Best email security for Google Workspace: Sentaro, alongside Gmail. Gmail filters bulk threats at very large scale, and it costs nothing extra. Before you buy anything, turn on the advanced phishing and malware settings in the Admin console. In Google’s documentation we found no behavioral model for business email compromise and vendor fraud, no awareness training and no DMARC report management. Sentaro covers the first of those, plus OAuth app and shadow-AI visibility, on top of Gmail.
- Why Sentaro wins
- API, no MX change, four-minute setup; detection aimed at payload-free BEC and vendor compromise; the App vector covers OAuth grants and shadow AI in the same platform; $6 per protected account per month with every feature included (prices in USD); hosted in Sweden on Microsoft Azure.
- Choose Sentaro if
- finance, HR or executives get targeted, you work with suppliers who invoice by email, or employees connect AI tools and third-party apps to their Google accounts.
- Consider Gmail alone only if
- you have turned on every Safety setting, run Business Standard or higher for the sandbox, and your main risk is malware rather than payment fraud.
- Do not expect Sentaro to
- replace Gmail’s spam filter, Vault, DLP or awareness training. It is a detection layer, not a suite.
Sentaro for Google Workspace at a glance
- What it is
- API-based email security (ICES category) for Google Workspace, also Microsoft 365
- Deployment
- Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes
- Works with
- Gmail’s built-in filtering and Admin console Safety settings, running in parallel
- Live today
- Message vector (phishing, BEC, QR codes, vendor compromise) and App vector (OAuth grants, shadow IT, consent phishing)
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
- Sovereign plan
- Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer
What Gmail security includes on each Google Workspace edition
Google Workspace protection varies by edition. The table below lists what Google’s own Admin Help pages say about each protection, as of 18 October 2026. Where a help page shows no “supported editions” box, we say so rather than guess.
| Protection | What Google documents | Editions |
|---|---|---|
| Default spam, phishing and malware filtering | Google says Gmail blocks more than 99.9% of spam, phishing and malware | All |
| Advanced phishing and malware protection | Attachment, link and spoofing checks with warning banner, spam or quarantine actions | No edition restriction shown |
| Enhanced pre-delivery message scanning | Delays suspicious mail slightly to run more checks | No edition restriction shown |
| Gmail Security Sandbox | Detonates attachments, including inside zip and rar archives; can delay delivery up to 3 minutes | Business Standard and Plus; Enterprise Standard and Plus; Frontline Plus. Not Business Starter |
| Advanced Protection Program | Security keys or passkeys, restricted third-party access, deep Gmail scans | No edition restriction shown |
| Security investigation tool | Search and remediate across the domain | Enterprise Standard and Plus; Frontline Standard and Plus; Education Standard and Plus; Enterprise Essentials Plus |
| DLP for Gmail | Data protection rules for outbound mail | Enterprise Standard and Plus; Frontline Standard and Plus; Education |
| Data regions | Choose US or Europe for covered data at rest | Business Standard and Plus; Enterprise Standard and Plus; Frontline; Education Standard and Plus |
In Google’s documentation we found no native security awareness training, no DMARC report management and no backup product (Vault is retention and eDiscovery). Its documented impersonation protections are spoofing and employee-name checks; we found no Google feature aimed specifically at vendor email compromise. How Gmail handles QR-code phishing specifically is not documented on the pages we checked.
Google Workspace phishing protection: settings to turn on first
All of these are in the Admin console under Gmail, Safety. They cost nothing and are worth doing whether or not you add Sentaro.
- 01
Attachments
Protect against encrypted attachments and attachments with scripts from untrusted senders, and against anomalous attachment types.
- 02
Links and external images
Identify links behind shortened URLs, scan linked images, and show a warning on any click to an untrusted domain.
- 03
Spoofing and authentication
Turn on protection against similar-domain-name spoofing, employee-name spoofing, inbound mail spoofing your own domain, and any unauthenticated mail. Apply it to Groups as well.
- 04
Choose the action
The default is a warning banner. For spoofing of your own domain and employee names, consider quarantine instead, so the message never reaches the user.
- 05
Pre-delivery scanning and sandbox
Keep enhanced pre-delivery scanning on. On Business Standard or higher, enable the Security Sandbox for attachments.
Gmail built-in protection vs Gmail plus Sentaro
Google entries come from Google Workspace Admin Help pages. “Not publicly documented” means we did not find it, not that it is missing.
| Capability | Gmail built-in (by edition) | Sentaro |
|---|---|---|
| Filtering and attachments | ||
| Spam, bulk and malware | YesAll editions | PartialRuns alongside Gmail, not instead of it |
| Attachment sandbox | PartialBusiness Standard and up | PartialAttachments evaluated; detonation not in Sentaro’s published scope |
| Link checks | YesShortened URLs, linked images, untrusted-domain warnings | YesDestination analysis, not reputation lookups alone |
| QR-code phishing | Not publicly documentedNot publicly documented | YesDecoded, destination and intent analyzed |
| Impersonation and fraud | ||
| Domain and employee-name spoofing | YesAdmin Safety settings | YesDisplay-name mismatches, lookalike domains at first contact |
| Payload-free BEC | PartialRule-style spoofing and name checks | YesIntent: payment redirects, secrecy, artificial deadlines |
| Vendor compromise in real threads | Not publicly documentedNo dedicated feature found | YesVendor-compromise and thread-hijack detection |
| Internal and historical mail | PartialInvestigation tool on Enterprise editions | YesEvaluates internal mail; history within 15 minutes |
| Apps and identity | ||
| OAuth app inventory and risk | PartialAdmin API access controls | YesEvery app, AI tool and grant, scope-level risk per user |
| Consent phishing | Not publicly documentedNot publicly documented as a feature | YesBlocked in mail flow; grants revocable in one click |
| Strong authentication for high-risk users | YesAdvanced Protection Program | NoNot in Sentaro’s scope; use APP |
| Suite and commercial | ||
| DLP, Vault, client-side encryption | YesEdition-dependent | NoNot in Sentaro’s published scope |
| Awareness training, DMARC reporting | No | NoNot in Sentaro’s published scope |
| Price | Included in your Workspace plan | $6 per account per month or $68 per year; first account free |
| Hosting | YesUS or Europe data regions, Business Standard and up | YesHosted in Sweden on Microsoft Azure |
Sources: Google Workspace Admin Help and workspace.google.com, accessed 18 October 2026.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How secure is Google Workspace against phishing?
Against volume, very. Google filters at a scale few vendors match, and its published claim is that Gmail blocks more than 99.9% of spam, phishing and malware. Against a single, well-researched message, the math changes. A business email compromise attempt carries no malware and often no link. It is a believable request from what looks like the CEO, or a real supplier whose mailbox has been taken over, inside a thread that has existed for months. Authentication passes. There is nothing for a payload scanner to find.
Sentaro’s Message vector reads what the message is trying to make someone do. It weighs intent and language (payment redirects, credential prompts, requests for secrecy and artificial deadlines), sender identity and infrastructure (display-name mismatches, newly registered and lookalike domains, SPF, DKIM and DMARC posture), and relationship and thread context (reply-chain reuse, injected replies, suppliers that suddenly change banking details). It uses existing mailbox history as its baseline, so it does not need a long learning period.
The OAuth problem Gmail settings do not solve
In Google Workspace, “Sign in with Google” makes it easy for an employee to grant a third-party app access to their mail, calendar or Drive. Consent phishing exploits exactly that: no password is stolen, the user simply approves access. Sentaro’s App vector builds a full inventory of apps, AI tools and OAuth grants across the domain, scores scope-level risk per app and per user, blocks consent-phishing lures in mail flow, and revokes risky grants via the Google Workspace admin SDK, in one click.
How does Sentaro connect to Google Workspace?
Through API-level integration via the Google Workspace admin SDK. A Workspace admin connects the domain, protection starts immediately, and historical visibility follows within 15 minutes. There are no MX-record changes, no mail rerouting, no endpoint agents and no rules to maintain. Gmail stays your first filter.
Sentaro’s integration carries Google’s Cloud Application Security Assessment: Google CASA verified API integration. The exact OAuth scopes Sentaro requests are not yet in its public documentation, which is still being written. Ask for the scope list along with the DPA before you approve the app in the Admin console.
| What Sentaro does | What Sentaro documents | Exact Google Workspace scope |
|---|---|---|
| Read inbound, internal and historical mail for verdicts | API-level integration via the Google Workspace admin SDK; historical visibility within 15 minutes | Shared on request before you connect |
| Label, quarantine or remove messages | Block, quarantine or tag inline per user group; similar messages remediated in one action | Shared on request before you connect |
| Inventory apps and OAuth grants | Full app and OAuth-grant inventory with scope-level risk per app and per user | Shared on request before you connect |
| Revoke risky OAuth grants | Risky grants revoked via the Google Workspace admin SDK, one click | Shared on request before you connect |
| Protect the connection itself | DPA: logical tenant isolation and scoped tokens for Google Workspace APIs; TLS 1.2+ in transit, AES-256 at rest | Not applicable |
Users see verdicts where they read mail: tagged messages are labeled in the mailbox, and malicious ones are removed or quarantined automatically, depending on the policy you set per user group.
What Sentaro stops in Google Workspace
Payload-free requests from impersonated executives, judged on intent and relationship history.
Suppliers that suddenly change banking details, and replies injected into real threads.
QR-code phishing
LiveQR codes decoded and their destinations evaluated like any URL, with the MFA or password framing around them.
Consent phishing
LiveLures blocked in mail flow; new grants surfaced with their scopes; lookalike AI apps flagged before access is approved.
Shadow AI
LiveAI chatbots, meeting notetakers and OAuth-connected assistants discovered and categorized.
Account takeover
Q4 2026Per-user baselines, anomalous sessions, forced re-authentication and session revocation.
Why this matters for each role
Lean IT
Verdicts are automatic and remediation is a click. Alerts fire when a decision is needed, not for every blocked message. No MX change to maintain.
Finance and accounts payable
Payment redirects and changed bank details are flagged against the supplier’s history, before anyone acts on them. Callback verification still matters.
Compliance owner
Every verdict carries its reasoning in the console, and the OAuth inventory shows which apps hold access to mail and files, and which accounts granted it.
The numbers behind email and app risk
Which setup fits your Workspace domain?
Gmail settings only
- You have turned on every Safety setting and the sandbox
- Your users rarely handle payments, payroll or supplier banking details
- You already govern third-party app access tightly in the Admin console
- Budget is zero this year
Gmail plus Sentaro
- Finance, HR and leadership are realistic BEC targets
- Suppliers invoice you by email
- Employees connect AI tools and SaaS apps with their Google accounts
- You want an EU vendor hosted in Sweden with public per-account pricing
What customers report
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
Frequently asked questions
What is the best email security for Google Workspace?
Sentaro, running alongside Gmail’s built-in protection. It is a Google CASA verified API integration that connects in four minutes with no MX changes and no agents, targets payload-free BEC, vendor compromise and QR-code phishing, and inventories every app, AI tool and OAuth grant with one-click revocation. It is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month; the first account is free. Prices in USD.
Does Google Workspace have built-in phishing protection?
Yes. Gmail filters spam, phishing and malware on every edition, and admins can turn on advanced phishing and malware protection for attachments, links and spoofing under Admin console, Gmail, Safety. The Security Sandbox for attachments needs Business Standard or higher. Google states that Gmail blocks more than 99.9% of spam, phishing and malware.
Do I need third-party email security for Google Workspace?
Not for bulk spam or known malware. A second layer earns its place when the risk is targeted: business email compromise without links, compromised supplier threads, and consent phishing through OAuth apps. Those rely on context and intent rather than payload, which is what Sentaro’s Message and App vectors analyze.
Is Microsoft 365 or Google Workspace more secure for email?
Both filter bulk threats at very large scale. Neither documents a dedicated feature for vendor email compromise, and OAuth app risk sits in admin controls or a separate product on both. The bigger difference is usually configuration and edition. Sentaro supports both platforms with the same engine, so the answer does not lock you in.
Can Google Workspace get hacked?
Individual accounts can be compromised, typically through phishing, consent phishing or reused passwords. Security keys through the Advanced Protection Program reduce password risk. Sentaro adds detection for the phishing and OAuth grants that lead to compromise; account-takeover detection arrives with its Behavioral vector in Q4 2026.
Will Sentaro slow down or reroute Gmail?
No. Sentaro connects over API and does not touch MX records or mail routing. Gmail continues to deliver mail as before, and Sentaro evaluates it inside the domain, including internal and historical mail.
How much does email security for Google Workspace cost with Sentaro?
Sentaro costs $6 per protected account per month, or $68 per account per year. The first account is free, prices are in USD, and every feature is included. Shared aliases and distribution lists do not count as accounts.
Is Sentaro verified by Google?
Sentaro’s Google Workspace integration is a Google CASA verified API integration. CASA is Google’s security assessment for apps that request access to Workspace data. Sentaro’s SOC 2 and ISO 27001 certifications are in progress; an evidence pack is available on request.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Google Workspace: security overview (99.9% claim)
- Google Workspace Admin Help: advanced phishing and malware protection
- Google Workspace Admin Help: Security Sandbox editions
- Google Workspace Admin Help: enhanced pre-delivery scanning
- Google Workspace Admin Help: Advanced Protection Program
- Google Workspace Admin Help: security investigation tool
- Google Workspace Admin Help: DLP for Gmail
- Google Workspace Admin Help: data regions
- Google Workspace pricing