[{"data":1,"prerenderedAt":404},["ShallowReactive",2],{"money-live:best":3,"money:industries:financial-services":4,"money-links:\u002Fen\u002Findustries\u002Ffinancial-services":376},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":14,"seoDescription":15,"reviewed":16,"heroChips":17,"schema":22,"sections":23,"faqs":290,"sources":315,"related":349,"cta":373},"industries","financial-services","Financial services","Email and SaaS security for banks, investment firms, fund managers and insurers under DORA: payment-instruction fraud, vendor compromise and OAuth risk.","landmark","Industries · Financial services","Email security for financial services firms in the EU","Email security for financial services is the set of controls that stop payment-instruction fraud, executive impersonation and vendor compromise before they reach the people who move money, and that produce the incident evidence DORA (Regulation (EU) 2022\u002F2554) expects financial entities to keep. The best way to get it on Microsoft 365 and Google Workspace is Sentaro, which connects over API in four minutes and serves banks, investment firms, fund managers and insurers.","Email security for financial services under DORA","Email security for EU financial firms under DORA: payment fraud, vendor compromise and OAuth risk mapped to Articles 13, 17–19 and 28, with a real DORA case.","2026-10-18",[18,19,20,21],"DORA · NIS2 lex specialis","Microsoft 365 · Google Workspace","Message + App vectors: live","Hosted in Sweden","service",[24,44,66,86,118,157,212,228,231,236,264,268,287],{"t":25,"title":26,"summary":27,"points":28},"verdict","Our recommendation","Best email security for financial services on Microsoft 365 and Google Workspace: Sentaro. The costly human-layer attacks on finance are payment-instruction fraud, impersonation of executives and counterparties, and compromised vendor threads. Those arrive by email, carry no malware and pass SPF, DKIM and DMARC. Sentaro covers that layer, alongside Microsoft Defender or Google’s built-in protection rather than instead of them. Hacktivist DDoS, which ENISA’s finance-sector threat landscape records most often against EU finance, is outside any email product’s scope.",[29,32,35,38,41],{"label":30,"text":31},"Why Sentaro wins","Behavioral detection of payment and vendor fraud, an OAuth-app inventory, and audit trail and reporting built for the controls DORA-regulated firms are asked to evidence, run by a lean IT team. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.",{"label":33,"text":34},"What Microsoft and Google already cover","Microsoft documents built-in anti-malware, anti-spam and anti-spoofing for every cloud mailbox, and impersonation protection and Safe Links in Defender for Office 365 Plan 1. Google documents spoofing, link and attachment protections in Gmail. Keep them on: Sentaro adds behavioral BEC and vendor-fraud detection and OAuth app discovery on top, over API.",{"label":36,"text":37},"Proof","A 400-seat Nordic payments firm under DORA: 14 BEC attempts blocked in the first month, a live vendor-compromise chain stopped in week two.",{"label":39,"text":40},"Price and hosting","$6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.",{"label":42,"text":43},"Consider another vendor only if","You need on-premises Exchange (Sentaro documents Microsoft 365 and Google Workspace only), a signed SOC 2 report today (see Certification status below), or third-party detection benchmarks.",{"t":45,"title":46,"items":47},"facts","At a glance",[48,51,54,57,60,63],{"label":49,"value":50},"Built for","Credit institutions, investment firms, fund managers, insurers and other DORA financial entities on Microsoft 365 or Google Workspace",{"label":52,"value":53},"Threats covered today","Payment-instruction and invoice fraud, CEO fraud, vendor-compromise and thread-hijack, lookalike domains at first contact, QR-code phishing, consent phishing",{"label":55,"value":56},"Status","Message and App vectors are live. Roadmap items are listed once, in the roadmap note on this page.",{"label":58,"value":59},"Deployment","Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.",{"label":61,"value":62},"Pricing","$6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.",{"label":64,"value":65},"Hosting","Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.",{"t":67,"title":68,"blocks":69},"prose","What email threats hit financial firms in Europe?",[70,73,75,78,84],{"t":71,"text":72},"p","ENISA’s first finance-sector threat landscape analysed 488 publicly reported incidents in the European finance sector between January 2023 and June 2024. Credit institutions were the most frequently affected, in 46% of incidents. Social engineering, including phishing, smishing and vishing, was the prevalent cybercrime tactic, and ENISA notes an increase in business email compromise in that period, including an adversary-in-the-middle phishing and BEC campaign that started at a compromised trusted vendor and spread across several financial organizations.",{"t":71,"text":74},"The same report found that social-engineering attacks led to financial loss in 50% of cases and that fraud is likely under-reported, because it often appears as the secondary consequence of a phishing incident. In ENISA’s broader Threat Landscape 2025, phishing was the leading intrusion vector across all EU sectors, at about 60% of observed cases.",{"t":76,"text":77},"h3","Three patterns finance teams see",{"t":79,"items":80},"ul",[81,82,83],"Payment-instruction changes. A counterparty, fund administrator or supplier “updates” settlement or bank details inside a real thread. The sender may be the genuine, compromised mailbox, so authentication passes.","Executive and partner impersonation at deadlines. A request “from” the CEO, CFO or a managing partner to release a payment before quarter close or a deal signing, framed as confidential and urgent.","Client and investor impersonation. Instructions that appear to come from a known client or investor ask for a redemption, transfer or change of account, timed to look routine.",{"t":71,"text":85},"Be clear about what email security does not touch: ENISA’s 2025 report attributes 83.5% of recorded finance-sector incidents to hacktivist DDoS. That needs network and application controls. The email and SaaS layer is where fraud and initial access start.",{"t":67,"title":87,"blocks":88},"Who in a financial firm is targeted, and through which workflows?",[89,116],{"t":90,"rows":91},"table",[92,96,100,104,108,112],[93,94,95],"Role","Workflow that creates risk","What Sentaro checks (Message vector, live)",[97,98,99],"Finance and accounts payable","Supplier invoices and bank-detail changes","Suppliers that suddenly change banking details, injected replies, reply-chain reuse",[101,102,103],"Treasury and settlements","Payment and settlement instructions by email","Payment-redirect intent, urgency and secrecy, sender infrastructure age",[105,106,107],"Executives and partners","Approvals under deadline pressure","Display-name mismatches, lookalike domains at first contact, the urgent-confidential-payment pattern in any language",[109,110,111],"Client services and investor relations","Client instructions, onboarding documents, redemptions","Relationship history with the sender, link and attachment destinations",[113,114,115],"Everyone with a mailbox","Sign-in prompts, QR codes, “shared document” lures","QR decoding and destination analysis; consent-phishing lures blocked in mail flow (App vector)",{"t":71,"text":117},"Sentaro reads every inbound and internal message the way an analyst would, before interaction. Relationship baselines come from existing mailbox history, so a bank-detail change in a counterparty thread that never contained one stands out from day one rather than after a learning period.",{"t":67,"title":119,"blocks":120},"What does DORA require for email security?",[121,123,155],{"t":71,"text":122},"DORA, Regulation (EU) 2022\u002F2554, has applied since 17 January 2025 and is directly binding on credit institutions, investment firms, payment and e-money institutions, insurers, fund managers and other financial entities listed in Article 2. For those entities it acts as the sector-specific act under NIS2 Article 4, so DORA’s ICT risk and reporting rules apply instead of NIS2’s where they are at least equivalent. DORA does not name email, but email and the SaaS apps connected to it are ICT assets in scope of every pillar below.",{"t":90,"rows":124},[125,130,135,140,145,150],[126,127,128,129],"Requirement","What it means for email","How Sentaro supports it","Evidence produced",[131,132,133,134],"Art. 5(2): the management body bears ultimate responsibility for ICT risk","The board needs to know how phishing and payment fraud are being handled","Automatic verdicts with reasoning; alerts only when a decision is needed","Admin console, audit trail and reporting",[136,137,138,139],"Art. 13(6): compulsory ICT security awareness and resilience training for all staff and senior management","Training stays mandatory; it cannot be the only control","Verdicts labeled in the mailbox, so staff see why a message is suspicious where they read it","Labeled verdicts per message (Sentaro does not replace your training programme)",[141,142,143,144],"Art. 17: detect, manage and log ICT-related incidents","Phishing, BEC and consent phishing are incidents to detect and record","Message vector scores every inbound and internal message; similar messages remediated across all mailboxes in one action","Who was targeted, what was blocked or delivered, when, and how far it spread",[146,147,148,149],"Art. 19 and Delegated Reg. 2025\u002F301: initial notification within 4 hours of classifying a major incident (no later than 24 hours from awareness), intermediate report within 72 hours of the initial notification, final report within one month of the latest intermediate report","You cannot classify an email-borne incident you have not detected","Detection at delivery, with verdict reasoning","Facts for the initial notification: scope, recipients, timing",[151,152,153,154],"Art. 28(3): register of information on all ICT third-party contracts","Your email security vendor, and every OAuth app with mailbox access, is an ICT dependency","App vector: full app and OAuth-grant inventory with scope-level risk per user; one-click revocation","Live inventory of apps and grants; Sentaro’s own DPA, subprocessor list and evidence pack for your register",{"t":71,"text":156},"No product makes a firm DORA compliant, and you should distrust any that claims to. Sentaro provides the email-layer controls, continuous evidence and incident detection the framework requires; governance, testing, contracts and documentation remain yours. In Sweden, financial entities under Finansinspektionen’s supervision report major ICT-related incidents to Finansinspektionen. This page is general guidance, not legal advice.",{"t":158,"title":159,"intro":160,"columns":161,"own":164,"groups":165},"compare","Payment-instruction fraud, impersonation and vendor compromise: what Sentaro covers","Status as published by Sentaro on 18 October 2026. Identity and Behavioral are roadmap items, shown as such.",[162,163],"Sentaro","Vector",0,[166,197],{"label":167,"rows":168},"Live today",[169,176,181,186,192],{"label":170,"cells":171},"Bank-detail change in an existing counterparty or vendor thread",[172,175],{"mark":173,"text":174},"yes","Vendor-compromise and thread-hijack detection","Message",{"label":177,"cells":178},"Payload-free CEO or partner payment request",[179,175],{"mark":173,"text":180},"Intent analysis; a core design target",{"label":182,"cells":183},"Newly registered lookalike domain",[184,175],{"mark":173,"text":185},"Detected at first contact; finance-facing lookalikes blockable domain-wide",{"label":187,"cells":188},"Consent phishing and risky OAuth apps",[189,191],{"mark":173,"text":190},"Blocked before the grant lands; one-click revocation","App",{"label":193,"cells":194},"Unsanctioned AI tools connected to mail and files",[195,191],{"mark":173,"text":196},"Discovered and categorized",{"label":198,"rows":199},"Out of scope",[200,207],{"label":201,"cells":202},"Phone and voice fraud (vishing, deepfake calls)",[203,206],{"mark":204,"text":205},"no","Sentaro cannot inspect a phone call, and does not claim to","—",{"label":208,"cells":209},"DDoS against online banking",[210,206],{"mark":204,"text":211},"Network-layer control needed",{"t":213,"title":214,"items":215},"stats","European finance-sector incidents, in numbers",[216,220,224],{"n":217,"l":218,"source":219},"488","publicly reported incidents in the European finance sector analysed, January 2023 to June 2024; banks affected in 46%","ENISA Threat Landscape: Finance Sector, 2025",{"n":221,"l":222,"source":223},"60%","of observed intrusions in the EU started with phishing","ENISA Threat Landscape, 2025",{"n":225,"l":226,"source":227},"$3.05bn","reported lost to business email compromise in 2025","FBI IC3 Internet Crime Report, 2025",{"t":229,"title":230,"quote":3,"caseStudy":3},"proof","In production in Nordic finance",{"t":232,"tone":233,"title":234,"text":235},"callout","roadmap","Roadmap: Identity and Behavioral vectors, Q4 2026","Message and App are live; Identity and Behavioral reach general availability in Q4 2026, included at no added cost. For this sector that covers: leaked credentials of your staff in breach corpora and infostealer logs (Identity); alerts when lookalikes of your domain are registered (Identity); account takeover, forwarding-rule abuse, session revocation (Behavioral).",{"t":45,"id":237,"title":238,"intro":239,"items":240},"procurement","Sovereignty and procurement facts","What a DORA register of information, a vendor-risk questionnaire or a DPO will ask about Sentaro as an ICT third-party provider.",[241,243,246,249,252,255,258,261],{"label":64,"value":242},"Hosted in Sweden on Microsoft Azure. EU-sovereign by design.",{"label":244,"value":245},"Subprocessors","Listed in Annex 3 of the DPA, with locations in the EU, the US and globally, including a US AI provider used for limited threat-signal analysis with no training on customer data. Review the list at \u002Fen\u002Flegal\u002Fdpa.",{"label":247,"value":248},"Who reads mail","Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA sets out the narrow exceptions.",{"label":250,"value":251},"Incident notice to you","Without undue delay and in any event within 24 hours of confirming a security incident (DPA).",{"label":253,"value":254},"Retention","Raw harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely (DPA).",{"label":256,"value":257},"Exit","Return or deletion of customer data within 30 days of termination, with certification on request (DPA).",{"label":259,"value":260},"Audit","Customer audit through an independent third party, at most once per 12 months. Swedish law; SCCs for transfers.",{"label":262,"value":263},"Sovereign plan","Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer.",{"t":232,"tone":265,"title":266,"text":267},"info","Certification status","SOC 2 and ISO 27001 certification in progress; no target date is published, and Sentaro says it will announce them the day they are signed, not before. Evidence pack on request. Google CASA verified API integration. The DPA and subprocessor list are at \u002Fen\u002Flegal\u002Fdpa.",{"t":269,"title":270,"items":271},"steps","Deploying Sentaro in a regulated firm",[272,275,278,281,284],{"title":273,"text":274},"Run alongside what you have","Sentaro connects through the Microsoft 365 or Google Workspace APIs next to Defender, Google’s built-in protection or a gateway. Nothing in mail routing changes.",{"title":276,"text":277},"Connect the tenant","An admin grants API access in about four minutes. Protection starts immediately and historical visibility follows within 15 minutes.",{"title":279,"text":280},"Review the history","Use the historical scan and the OAuth-app inventory as a starting point for your ICT asset and third-party records.",{"title":282,"text":283},"Set policy per group","Map detections to actions per user group: block, quarantine or tag inline. Finance and treasury are the usual first groups.",{"title":285,"text":286},"Add Sentaro to your register","Request the evidence pack, DPA and subprocessor list from hello@sentaro.com for your DORA register and vendor-risk file.",{"t":232,"tone":265,"title":288,"text":289},"What Sentaro does not replace","Callback verification of payment changes, four-eyes approval, DORA-mandated training and your incident classification process all stay. Sentaro’s terms state plainly that it does not guarantee every threat is detected. It reduces how often your procedure is the only control between an attacker and a payment.",[291,294,297,300,303,306,309,312],{"q":292,"a":293},"What is the best email security for financial services?","Sentaro — it is our pick for EU banks, investment firms, fund managers and insurers on Microsoft 365 and Google Workspace. It detects payment-instruction fraud, executive impersonation and vendor compromise by behavior, inventories OAuth apps, and supplies the detection and evidence DORA expects. A 400-seat Nordic payments firm under DORA saw 14 BEC attempts blocked in its first month. It is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month (prices in USD).",{"q":295,"a":296},"Does DORA require email security?","DORA does not mention email by name. It requires financial entities to protect, detect, manage and report ICT-related incidents (Articles 9, 10 and 17 to 19), train all staff (Article 13(6)) and register ICT third-party arrangements (Article 28). Email is the main route for phishing and payment fraud, so in practice email-layer detection and evidence are part of meeting those articles. No product delivers DORA compliance on its own.",{"q":298,"a":299},"Is an email security vendor an ICT third-party service provider under DORA?","Generally yes: a vendor that processes your mail to deliver a security service provides an ICT service, so the contract belongs in your register of information under Article 28(3). For Sentaro, the DPA, subprocessor list, 24-hour incident notice, audit rights and 30-day exit terms are published, and an evidence pack is available on request. Confirm classification with your compliance function.",{"q":301,"a":302},"How fast must a major ICT-related incident be reported under DORA?","Under Delegated Regulation (EU) 2025\u002F301, the initial notification is due within four hours of classifying the incident as major and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of the initial notification, and a final report within one month of the latest intermediate report. In Sweden, reports go to Finansinspektionen.",{"q":304,"a":305},"Do NIS2 rules also apply to banks?","Banking and financial market infrastructures are listed in NIS2 Annex I, but NIS2 Article 4 lets sector-specific acts take precedence where they are at least equivalent. DORA is that act for financial entities, so DORA’s ICT risk and incident rules generally apply instead. Firms outside DORA’s scope may still be reached by NIS2 or national law.",{"q":307,"a":308},"Can email security stop payment-instruction fraud?","It can stop the email-borne part. Sentaro flags suppliers and counterparties that suddenly change banking details, injected replies in real threads and newly registered lookalike domains at first contact, with no payload needed. It does not replace callback verification and dual approval, which remain the control that always applies.",{"q":310,"a":311},"Where is Sentaro hosted, and who can read our mail?","Sentaro is hosted in Sweden on Microsoft Azure. Analysis is automated, and nobody at Sentaro reads your mail in the course of providing the service; the DPA sets out the narrow exceptions. Subprocessors, including some outside the EU, are listed in the DPA. The Sovereign plan adds dedicated EU tenancy and a custom DPA.",{"q":313,"a":314},"Is Sentaro SOC 2 or ISO 27001 certified?","Not yet. SOC 2 and ISO 27001 certification are in progress, and Sentaro says it will announce them the day they are signed. An evidence pack for DORA, NIS2 and SOC 2 diligence is available on request. Google CASA verified API integration is in place.",[316,319,322,325,328,331,334,337,340,343,346],{"label":317,"url":318},"Regulation (EU) 2022\u002F2554 (DORA), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj\u002Feng",{"label":320,"url":321},"Commission Delegated Regulation (EU) 2025\u002F301 (DORA incident reporting time limits), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg_del\u002F2025\u002F301\u002Foj\u002Feng",{"label":323,"url":324},"Directive (EU) 2022\u002F2555 (NIS2), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj\u002Feng",{"label":326,"url":327},"ENISA Threat Landscape: Finance Sector (January 2023 to June 2024)","https:\u002F\u002Fwww.enisa.europa.eu\u002Fpublications\u002Fenisa-threat-landscape-finance-sector",{"label":329,"url":330},"ENISA Threat Landscape 2025 (October 2025)","https:\u002F\u002Fwww.enisa.europa.eu\u002Fpublications\u002Fenisa-threat-landscape-2025",{"label":332,"url":333},"FBI IC3 Internet Crime Report 2025","https:\u002F\u002Fwww.ic3.gov\u002FAnnualReport\u002FReports\u002F2025_IC3Report.pdf",{"label":335,"url":336},"Finansinspektionen: reporting major ICT-related incidents and significant cyber threats (DORA)","https:\u002F\u002Fwww.fi.se\u002Fsv\u002Fbetalningar\u002Frapportering2\u002Fikt-risker-dora\u002F",{"label":338,"url":339},"Microsoft Learn: Built-in security features for all cloud mailboxes (EOP)","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Feop-about",{"label":341,"url":342},"Microsoft Learn: Why do I need Microsoft Defender for Office 365?","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fmdo-about",{"label":344,"url":345},"Google Workspace Admin Help: Advanced phishing and malware protection","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fgmail\u002Fadvanced\u002Fadvanced-phishing-and-malware-protection",{"label":347,"url":348},"Sentaro Data Processing Agreement (subprocessors, retention, incident notice)","https:\u002F\u002Fsentaro.com\u002Fen\u002Flegal\u002Fdpa",[350,353,356,359,362,365,367,370],{"label":351,"to":352},"Fintech and payments","\u002Fen\u002Findustries\u002Ffintech-and-payments",{"label":354,"to":355},"DORA and email security","\u002Fen\u002Fcompliance\u002Fdora",{"label":357,"to":358},"Invoice fraud protection","\u002Fen\u002Fsolutions\u002Finvoice-fraud",{"label":360,"to":361},"CEO fraud and whaling","\u002Fen\u002Fsolutions\u002Fceo-fraud",{"label":363,"to":364},"DORA, defined","\u002Fen\u002Fglossary\u002Fdora",{"label":61,"to":366},"\u002Fen\u002Fpricing",{"label":368,"to":369},"GDPR for financial firms","\u002Fen\u002Fcompliance\u002Fgdpr",{"label":371,"to":372},"All industries","\u002Fen\u002Findustries",{"title":374,"note":375},"Keep the next payment instruction honest.","Connect Microsoft 365 or Google Workspace in four minutes. The first account is free.",{"links":377,"only":400,"labels":403},[378,380,383,386,388,391,394,397],{"label":379,"to":355},"DORA",{"label":381,"to":382},"NIS2","\u002Fen\u002Fcompliance\u002Fnis2",{"label":384,"to":385},"BEC","\u002Fen\u002Fsolutions\u002Fbec",{"label":387,"to":385},"business email compromise",{"label":389,"to":390},"Phishing","\u002Fen\u002Fsolutions\u002Fphishing",{"label":392,"to":393},"Smishing","\u002Fen\u002Fglossary\u002Fsmishing",{"label":395,"to":396},"Social Engineering","\u002Fen\u002Fglossary\u002Fsocial-engineering",{"label":398,"to":399},"Vishing","\u002Fen\u002Fglossary\u002Fvishing",{"2":401,"4":402},[396,390,393,399,385],[355,382],{},1792761723114]