Integrated Cloud Email Security (ICES) is the category of email security that connects via API inside cloud email platforms like Microsoft 365 and Google Workspace, analyzing mail behaviorally after the platform''s native filtering, without rerouting mail flow. The term was popularized by industry analysts to distinguish this architecture from the traditional secure email gateway.
Key facts
- ICES deploys via API in minutes: no MX record changes, no mail rerouting, no appliances.
- Because it sits inside the platform, it sees internal mail, historical mail and OAuth events, which gateways never see.
- Detection is typically behavioral and AI-driven, aimed at the targeted attacks (spear phishing, BEC) that pass both native filtering and gateways.
ICES vs SEG
| ICES | Secure email gateway | |
|---|---|---|
| Deployment | API connection in minutes | MX record change; mail rerouted through the gateway |
| Visibility | Inbound, outbound, internal and historical mail, plus OAuth and login events | Inbound, sometimes outbound, mail at the perimeter only |
| Detection | Behavioral and AI-driven: relationship, intent, context | Signatures, reputation, sandboxing of payloads |
| Payload-free attacks | A core design target | Largely invisible |
| Remediation | Remove from mailboxes after delivery, across the tenant | Block or quarantine at the gateway; nothing once delivered |
| Native filtering | Runs alongside Microsoft and Google | Often replaces it, or scans the same mail twice |
Why the category emerged
Cloud platforms made the gateway''s original job partly redundant: Microsoft and Google now do solid bulk filtering natively. What remained unsolved was the targeted remainder: payload-free BEC, AI-written phishing, account takeover, and those require context a perimeter box cannot have: who normally mails whom, what normal looks like, which apps hold access. ICES is the architectural answer: put the intelligence where the context is.
What to evaluate in an ICES product
Detection approach (behavioral/AI-native or rules with AI labels), coverage beyond inbound mail (internal mail, OAuth/app layer, account takeover signals), remediation (automatic and retroactive across mailboxes), and evidence quality (can verdicts be audited). Sentaro is an ICES platform built AI-native, with the OAuth/app layer as a first-class citizen rather than an add-on.