Sentaro vs Hornetsecurity: Microsoft 365 suite or API detection layer

Proofpoint announced a definitive agreement to acquire Hornetsecurity on 15 May 2025 and completed it on 8 December 2025, for $1.8B in total consideration. Proofpoint states that Hornetsecurity brings nearly $200M in annual recurring revenue and more than 125,000 customers served through more than 12,000 MSPs and channel partners in over 120 countries. Hornetsecurity continues as a dedicated MSP and SMB business unit led by its founder, Daniel Hofmann.

For a buyer, the practical step is contractual. Hornetsecurity is now part of a US-headquartered group owned by Thoma Bravo, so procurement teams that chose it partly as a German vendor should check which entity signs the contract and DPA, and review the current subprocessor list. Proofpoint also sells Proofpoint Essentials to the same SMB and MSP market; ask your partner how the two lines are positioned.

The acquisition says nothing about product quality. It does mean "European vendor" is now a question of hosting and contract terms rather than ownership.

Hornetsecurity 365 Total Protection is built as a suite. Plan 1 covers spam and malware filtering plus automated email encryption. Plan 2 adds AI-based advanced threat protection and archiving. Plan 3 adds Microsoft 365 backup of mailboxes, Teams, OneDrive, SharePoint and Entra ID. Plan 4 adds security awareness training, DMARC management, permission management and Teams protection. You pick a plan and get everything below it.

Sentaro is built as a detection and response layer. It connects through the Microsoft 365 and Google Workspace APIs and reads every inbound and internal message for intent, sender identity, relationship context, links, attachments and QR codes. Malicious messages are removed or quarantined automatically, and similar messages across all mailboxes can be remediated in one action. The App vector inventories every app, AI tool and OAuth grant in the tenant and revokes risky grants through the admin SDKs. Sentaro does not archive, back up or encrypt mail.

Both companies are European in origin. Hornetsecurity is based in Hanover, Germany, and states that it runs 12 regional data centers independent of Microsoft’s infrastructure. Sentaro AB was founded in 2025 in Stockholm and is hosted in Sweden on Microsoft Azure. Its subprocessors, including database hosting in Frankfurt and a limited third-party AI subprocessor, are listed in the DPA at /en/legal/dpa.

For NIS2, Cybersäkerhetslagen and DORA, neither product makes you compliant. What matters is evidence: who received what, when it was detected, what was done. Sentaro is built for the controls regulated EU firms are asked to evidence and provides the email-layer controls, continuous evidence and incident detection those frameworks require. Hornetsecurity’s archiving and backup help with retention and recovery obligations, which Sentaro does not cover.

Our recommendation for Nordic and DACH firms on Microsoft 365 or Google Workspace is Sentaro: keep Microsoft Defender or Gmail for bulk mail, add Sentaro for targeted fraud and OAuth app risk, and handle archiving and backup in a dedicated tool.

• Your gap is payload-free BEC, vendor-invoice fraud or QR lures: Sentaro’s Message vector is built for these, including vendor-compromise and thread-hijack detection.
• You want shadow IT and OAuth control: every app, AI tool and OAuth grant, with one-click revocation, included in every plan.
• You run Google Workspace, or both Google Workspace and Microsoft 365.
• You want a published price ($6 per protected account per month; prices in USD) and a four-minute API connection.
• You want an independent vendor hosted in Sweden on Microsoft Azure, with subprocessors listed in the DPA.

We make Sentaro, so weigh this section accordingly: every point above comes from Sentaro’s published product information, and its limits are listed on this page too.

• You want filtering, encryption, archiving, Microsoft 365 backup, DMARC management and awareness training in one plan and one contract.
• You need MX-based or hybrid filtering in front of Microsoft 365.
• You buy through an MSP that already standardizes on Hornetsecurity; its channel spans more than 12,000 partners.