[{"data":1,"prerenderedAt":503},["ShallowReactive",2],{"money-live:best":3,"money:platforms:google-workspace-email-security":4,"money-links:\u002Fen\u002Fplatforms\u002Fgoogle-workspace-email-security":482},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":14,"seoDescription":15,"reviewed":16,"heroChips":17,"schema":22,"sections":23,"faqs":405,"sources":430,"disclaimer":458,"related":459,"cta":479},"platforms","google-workspace-email-security","Google Workspace","What Gmail’s built-in protection covers on each Workspace edition, which settings to turn on, and what an API layer adds for BEC and OAuth apps.","mail","Platforms · Google Workspace","Google Workspace email security: what Gmail covers and what to add","Google Workspace email security starts with Gmail’s built-in filtering, which Google says blocks more than 99.9% of spam, phishing and malware, plus admin-controlled phishing and malware settings and, on Business Standard and above, an attachment sandbox. The best way to add protection against payload-free business email compromise (BEC), vendor fraud and risky OAuth apps on top of Gmail is Sentaro, an API-based layer hosted in Sweden on Microsoft Azure that connects in four minutes with no MX change.","Best email security for Google Workspace (2026)","What Gmail protects on each Google Workspace edition, the phishing settings to turn on, and how an API layer adds BEC and OAuth-app protection.","2026-10-18",[18,19,20,21],"Runs alongside Gmail","Google CASA verified API integration","API · no MX change","$6 per account","service",[24,41,66,113,134,260,273,306,341,356,372,390,395,399,402],{"t":25,"title":26,"summary":27,"points":28},"verdict","Our recommendation","Best email security for Google Workspace: Sentaro, alongside Gmail. Gmail filters bulk threats at very large scale, and it costs nothing extra. Before you buy anything, turn on the advanced phishing and malware settings in the Admin console. In Google’s documentation we found no behavioral model for business email compromise and vendor fraud, no awareness training and no DMARC report management. Sentaro covers the first of those, plus OAuth app and shadow-AI visibility, on top of Gmail.",[29,32,35,38],{"label":30,"text":31},"Why Sentaro wins","API, no MX change, four-minute setup; detection aimed at payload-free BEC and vendor compromise; the App vector covers OAuth grants and shadow AI in the same platform; $6 per protected account per month with every feature included (prices in USD); hosted in Sweden on Microsoft Azure.",{"label":33,"text":34},"Choose Sentaro if","finance, HR or executives get targeted, you work with suppliers who invoice by email, or employees connect AI tools and third-party apps to their Google accounts.",{"label":36,"text":37},"Consider Gmail alone only if","you have turned on every Safety setting, run Business Standard or higher for the sandbox, and your main risk is malware rather than payment fraud.",{"label":39,"text":40},"Do not expect Sentaro to","replace Gmail’s spam filter, Vault, DLP or awareness training. It is a detection layer, not a suite.",{"t":42,"title":43,"items":44},"facts","Sentaro for Google Workspace at a glance",[45,48,51,54,57,60,63],{"label":46,"value":47},"What it is","API-based email security (ICES category) for Google Workspace, also Microsoft 365",{"label":49,"value":50},"Deployment","Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes",{"label":52,"value":53},"Works with","Gmail’s built-in filtering and Admin console Safety settings, running in parallel",{"label":55,"value":56},"Live today","Message vector (phishing, BEC, QR codes, vendor compromise) and App vector (OAuth grants, shadow IT, consent phishing)",{"label":58,"value":59},"Pricing","$6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.",{"label":61,"value":62},"Hosting","Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA",{"label":64,"value":65},"Sovereign plan","Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer",{"t":67,"id":68,"title":69,"blocks":70},"prose","by-edition","What Gmail security includes on each Google Workspace edition",[71,74,111],{"t":72,"text":73},"p","Google Workspace protection varies by edition. The table below lists what Google’s own Admin Help pages say about each protection, as of 18 October 2026. Where a help page shows no “supported editions” box, we say so rather than guess.",{"t":75,"rows":76},"table",[77,81,85,89,92,96,99,103,107],[78,79,80],"Protection","What Google documents","Editions",[82,83,84],"Default spam, phishing and malware filtering","Google says Gmail blocks more than 99.9% of spam, phishing and malware","All",[86,87,88],"Advanced phishing and malware protection","Attachment, link and spoofing checks with warning banner, spam or quarantine actions","No edition restriction shown",[90,91,88],"Enhanced pre-delivery message scanning","Delays suspicious mail slightly to run more checks",[93,94,95],"Gmail Security Sandbox","Detonates attachments, including inside zip and rar archives; can delay delivery up to 3 minutes","Business Standard and Plus; Enterprise Standard and Plus; Frontline Plus. Not Business Starter",[97,98,88],"Advanced Protection Program","Security keys or passkeys, restricted third-party access, deep Gmail scans",[100,101,102],"Security investigation tool","Search and remediate across the domain","Enterprise Standard and Plus; Frontline Standard and Plus; Education Standard and Plus; Enterprise Essentials Plus",[104,105,106],"DLP for Gmail","Data protection rules for outbound mail","Enterprise Standard and Plus; Frontline Standard and Plus; Education",[108,109,110],"Data regions","Choose US or Europe for covered data at rest","Business Standard and Plus; Enterprise Standard and Plus; Frontline; Education Standard and Plus",{"t":72,"text":112},"In Google’s documentation we found no native security awareness training, no DMARC report management and no backup product (Vault is retention and eDiscovery). Its documented impersonation protections are spoofing and employee-name checks; we found no Google feature aimed specifically at vendor email compromise. How Gmail handles QR-code phishing specifically is not documented on the pages we checked.",{"t":114,"id":115,"title":116,"intro":117,"items":118},"steps","phishing-settings","Google Workspace phishing protection: settings to turn on first","All of these are in the Admin console under Gmail, Safety. They cost nothing and are worth doing whether or not you add Sentaro.",[119,122,125,128,131],{"title":120,"text":121},"Attachments","Protect against encrypted attachments and attachments with scripts from untrusted senders, and against anomalous attachment types.",{"title":123,"text":124},"Links and external images","Identify links behind shortened URLs, scan linked images, and show a warning on any click to an untrusted domain.",{"title":126,"text":127},"Spoofing and authentication","Turn on protection against similar-domain-name spoofing, employee-name spoofing, inbound mail spoofing your own domain, and any unauthenticated mail. Apply it to Groups as well.",{"title":129,"text":130},"Choose the action","The default is a warning banner. For spoofing of your own domain and employee names, consider quarantine instead, so the message never reaches the user.",{"title":132,"text":133},"Pre-delivery scanning and sandbox","Keep enhanced pre-delivery scanning on. On Business Standard or higher, enable the Security Sandbox for attachments.",{"t":135,"id":136,"title":137,"intro":138,"columns":139,"own":142,"groups":143,"footnote":259},"compare","gmail-vs-sentaro","Gmail built-in protection vs Gmail plus Sentaro","Google entries come from Google Workspace Admin Help pages. “Not publicly documented” means we did not find it, not that it is missing.",[140,141],"Gmail built-in (by edition)","Sentaro",1,[144,178,209,233],{"label":145,"rows":146},"Filtering and attachments",[147,156,163,170],{"label":148,"cells":149},"Spam, bulk and malware",[150,153],{"mark":151,"text":152},"yes","All editions",{"mark":154,"text":155},"partial","Runs alongside Gmail, not instead of it",{"label":157,"cells":158},"Attachment sandbox",[159,161],{"mark":154,"text":160},"Business Standard and up",{"mark":154,"text":162},"Attachments evaluated; detonation not in Sentaro’s published scope",{"label":164,"cells":165},"Link checks",[166,168],{"mark":151,"text":167},"Shortened URLs, linked images, untrusted-domain warnings",{"mark":151,"text":169},"Destination analysis, not reputation lookups alone",{"label":171,"cells":172},"QR-code phishing",[173,176],{"mark":174,"text":175},"unknown","Not publicly documented",{"mark":151,"text":177},"Decoded, destination and intent analyzed",{"label":179,"rows":180},"Impersonation and fraud",[181,188,195,202],{"label":182,"cells":183},"Domain and employee-name spoofing",[184,186],{"mark":151,"text":185},"Admin Safety settings",{"mark":151,"text":187},"Display-name mismatches, lookalike domains at first contact",{"label":189,"cells":190},"Payload-free BEC",[191,193],{"mark":154,"text":192},"Rule-style spoofing and name checks",{"mark":151,"text":194},"Intent: payment redirects, secrecy, artificial deadlines",{"label":196,"cells":197},"Vendor compromise in real threads",[198,200],{"mark":174,"text":199},"No dedicated feature found",{"mark":151,"text":201},"Vendor-compromise and thread-hijack detection",{"label":203,"cells":204},"Internal and historical mail",[205,207],{"mark":154,"text":206},"Investigation tool on Enterprise editions",{"mark":151,"text":208},"Evaluates internal mail; history within 15 minutes",{"label":210,"rows":211},"Apps and identity",[212,219,226],{"label":213,"cells":214},"OAuth app inventory and risk",[215,217],{"mark":154,"text":216},"Admin API access controls",{"mark":151,"text":218},"Every app, AI tool and grant, scope-level risk per user",{"label":220,"cells":221},"Consent phishing",[222,224],{"mark":174,"text":223},"Not publicly documented as a feature",{"mark":151,"text":225},"Blocked in mail flow; grants revocable in one click",{"label":227,"cells":228},"Strong authentication for high-risk users",[229,230],{"mark":151,"text":97},{"mark":231,"text":232},"no","Not in Sentaro’s scope; use APP",{"label":234,"rows":235},"Suite and commercial",[236,243,248,253],{"label":237,"cells":238},"DLP, Vault, client-side encryption",[239,241],{"mark":151,"text":240},"Edition-dependent",{"mark":231,"text":242},"Not in Sentaro’s published scope",{"label":244,"cells":245},"Awareness training, DMARC reporting",[246,247],{"mark":231},{"mark":231,"text":242},{"label":249,"cells":250},"Price",[251,252],"Included in your Workspace plan","$6 per account per month or $68 per year; first account free",{"label":61,"cells":254},[255,257],{"mark":151,"text":256},"US or Europe data regions, Business Standard and up",{"mark":151,"text":258},"Hosted in Sweden on Microsoft Azure","Sources: Google Workspace Admin Help and workspace.google.com, accessed 18 October 2026.",{"t":67,"id":261,"title":262,"blocks":263},"how-secure","How secure is Google Workspace against phishing?",[264,266,268,271],{"t":72,"text":265},"Against volume, very. Google filters at a scale few vendors match, and its published claim is that Gmail blocks more than 99.9% of spam, phishing and malware. Against a single, well-researched message, the math changes. A business email compromise attempt carries no malware and often no link. It is a believable request from what looks like the CEO, or a real supplier whose mailbox has been taken over, inside a thread that has existed for months. Authentication passes. There is nothing for a payload scanner to find.",{"t":72,"text":267},"Sentaro’s Message vector reads what the message is trying to make someone do. It weighs intent and language (payment redirects, credential prompts, requests for secrecy and artificial deadlines), sender identity and infrastructure (display-name mismatches, newly registered and lookalike domains, SPF, DKIM and DMARC posture), and relationship and thread context (reply-chain reuse, injected replies, suppliers that suddenly change banking details). It uses existing mailbox history as its baseline, so it does not need a long learning period.",{"t":269,"text":270},"h3","The OAuth problem Gmail settings do not solve",{"t":72,"text":272},"In Google Workspace, “Sign in with Google” makes it easy for an employee to grant a third-party app access to their mail, calendar or Drive. Consent phishing exploits exactly that: no password is stolen, the user simply approves access. Sentaro’s App vector builds a full inventory of apps, AI tools and OAuth grants across the domain, scores scope-level risk per app and per user, blocks consent-phishing lures in mail flow, and revokes risky grants via the Google Workspace admin SDK, in one click.",{"t":67,"id":274,"title":275,"blocks":276},"how-it-connects","How does Sentaro connect to Google Workspace?",[277,279,281,304],{"t":72,"text":278},"Through API-level integration via the Google Workspace admin SDK. A Workspace admin connects the domain, protection starts immediately, and historical visibility follows within 15 minutes. There are no MX-record changes, no mail rerouting, no endpoint agents and no rules to maintain. Gmail stays your first filter.",{"t":72,"text":280},"Sentaro’s integration carries Google’s Cloud Application Security Assessment: Google CASA verified API integration. The exact OAuth scopes Sentaro requests are not yet in its public documentation, which is still being written. Ask for the scope list along with the DPA before you approve the app in the Admin console.",{"t":75,"rows":282},[283,287,291,294,297,300],[284,285,286],"What Sentaro does","What Sentaro documents","Exact Google Workspace scope",[288,289,290],"Read inbound, internal and historical mail for verdicts","API-level integration via the Google Workspace admin SDK; historical visibility within 15 minutes","Shared on request before you connect",[292,293,290],"Label, quarantine or remove messages","Block, quarantine or tag inline per user group; similar messages remediated in one action",[295,296,290],"Inventory apps and OAuth grants","Full app and OAuth-grant inventory with scope-level risk per app and per user",[298,299,290],"Revoke risky OAuth grants","Risky grants revoked via the Google Workspace admin SDK, one click",[301,302,303],"Protect the connection itself","DPA: logical tenant isolation and scoped tokens for Google Workspace APIs; TLS 1.2+ in transit, AES-256 at rest","Not applicable",{"t":72,"text":305},"Users see verdicts where they read mail: tagged messages are labeled in the mailbox, and malicious ones are removed or quarantined automatically, depending on the policy you set per user group.",{"t":307,"title":308,"columns":309,"items":310},"cards","What Sentaro stops in Google Workspace",3,[311,317,322,326,330,335],{"title":312,"text":313,"icon":314,"to":315,"tag":316},"Business email compromise","Payload-free requests from impersonated executives, judged on intent and relationship history.","alert-triangle","\u002Fen\u002Fsolutions\u002Fbec","Live",{"title":318,"text":319,"icon":320,"to":321,"tag":316},"Invoice and vendor fraud","Suppliers that suddenly change banking details, and replies injected into real threads.","receipt","\u002Fen\u002Fsolutions\u002Finvoice-fraud",{"title":171,"text":323,"icon":324,"to":325,"tag":316},"QR codes decoded and their destinations evaluated like any URL, with the MFA or password framing around them.","qr-code","\u002Fen\u002Fsolutions\u002Fqr-code-phishing",{"title":220,"text":327,"icon":328,"to":329,"tag":316},"Lures blocked in mail flow; new grants surfaced with their scopes; lookalike AI apps flagged before access is approved.","key-round","\u002Fen\u002Fsolutions\u002Fconsent-phishing",{"title":331,"text":332,"icon":333,"to":334,"tag":316},"Shadow AI","AI chatbots, meeting notetakers and OAuth-connected assistants discovered and categorized.","bot","\u002Fen\u002Fsolutions\u002Fshadow-ai",{"title":336,"text":337,"icon":338,"to":339,"tag":340},"Account takeover","Per-user baselines, anomalous sessions, forced re-authentication and session revocation.","user-x","\u002Fen\u002Fsolutions\u002Faccount-takeover","Q4 2026",{"t":307,"title":342,"columns":309,"items":343},"Why this matters for each role",[344,348,352],{"title":345,"text":346,"icon":347},"Lean IT","Verdicts are automatic and remediation is a click. Alerts fire when a decision is needed, not for every blocked message. No MX change to maintain.","zap",{"title":349,"text":350,"icon":351},"Finance and accounts payable","Payment redirects and changed bank details are flagged against the supplier’s history, before anyone acts on them. Callback verification still matters.","coins",{"title":353,"text":354,"icon":355},"Compliance owner","Every verdict carries its reasoning in the console, and the OAuth inventory shows which apps hold access to mail and files, and which accounts granted it.","file-check",{"t":357,"title":358,"items":359},"stats","The numbers behind email and app risk",[360,364,368],{"n":361,"l":362,"source":363},"60%","of intrusions in the EU start with phishing","ENISA Threat Landscape, 2025",{"n":365,"l":366,"source":367},"$3.05bn","reported lost to business email compromise in 2025","FBI IC3 Internet Crime Report, 2025",{"n":369,"l":370,"source":371},"67%","reach AI services from non-corporate accounts on corporate devices","Verizon DBIR, 2026",{"t":373,"title":374,"options":375},"choose","Which setup fits your Workspace domain?",[376,383],{"heading":377,"items":378},"Gmail settings only",[379,380,381,382],"You have turned on every Safety setting and the sandbox","Your users rarely handle payments, payroll or supplier banking details","You already govern third-party app access tightly in the Admin console","Budget is zero this year",{"heading":384,"own":3,"items":385},"Gmail plus Sentaro",[386,387,388,389],"Finance, HR and leadership are realistic BEC targets","Suppliers invoice you by email","Employees connect AI tools and SaaS apps with their Google accounts","You want an EU vendor hosted in Sweden with public per-account pricing",{"t":391,"tone":392,"title":393,"text":394},"callout","roadmap","Roadmap: Identity and Behavioral vectors, Q4 2026","Message and App are live; Identity and Behavioral reach general availability in Q4 2026, included at no added cost. Account-takeover and session-anomaly detection, forced re-authentication, session revocation, leaked-credential monitoring and lookalike-domain registration alerts belong to those roadmap vectors, so they are left out of the comparison table above. For account takeover today, Google documents the security center and investigation tool on Enterprise editions.",{"t":391,"tone":396,"title":397,"text":398},"info","Certification status","SOC 2 and ISO 27001 certification in progress; no target date is published, and Sentaro says it will announce them the day they are signed, not before. Evidence pack on request. Google CASA verified API integration. The DPA and subprocessor list are at \u002Fen\u002Flegal\u002Fdpa.",{"t":400,"title":401,"quote":3,"caseStudy":3},"proof","What customers report",{"t":391,"tone":396,"title":403,"text":404},"Who wrote this page","Sentaro publishes this page and recommends itself; Google facts are public and sourced as of 18 October 2026.",[406,409,412,415,418,421,424,427],{"q":407,"a":408},"What is the best email security for Google Workspace?","Sentaro, running alongside Gmail’s built-in protection. It is a Google CASA verified API integration that connects in four minutes with no MX changes and no agents, targets payload-free BEC, vendor compromise and QR-code phishing, and inventories every app, AI tool and OAuth grant with one-click revocation. It is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month; the first account is free. Prices in USD.",{"q":410,"a":411},"Does Google Workspace have built-in phishing protection?","Yes. Gmail filters spam, phishing and malware on every edition, and admins can turn on advanced phishing and malware protection for attachments, links and spoofing under Admin console, Gmail, Safety. The Security Sandbox for attachments needs Business Standard or higher. Google states that Gmail blocks more than 99.9% of spam, phishing and malware.",{"q":413,"a":414},"Do I need third-party email security for Google Workspace?","Not for bulk spam or known malware. A second layer earns its place when the risk is targeted: business email compromise without links, compromised supplier threads, and consent phishing through OAuth apps. Those rely on context and intent rather than payload, which is what Sentaro’s Message and App vectors analyze.",{"q":416,"a":417},"Is Microsoft 365 or Google Workspace more secure for email?","Both filter bulk threats at very large scale. Neither documents a dedicated feature for vendor email compromise, and OAuth app risk sits in admin controls or a separate product on both. The bigger difference is usually configuration and edition. Sentaro supports both platforms with the same engine, so the answer does not lock you in.",{"q":419,"a":420},"Can Google Workspace get hacked?","Individual accounts can be compromised, typically through phishing, consent phishing or reused passwords. Security keys through the Advanced Protection Program reduce password risk. Sentaro adds detection for the phishing and OAuth grants that lead to compromise; account-takeover detection arrives with its Behavioral vector in Q4 2026.",{"q":422,"a":423},"Will Sentaro slow down or reroute Gmail?","No. Sentaro connects over API and does not touch MX records or mail routing. Gmail continues to deliver mail as before, and Sentaro evaluates it inside the domain, including internal and historical mail.",{"q":425,"a":426},"How much does email security for Google Workspace cost with Sentaro?","Sentaro costs $6 per protected account per month, or $68 per account per year. The first account is free, prices are in USD, and every feature is included. Shared aliases and distribution lists do not count as accounts.",{"q":428,"a":429},"Is Sentaro verified by Google?","Sentaro’s Google Workspace integration is a Google CASA verified API integration. CASA is Google’s security assessment for apps that request access to Workspace data. Sentaro’s SOC 2 and ISO 27001 certifications are in progress; an evidence pack is available on request.",[431,434,437,440,443,446,449,452,455],{"label":432,"url":433},"Google Workspace: security overview (99.9% claim)","https:\u002F\u002Fworkspace.google.com\u002Fsecurity\u002F",{"label":435,"url":436},"Google Workspace Admin Help: advanced phishing and malware protection","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fgmail\u002Fadvanced\u002Fadvanced-phishing-and-malware-protection",{"label":438,"url":439},"Google Workspace Admin Help: Security Sandbox editions","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fgmail\u002Fadvanced\u002Fset-up-rules-to-detect-harmful-attachments",{"label":441,"url":442},"Google Workspace Admin Help: enhanced pre-delivery scanning","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F7380368",{"label":444,"url":445},"Google Workspace Admin Help: Advanced Protection Program","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F9378686",{"label":447,"url":448},"Google Workspace Admin Help: security investigation tool","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F7575955",{"label":450,"url":451},"Google Workspace Admin Help: DLP for Gmail","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fsecurity\u002Fprevent-data-leaks-in-email-and-attachments-gmail-dlp",{"label":453,"url":454},"Google Workspace Admin Help: data regions","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F7630496",{"label":456,"url":457},"Google Workspace pricing","https:\u002F\u002Fworkspace.google.com\u002Fpricing","Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.",[460,463,466,467,470,471,473,476],{"label":461,"to":462},"Sentaro vs Google Workspace security","\u002Fen\u002Fcompare\u002Fsentaro-vs-google-workspace-security",{"label":464,"to":465},"Microsoft 365 email security","\u002Fen\u002Fplatforms\u002Fmicrosoft-365-email-security",{"label":220,"to":329},{"label":468,"to":469},"Shadow IT discovery","\u002Fen\u002Fsolutions\u002Fshadow-it",{"label":312,"to":315},{"label":58,"to":472},"\u002Fen\u002Fpricing",{"label":474,"to":475},"Sentaro vs Material Security for Workspace","\u002Fen\u002Fcompare\u002Fsentaro-vs-material-security",{"label":477,"to":478},"How the platform connects to Gmail","\u002Fen\u002Fplatform",{"title":480,"note":481},"Keep Gmail’s filter. Add the layer for what it lets through.","Connect Google Workspace over API in four minutes. The first account is free.",{"links":483,"only":499,"labels":502},[484,486,487,490,493,496],{"label":485,"to":315},"business email compromise",{"label":220,"to":329},{"label":488,"to":489},"Lookalike domains","\u002Fen\u002Fsolutions\u002Flookalike-domains",{"label":491,"to":492},"Phishing","\u002Fen\u002Fsolutions\u002Fphishing",{"label":494,"to":495},"DMARC","\u002Fen\u002Fglossary\u002Fdmarc",{"label":497,"to":498},"Vendor Email Compromise","\u002Fen\u002Fglossary\u002Fvendor-email-compromise",{"2":500,"5":501},[495,498,492],[315,489,329],{},1792761722264]