For EU teams on Microsoft 365 and Google Workspace, Sentaro is our first choice among ICES vendors. It deploys over API in four minutes, targets payload-free BEC and vendor compromise, covers OAuth apps and shadow AI in the same platform, publishes one price with every feature included, and publishes its hosting (Sweden, Microsoft Azure). For other buyers the fit depends on your platform (several vendors document Microsoft 365 more fully than Google Workspace), how much scope you want bundled (DMARC, archiving, backup, training), whether you also need a gateway mode, and how much the vendor documents publicly. EU-regulated buyers who need a published price have a short list: only three vendors here publish one, and hosting terms range from a single named country to US-or-EU options set by contract.
- Why Sentaro wins
- each reason can be checked on sentaro.com: a published price ($6 per protected account per month, or $68 per year; first account free; prices in USD), published hosting (Sweden, Microsoft Azure) with a DPA subprocessor list, an API connection in four minutes with no MX change, and email plus OAuth app coverage in one platform (App vector, live since Q3 2026). Only three of the 16 vendors on this page publish a price, and several offer EU hosting only as an option set by subscription or by module.
- Consider others only if
- you need verdicts inside the Defender portal (Darktrace, KnowBe4, VIPRE), a gateway mode, or bundled archiving, backup and training.
- Only 3 of 16 publish prices
- Material Security and Sentaro publish per-user or per-account prices, and Sublime Security publishes a free tier for the first 100 mailboxes. The rest quote on request.
- Microsoft’s own ICES program
- Microsoft Learn (updated 17 July 2026) lists only Darktrace, KnowBe4 and VIPRE as passing verdicts into the Defender portal, and it requires Defender for Office 365 Plan 2 or E5.
Integrated cloud email security vendors at a glance
Sentaro, our pick, first; the rest alphabetical. A "Not publicly documented" mark means we did not find the fact in the vendor’s public material on 18 October 2026, not that it is absent. Prices in USD, as of 18 October 2026.
| Capability | Deployment | Microsoft 365 | Google Workspace | Public price | Owner | Published EU hosting |
|---|---|---|---|---|---|---|
| Sentaro | API | Yes | Yes | Yes$6/account/month or $68/year; first account free | Sentaro AB (Stockholm) | YesHosted in Sweden on Microsoft Azure; subprocessors in the DPA |
| Abnormal AI (Inbound Email Security) | API | Yes | Yes | NoQuote on request | Venture-backed, private | PartialAWS US or EU (Ireland), by subscription (subprocessor list, July 2026) |
| Barracuda (Email Protection) | API-first; MX for Email Gateway Defense | Yes | Yes | NoQuote on request | KKR | PartialFrankfurt and London for Email Gateway Defense; US only for Impersonation Protection (trust center) |
| Check Point (Harmony Email & Collaboration, formerly Avanan) | API, monitor or inline | Yes | Yes | NoQuote on request | Check Point (NASDAQ: CHKP) | YesIreland region selectable |
| Cloudflare (Email Security, formerly Area 1) | MX/inline, API, BCC/journaling, mixed | Yes | Yes | NoPlans published, prices not | Cloudflare (NYSE: NET) | PartialProcessing region selectable (US, Germany, India, Australia) for MX/inline and BCC modes |
| Darktrace (Darktrace / EMAIL) | API; API + journaling recommended for M365 | Yes | Not publicly documented | NoQuote on request | Thoma Bravo | Not publicly documented |
| Fortinet (FortiMail Workspace Security, formerly Perception Point) | API | Yes | Yes | NoQuote on request | Fortinet (NASDAQ: FTNT) | Not publicly documented |
| Hornetsecurity (365 Total Protection) | MX, API or hybrid | Yes | Not publicly documented | NoQuote on request | Proofpoint (since Dec 2025) | Not publicly documented12 regional data centers stated; locations not listed |
| IRONSCALES | API | Yes | Yes | NoTiers listed, prices on request | Venture-backed, private | PartialSubprocessor list: AWS in the USA and Germany |
| KnowBe4 (Cloud Email Security: Defend, from Egress) | Native Microsoft 365 integration; mode not specified | Yes | Not publicly documented | NoQuote on request | Vista Equity Partners | PartialCustomer-chosen main storage incl. Ireland or Germany (DTIA, October 2026) |
| Libraesva (Email Security) | Gateway plus API remediation | Yes | Yes | NoQuote on request | LibraCyber group (private) | Not publicly documentedLocal or chosen cloud; regions not listed |
| Material Security | API | Yes | Yes | YesFrom $4/user/month + Shared Drive fee | Venture-backed, private | Not publicly documentedNo EU region documented; subprocessor list names Google Cloud, U.S.A. |
| Mimecast (Email Security, Cloud Integrated) | API (Cloud Integrated); MX (Cloud Gateway) | Yes | Yes | NoQuote on request | Permira-advised funds | YesFrankfurt data centers (announced 2018) |
| Proofpoint (Core Email Protection) | API or inline | Yes | Yes | NoQuote on request | Thoma Bravo | PartialCore Email Protection API: EU or US data centre; some US processing |
| Sublime Security | API; managed cloud or self-hosted | Yes | Yes | PartialFirst 100 mailboxes free on managed cloud | Venture-backed, private | PartialManaged-cloud regions incl. EU (Dublin); or self-host in your region |
| Trend Micro (TrendAI Vision One Email and Collaboration Security) | API, inline (no MX change) and gateway | Yes | Yes | NoQuote on request | Trend Micro | Not publicly documented |
Sources for every row are listed at the end of the page. Ownership is as published by the vendor or its acquirer.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
What each vendor is known for
One line per vendor, in the vendor’s own terms where possible. Our pick first, then alphabetical.
Sentaro
Our pickBest for: EU teams on Microsoft 365 and Google Workspace
API-based detection for payload-free BEC, vendor compromise, QR lures and consent phishing, plus an inventory of every app, AI tool and OAuth grant with one-click revocation. $6 per protected account per month, every feature included (prices in USD). Hosted in Sweden on Microsoft Azure.
Abnormal AI
Best for: Enterprise and mid-market
Behavioral baselines for every employee and vendor; products for account takeover, Microsoft 365 posture and AI security. Abnormal states that more than 30% of the Fortune 500 are customers.
Barracuda Email Protection
Best for: SMBs, mid-market and MSPs wanting a bundle
Three cumulative plans bundling threat protection with DMARC reporting, encryption, DLP, Microsoft 365 backup, archiving and training.
Check Point Harmony Email & Collaboration
Best for: Enterprise, mid-market and MSSPs
Inline prevention via API, sandboxing and CDR, and coverage across Teams, Slack, Drive, Box, Dropbox and ShareFile. Gartner MQ Leader 2025 (vendor-stated).
Cloudflare Email Security
Best for: Cloudflare Zero Trust customers
Every deployment mode (MX, API, journaling, mixed), link and attachment isolation, and bundling with Cloudflare Zero Trust.
Darktrace / EMAIL
Best for: Mid-market and enterprise
A per-organization behavioral model rather than a shared cross-customer model; ICES Vendor Ecosystem partner in Defender.
FortiMail Workspace Security
Best for: Fortinet Security Fabric customers
Formerly Perception Point; includes a 24x7 managed incident response service and covers browsers and SaaS apps.
Hornetsecurity 365 Total Protection
Best for: SMBs and mid-market via MSPs
German-rooted Microsoft 365 suite with filtering, encryption, archiving, backup, DMARC and training; now a Proofpoint company.
IRONSCALES
Best for: SMBs and MSPs
Adaptive AI plus crowdsourced intelligence; bundles phishing simulation and training; multi-tenant MSP console.
KnowBe4 Defend
Best for: KnowBe4 training customers on M365
Inbound protection from the Egress acquisition, sold alongside KnowBe4’s training; ICES Vendor Ecosystem partner in Defender.
Libraesva
Best for: EU buyers needing on-prem options
Italian gateway with API remediation and on-premises or private-cloud options; announced a combination with awareness vendor Cyber Guru in January 2026.
Material Security
Best for: Enterprise and tech companies on Google Workspace
Post-compromise containment, Google Drive data protection and OAuth security, with public per-user pricing.
Mimecast Cloud Integrated
Best for: Mid-market and enterprise wanting gateway or API from one vendor
API product from a vendor with gateway, archive and continuity heritage since 2003.
Proofpoint Core Email Protection
Best for: Large enterprises
API or inline, backed by Proofpoint Nexus threat intelligence and a deep add-on portfolio.
Sublime Security
Best for: Security teams that write detections
Detection-as-code in its MQL language with open-source rules, AI agents for triage and rule-writing, and a free tier.
Trend Micro Vision One Email and Collaboration
Best for: Trend Vision One customers
API, inline and gateway modes, on-premises Exchange and Domino coverage, and Vision One XDR integration.
What is Microsoft’s ICES Vendor Ecosystem?
Microsoft runs an ICES Vendor Ecosystem for Defender for Office 365. Approved non-Microsoft vendors pass a verdict, a confidence level and threat details on individual messages through a private Microsoft Graph API. Defender takes the most serious verdict, updates the message and logs, and moves the message to the policy-specified location. The results appear in Defender’s quarantine, Threat Explorer, the Email entity page, Advanced Hunting and dedicated reports, including an "Efficacy" view of what the third party caught that Defender did not.
| Question | Answer from Microsoft Learn (ms.date 17 July 2026) |
|---|---|
| Which vendors are approved? | Darktrace/EMAIL, KnowBe4 Defend Platform, VIPRE Integrated Email Security (IES) |
| Which licence is required? | Defender for Office 365 Plan 2 or Microsoft 365 E5 |
| Does it cost extra? | No; the integration and Graph API support are included with Plan 2 |
| Can I use other vendors? | Yes, but without this integration; other ICES vendors are not part of it |
| Which verdict wins if vendors disagree? | The most serious: malware, then high-confidence phishing, phishing, high-confidence spam, spam |
Being outside the program does not stop a vendor from protecting a Microsoft 365 tenant; every other vendor on this page connects through its own API integration and its own console. What the program changes is where the verdicts are visible. If a single Defender portal view matters to your SOC, that narrows the list today. Sentaro is not part of the program.
How to choose an ICES vendor
- Platform fit: confirm Google Workspace support in the mode you will actually use; several vendors are Microsoft 365-first.
- Timing: ask how many seconds pass between delivery and action on your tenant, and whether users can open the message in that window.
- Scope: decide whether you need only detection, or also DMARC, encryption, archiving, backup, DLP and training. Bundles change the price comparison.
- Data: ask where mail content is processed and stored, which subprocessors are involved, and how long raw mail is retained.
- Evidence: for NIS2 or DORA, check that incident timelines (who, what, when, scope) can be exported for reporting deadlines.
- Permissions: review the API scopes requested and confirm access can be revoked in one step.
- Trial on live traffic: run two vendors side by side behind native filtering for two to four weeks and compare catches and analyst time.
Running a fair ICES evaluation
- 01
Keep native filtering on
Apply Microsoft’s Standard or Strict preset policies, or Google’s advanced phishing settings, so every vendor is measured on residual risk.
- 02
Connect two or three vendors in monitor mode
API-based tools can watch the same tenant at once without changing MX records.
- 03
Build a ground-truth set
Use user-reported phishing, known invoice-fraud attempts and finance-team mail from the trial period.
- 04
Score catches, misses and noise
Count true detections, missed threats and alerts that needed a human decision.
- 05
Price the scope you need
Get written quotes for the same feature scope and seat count, including add-ons.
Why Sentaro is our pick over the other 15
Sentaro is an API-based email security platform for Microsoft 365 and Google Workspace, hosted in Sweden on Microsoft Azure. For EU teams it combines what the table shows is rare across this category: a published price, a published hosting location and email plus app coverage in one product.
- Four-minute deployment. Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes. It runs alongside Microsoft Defender, Google’s built-in protection and any gateway you keep.
- Fraud-first detection. Vord, Sentaro’s proprietary engine, scores every inbound and internal message before interaction, reading intent, sender identity, reply-chain context and QR-code destinations. Payload-free BEC and vendor compromise are a core design target.
- Apps and shadow AI included. The App vector inventories every app, AI tool and OAuth grant within 15 minutes of connecting, with scope-level risk and one-click revocation.
- Transparent price. $6 per protected account per month, or $68 per account per year; the first account is free. Nothing held back for a higher tier. Prices in USD.
- Published hosting. Hosted in Sweden on Microsoft Azure; the DPA lists subprocessors (/en/legal/dpa).
Where others may still fit: Sentaro is not part of Microsoft’s ICES Vendor Ecosystem, offers no archiving, backup or training, and has no live account-takeover detection yet. Its roadmap and certification status are in the two notes below.
Frequently asked questions
What is the best ICES vendor?
Sentaro, for EU teams on Microsoft 365 and Google Workspace. It connects over API in four minutes with no MX changes, targets payload-free BEC and vendor compromise, and inventories OAuth apps and AI tools in the same platform. It publishes its price ($6 per protected account per month, first account free; prices in USD) and its hosting (Sweden, on Microsoft Azure). If you need verdicts inside the Defender portal, look at Microsoft’s three ICES partners.
What is an ICES vendor?
An integrated cloud email security (ICES) vendor protects cloud mail platforms such as Microsoft 365 and Google Workspace by connecting through their APIs, rather than by sitting in the mail path as a secure email gateway. ICES tools run after native filtering and can see internal and historical mail.
Which ICES vendors are in Microsoft’s ICES Vendor Ecosystem?
As of Microsoft Learn’s July 2026 update, three: Darktrace/EMAIL, KnowBe4 Defend Platform and VIPRE Integrated Email Security. The integration requires Defender for Office 365 Plan 2 or Microsoft 365 E5 and surfaces partner verdicts in the Defender portal at no extra charge.
Which ICES vendors publish their prices?
Few. Material Security publishes per-user prices from $4 per month plus a Shared Drive fee. Sublime Security offers the first 100 mailboxes free on managed cloud. Sentaro publishes $6 per protected account per month, or $68 per account per year; the first account is free (prices in USD, as of 18 October 2026). Most others, including Abnormal, Proofpoint, Mimecast and Check Point, quote on request.
Which ICES vendors are hosted in the EU?
Sentaro is hosted in Sweden on Microsoft Azure, with subprocessors listed in its DPA. Check Point’s admin guide lists a selectable Ireland region, and Mimecast announced two Frankfurt data centers in 2018. Others offer the EU as an option: Abnormal (AWS in the EU, Ireland, by subscription), Sublime (an EU, Dublin, managed-cloud region), KnowBe4 (customer-chosen storage in Ireland or Germany), IRONSCALES (AWS in Germany and the USA on its subprocessor list), Proofpoint (an EU or US data centre for its API product, with some US processing), Cloudflare (a German processing region) and Barracuda (Frankfurt for its gateway, US-only for its API modules). Hornetsecurity states 12 regional data centers without listing locations, and Libraesva says it runs locally or in your chosen cloud. Ask every vendor for its current subprocessor list.
Is an ICES a replacement for Microsoft Defender for Office 365?
Usually not. Most ICES vendors, Sentaro included, are designed to run alongside Microsoft’s built-in protection or Defender for Office 365 and catch what native filtering misses. Whether you also need Plan 2 depends on whether you want its investigation tools and, for the ICES Vendor Ecosystem, the Defender portal integration that requires it.
What does Gartner call this category?
Integrated cloud email security (ICES) is the analyst term used to distinguish API-based products from secure email gateways. Several vendors, including Check Point and KnowBe4, cite placements in Gartner’s 2025 Magic Quadrant for Email Security; those claims are vendor-stated on their own sites.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Microsoft Learn: Defender for Office 365 ICES Vendor Ecosystem (ms.date 17 Jul 2026)
- Abnormal AI: Inbound Email Security
- Barracuda: Email Protection
- Barracuda Campus: Email Gateway Defense MX configuration
- Check Point: Harmony Email & Collaboration
- Check Point: admin guide, data residency regions
- Cloudflare: Email Security deployment
- Darktrace: Darktrace / EMAIL
- Thoma Bravo: completes acquisition of Darktrace
- Fortinet: FortiMail Workspace Security
- Hornetsecurity: 365 Total Protection
- IRONSCALES: pricing
- KnowBe4: Cloud Email Security
- Libraesva: homepage
- Material Security: pricing
- Mimecast: Email Security
- Proofpoint: Core Email Protection
- Sublime Security: installation docs (free tier)
- Trend Micro: TrendAI email security
- Abnormal AI: about (Fortune 500 share)
- Barracuda: Email Protection plans
- KKR completes acquisition of Barracuda (Business Wire, 2022)
- Cloudflare: Email Security product plans (Q3 2025)
- Hornetsecurity: email security modes
- Proofpoint: completes acquisition of Hornetsecurity (Dec 2025)
- Proofpoint: Frankfurt data center for data security
- Data Centre News: Mimecast opens two Frankfurt data centers (2018)
- Vista Equity Partners completes acquisition of KnowBe4
- Libraesva and Cyber Guru combination (Business Wire via l’Adige, Jan 2026)
- Sentaro: data processing agreement and subprocessors
- Abnormal AI: Subprocessors (updated 31 July 2026; accessed 2026-10-21)
- Barracuda Trust Center: Data center locations (accessed 2026-10-21)
- Cloudflare docs: Email Security regional processing (accessed 2026-10-21)
- IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
- KnowBe4: Data Transfer Impact Assessment (updated 13 October 2026)
- Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)
- Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)
- Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)