- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
- Endpoint Management
- UEM & MDM
- RMM & Patch
- Endpoint Protection
- Remote Access & Support
Endpoint Management
- Security
- Backup & Cyber Resilience
- Backup & Recovery
- SaaS Backup
- Disaster Recovery
- Cyber Recovery
Backup & Cyber Resilience
- Identity & Access
- Privileged Access Management
- IAM, SSO & MFA
- Identity Governance
Identity & Access
- Network Security & SASE
- Firewall & Network Security
- SASE & SSE
- Zero Trust Access
- Secure Web & DNS
Network Security & SASE
Your mail platform already filters spam. What it doesn’t stop is a message with no attachment, no link and no malware.
Exchange Online Protection and Gmail catch the commodity threats; the remaining purchase is behavioural — who normally writes to whom about what — and architectural: a gateway in front of the tenant, or an API behind it.
Defender for Office 365 Plan 1 is in Business Premium and, from 1 July 2026, in Microsoft 365 E3; Plan 2 is in E5. Check which you hold before pricing a third filter.
Already decided — before the demo
Still yours to weigh
What email and collaboration security actually is
A filter between the internet and your people’s inboxes — and increasingly their chat windows. It removes malware and phishing links (the commodity job your platform already does well), and it tries to catch the message that carries neither: the supplier “changing bank details”, the CEO asking for gift cards, the lookalike domain. That second job is behavioural: it needs to know who normally writes to whom, about what, from where.
Two architectures do it. A gateway takes your MX record and filters before mail reaches the tenant — strong for commodity threats, outbound DLP and continuity, slow to cut over. An API deployment reads the mailbox through Microsoft’s or Google’s interfaces — live in an hour, no MX change, and (depending on the product) removing a message seconds after delivery or blocking it inline. Enterprises increasingly run one of each; SMBs increasingly run the API layer on top of what the platform includes.
The architectural split that decides everything
Gateway or API is not a feature; it is the deployment model, and it sets cut-over risk, what the tool can see, whether it can block before delivery, and who owns the quarantine. Decide it before the vendor shortlist, not after.
Often confused withEndpoint Protection — when the attack arrives as a file, not a message →·Managed Detection & Response — who reads the alerts the filter raises →·SIEM & Log Management — where mail telemetry joins the rest →
Gateway vs API deployment · what the mail platform already filters
Two things this buyer confuses, and nothing more. Neither pair is a ladder: gateway and API are different places to stand, and the platform’s own filtering is the floor you are adding to, not replacing.
Gateway (MX) deployment
Your MX record points at the vendor; mail is filtered before it reaches Microsoft 365 or Google. Sees everything inbound and outbound, blocks before delivery, carries DLP and continuity — and the cut-over is a project with a rollback plan. Proofpoint, Mimecast, Barracuda, FortiMail, Forcepoint, Trend, Cloudflare inline.
API deployment
The vendor reads and acts on mailboxes through Microsoft Graph or Google APIs. No MX change, live in an hour, sees internal and collaboration traffic — and some products scan post-delivery (remove within seconds) while others (Check Point inline mode) block before the user sees it. Abnormal, Check Point, Coro; Proofpoint, Mimecast, Sophos, Barracuda, Trend, Cloudflare and Kaspersky also offer it.
What the platform already filters
Exchange Online Protection in every Microsoft 365 plan; Defender for Office 365 P1 in Business Premium and (from July 2026) E3; P2 in E5. Gmail's 99.9% spam/phishing/malware block and advanced phishing controls in every edition. The floor is high; what it lacks at depth is behavioural BEC detection, collaboration scanning and third-party DLP.
Six things decide this purchase. The feature grid is none of them.
Six variables decide this purchase. The instrument tests deployment, threat focus, collaboration scope, awareness, hosting and published pricing; India residency and the platform floor are prose because the honest answers are “documented twice” and “it depends on your licence”.
Gateway vs API deployment
The architectural split that decides cut-over risk, pre- vs post-delivery blocking, and who owns the quarantine. Many vendors now do both — the chip shows which.
BEC and impersonation vs malware filtering
The commodity job is done by the platform; the purchase is the message with no payload. Behavioural detection is documented at most vendors here — Kaspersky's is anti-phishing first.
What Microsoft 365 / Google already include
EOP and Defender P1/P2, Gmail's controls — the floor. Know which plan you hold before you price a third filter.
Collaboration coverage beyond mail
Teams, Slack, SharePoint, OneDrive, Google Drive — where the links now arrive. An add-on almost everywhere; in-policy at Check Point and Abnormal.
Awareness training — bundled or separate
Barracuda, Trend (Phish Insight) and Coro bundle it; Proofpoint, Mimecast, Sophos and Kaspersky sell it as a separate SKU; Abnormal, Check Point, FortiMail, Cloudflare, Forcepoint and Bitdefender do not sell it. Bought and never run is the failure mode.
India data residency for mail content
Documented at Proofpoint (Mumbai) and Sophos (Mumbai); unknown elsewhere. Flagged, never eliminated — ask in writing.
Narrow 21 products to your shortlist
Pick what holds for you. Filters that fail a constraint fade with the reason on them; add-ons (awareness, DMARC, collaboration, account takeover) fade when a chip is about the filter itself. Unset a chip and everything returns.
Commercial shape
Beyond mail
Hosting
Deployment
The threat
India residency and the platform floor are in the notes below, not chips — only two vendors document an India data centre for mail content, and what your tenant already filters depends on the plan you hold.
per employee / year reported; API-only (no MX change); minimum contracts reported $25–50k
Estates on Microsoft 365 or Google Workspace that keep the native gateway and add behavioural AI for the message with no attachment, no link and no malware.
The catch: API-only — it does not replace the gateway; reported minimum contract values rule out very small estates; no awareness training; India residency not documented.
add-on module; detects compromised mailboxes and identities via behavioural baselines
Abnormal estates adding account-compromise detection to inbound protection.
The catch: An add-on to Abnormal, not a mail filter on its own; quote-only.
per user / month (Essentials Business → Professional); Core / enterprise on quote; Mumbai data centre (2025)
The reference gateway — now also API-deployable — for estates that want Proofpoint's threat intelligence, DLP and archiving lineage with an India data centre.
The catch: Essentials is the published SMB line; enterprise Core is quote-only and the suite (awareness, DMARC, DLP) is separate SKUs that add up; on-prem is the legacy appliance path.
DMARC authentication and supplier-risk visibility; gateway-agnostic
Teams that must stop their own domain being spoofed — DMARC to enforcement with supplier visibility.
The catch: Stops spoofing of your domain; does not filter inbound mail — a companion, not a filter.
per user / year; simulations + training tied to Proofpoint threat data
Estates that want the training fed by the same threat intelligence that filters their mail.
The catch: Training, not detection; bought and never run is the category's quietest failure.
per user / month reported (UK G-Cloud shows ~$58–88 / user / year for mid tiers); gateway or API-integrated for Microsoft 365
Mid-market and enterprise estates wanting a mature gateway with an API option, archiving and continuity from one vendor.
The catch: No published list; the collaboration, awareness and DMARC pieces are separate SKUs; India data centre not documented (APAC is Singapore).
Teams, Slack, Zoom and file-share protection; API-based add-on
Mimecast estates extending protection to the messages that are not email.
The catch: An add-on — the gateway is a separate SKU; quote-only.
per user / year; video-led training and simulations
Mimecast estates adding training from the same console.
The catch: Training, not detection; separate SKU.
DMARC, SPF, DKIM reporting to enforcement; gateway-agnostic
Teams getting their own domains to DMARC enforcement, whatever gateway they run.
The catch: Protects your domain's reputation; filters nothing inbound.
per user / year reported (Advanced; Email Plus tier from April 2026 on quote); gateway or Microsoft 365 API; Mumbai region
Sophos Central estates that want mail filtering in the same console as endpoint, firewall and MDR — with a Mumbai data region.
The catch: No published list; no Teams / Slack coverage; awareness (Phish Threat) is a separate SKU; strongest inside a Sophos estate.
per user / year; simulations and training in Sophos Central
Sophos estates running simulations from the console they already use.
The catch: Training only; separate SKU.
per user / year reported; API-based for Microsoft 365 and Google Workspace with inline prevent mode; Teams, SharePoint, OneDrive, Google Drive
Microsoft 365 / Google Workspace estates that want API deployment that can still block before delivery, plus collaboration apps in scope.
The catch: API-only (no MX gateway); no awareness SKU; no published list; India data region not documented.
per user / month (Advanced → Premium Plus); gateway plus API impersonation protection; awareness training bundled at higher tiers; appliance option
Mid-market estates that want gateway filtering, API-based impersonation protection, awareness training and backup in one published-price bundle.
The catch: Collaboration apps are not covered; the useful pieces (forensics, awareness) sit in the higher tiers; India data centre not documented.
appliance, VM or FortiMail Cloud; per mailbox / domain on quote; Microsoft 365 API integration is documented for the cloud service
Fortinet Security Fabric estates — and anyone who needs an on-prem mail gateway they own.
The catch: Gateway-first; no collaboration coverage; no awareness SKU on TechBag; quote-only.
per user / year listing (Standard); Advanced higher; 4–5k seats reported $6–8; gateway or API (Cloud App Security for Microsoft 365 / Google)
Trend Vision One estates wanting mail and collaboration telemetry in the same XDR as the endpoint, with Phish Insight simulations included.
The catch: Listing prices vary widely with volume; Vision One credit billing for the XDR side is opaque; India data region not documented.
per user, inside Cloudflare Zero Trust; MX (inline) or API deployment
Cloudflare One estates adding pre-emptive phishing and BEC detection to the zero-trust bundle.
The catch: Sold inside the Zero Trust bundle — no standalone list; no collaboration or awareness; strongest when Cloudflare already fronts your traffic.
per year listing for a small bundle (5 devices, 2 file servers, 8 mailboxes); launched April 2026
GravityZone estates adding mail filtering to the console they already run.
The catch: New in 2026 — deployment mode, collaboration coverage and depth are thinly documented; listed as a small bundle rather than per mailbox.
per mailbox / year; on-prem mail-server gateway or API for Microsoft 365 (Exchange Online, SharePoint, OneDrive, Teams)
Kaspersky estates wanting anti-phishing and malware filtering on-prem or inside Microsoft 365, with collaboration stores in scope.
The catch: Behavioural BEC detection is not documented at the level of Abnormal or Check Point; procurement caveats apply in some sectors; quote-only.
per user / year; automated training platform
Teams wanting automated, adaptive training independent of the mail filter.
The catch: Training only; procurement caveats apply.
per user / month listing; cloud, on-prem or hybrid gateway with Forcepoint DLP integration
Regulated estates that want an on-prem or hybrid gateway with DLP from the same vendor.
The catch: Gateway only (no API mode); no collaboration or awareness; strongest paired with Forcepoint DLP.
per user / month historical (public list withdrawn in 2026); API for Microsoft 365 and Google; awareness module bundled
SMBs that want mail protection in the same modular agent and bill as endpoint and cloud apps.
The catch: API-only; collaboration apps are a separate module; price now quote-only; India residency not documented.
Why each constraint rules out what it doesShow the reasoning ↓
Vendor-published list priceRules out Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Proofpoint Email Fraud Defense (DMARC), Proofpoint Security Awareness, Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Mimecast Aware (awareness training), Mimecast DMARC Analyzer, Sophos Email, Sophos Phish Threat, Check Point Harmony Email & Collaboration, Fortinet FortiMail, Cloudflare Email Security (Area 1), Kaspersky Security for Mail Server / for Microsoft Office 365, Kaspersky Security Awareness (ASAP) and Coro Email Protection — quote-only (reported ranges at most). That leaves Proofpoint Email Protection (Essentials · Core), Barracuda Email Protection, Trend Micro Email Security / Vision One Email & Collaboration, Bitdefender GravityZone Extended Email Security and Forcepoint Email Security.
Collaboration apps tooRules out Abnormal Account Takeover Protection — an account-takeover add-on, not the mail filter; Proofpoint Email Fraud Defense (DMARC) and Mimecast DMARC Analyzer — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Aware (awareness training), Sophos Phish Threat and Kaspersky Security Awareness (ASAP) — awareness training, not a mail filter; Mimecast Email Security (Cloud Gateway · Cloud Integrated), Sophos Email, Barracuda Email Protection, Fortinet FortiMail, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Forcepoint Email Security and Coro Email Protection — email only; no collaboration-app coverage. That leaves Abnormal Inbound Email Security, Proofpoint Email Protection (Essentials · Core), Mimecast Collaboration Security, Check Point Harmony Email & Collaboration, Trend Micro Email Security / Vision One Email & Collaboration and Kaspersky Security for Mail Server / for Microsoft Office 365.
Awareness training in the same contractRules out Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Proofpoint Email Fraud Defense (DMARC), Mimecast DMARC Analyzer, Check Point Harmony Email & Collaboration, Fortinet FortiMail, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security and Forcepoint Email Security — no awareness training from this vendor. That leaves Proofpoint Email Protection (Essentials · Core), Proofpoint Security Awareness, Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Mimecast Aware (awareness training), Sophos Email, Sophos Phish Threat, Barracuda Email Protection, Trend Micro Email Security / Vision One Email & Collaboration, Kaspersky Security for Mail Server / for Microsoft Office 365, Kaspersky Security Awareness (ASAP) and Coro Email Protection. It flags Proofpoint Email Protection (Essentials · Core) — Same vendor, separate SKU, Mimecast Email Security (Cloud Gateway · Cloud Integrated) — Same vendor, separate SKU, Mimecast Collaboration Security — Same vendor, separate SKU, Sophos Email — Same vendor, separate SKU and Kaspersky Security for Mail Server / for Microsoft Office 365 — Same vendor, separate SKU — marked on the cards, not removed.
On-prem or hybrid gatewayRules out Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Sophos Email, Check Point Harmony Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security and Coro Email Protection — cloud-only service; Proofpoint Email Fraud Defense (DMARC) and Mimecast DMARC Analyzer — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Aware (awareness training), Sophos Phish Threat and Kaspersky Security Awareness (ASAP) — awareness training, not a mail filter. That leaves Proofpoint Email Protection (Essentials · Core), Barracuda Email Protection, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Kaspersky Security for Mail Server / for Microsoft Office 365 and Forcepoint Email Security. It flags Trend Micro Email Security / Vision One Email & Collaboration — On-prem option not documented either way — marked on the cards, not removed.
API deploymentRules out Proofpoint Email Fraud Defense (DMARC) and Mimecast DMARC Analyzer — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Aware (awareness training), Sophos Phish Threat and Kaspersky Security Awareness (ASAP) — awareness training, not a mail filter; Fortinet FortiMail and Forcepoint Email Security — MX gateway only. That leaves Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Proofpoint Email Protection (Essentials · Core), Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Sophos Email, Check Point Harmony Email & Collaboration, Barracuda Email Protection, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Kaspersky Security for Mail Server / for Microsoft Office 365 and Coro Email Protection. It flags Bitdefender GravityZone Extended Email Security — Deployment mode not documented — marked on the cards, not removed.
MX gateway deploymentRules out Abnormal Inbound Email Security, Check Point Harmony Email & Collaboration and Coro Email Protection — API-only; it does not sit in front of the tenant; Abnormal Account Takeover Protection — an account-takeover add-on, not the mail filter; Proofpoint Email Fraud Defense (DMARC) and Mimecast DMARC Analyzer — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Aware (awareness training), Sophos Phish Threat and Kaspersky Security Awareness (ASAP) — awareness training, not a mail filter; Mimecast Collaboration Security — a collaboration add-on, not the mail filter. That leaves Proofpoint Email Protection (Essentials · Core), Mimecast Email Security (Cloud Gateway · Cloud Integrated), Sophos Email, Barracuda Email Protection, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Kaspersky Security for Mail Server / for Microsoft Office 365 and Forcepoint Email Security. It flags Bitdefender GravityZone Extended Email Security — Deployment mode not documented — marked on the cards, not removed.
BEC and impersonation without a payloadRules out Abnormal Account Takeover Protection — an account-takeover add-on, not the mail filter; Proofpoint Email Fraud Defense (DMARC) and Mimecast DMARC Analyzer — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Aware (awareness training), Sophos Phish Threat and Kaspersky Security Awareness (ASAP) — awareness training, not a mail filter; Mimecast Collaboration Security — a collaboration add-on, not the mail filter; Kaspersky Security for Mail Server / for Microsoft Office 365 — anti-phishing and malware filtering; behavioural BEC detection not documented. That leaves Abnormal Inbound Email Security, Proofpoint Email Protection (Essentials · Core), Mimecast Email Security (Cloud Gateway · Cloud Integrated), Sophos Email, Check Point Harmony Email & Collaboration, Barracuda Email Protection, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Forcepoint Email Security and Coro Email Protection.
India data residency for mail contentDocumented: Proofpoint (Mumbai data centre, 2025) and Sophos Central (Mumbai). Not documented either way for the rest — Mimecast's APAC centre is Singapore; Abnormal, Check Point, Barracuda, Trend, Cloudflare, Bitdefender, Kaspersky, Forcepoint and Coro publish no India region for mail content. Nothing is ruled out on it; ask where the message body is stored and scanned, in writing.
What Microsoft 365 and Google Workspace already filterNot a chip because it removes nothing from this list — it removes part of the purchase. Exchange Online Protection is in every Microsoft 365 plan; Defender for Office 365 Plan 1 (Safe Links / Attachments, anti-phishing) is in Business Premium and, from 1 July 2026, in E3; Plan 2 (Threat Explorer, automated investigation, attack simulation) is in E5. Gmail blocks 99.9% of spam, phishing and malware and exposes advanced phishing and malware controls in every edition. What neither does at depth is behavioural BEC detection, collaboration-app scanning and third-party DLP — that is the gap these products price.
Double-filteringTwo filters in series (a gateway and the platform's own) is fine; two that both quarantine, with two admin consoles and two release paths, is the usual source of 'the mail never arrived'. Decide which one holds the quarantine before cut-over.
Eight situations, eight shortlists — with the deployment decided first
Every shortlist starts from your mail platform and whether MX may change. The filter is the second decision.
Microsoft 365, a BEC scare, and no appetite to touch MX
Why: API-based behavioural detection sits behind Exchange Online Protection and Defender P1 without a gateway cut-over; Check Point can still block inline, Coro bundles it for SMBs.
The trade-off: Abnormal's reported minimums rule out very small estates; API-only tools do not replace the gateway you may need for outbound DLP and continuity.
Google Workspace estate
Why: All three document Google Workspace API deployment (Check Point and Trend also cover Google Drive / collaboration); Gmail keeps the commodity filtering.
The trade-off: Gateway-first vendors (Proofpoint, Mimecast, Barracuda, FortiMail) work on Google too — but via MX, with the cut-over that implies.
Regulated — an on-prem or hybrid gateway, or an India data centre
Why: Forcepoint and FortiMail ship appliances and VMs you own; Proofpoint documents a Mumbai data centre; Kaspersky and Barracuda also offer on-prem gateways.
The trade-off: On-prem means you patch the gateway; a Mumbai region for cloud (Proofpoint, Sophos) may satisfy the regulator without the appliance — ask before you buy hardware.
You already run Sophos, Trend, Kaspersky, Bitdefender or ESET on the endpoint
Why: Mail inside the console you already run (Sophos Central, Vision One, Kaspersky Security Center) — one agent estate, one vendor, and often one bundle price.
The trade-off: Suite email is rarely the deepest BEC detection; if impersonation is the threat, layer an API tool on top rather than assume the suite covers it.
Enterprise — gateway and API, layered
Why: The common enterprise shape: a gateway (Proofpoint or Mimecast) for commodity threats, outbound DLP and continuity, plus an API behavioural layer (Abnormal, Check Point) for BEC.
The trade-off: Two contracts, two consoles, one quarantine owner — decide which before cut-over or the double-filtering failure mode finds you.
Teams, Slack and SharePoint are where the links now arrive
Why: Check Point covers Teams / SharePoint / OneDrive / Google Drive in the same policy; Mimecast sells Collaboration Security as an add-on; Abnormal extends to Slack, Teams and Zoom messaging; Trend and Kaspersky cover the Microsoft stores.
The trade-off: Collaboration coverage is an add-on almost everywhere — price it as one; and the platform's own DLP for those apps may already be on your invoice.
Awareness training and DMARC on the same contract
Why: Proofpoint (Security Awareness + Email Fraud Defense), Mimecast (Aware + DMARC Analyzer) and Barracuda (awareness bundled at Premium Plus) put filter, training and domain protection under one vendor.
The trade-off: Same vendor is not the same SKU — Proofpoint's and Mimecast's pieces are priced separately; Barracuda's bundle is tier-gated. Training bought and never run is the failure mode, whoever sells it.
SMB — published price, no sales cycle
Why: Proofpoint Essentials from $2 per user per month, Barracuda from $3, Forcepoint at $2.40 — on the vendors' own pages or listings.
The trade-off: Published entry tiers are gateway filtering; BEC behavioural AI and collaboration coverage cost more at every vendor — check which tier you are actually pricing.
Where the filter stands decides what it can see and when it can act
Three positions, each with a different blast radius at cut-over and a different answer to “can it stop the message before anyone reads it”.
Position 1
In front of the tenant (MX gateway)
Sees all inbound and outbound, blocks pre-delivery, carries DLP and continuity. The cut-over changes MX, the rollback is a DNS change, and the quarantine lives with the gateway. Internal mail and collaboration traffic are invisible unless the vendor adds an API connector.
Position 2
Behind the tenant (API)
Reads mailboxes through Graph / Google APIs: internal mail, collaboration apps and historical mail are visible; deployment is authorisation, not DNS. Post-delivery products remove within seconds; Check Point's inline mode and some gateways' API options block before delivery. No outbound gateway DLP or continuity.
Position 0
The floor — what the platform already does
Exchange Online Protection everywhere; Defender for Office 365 P1 in Business Premium and E3 (July 2026), P2 in E5 with Threat Explorer and automated investigation; Gmail's 99.9% block and advanced controls in every edition. Most SMBs add one API layer to this; most enterprises add a gateway and an API layer.
BEC without a payload
What actually detects the message with no link and no attachment.
- —Behavioural baselines: who writes to whom, from where, about what, in what tone — Abnormal’s and Check Point’s core; Proofpoint, Mimecast, Barracuda, Sophos, Trend and Cloudflare document impersonation and display-name / lookalike-domain analysis on top of their filtering.
- —Domain authentication is the other half: DMARC to enforcement on your own domains (Proofpoint Email Fraud Defense, Mimecast DMARC Analyzer, or your platform’s tooling) stops the spoof of you, which no inbound filter can.
- —Kaspersky’s mail products document anti-phishing and malware filtering; behavioural BEC detection at the depth above is not documented — the instrument says so rather than guessing.
Cut-over and coexistence
The failure is almost never the filter. It is the seam.
- —MX change: TTL down a week before, a rollback DNS record ready, outbound relay tested, and the platform’s own connector locked to the gateway’s IPs so nobody bypasses it.
- —Two quarantines: decide which product holds the quarantine and which only reports — two release paths is how “the mail never arrived” happens.
- —Post-delivery API scan: a message that is read in the seconds before removal still landed. If that window matters, pick an inline-capable API (Check Point) or a gateway.
- —Awareness bought, never run: budget the person who schedules the simulations, or do not buy the SKU.
What changes at 250, 2,000 and 20,000 mailboxes
Mail security scales by mailboxes and by the number of domains, tenants and collaboration apps in scope — and by how many people will answer user reports.
The floor plus one layer
- —What the platform includes is most of the answer; an API behavioural layer or a published-price gateway is the purchase.
- —Abnormal's reported minimums rule it out; Proofpoint Essentials, Barracuda, Forcepoint, Coro and the suite vendors are priced for this band.
- —One admin owns the quarantine and the user-report queue.
Put this in your PoC
Send yourself a payload-free impersonation from a lookalike domain during the trial; count which layer caught it.
Domains, DLP and the report queue
- —Multiple domains and DMARC enforcement become a project; outbound DLP starts to matter — which pulls toward a gateway or the platform's own DLP.
- —User-reported phish at this size needs triage tooling or it becomes noise.
- —Collaboration apps are now in scope whether you bought coverage or not.
Put this in your PoC
Run DMARC to p=reject on one domain; measure the user-report volume for a month and who triaged it.
Architecture, residency and two layers
- —Gateway plus API is the common shape; continuity and archiving are separate decisions with their own vendors.
- —Data residency for mail content becomes a board question — two vendors document an India centre.
- —Tenant consolidation and M&A mean the filter must handle many tenants and many MX records.
Put this in your PoC
Test cut-over on a pilot domain with full rollback; confirm where the message body is scanned and stored, in writing.
Proofpoint, Mimecast, Barracuda, Trend, Sophos, Check Point, Cloudflare, Kaspersky and Forcepoint document very large estates; Abnormal does too (enterprise-first); Coro is SMB-positioned; Bitdefender’s email product is new (April 2026). Where a specific filter strains for your estate: [TechBag to confirm].
Switching filters is a DNS change — or an API revoke — plus everything you tuned
The technical swap is small; the policy, the allow-lists, the quarantine history and the users’ habits are what move slowly.
MX gateway
Lower TTL, point MX at the new gateway, keep the old for a week, then remove it and lock the tenant connector to the new IPs. A DNS change with a project around it.
API product
Authorise the new app, run both for a fortnight in report-only, revoke the old. The lightest switch in security.
Policies and allow-lists
Impersonation lists, trusted senders, DLP rules and quarantine policies are rebuilt by hand — no import format.
Quarantine and reports
Quarantined mail, investigation history and user-report records stay in the old console. Export or release what you need before it closes.
Cut-over plan and rebuild hours for your tenant: [TechBag to confirm] — TechBag scopes it from your domains, policies and collaboration apps in scope.
Per mailbox per month, layered on what you already pay for
What your tenant already includes, what the filters cost in USD and INR at three estate sizes, and what the licence leaves out.
Do you already own one?
Four licences you may hold already filter mail. Usually they are the floor, not the answer — but know the floor.
- Microsoft 365
- Partly Exchange Online Protection everywhere; Defender for Office 365 P1 in Business Premium and (from 1 July 2026) E3; P2 in E5. Commodity filtering, Safe Links / Attachments, basic impersonation — not behavioural BEC AI, not third-party DLP.
- Google Workspace
- Partly Gmail blocks 99.9% of spam, phishing and malware with advanced controls in every edition. Behavioural BEC, collaboration-app scanning and DLP depth are what the products here add.
- Your endpoint suite
- Often Sophos Email, Trend, Kaspersky, Bitdefender and ESET PROTECT Complete bundle mail filtering with the endpoint contract. Read the tier — it is rarely the deepest BEC detection.
- Your SASE / CDN
- Sometimes Cloudflare Zero Trust includes Email Security; Cisco and Fortinet bundle mail into their platforms. If you already pay, ask what is switched on.
If the plan you hold already does the job, we say so before the quote — and then show you the message it would have missed.
What the rest actually cost
Published and reported prices normalised to per mailbox per month (INR for scale), then worked at 250 / 2,000 / 20,000 mailboxes. The platform’s own add-ons are in the grid because they are the honest comparator.
- Defender for Office 365 P1(standalone)$500 ≈₹41,500
- Defender for Office 365 P2(standalone)$1,250 ≈₹1,03,750
- Proofpoint Essentials(Business → Professional)$500–1,465 ≈₹41,500–₹1,21,595
- Forcepoint Email Security(listing)$600 ≈₹49,800
- Barracuda Email Protection(Advanced → Premium Plus)$750–3,000 ≈₹62,250–₹2,49,000
- Abnormal(reported $15–35 / employee / yr; minimums apply)$313–729 ≈₹25,979–₹60,507
- Check Point Harmony Email(reported $15–40 / user / yr)$313–833 ≈₹25,979–₹69,139
- Sophos Email(reported $28–48 / user / yr)$583–1,000 ≈₹48,389–₹83,000
- Mimecast(reported $5–15 / user / mo)$1,250–3,750 ≈₹1,03,750–₹3,11,250
- Trend Micro Email Security(listing ~$60 / user / yr; volume $6–8)$125–1,250 ≈₹10,375–₹1,03,750
- Coro Email(historical $10.50)$2,625 ≈₹2,17,875
- FortiMailQuote
- Cloudflare Email Security(Zero Trust bundle)Quote
- Kaspersky mail productsQuote
- Bitdefender Extended Email Security(bundle listing)Quote
- Defender for Office 365 P1(standalone)$4,000 ≈₹3,32,000
- Defender for Office 365 P2(standalone)$10,000 ≈₹8,30,000
- Proofpoint Essentials(Business → Professional)$4,000–11,720 ≈₹3,32,000–₹9,72,760
- Forcepoint Email Security(listing)$4,800 ≈₹3,98,400
- Barracuda Email Protection(Advanced → Premium Plus)$6,000–24,000 ≈₹4,98,000–₹19,92,000
- Abnormal(reported $15–35 / employee / yr; minimums apply)$2,500–5,833 ≈₹2,07,500–₹4,84,139
- Check Point Harmony Email(reported $15–40 / user / yr)$2,500–6,667 ≈₹2,07,500–₹5,53,361
- Sophos Email(reported $28–48 / user / yr)$4,667–8,000 ≈₹3,87,361–₹6,64,000
- Mimecast(reported $5–15 / user / mo)$10,000–30,000 ≈₹8,30,000–₹24,90,000
- Trend Micro Email Security(listing ~$60 / user / yr; volume $6–8)$1,000–10,000 ≈₹83,000–₹8,30,000
- Coro Email(historical $10.50)$21,000 ≈₹17,43,000
- FortiMailQuote
- Cloudflare Email Security(Zero Trust bundle)Quote
- Kaspersky mail productsQuote
- Bitdefender Extended Email Security(bundle listing)Quote
- Defender for Office 365 P1(standalone)$40,000 ≈₹33,20,000
- Defender for Office 365 P2(standalone)$1,00,000 ≈₹83,00,000
- Proofpoint Essentials(Business → Professional)$40,000–1,17,200 ≈₹33,20,000–₹97,27,600
- Forcepoint Email Security(listing)$48,000 ≈₹39,84,000
- Barracuda Email Protection(Advanced → Premium Plus)$60,000–2,40,000 ≈₹49,80,000–₹1,99,20,000
- Abnormal(reported $15–35 / employee / yr; minimums apply)$25,000–58,333 ≈₹20,75,000–₹48,41,639
- Check Point Harmony Email(reported $15–40 / user / yr)$25,000–66,667 ≈₹20,75,000–₹55,33,361
- Sophos Email(reported $28–48 / user / yr)$46,667–80,000 ≈₹38,73,361–₹66,40,000
- Mimecast(reported $5–15 / user / mo)$1,00,000–3,00,000 ≈₹83,00,000–₹2,49,00,000
- Trend Micro Email Security(listing ~$60 / user / yr; volume $6–8)$10,000–1,00,000 ≈₹8,30,000–₹83,00,000
- Coro Email(historical $10.50)$2,10,000 ≈₹1,74,30,000
- FortiMailQuote
- Cloudflare Email Security(Zero Trust bundle)Quote
- Kaspersky mail productsQuote
- Bitdefender Extended Email Security(bundle listing)Quote
TechBag gives INR pricing, GST, PO cycle, minimums and tier-matched quotes. The INR above is conversion for scale at ≈₹83/$; the tier-matched INR quote is ours.
What isn’t in the licence price
The cut-over
An MX change with rollback, connector lock-down and a week of dual-running; or an API authorisation and a fortnight in report-only. People-hours, not licence dollars — in the switching-cost section; your number is [TechBag to confirm].
The quarantine owner and the report queue
Someone releases quarantined mail and triages user reports every working day. At 2,000 mailboxes that is a role, not a task — and two products with two quarantines doubles it.
Training that nobody runs
Awareness SKUs bundled or separate (Barracuda, Trend, Coro bundle; Proofpoint, Mimecast, Sophos, Kaspersky sell separately) need a person to schedule simulations and read the results. Budget the hour a month or skip the SKU.
What goes wrong
Documented deployment behaviour, cross-checked against TechBag engagements before any becomes a named case. Most of these are seams, not products.
Double-filtering with the native platform
A gateway and Defender / Gmail both quarantining, two consoles, two release paths. 'The mail never arrived' — decide which product owns the quarantine before cut-over.
MX record changes during a gateway cutover
TTL not lowered, no rollback record, tenant connector not locked to the gateway — mail bounces or bypasses for a day. A DNS change is a project.
API deployments that only scan post-delivery
The message was read in the seconds before removal. If that window matters, choose an inline-capable API (Check Point) or a gateway.
Awareness training bought and never run
The SKU was on the quote; nobody scheduled a simulation. The cheapest line in the contract and the most often wasted.
BEC assumed covered by the suite
The endpoint suite's mail tier filtered malware well and missed the supplier's changed bank details. Behavioural detection is the top tier or a separate vendor.
Collaboration apps left out of scope
The link arrived in Teams; the contract said mail. Coverage beyond mail is an add-on almost everywhere.
Your own domain spoofed
No inbound filter stops a spoof of you arriving at your customers. DMARC to enforcement is a separate project — Proofpoint EFD, Mimecast DMARC Analyzer, or your platform.
Residency assumed
Two vendors document an India data centre for mail content. For the rest, where the message body is scanned and stored is a question to ask in writing — not a box on the datasheet.
Three doors — pick by where you are
Vendor-neutral. No gated content.