--- title: "Business email compromise cost US$2.77bn in a year; 5 of 14 filters print a price" summary: "FBI IC3 loss figures for 2024, TechBag’s count of 14 email filters on BEC detection, published price and Indian data centre, and the CERT-In and DPDP duties, as of September 2026." url: https://www.thetechbag.com/blog/do-we-need-e-mail-security-protect format: Note desk: "Security operations" published: 2024-11-12 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["email security","business email compromise","BEC","phishing","DMARC","Proofpoint","Sophos","Microsoft Defender for Office 365","Gmail","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/do-we-need-e-mail-security-protect.png --- # Business email compromise cost US$2.77bn in a year; 5 of 14 filters print a price *FBI IC3 loss figures for 2024, TechBag’s count of 14 email filters on BEC detection, published price and Indian data centre, and the CERT-In and DPDP duties, as of September 2026.* Note · Security operations · By TechBag · Published 2024-11-12 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/do-we-need-e-mail-security-protect Business email compromise cost the victims who reported it to the FBI US$2.77 billion in 2024, from 21,442 complaints, which is about US$1,29,000 a complaint. Phishing and spoofing drew nine times as many complaints, 193,407, and US$70 million in losses, about US$362 each.[1] That one contrast answers the question this piece asked in 2021. You do not buy email security to stop spam; your mail platform already does that. You buy it to stop the one message with no link, no attachment and no malware that asks accounts payable to change a supplier’s bank details. And of the 14 email filters in TechBag’s guide, only five print a price for doing so. ## What the 14 filters actually tell you, counted TechBag’s email and collaboration security guide holds 22 products by SKU, of which 14 are filters and the rest are awareness, DMARC and collaboration add-ons.[2] We counted four things across the 14 filters. Twelve document behavioural detection of business email compromise, the payload-free message; the other two, N-able Mail Assure and Kaspersky, document anti-phishing and malware filtering and nothing deeper. Ten carry any price at all, and five of those are published lists: Proofpoint Essentials, at US$2.75 to US$5.33 a user a month on its October 2021 US list, Barracuda, Trend Micro, Forcepoint and a Bitdefender small-bundle listing. The other five are reported ranges, and four are quote-only. Two document an Indian data centre for mail content: Proofpoint, with an India data centre since 2025, and Sophos, in the Sophos Central Mumbai region.[2] **Figure: Twelve of 14 filters detect a payload-free message; five print a price and two document an Indian data centre** *Count of the 14 email filters in TechBag's email security guide meeting each test, vendor documentation, September 2026* Behavioural BEC detection documented of 14 12 filters Any price, published or reported of 14 10 filters Published list price Proofpoint, Barracuda, Trend Micro, Bitdefender, Forcepoint 5 filters Indian data centre documented for mail content Proofpoint, Sophos 2 filters | | Value (filters) | | --- | --- | | Behavioural BEC detection documented | 12 | | Any price, published or reported | 10 | | Published list price | 5 | | Indian data centre documented for mail content | 2 | Source: TechBag email & collaboration security guide, 22 products by SKU, 14 of them filters; TechBag count · as of 30 September 2026 · A reported range is a figure seen in a tender or reseller listing, not on the vendor's own price page ReportedWhat you already own Exchange Online Protection is in every Microsoft 365 plan. Defender for Office 365 Plan 1, with Safe Links, Safe Attachments and anti-phishing, is in Business Premium and, from 1 July 2026, in E3; Plan 2 is in E5. Gmail states that it blocks 99.9% of spam, phishing and malware in every edition.[2][4] The commodity layer is paid for. What neither platform does at depth is behavioural detection of the payload-free message, scanning of Teams, Slack and shared drives, and third-party DLP, and that is what the 14 filters price. ## The two cheap things to do before buying anything The 2021 version of this piece advised strong passwords and avoiding public Wi-Fi. The 2026 version has two instructions, both free. First, publish SPF, DKIM and DMARC for every domain you send from. Since 1 February 2024 Google has required senders of 5,000 or more messages a day to Gmail to have all three, to keep the spam rate in Postmaster Tools under 0.30%, and to support one-click unsubscribe, and a DMARC policy at `p=reject` is what stops your own domain being used against your suppliers.[3] Second, switch on what you own: the Defender or Gmail controls above are frequently licensed and never configured. Only then price a third filter, and price the tier that carries the behavioural layer, because in most of the guide’s records that is the top tier, not the entry one.[2] Our view Our view: a company under 250 mailboxes on Business Premium or Google Workspace has most of what it needs and should spend its first rupee on DMARC enforcement and a payment-change call-back rule, not a gateway. Above 2,000 mailboxes, or with a finance team that pays suppliers on emailed instructions, the behavioural layer is worth its quote, and the vendor that will not print a price should at least put the per-mailbox figure and the tier name in writing before the trial. ## If you are buying this in India Proofpoint’s published US$2.75 to US$5.33 a user a month is ₹234 to ₹453 at ₹85 to the dollar, plus 18% GST; every filter without a published list is a quote, which TechBag takes in INR with GST shown separately.[2] A compromised mailbox is a reportable event twice over. CERT-In’s Directions of 28 April 2022 list unauthorised access and identity theft and spoofing among the incidents to be reported within six hours, and require ICT logs to be kept for 180 days within India, which is why the question of where the mail filter stores its logs matters as much as where it scans the message.[5] Under the DPDP Rules, notified on 13 November 2025, the duty to notify the Data Protection Board and every affected person of a personal-data breach takes effect on 13 May 2027, and a mailbox full of customer correspondence is personal data.[6] For the 12 filters with no documented Indian data centre, ask in writing where the message body is scanned and stored, before the trial. How we did this Figures as of 30 September 2026 Loss and complaint figures are read from the FBI Internet Crime Complaint Center’s 2024 report, crime-type tables by complaint count and by loss; the per-complaint figures are TechBag’s division of one by the other and describe reported US losses, not Indian ones, for which no comparable public count exists. The 14-filter counts are TechBag’s reading of the product records in its own email security guide, built from vendor documentation; “documented” means the vendor states it, not that TechBag tested it. Google’s sender requirements are read from its sender-guidelines page. Prices are converted at ₹85 to the dollar and exclude GST unless stated. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [FBI Internet Crime Complaint Center, 2024 Internet Crime Report (crime types by complaints and by loss)](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf) — released April 2025 2. [TechBag, Email & Collaboration Security: how to choose (22 products by SKU)](https://www.thetechbag.com/browse/security/email-security) — vendor documentation verified 22 August 2026 3. [Google Workspace Admin Help, Email sender guidelines](https://support.google.com/a/answer/81126) — requirements from 1 February 2024 4. [Microsoft, 2026 Microsoft 365 packaging and pricing updates](https://www.microsoft.com/en-us/licensing/news/2026-M365-Packaging-Pricing-Updates) — 16 February 2026 5. [CERT-In, Directions under section 70B(6) of the IT Act](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 6. [Legismith Partners, DPDP Rules 2025 commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Email & collaboration security guide](https://www.thetechbag.com/browse/security/email-security) — the 22 product records counted here, gateway against API, with per-mailbox prices - [Proofpoint vendor hub](https://www.thetechbag.com/proofpoint) — the published Essentials price and the India data centre - [Abnormal AI vendor hub](https://www.thetechbag.com/abnormal) — the API-deployed behavioural end of the argument