Keep Gmail as the baseline and add Sentaro: it is the best protection to add to Gmail for EU teams on Google Workspace. Gmail’s included protections handle the bulk of spam, malware and spoofing, so turn on the advanced Safety settings first. Sentaro closes the gap behind them, and each reason can be checked: it connects through the Google Workspace admin SDK in four minutes with no MX change, as a Google CASA verified API integration; its BEC and vendor-fraud verdicts show their reasoning in the console, so you can audit them on your own mail; its App vector, live since Q3 2026, inventories every app, AI tool and OAuth grant; its price, $6 per protected account per month with every feature included, is published on sentaro.com/en/pricing; and it is hosted in Sweden on Microsoft Azure, with subprocessors listed in its public DPA.
- Choose Sentaro if…
- finance and supplier mail is where you lose money, IT is lean, or you need an inventory of every app and AI tool with access to Workspace data.
- Why Sentaro wins
- we found no Google Workspace Admin Help feature built specifically for vendor email compromise (October 2026); Sentaro treats it as a core design target, adds consent-phishing blocking and one-click grant revocation (App vector, live since Q3 2026), and covers Microsoft 365 with the same engine.
- Consider Gmail alone only if…
- you are a small team on Business Standard or higher, the advanced Safety settings are on, and payments are always verified out of band.
- Edition matters
- The Gmail Security Sandbox is not in Business Starter, and Google lists the security investigation tool and Gmail DLP for Enterprise, Frontline and Education editions.
At a glance
- What it is
- Google Workspace: Gmail’s native filtering plus admin settings in Admin console > Gmail > Safety, with more tools in higher editions. Sentaro: an ICES-category platform that connects over API and runs behind native filtering.
- Deployment
- Google: on by default; advanced settings configured by an admin. Sentaro: connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
- Platforms
- Google: Gmail, Drive and Chat. Sentaro: Google Workspace and Microsoft 365, with Slack and Teams listed as channels.
- Price
- Google: included in the Workspace subscription (Business Starter EUR 6.80 to Business Plus EUR 21.10 per user per month, as Google’s pricing page showed an EU visitor on 18 October 2026). Sentaro: $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.
- Hosting
- Google: Google documents data regions (US, Europe or no preference) for Business Standard and higher editions. Sentaro: hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.
- Best for
- Google: every Workspace tenant, as the baseline. Sentaro: regulated EU SMEs and mid-market firms with lean IT that want a behavioral layer and app visibility on top.
What email security does each Google Workspace edition include?
Google documents the edition for each protection in the “Supported editions for this feature” box on its Admin Help pages. Where a page shows no box, we record it as “no edition restriction shown”. This is the picture as of 18 October 2026.
| Protection | Business Starter | Business Standard | Business Plus | Enterprise |
|---|---|---|---|---|
| Default spam, phishing and malware filtering | Yes | Yes | Yes | Yes |
| Advanced phishing and malware settings (attachments, links, spoofing) | No restriction shown | No restriction shown | No restriction shown | No restriction shown |
| Enhanced pre-delivery message scanning | No restriction shown | No restriction shown | No restriction shown | No restriction shown |
| Gmail Security Sandbox (attachment detonation) | No | Yes | Yes | Standard and Plus |
| Security dashboard and security investigation tool | Not listed | Not listed | Not listed | Standard and Plus |
| DLP for Gmail | Not listed | Not listed | Not listed | Standard and Plus |
| Vault (retention and eDiscovery) | Not listed | Not listed | Yes | Yes |
| Data regions (US or Europe) | Not listed | Yes | Yes | Standard and Plus |
| Client-side encryption | Not listed | Not listed | Not listed | Enterprise Plus |
| Price (EUR per user per month) | 6.80 | 13.60 | 21.10 | Contact sales |
Prices are as Google’s pricing page displayed them to an EU visitor on 18 October 2026; Business plans are capped at 300 users. Frontline and Education editions have their own lists, and the Advanced Protection Program for high-risk users shows no edition restriction on its help page.
Gmail built-in protection vs Sentaro, feature by feature
We make Sentaro. Google rows follow Google Workspace Admin Help, as of 18 October 2026. “Not publicly documented” means we could not confirm it from Google’s documentation, not that Gmail lacks it.
| Capability | Google Workspace (Gmail) | Sentaro |
|---|---|---|
| Deployment and price | ||
| Where it runs | Native to Gmail, before delivery | API connection inside the tenant, behind native filtering |
| Setup | YesOn by default; advanced settings by admin | YesFour minutes over API, no MX change |
| Microsoft 365 | No | Yes |
| Price | Included in Workspace | $6 per protected account per month; first account free |
| Email threats | ||
| Spam, bulk and known malware | YesGoogle states it blocks more than 99.9% | PartialComplements native filtering, does not replace it |
| Attachment detonation | YesSecurity Sandbox, Business Standard and up | Not publicly documentedNot documented as sandboxing |
| Suspicious links | YesShortened-URL and linked-image scanning, click warnings | YesDestination analysis, not reputation alone |
| QR-code phishing | Not publicly documentedNot confirmed in Google’s documentation | YesQR decoded, destination and intent scored |
| Domain and name spoofing | YesSimilar-domain and employee-name spoofing checks | YesDisplay-name mismatch, lookalike domains at first contact |
| Payload-free BECFraud with no link or attachment, such as a request to change bank details. | PartialSpoofing and name-impersonation settings | YesIntent and relationship signals, a core design target |
| Vendor compromise and thread hijackingA real supplier mailbox taken over and used inside an existing thread. | Not publicly documentedNo dedicated feature found | YesReply-chain reuse, changed bank details |
| Internal mail | Not publicly documentedNot publicly documented | YesInbound and internal mail scored |
| Apps, identity and response | ||
| OAuth app and AI-tool inventoryWhich apps and AI tools users have connected, and what they can access. | YesAccessed apps list with user counts and OAuth scopes | YesEvery app and grant, scope-level risk per user |
| Consent phishingA lure that tricks a user into granting an app OAuth access. | Not publicly documentedNot publicly documented | YesLures blocked in mail flow, grants surfaced |
| Grant revocation | YesBlock an app; restricting a service revokes untrusted apps’ tokens | YesOne click, via the Workspace admin SDK |
| Search and remediate across the domain | YesSecurity investigation tool, Enterprise | YesSimilar messages in all mailboxes, one action |
| Outbound DLP | YesDLP for Gmail, Enterprise | NoNot in Sentaro’s published scope |
| Awareness training | NoNot part of Workspace | NoNot in Sentaro’s published scope |
Sentaro cells show live capabilities only (Message and App vectors); its roadmap is stated once, in the note below the table.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Is Google Workspace secure enough against phishing?
For volume attacks, mostly yes. Google states that Gmail’s AI-powered protections block more than 99.9% of spam, phishing and malware, and the advanced Safety settings add checks on encrypted and scripted attachments, shortened URLs, similar-domain names, employee-name spoofing and unauthenticated mail. Turn them on before you buy anything.
What gets through is a different kind of mail. A typical case: a real supplier account is compromised, and the attacker replies inside a genuine invoice thread with new bank details. The sender is authentic, the domain is not similar to anything, and there is no payload. Google’s documented BEC-related settings are spoofing and name-impersonation checks; we found no Google feature built specifically for vendor email compromise. Sentaro’s Message vector reads intent and relationship context instead, such as reply-chain reuse, injected replies and suppliers that suddenly change banking details.
Third-party and AI apps in Workspace
Workspace users connect meeting notetakers, AI assistants and other tools to their accounts with OAuth. Google’s Admin console lists accessed apps with their user counts and OAuth scopes, and lets admins trust, limit or block each app per organizational unit. Sentaro’s App vector adds a live inventory of every app, AI tool and OAuth grant within 15 minutes of connecting, scope-level risk per app and per user, blocking of consent phishing lures, and one-click revocation through the Workspace admin SDK. Legitimate tools are not blocked; only malicious apps and consent phishing attempts are blocked automatically.
Do you need more than Gmail’s built-in protection?
For most EU teams the answer is yes: keep Gmail as the baseline and add Sentaro behind it.
Choose Sentaro (on top of Gmail) if…
- Finance, payroll and supplier conversations are your biggest exposure.
- You are on Business Starter or Standard without Enterprise investigation tools, and IT is one or two people.
- You need to know which AI tools and apps hold OAuth access to Workspace data.
- You run Google Workspace and Microsoft 365 side by side.
- You are an EU firm under NIS2 or DORA that wants a vendor built for the controls regulated EU firms are asked to evidence.
Gmail alone may be enough if…
- You are on Business Standard or higher, so the Security Sandbox is available, and the advanced Safety settings are on.
- Your main risk is bulk phishing and malware, not payment fraud.
- Every change to bank details is verified by phone before payment, and few third-party apps are connected.
Where Sentaro wins on top of Gmail
- Payload-free fraud from real accounts: relationship and thread context, such as reply-chain reuse and changed bank details, rather than spoofing checks alone.
- QR-code lures: codes are decoded and their destinations evaluated like any URL, with the surrounding intent weighed into the verdict.
- App and AI-tool risk: a live inventory of every app and OAuth grant within 15 minutes, scope-level risk per user, and consent phishing blocked in mail flow.
- Lower editions: Business Starter and Standard tenants get domain-wide remediation of similar messages without needing Enterprise investigation tools.
- Mixed estates: the same engine covers Google Workspace and Microsoft 365, at $6 per protected account per month with every feature included. Prices in USD.
Where Gmail’s built-in security still does the job
- Cost and position: it is part of the Workspace subscription and filters before delivery. Sentaro runs behind it and does not replace it.
- Attachment detonation: the Gmail Security Sandbox detonates attachments in Business Standard and up. Sentaro does not document sandboxing.
- Account hardening: the Advanced Protection Program enforces security keys or passkeys for high-risk users today. Sentaro has no equivalent live today (see the roadmap note).
- Data controls: DLP for Gmail, client-side encryption and Vault exist in higher editions. Sentaro offers none of these.
Sentaro security and data handling
- Hosting
- Hosted in Sweden on Microsoft Azure. The DPA at /en/legal/dpa lists every subprocessor and its location.
- Engine
- Verdicts come from Vord, Sentaro’s proprietary engine.
- Access to mail
- Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service.
- Incident notice
- Within 24 hours of confirming a security incident, per the DPA.
- Regulation
- Built for the controls regulated EU firms are asked to evidence under NIS2 and DORA. No product makes you compliant on its own.
How to add Sentaro to Google Workspace
- 01
Turn on Gmail’s advanced Safety settings
In Admin console > Gmail > Safety, enable the attachment, link and spoofing protections. Keep the baseline as strong as your edition allows.
- 02
Connect Workspace over API
A Workspace admin connects Sentaro in about four minutes through the Google Workspace admin SDK. No MX change, no agents. Protection starts immediately.
- 03
Review history and apps
Within 15 minutes you see historical mail verdicts and the full app and OAuth-grant inventory, including AI tools users have already connected.
- 04
Set actions per group
Map detections to block, quarantine or an inline tag per user group, and revoke risky grants in one click.
What customers say
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
Frequently asked questions
Is Sentaro better than Google Workspace security?
Yes, as the layer to add on top: keep Gmail as the baseline and add Sentaro. Gmail handles spam, bulk phishing and known malware. Sentaro adds detection for payload-free BEC and vendor fraud inside real threads, QR-code lures, and a scored inventory of every OAuth app and AI tool, for $6 per protected account per month. Prices in USD. It connects in four minutes with no MX change.
What is the best protection to add to Gmail?
Sentaro. It connects to Google Workspace over API in about four minutes, runs behind Gmail’s filtering, and targets what gets through: invoice fraud in compromised supplier threads, QR lures and consent phishing. The App vector inventories every app, AI tool and OAuth grant. It is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month, first account free. Prices in USD.
How secure is Google Workspace email?
Very secure against bulk attacks. Gmail’s built-in filtering is a strong baseline: Google states it blocks more than 99.9% of spam, phishing and malware, and admins can add stricter attachment, link and spoofing checks. The remaining risk is targeted mail with no payload, such as invoice fraud inside a real supplier thread, and third-party apps with broad OAuth access.
Which Google Workspace editions include the Gmail Security Sandbox?
Google lists the Gmail Security Sandbox for Business Standard, Business Plus, Enterprise Standard, Enterprise Plus and Frontline Plus. It is not in Business Starter. The sandbox detonates attachments, including files inside zip and rar archives, and can delay delivery by up to three minutes.
Does Google Workspace protect against business email compromise?
Partly. Gmail’s advanced settings check for similar-domain spoofing, employee-name spoofing and unauthenticated mail. Those settings target impersonation; Google does not document a feature built specifically for vendor email compromise, where a real supplier account is used. That is what Sentaro’s relationship and thread-context signals are designed for.
Can Sentaro replace Gmail’s spam and malware filtering?
No. Sentaro is an ICES-category platform that runs behind native filtering and is designed to work with Google’s built-in protection rather than replace it. Gmail keeps handling spam, bulk and known malware; Sentaro adds behavioral detection and app visibility on top.
Does Sentaro need MX changes on Google Workspace?
No. Sentaro connects through the Google Workspace admin SDK in about four minutes, with no MX change and no agents. Protection starts immediately and historical visibility follows within 15 minutes. Sentaro is a Google CASA verified API integration.
How do I find the third-party apps connected to Google Workspace?
In the Admin console. Google’s Manage App Access page lists accessed apps with their user counts and requested OAuth scopes, and can export them as CSV. Sentaro’s App vector builds a live inventory of every app, AI tool and OAuth grant within 15 minutes of connecting, scores scope-level risk per user, and lets an admin revoke a risky grant in one click.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Google Workspace security overview (99.9% claim)
- Google Workspace Admin Help: advanced phishing and malware protection
- Google Workspace Admin Help: Gmail Security Sandbox and editions
- Google Workspace Admin Help: enhanced pre-delivery message scanning
- Google Workspace Admin Help: Advanced Protection Program
- Google Workspace Admin Help: data regions and editions
- Google Workspace Admin Help: security dashboard editions
- Google Workspace Admin Help: security investigation tool editions
- Google Workspace Admin Help: client-side encryption editions
- Google Workspace pricing (EUR, viewed from the EU, 18 Oct 2026)
- Google Workspace Admin Help: control which third-party apps access Workspace data
- Google Workspace Admin Help: DLP for Gmail editions