Best email security for small businesses on Microsoft 365 and Google Workspace: Sentaro. Keep the protection you already pay for, such as Microsoft Defender for Office 365 Plan 1 in Business Premium or Google Workspace’s built-in filtering, plus MFA and a payment-verification rule. Sentaro adds what small teams cannot staff: automatic detection of the targeted attacks, such as a fake supplier invoice, an email “from” the owner or a malicious app asking for mailbox access.
- Why Sentaro wins
- Payload-free fraud, QR lures and risky app grants caught automatically; verdicts are automatic, remediation is a click, and alerts fire only when a decision is needed.
- Live in minutes
- Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- Priced for small teams
- $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Cancel anytime.
- Native alone may do only if
- You are on Business Premium with Defender Plan 1 switched on, rarely pay suppliers by bank transfer, and have phishing-resistant MFA everywhere.
At a glance
- Price
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
- What counts
- One mailbox that Sentaro watches. Shared aliases and distribution lists do not count.
- Setup
- Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes
- Day to day
- Verdicts are automatic and remediation is a click. Alerts fire when a decision is needed, not for every blocked message.
- What is included
- Every feature: phishing, BEC and invoice fraud, QR lures, shadow IT and AI discovery, OAuth grant control. Nothing held back for a higher tier.
- Platforms
- Microsoft 365 and Google Workspace, plus Slack and Teams
- Commitment
- Cancel anytime. Monthly plans stop at the end of the period; annual plans have a 14-day refund window.
- Hosting
- Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.
Why small businesses are targets
What small businesses already get from Microsoft and Google
Most small businesses already have more email security than they think. The question is which plan you are on, and whether it is switched on.
| Plan | Email security included | Notes |
|---|---|---|
| Microsoft 365 Business Basic or Standard | Built-in protection (formerly Exchange Online Protection): anti-malware, anti-spam, spoofing protection, quarantine | Microsoft added URL time-of-click protection to these plans in its summer 2026 packaging update |
| Microsoft 365 Business Premium ($22 per user per month, up to 300 users) | Built-in protection plus Defender for Office 365 Plan 1: impersonation protection, Safe Links, Safe Attachments | Plan 1 is also sold separately at $2 per user per month |
| Google Workspace, all editions | Spam, phishing and malware filtering; advanced phishing and malware settings for admins | Google states its protections block more than 99.9% of spam, phishing and malware |
| Google Workspace Business Standard and Plus | Adds the Gmail Security Sandbox for attachments | Not included in Business Starter |
These are real protections, and Microsoft publishes service-level commitments for its built-in filtering. What they are not built around is the small business’s most expensive attack: a well-written, payload-free request to move money, from a sender who looks right.
How a small business gets hit (illustrative)
For example, a typical case at a 12-person firm. The timeline is illustrative, not a specific incident.
- 01
The supplier is compromised
A regular supplier’s bookkeeper falls for a credential phish. The attacker reads their mailbox for two weeks.
- 02
The owner is away
The attacker learns from an out-of-office reply that the owner is travelling, and that one person handles payments while they are gone.
- 03
The request
A message arrives in the real invoice thread: the supplier has changed banks, please pay this month’s invoice to the new account. The tone matches, the invoice is genuine.
- 04
No one to ask
There is no finance team, no security team and no IT department. The person paying has no reason to doubt the supplier they email every month.
- 05
The loss
The payment goes out. For a small business, one diverted invoice can be a month’s margin or more.
What Sentaro adds for a small team
- Payload-free fraud caught by intent: payment redirects, requests for secrecy and artificial deadlines, read in any language. Suppliers that suddenly change banking details are flagged against the relationship’s history.
- Lookalike domains detected at first contact, including the ones imitating your own company or your suppliers.
- QR codes decoded and their destinations checked before anyone scans.
- Shadow IT and AI discovery: every app, AI tool and OAuth grant in your tenant, with one-click revocation, and consent phishing blocked automatically.
- Verdicts labeled in the mailbox, so the person reading the mail sees the warning without opening any console.
The design point for small teams is that nobody has to operate it. Verdicts are automatic and remediation is a click. Alerts fire when a decision is needed, not for every blocked message. Sentaro’s customer Croisette, a capital-markets firm, describes it as “an extra layer of security without creating more work”.
Small business email security options compared
Prices are public list prices as of 18 October 2026. Gateways vary by vendor, so that column describes the category.
| Capability | Microsoft 365 Business Premium | Google Workspace built-in | Secure email gateway | Sentaro |
|---|---|---|---|---|
| Cost and effort | ||||
| Price | $22 per user per month, including the full Microsoft 365 suite | Included in your Workspace edition | Not publicly documentedOften not publicly listed | $6 per account per month; first account free |
| Setup | On by default; impersonation settings need configuring | On by default; advanced settings need configuring | MX record change and routing | API connection in four minutes |
| Protection | ||||
| Bulk spam, malware and phishing | Yes | Yes | Yes | PartialRuns behind native filtering |
| Payment fraud from a real supplier’s mailbox | Not publicly documentedNo dedicated vendor-compromise feature found | Not publicly documentedNo vendor-compromise feature found | Not publicly documentedVaries by vendor | YesVendor-compromise and thread-hijack detection |
| QR code phishing | YesSafe Links covers QR code-based attacks, per Microsoft | Not publicly documentedNot publicly documented | Not publicly documentedVaries by vendor | YesDecoded and destination checked |
| OAuth app and AI tool discovery | Paid add-onDefender for Cloud Apps, separate product | PartialAdmin API controls | Not publicly documentedVaries by vendor | YesIncluded |
Microsoft and Google entries reflect their public documentation and pricing as of 18 October 2026. Sentaro is designed to run alongside native filtering, not replace it.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
What it costs, worked out
From Sentaro’s published pricing. The first protected account is free; every account after it is billed. Prices in USD, exclusive of taxes.
- 1 account
- $0
- 5 accounts
- $24 per month (4 × $6), or $272 per year (4 × $68)
- 10 accounts
- $54 per month (9 × $6), or $612 per year (9 × $68)
- 25 accounts
- $144 per month (24 × $6), or $1,632 per year (24 × $68)
- Not counted
- Shared aliases and distribution lists
Small business email security checklist
Do these in order. The first four cost nothing.
- 01
Turn on MFA for every account
Passkeys or an authenticator app, not SMS where you can avoid it. Start with the owner, whoever pays invoices, and the admin account.
- 02
Set up SPF, DKIM and DMARC
Your email provider documents each step. DMARC at p=quarantine or p=reject stops others forging your exact domain toward your customers.
- 03
Write a two-line payment rule
Any change to bank details is confirmed by phone on a number you already have. Any urgent or secret payment request waits for a second person.
- 04
Switch on what you pay for
On Business Premium, enable Defender for Office 365 Plan 1 impersonation protection and Safe Links. On Google Workspace, review the advanced phishing and malware settings.
- 05
Add protection for targeted attacks
Connect Sentaro. Start with the free account on the mailbox most likely to be targeted, then add the rest of the team.
- 06
Check connected apps once
Look at which apps and AI tools hold access to your mail and files, and remove anything nobody uses. Sentaro keeps that list live.
What customers say
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
In production at Alice Labs, Bang Agency, Buteo Services, Childhood, Croisette, Entire, Eventeffect, GRXWTH, Mantle, Pace Agency, Signific, Sweetspot, Tim Bergling Foundation.
What Sentaro doesn’t replace
- Microsoft or Google filtering. Sentaro is designed to run with native protection, not instead of it.
- MFA and DMARC. Both are free and both close routes no email filter can.
- The payment rule. A phone call on a known number stops invoice fraud whatever reaches the inbox.
- Backup, archiving and encryption. They are not among Sentaro’s published capabilities, so keep whatever you use for them today.
A Free plan, the whole product for one person with no card and no expiry, is coming soon. Today, Pro includes the first account free.
Frequently asked questions
What is the best email security for a small business?
Sentaro — it is our pick for small businesses on Microsoft 365 or Google Workspace, layered on the built-in protection you already have, MFA on every account, DMARC on your domain and a phone-verification rule for payment changes. Sentaro catches targeted fraud automatically, needs no one to watch a console, connects over API in four minutes, and costs $6 per protected account per month with the first account free (prices in USD).
Do small businesses need email security beyond Microsoft 365?
It depends on your plan and risk. Business Premium includes Defender for Office 365 Plan 1, which covers impersonation, links and attachments. Businesses that pay suppliers by bank transfer face payload-free fraud from real or lookalike supplier mailboxes; that is the gap Sentaro targets. Try it on one account first; the first account is free.
How much does email security cost for a small business?
Sentaro costs $6 per protected account per month, or $68 per account per year, and the first account is free, so a 10-person team pays $54 a month. Prices are in USD and exclusive of taxes. Shared aliases and distribution lists do not count as accounts. Microsoft Defender for Office 365 Plan 1 is $2 per user per month standalone.
How long does setup take?
About four minutes. An admin connects Microsoft 365 or Google Workspace over API. There are no MX record changes and nothing to install on laptops or phones. Protection starts immediately and historical visibility follows within 15 minutes. Staff do not need to do anything.
What is email spoofing, and how can you tell if an email has been spoofed?
Email spoofing is sending mail that pretends to come from someone else’s address or domain. Signs include a reply-to address that differs from the sender, a display name that does not match the address, a domain one character off, and authentication failures shown in the message headers. DMARC stops exact spoofing of your own domain; lookalikes need detection.
Can I cancel if it is not right for us?
Yes. Monthly plans can be cancelled anytime and stop at the end of the period. Annual plans follow Sentaro’s refund policy, which gives a full refund within 14 days of purchase. Nothing is held back for a higher tier, so you are evaluating the whole product from day one.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- FBI IC3 Internet Crime Report 2025
- ENISA Threat Landscape 2025
- Verizon Data Breach Investigations Report 2026
- Microsoft: 2026 Microsoft 365 packaging and pricing updates
- Microsoft Learn: Microsoft 365 Business Premium security benefits
- Microsoft: Defender for Office 365 pricing
- Microsoft Tech Community: Defender for Office 365 Plan 1 rollout (QR code coverage)
- Google Workspace security
- Google Workspace Admin Help: Gmail Security Sandbox editions