describes an API-first deployment, while its Email Gateway Defense documentation still requires an MX change. Libraesva combines a gateway with API remediation.",{"t":205,"rows":206},"table",[207,212,217,222,227,232,237,242],[208,209,210,211],"Vendor","Gateway \u002F MX mode","API mode","Source",[213,214,215,216],"Mimecast","Cloud Gateway","Cloud Integrated","mimecast.com",[218,219,220,221],"Proofpoint","Inline","API via Microsoft Graph","proofpoint.com",[223,224,225,226],"Hornetsecurity","MX-based","API-based, plus hybrid","hornetsecurity.com",[228,229,230,231],"Cloudflare Email Security","MX\u002FInline","API, BCC\u002FJournaling, mixed","developers.cloudflare.com",[233,234,235,236],"Barracuda","Email Gateway Defense (MX)","Email Protection (API-first)","barracuda.com",[238,239,240,241],"Check Point Harmony Email","None needed","API, inline or monitor","checkpoint.com",[243,244,245,246],"Abnormal, Sublime, IRONSCALES, Material","None","API","Vendor sites",{"t":189,"id":248,"title":249,"blocks":250},"payload-free","Why payload-free attacks favor the API model",[251,253],{"t":194,"text":252},"Payload and reputation checks look at links, attachments, sender reputation and authentication. Business email compromise can carry none of those. For example, a request to change supplier bank details, sent from a real but compromised supplier mailbox, passes authentication and contains only text. The FBI IC3 Internet Crime Report 2025 records $3.05bn in reported BEC losses in 2025.",{"t":194,"text":254},"Catching that message needs mailbox context: has this supplier ever changed banking details before, was this reply injected into an existing thread, is the tone unusual for this relationship? An API-based tool reads mailbox history to answer those questions, while a gateway sees only the mail routed through it. That is the main technical argument for the API category.",{"t":45,"title":256,"items":257},"Moving from a gateway to native filtering plus an API layer",[258,261,264,267,270],{"title":259,"text":260},"Add the API layer behind the gateway","Connect the API tool while the gateway stays in place. No mail-flow change yet.",{"title":262,"text":263},"Measure for four to eight weeks","Count what the API layer catches after the gateway. That number is your residual risk.",{"title":265,"text":266},"Inventory gateway-only features","List continuity, outbound relay, encryption, archiving and DLP you rely on, and find a home for each.",{"title":268,"text":269},"Tighten native filtering","In Microsoft 365, apply Standard or Strict preset security policies; in Google Workspace, review Gmail safety settings.",{"title":271,"text":272},"Cut MX over","Point MX back at Microsoft or Google, keep the gateway contract for one overlap period, then retire it.",{"t":189,"id":274,"title":275,"blocks":276},"why-sentaro","Why Sentaro is the better choice than both",[277,279,287],{"t":194,"text":278},"Sentaro is an API-based email security platform for Microsoft 365 and Google Workspace, hosted in Sweden on Microsoft Azure (subprocessors are listed in the DPA at \u002Fen\u002Flegal\u002Fdpa). It is our pick over a gateway, and over other API tools, for EU teams on cloud mail. It runs alongside Microsoft Defender, Google’s built-in protection and existing gateways rather than replacing them; Sentaro says most of its customers retire the gateway later.",{"t":280,"items":281},"ul",[282,283,284,285,286],"Four-minute deployment. Connects through the Google Workspace and Microsoft 365 admin SDKs; no MX changes, no agents; historical visibility within 15 minutes. Rollback is revoking the app.","Scored before interaction. Every inbound and internal message is scored by Vord, Sentaro’s proprietary engine, and either blocked or tagged inline in the mailbox.","Built for payload-free fraud. The Message vector reads intent, sender identity, reply-chain context and suppliers that suddenly change banking details, which is exactly the context a gateway does not have.","More than mail. The App vector inventories every app, AI tool and OAuth grant in the tenant, with scope-level risk and one-click revocation.","One published price. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.",{"t":194,"text":288},"One published example: a 400-seat Nordic payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. Where Sentaro does not fit: it does not offer gateway features such as continuity, archiving or encryption, and it is built for Microsoft 365 and Google Workspace, not on-premises Exchange.",{"t":40,"tone":290,"title":291,"text":292},"roadmap","Roadmap: Identity and Behavioral, Q4 2026","Sentaro’s capabilities described on this page are live today: the Message vector (since Q2 2026) and the App vector (since Q3 2026). Identity (leaked credentials, lookalike-domain registration alerts) and Behavioral (account-takeover and session anomalies, forwarding-rule abuse, forced re-authentication and session revocation) reach general availability in Q4 2026, included at no added cost.",{"t":40,"tone":41,"title":294,"text":295},"Certification status","SOC 2 and ISO 27001: certification in progress, with no target date published; Sentaro says it will announce them the day they are signed, and not before. Google CASA: verified API integration. The DPA and subprocessor list are public at sentaro.com\u002Fen\u002Flegal\u002Fdpa; an evidence pack for NIS2, DORA and SOC 2 diligence is available on request from hello@sentaro.com.",[297,300,303,306,309,312,315,318],{"q":298,"a":299},"What is the best API-based email security for Microsoft 365 and Google Workspace?","Sentaro, for EU teams. It connects over API in four minutes with no MX changes and no agents, scores every inbound and internal message before interaction, and targets payload-free BEC and vendor compromise. The same platform inventories OAuth apps and AI tools. It is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month; the first account is free. Prices in USD.",{"q":301,"a":302},"Which is better, API-based email security or a secure email gateway?","For cloud-only Microsoft 365 and Google Workspace tenants, API-based email security: it deploys without DNS changes, sees internal and historical mail, and has the mailbox context needed for payload-free fraud. A gateway still fits on-premises or hybrid Exchange, or where you depend on continuity, outbound relay or archiving.",{"q":304,"a":305},"What is the difference between a secure email gateway and API-based email security?","A secure email gateway receives your mail first because your MX record points to it, scans it, and relays clean mail to your mail platform. API-based email security connects to Microsoft 365 or Google Workspace through their APIs, leaves MX records alone, and analyzes and acts on mail inside the tenant, including internal and historical mail.",{"q":307,"a":308},"Is ICES the same as API-based email security?","Mostly. Integrated cloud email security (ICES) is the analyst term for email security that integrates with a cloud mail platform via API rather than sitting in the MX path. Microsoft also uses the term for its ICES Vendor Ecosystem; as of July 2026, Microsoft Learn lists three approved vendors (Darktrace, KnowBe4 and VIPRE) whose verdicts flow into Defender for Office 365 Plan 2.",{"q":310,"a":311},"Do I still need a secure email gateway with Microsoft 365?","Not always. Microsoft 365 includes built-in protection for every cloud mailbox, and Defender for Office 365 adds Safe Links, Safe Attachments and impersonation protection. Cloud-only organizations can add an API layer instead. A gateway still makes sense for on-premises or hybrid Exchange, or if you rely on its continuity, outbound or archiving features.",{"q":313,"a":314},"Can API-based email security block email before it reaches the inbox?","Some products can. Check Point and Trend Micro describe inline modes that work without an MX change, and Darktrace recommends API plus journaling for pre-inbox analysis. Other API tools remediate shortly after delivery. Ask each vendor how long the window is on your own tenant.",{"q":316,"a":317},"Can I run a gateway and an API tool together?","Yes. The API tool sits behind the gateway and native filtering and acts on what reaches the mailbox. That also gives you data on whether the gateway is still earning its cost.",{"q":319,"a":320},"Is API access to my mailboxes a security risk?","Any tool with mailbox access is a high-value target, whether it reads mail through MX or through an API. Review the permission scopes the vendor requests, its certifications, its subprocessors and where data is stored, and confirm you can revoke access in one step.",[322,325,328,331,334,337,340,343,346,349,352,355,358,361],{"label":323,"url":324},"Microsoft Learn: Built-in security features for all cloud mailboxes (connectors, Enhanced Filtering)","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Feop-about",{"label":326,"url":327},"Microsoft Learn: Defender for Office 365 ICES Vendor Ecosystem","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fmdo-ices-vendor-ecosystem",{"label":329,"url":330},"Darktrace: why API + journaling for Microsoft 365 (4 Nov 2025)","https:\u002F\u002Fdarktrace.com\u002Fblog\u002Fwhy-api-journaling-delivers-faster-sla-backed-email-security-for-microsoft-365",{"label":332,"url":333},"Check Point: Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F",{"label":335,"url":336},"Cloudflare: Email Security deployment options","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Femail-security\u002Fsetup",{"label":338,"url":339},"Trend Micro: Vision One inline protection for Exchange Online","https:\u002F\u002Fdocs.trendmicro.com\u002Fen-us\u002Fdocumentation\u002Farticle\u002Ftrend-vision-one-inline-settings-exchange",{"label":341,"url":342},"Mimecast: Email Security (Cloud Gateway and Cloud Integrated)","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F",{"label":344,"url":345},"Proofpoint: Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection",{"label":347,"url":348},"Hornetsecurity: email security modes","https:\u002F\u002Fwww.hornetsecurity.com\u002Fen\u002Femail-security-modes\u002F",{"label":350,"url":351},"Abnormal AI: Inbound Email Security (setup claim)","https:\u002F\u002Fabnormal.ai\u002Fproducts\u002Finbound-email-security",{"label":353,"url":354},"Libraesva: email security","https:\u002F\u002Fwww.libraesva.com\u002F",{"label":356,"url":357},"Barracuda: Email Protection","https:\u002F\u002Fwww.barracuda.com\u002Fproducts\u002Femail-protection",{"label":359,"url":360},"Barracuda Campus: Email Gateway Defense MX configuration","https:\u002F\u002Fdocumentation.campus.barracuda.com\u002Fwiki\u002Fspaces\u002FEGD\u002Fpages\u002F2850923\u002FHow+to+Configure+MX+Records+to+Direct+Mail+Flow+to+Barracuda",{"label":362,"url":363},"FBI IC3: Internet Crime Report 2025","https:\u002F\u002Fwww.ic3.gov\u002FAnnualReport\u002FReports\u002F2025_IC3Report.pdf","Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.",[366,369,371,374,377,380,383,386],{"label":367,"to":368},"Integrated cloud email security","\u002Fen\u002Fglossary\u002Fintegrated-cloud-email-security",{"label":87,"to":370},"\u002Fen\u002Fglossary\u002Fsecure-email-gateway",{"label":372,"to":373},"ICES vendors compared","\u002Fen\u002Fcompare\u002Fices-vendors-compared",{"label":375,"to":376},"Mimecast alternatives","\u002Fen\u002Falternatives\u002Fmimecast-alternatives",{"label":378,"to":379},"Proofpoint vs Mimecast","\u002Fen\u002Fcompare\u002Fproofpoint-vs-mimecast",{"label":381,"to":382},"Pricing","\u002Fen\u002Fpricing",{"label":384,"to":385},"Sentaro vs Proofpoint","\u002Fen\u002Fcompare\u002Fsentaro-vs-proofpoint",{"label":387,"to":388},"How Sentaro connects over API","\u002Fen\u002Fplatform",{"links":390,"only":408,"labels":412},[391,394,397,400,403,406],{"label":392,"to":393},"API-based email security","\u002Fen\u002Fbest\u002Fcloud-email-security",{"label":395,"to":396},"DORA","\u002Fen\u002Fcompliance\u002Fdora",{"label":398,"to":399},"Google Workspace","\u002Fen\u002Fplatforms\u002Fgoogle-workspace-email-security",{"label":401,"to":402},"Microsoft 365","\u002Fen\u002Fplatforms\u002Fmicrosoft-365-email-security",{"label":404,"to":405},"BEC","\u002Fen\u002Fsolutions\u002Fbec",{"label":407,"to":405},"business email compromise",{"5":409,"7":410,"9":411},[402],[405],[393,399,396],{},1792761723473]