Public sector email security: NIS2 and cybersäkerhetslagen

Our recommendation

Best email security for the public sector on Microsoft 365 and Google Workspace: Sentaro. Public administration is the most targeted sector in ENISA’s 2025 threat landscape, though most of that volume is hacktivist DDoS, which email security does not address. The email risks are fewer and more damaging: state-linked phishing against officials, ransomware that often begins with stolen credentials, and fraud against authorities whose suppliers are a matter of public record. Sentaro covers the email and SaaS layer, run by a small IT team.

Why Sentaro wins: Detection and evidence for NIS2 and cybersäkerhetslagen without rerouting mail. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
What Microsoft and Google already cover: Microsoft documents built-in anti-malware, anti-spam and anti-spoofing for every cloud mailbox, and impersonation protection and Safe Links in Defender for Office 365 Plan 1. Google documents spoofing, link and attachment protections in Gmail. Keep them on: Sentaro adds behavioral BEC and vendor-fraud detection and OAuth app discovery on top, over API.
Hosting and price: Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA. The Sovereign plan offers dedicated EU tenancy. Pro is $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
Check first: Your procurement and data-location requirements against the DPA, which lists subprocessors, including some outside the EU.
Be aware: Sentaro has no named public-sector customer or case study published yet.

At a glance

Built for: Government agencies, regions, municipalities, municipal associations and publicly owned companies on Microsoft 365 or Google Workspace
Threats covered today: Credential phishing, supplier and invoice fraud, payroll diversion, executive and politician impersonation, consent phishing, shadow AI
Status: Message and App vectors are live. Roadmap items are listed once, in the roadmap note on this page.
Deployment: Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
Pricing: $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
Hosting: Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.

What threats does EU public administration face by email?

ENISA’s Threat Landscape 2025, covering July 2024 to June 2025, found public administration to be the most targeted sector at 38.2% of incidents with an identified sector. ENISA attributes the increase mainly to hacktivist-led DDoS. Under that volume sit the threats that reach inboxes: public administration was the most targeted sector for state-nexus cyberespionage, with 77 incidents, including campaigns against ministries, diplomatic entities and municipal administrations. It also accounted for 17% of all recorded data breaches, and ransomware was particularly prevalent against municipalities.

Across all sectors, ENISA found phishing to be the leading intrusion vector, at about 60% of observed cases. For an authority, that matters because its addresses are public by design: citizens, companies and journalists are expected to email case handlers and registries, so an unknown sender with an attachment is normal traffic.

Who is targeted, and through which workflows

Role	Workflow that creates risk	Typical lure (illustrative)
Case handlers and registry staff	Incoming applications, complaints and documents from the public	An “appeal” or “supplementary document” behind a sign-in page
Finance and accounts payable	Supplier invoices; supplier relationships are often visible in procurement records	A contracted supplier announces new bank details before a large invoice
HR and payroll	Salary changes for thousands of employees	An employee “asks” to update their salary account
Officials and elected representatives	Contact with ministries, other authorities and foreign counterparts	A meeting invitation or a document from a spoofed counterpart
IT and service desk	Admin consent for apps and integrations	An app requesting broad access to mail and files

Does NIS2 apply to municipalities and government agencies?

NIS2 Annex I lists public administration entities of central government, and of regional level as defined by each member state. Central-government entities are essential entities regardless of size; regional entities are covered where a risk-based assessment finds their services critical. Member states may extend the directive to local government (Article 2(5)). Entities working in national security, public security, defence or law enforcement are excluded (Article 2(7)).

Sweden went further. Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026, applies to regions, municipalities and municipal associations, and to the state agencies within its scope (chapter 1, sections 3 and 8). Six county administrative boards supervise municipalities and regions; Post- och telestyrelsen supervises the county administrative boards. Significant incidents are reported to the national CSIRT unit, which has been Försvarets radioanstalt (FRA) since 1 July 2026. The law requires management to undergo training on security measures, and penalties for a public operator can reach SEK 10 million.

Requirement	What it means for email	How Sentaro supports it	Evidence produced
Security measures (NIS2 Art. 21; cybersäkerhetslagen ch. 2)	Phishing, supplier fraud and risky app grants are risks to manage, not only filter	Message vector scores every inbound and internal message; App vector inventories every app and OAuth grant	Verdicts with reasoning; app and grant inventory per user
Supply chain security (NIS2 Art. 21(2)(d))	Suppliers’ mailboxes and connected apps are part of your exposure	Vendor-compromise and thread-hijack detection; consent phishing blocked before the grant lands	Live list of third-party apps with access to authority data
Incident reporting: early warning within 24 hours, notification within 72 hours, final report within one month of the notification	You need to know quickly who received what and whether anyone acted on it	Detection at delivery; similar messages remediated across all mailboxes in one action	Who was targeted, what was blocked or delivered, when, and the spread
GDPR Art. 33: personal data breach notified to IMY within 72 hours of awareness	A compromised case handler’s mailbox may hold citizens’ personal data	Earlier detection of phishing and of internal mail from a compromised account	Facts for the breach assessment

No product makes an authority compliant with NIS2 or cybersäkerhetslagen; governance, risk analysis and documentation stay with the organization. Security-classified information is governed by separate rules and is outside the scope of this page. This is general guidance, not legal advice.

Espionage phishing, supplier fraud and public inboxes: what Sentaro covers

Status as published by Sentaro on 18 October 2026.

Capability	Sentaro	Vector
Live today
Targeted credential phishing against officials	YesBehavioral detection for targeted and AI-written phishing	Message
Supplier bank-detail change before an invoice is paid	YesVendor-compromise detection	Message
Lookalike domain of another authority or supplier	YesAt first contact	Message
Apps and AI tools connected to the tenant	YesInventory, scope-level risk, one-click revocation	App
Outside Sentaro
DDoS against public websites and e-services	NoNetwork-layer control needed	—
On-premises mail servers	Not publicly documentedNot documented; Microsoft 365 and Google Workspace only	—

Yes
Partial
No
On roadmap
Paid add-on
Not publicly documented

Try it on your own tenant. API connection in about four minutes, alongside what you run today. $6 per account / month.Start free Speak to sales →

EU public administration in ENISA’s 2025 data

38.2%of EU incidents with an identified sector hit public administration, mostly hacktivist DDoSENISA Threat Landscape, 2025

77state-nexus cyberespionage incidents against EU public administration, the most of any sectorENISA Threat Landscape, 2025

60%of observed intrusions in the EU started with phishingENISA Threat Landscape, 2025

Sovereignty and procurement facts

The facts a procurement officer, a data protection officer or an information security coordinator will check before signing.

Hosting: Hosted in Sweden on Microsoft Azure. EU-sovereign by design.
Subprocessors: Listed in Annex 3 of the DPA, with locations in the EU, the US and globally, including a US AI provider used for limited threat-signal analysis with no training on customer data. Review the list at /en/legal/dpa.
Who reads mail: Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA sets out the narrow exceptions.
Incident notice to you: Without undue delay and in any event within 24 hours of confirming a security incident (DPA).
Retention: Raw harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely (DPA).
Exit: Return or deletion of customer data within 30 days of termination, with certification on request (DPA).
Audit: Customer audit through an independent third party, at most once per 12 months. Swedish law; SCCs for transfers.
Sovereign plan: Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer.

Frequently asked questions

What is the best email security for the public sector?

Sentaro — it is our pick for EU authorities, regions and municipalities on Microsoft 365 and Google Workspace. It detects phishing, supplier fraud and targeted lures behaviorally, supplies the incident facts NIS2 and cybersäkerhetslagen reporting depends on, and connects over API in four minutes without rerouting mail. It is hosted in Sweden on Microsoft Azure; check the DPA subprocessor list against your requirements. The Sovereign plan offers dedicated EU tenancy.

Are Swedish municipalities covered by cybersäkerhetslagen?

Yes. Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026, applies to regions, municipalities and municipal associations (chapter 1, section 3). Under the cybersäkerhetsförordning, six county administrative boards supervise them by geographic area. Significant incidents are reported to the CSIRT unit, which is Försvarets radioanstalt from 1 July 2026.

Does NIS2 cover local government?

Not automatically. NIS2 covers public administration entities of central government and, after a risk-based assessment, of regional level. Article 2(5) lets member states extend it to local government, which Sweden did. Check your own member state’s transposition law.

What are the penalties for public bodies under cybersäkerhetslagen?

The supervisory authority can impose a sanction fee of at least SEK 5,000 and, for a public operator, up to SEK 10 million. For private essential entities the maximum is the higher of 2% of global turnover or the SEK equivalent of EUR 10 million, and for important entities the higher of 1.4% or EUR 7 million (4 kap. 10 §). NIS2 lets each member state decide whether and how far fines apply to public administration entities.

Where does Sentaro process our data?

Sentaro is hosted in Sweden on Microsoft Azure, with its primary database in Frankfurt. The DPA lists all subprocessors and their locations, including some outside the EU, and transfers are covered by standard contractual clauses with Swedish law. The Sovereign plan adds dedicated EU tenancy and a custom DPA with audit support.

Can Sentaro help with the 24-hour early warning?

It supplies the facts. When a phishing or fraud email is detected, Sentaro shows who received it, whether it was blocked or delivered, when, and whether similar messages reached other mailboxes. Deciding whether an incident is significant and filing the early warning remain your responsibility.

Does Sentaro replace Microsoft Defender?

No. Microsoft Defender and Google’s built-in protection are a good baseline for bulk attacks, and Sentaro is designed to run with them. It adds behavioral detection for targeted, novel and payload-free attacks, connected over API with no change to mail routing.

Email security for the public sector