Critical infrastructure email security under NIS2

Our recommendation

Best email security for critical infrastructure on Microsoft 365 and Google Workspace: Sentaro. Operational technology is where the consequences land, but most intrusions start on the IT side: ENISA’s Threat Landscape 2025 names phishing as the leading intrusion vector across EU sectors. Engineers, procurement and finance staff deal with many suppliers and approve payments for parts and services. Sentaro protects that layer. It is not an OT security product and does not monitor industrial networks.

Why Sentaro wins: Detection and incident facts (who, what, when, scope) for NIS2 essential and important entities, without a gateway project. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
What Microsoft and Google already cover: Microsoft documents built-in anti-malware, anti-spam and anti-spoofing for every cloud mailbox, and impersonation protection and Safe Links in Defender for Office 365 Plan 1. Google documents spoofing, link and attachment protections in Gmail. Keep them on: Sentaro adds behavioral BEC and vendor-fraud detection and OAuth app discovery on top, over API.
Price and hosting: $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.
Combine with: OT network monitoring, segmentation between IT and OT, endpoint protection and backups. Email security covers one entry point, not the plant.
Be aware: Sentaro has no named critical-infrastructure customer or case study published yet.

At a glance

Built for: Energy, district heating, drinking water, waste water, transport, logistics and manufacturing operators on Microsoft 365 or Google Workspace
Threats covered today: Credential phishing, QR-code lures, supplier and contractor bank-detail fraud, executive impersonation, consent phishing, shadow AI
Status: Message and App vectors are live. Roadmap items are listed once, in the roadmap note on this page.
Deployment: Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
Pricing: $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
Hosting: Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.

Which critical infrastructure sectors does NIS2 cover?

NIS2 Annex I lists the sectors of high criticality: energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Annex II adds other critical sectors, among them postal and courier services, waste management, chemicals, food production and distribution, and manufacturing of medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment.

Large entities in Annex I sectors are essential entities; most other covered entities are important entities. Entities identified as critical entities under the Critical Entities Resilience Directive, (EU) 2022/2557, are covered regardless of their size. Maximum fines for breaching the security or reporting duties are at least EUR 10 million or 2% of worldwide turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher.

Sector in Sweden	Supervisory authority under cybersäkerhetslagen
Energy	Statens energimyndighet
Transport; manufacture of motor vehicles and other transport equipment	Transportstyrelsen
Drinking water, waste water, food	Livsmedelsverket
Digital infrastructure, ICT service management, postal and courier, space	Post- och telestyrelsen
Waste management, chemicals, manufacture of electronics, electrical equipment and machinery	Six county administrative boards

Cybersäkerhetslagen (SFS 2025:1506) has been in force since 15 January 2026. Significant incidents are reported to the national CSIRT unit, which has been Försvarets radioanstalt (FRA) since 1 July 2026, with an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month of the notification.

Where email fits in NIS2 Article 21 for an operator

Requirement	What it means for email	How Sentaro supports it	Evidence produced
Art. 21(2)(b): incident handling	Phishing and fraud emails are incidents to detect, contain and record	Every inbound and internal message scored before interaction; similar messages remediated across all mailboxes in one action	Who was targeted, what was blocked or delivered, when, and the spread
Art. 21(2)(d): supply chain security	Suppliers, integrators and contractors email your staff daily; their compromise becomes yours	Vendor-compromise and thread-hijack detection; newly registered lookalike supplier domains caught at first contact	Flagged supplier threads with verdict reasoning
Art. 21(2)(i): access control and asset management	Apps with OAuth access to mail and files are assets to know about	App vector inventory of every app, AI tool and OAuth grant, with one-click revocation	Live app and grant inventory per user
Art. 21(2)(j): multi-factor or continuous authentication	MFA stays essential; adversary-in-the-middle phishing aims to get around it	Detection of the phishing message itself; session anomaly scoring and forced re-authentication are Q4 2026 (Behavioral)	Verdicts today; session evidence from Q4 2026
Art. 23: 24-hour early warning, 72-hour notification, one-month final report	You need scope and timing of an email-borne incident within hours	Detection at delivery, with reasoning in the admin console	Facts for the early warning and the notification

Sentaro provides the email-layer controls, continuous evidence and incident detection NIS2 requires; it does not make an operator compliant, and governance, risk analysis, OT security and documentation stay with you. This is general guidance, not legal advice.

What threats reach operators by email?

In ENISA’s Threat Landscape 2025, covering July 2024 to June 2025, essential entities accounted for 53.7% of recorded incidents, and phishing was the leading intrusion vector across sectors at about 60% of observed cases. Transport was the second most targeted sector at 7.5% of incidents; most were hacktivist DDoS, while ransomware made up 83.9% of the cybercrime incidents against transport. In manufacturing, cybercrime was the primary threat, at 59.3% of activity, with ransomware disrupting business continuity at several EU manufacturers.

Who is targeted at an operator

Role	Workflow that creates risk	Typical lure (illustrative)
Engineers and operations staff	Contact with OEMs, integrators and remote-support providers	A “firmware update” or “service report” link from a lookalike vendor domain
Procurement and accounts payable	Spare parts, contractors and framework-agreement suppliers	A known contractor’s real mailbox announces new bank details
Project and tender teams	Tender documents and drawings from many parties	A “tender clarification” document behind a sign-in page
Executives	Approvals and contact with authorities	A message “from” the CEO or a regulator requesting urgent action

Office-IT entry points to energy, water and transport: what Sentaro covers

Status as published by Sentaro on 18 October 2026.

Capability	Sentaro	Vector
Live today
Credential phishing and QR-code lures	YesDestination analysis, not reputation lookups alone	Message
Contractor or supplier bank-detail changes	YesVendor-compromise and thread-hijack detection	Message
Lookalike vendor and OEM domains	YesAt first contact	Message
Apps with access to mail and engineering files	YesInventory, scope-level risk, one-click revocation	App
Outside Sentaro
OT and industrial control system networks	NoUse OT-specific monitoring and segmentation	—
DDoS against public services	NoNetwork-layer control needed	—

Yes
Partial
No
On roadmap
Paid add-on
Not publicly documented

Try it on your own tenant. API connection in about four minutes, alongside what you run today. $6 per account / month.Start free Speak to sales →

Phishing, ransomware and NIS2 entities in ENISA’s 2025 data

60%of observed intrusions in the EU started with phishingENISA Threat Landscape, 2025

53.7%of recorded EU incidents hit NIS2 essential entitiesENISA Threat Landscape, 2025

83.9%of cybercrime incidents against EU transport were ransomwareENISA Threat Landscape, 2025

Sovereignty and procurement facts

What an information security manager, a supervisory inspection or a group procurement function will ask about Sentaro.

Hosting: Hosted in Sweden on Microsoft Azure. EU-sovereign by design.
Subprocessors: Listed in Annex 3 of the DPA, with locations in the EU, the US and globally, including a US AI provider used for limited threat-signal analysis with no training on customer data. Review the list at /en/legal/dpa.
Who reads mail: Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA sets out the narrow exceptions.
Incident notice to you: Without undue delay and in any event within 24 hours of confirming a security incident (DPA).
Retention: Raw harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely (DPA).
Exit: Return or deletion of customer data within 30 days of termination, with certification on request (DPA).
Audit: Customer audit through an independent third party, at most once per 12 months. Swedish law; SCCs for transfers.
Sovereign plan: Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer.

Frequently asked questions

What is the best email security for critical infrastructure?

Sentaro — it is our pick for energy, water, transport and manufacturing operators whose office IT runs on Microsoft 365 or Google Workspace. It stops phishing, credential lures and supplier fraud behaviorally and supplies the who/what/when/scope NIS2’s 24-hour early warning depends on, connected over API in four minutes. It is hosted in Sweden on Microsoft Azure. It is not an OT security product, so combine it with OT monitoring and segmentation.

Is my company an essential or important entity under NIS2?

It depends on sector and size. Large entities in NIS2 Annex I sectors, such as energy, transport, drinking water and waste water, are generally essential; medium-sized ones and Annex II sectors, such as manufacturing and chemicals, are generally important. Critical entities under Directive (EU) 2022/2557 are covered regardless of size. National law, such as Sweden’s cybersäkerhetslagen, sets the final rules.

Who do Swedish operators report significant incidents to?

Under the cybersäkerhetsförordning, incident reports go to the national CSIRT unit, which is Försvarets radioanstalt from 1 July 2026 (SFS 2026:623). The early warning is due within 24 hours of becoming aware of a significant incident, the incident notification within 72 hours and the final report within one month of the notification. Your sector supervisor, such as Energimyndigheten, oversees compliance.

Does email security protect OT systems?

Not directly. Sentaro protects email, Slack and Teams messages and the apps connected to Microsoft 365 or Google Workspace. It reduces one of the main ways attackers reach a corporate network, but OT systems need their own monitoring, segmentation and access controls. Treat email security as one Article 21 measure among several.

Can Sentaro detect adversary-in-the-middle phishing that bypasses MFA?

Sentaro’s Message vector evaluates the phishing message itself, including links, QR codes and sender infrastructure, before anyone clicks. Detection of the resulting session, such as anomalous sign-ins, MFA fatigue and impossible travel, with forced re-authentication and session revocation, is part of the Behavioral vector, scheduled for Q4 2026.

Where is Sentaro hosted?

Sentaro is hosted in Sweden on Microsoft Azure. The DPA lists every subprocessor and its location, including some outside the EU. Operators with strict data-location requirements can ask about the Sovereign plan, which adds dedicated EU tenancy, a custom DPA with audit support, SIEM export and API access.

How quickly can Sentaro be deployed across several sites?

Sentaro connects at tenant level, not per site. An admin connects Microsoft 365 or Google Workspace over API in about four minutes, with no MX changes and no agents. Protection starts immediately and historical visibility follows within 15 minutes, for every protected account wherever its holder works.

Email security for critical infrastructure operators