- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Symantec Email Security.cloud
Your mail platform filters the obvious. The invoice from a spoofed CFO still lands — Symantec Email Security.cloud filters every message for Microsoft 365 and Google Workspace before it lands, rechecks links at click time and opens risky content in a remote, read-only view.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Broadcom platform family
This page covers Symantec Email Security.cloud — Broadcom’s hosted email gateway. The rest:
Quick facts
30-second orientation- Product
- A SaaS email gateway that filters inbound and outbound mail before it reaches the tenant
- Maker
- Broadcom Inc., Palo Alto; the Symantec line sits in the Enterprise Security Group under Jason Rolleston
- Mail platforms
- Microsoft 365 and Google Workspace, reached by pointing your MX records at Broadcom’s cluster hosts
- Price
- No list price; Broadcom sells through partners and every product page says contact or buy via partner
- Add-ons
- Email Threat Detection, Response and Isolation; Symantec DLP; the PGP Encryption Service for Email
- Service targets
- 99.999% availability, over 99% spam capture, under 0.0003% spam false positives (KB 381821)
- Analysts
- KuppingerCole Email Security 2025 Overall Leader; Radicati Secure Email 2025 Top Player
- On-prem sibling
- Symantec Messaging Gateway is a separate appliance, physical or virtual, licensed on its own
- India
- Offices in Bangalore, Hyderabad and Pune; no Indian data region is documented for this service
- In India via
- TechBag — MX cut-over plan, add-on scoping, quote in INR with GST, first-month tuning
Understand email gateways before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is a hosted email gateway?
A cloud service in front of your mailboxes that checks every message before your mail platform stores it.
Native filtering alone vs a hosted gateway in front of it — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Native filtering only | Symantec Email Security.cloud |
|---|---|---|
| Where mail is checked | Only by the tenant’s built-in filters | At a gateway before the tenant stores it |
| A doubtful link | Block it and annoy users, or allow it | Open it in a remote, read-only session |
| A link armed later | Clean at delivery, so nothing rechecks | Rechecked when the user clicks it |
| One phish, many inboxes | A ticket per user who reports it | Traced across users, campaigns and IoCs |
| Sensitive outbound mail | Left to each sender’s judgement | Content and encryption policies by rule |
| What it is NOT | — | An API-only tool, a training suite or a price list |
The cheapest test is one domain: lower its TTL, point its MX at Broadcom, and compare a month of quarantine against what reached inboxes before.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
MX routing
Your domain’s MX records name a primary cluster host at preference 10 and a backup at 20, both under messagelabs.com; your own mail host must not appear in them.
Scanning
Reputation analysis, several antivirus engines and anti-spam signatures check each message, and links and attachments are analysed in real time and again at click time.
Containment
Suspicious links and attachments open in a remote, read-only environment, and admins trace an attack across users, campaigns and indicators of compromise.
Policy
Content, compliance and encryption policies cover outbound mail; sandboxing with clawback, Symantec DLP and PGP encryption are separately licensed modules.
A hosted gateway on your MX records — filters, click-time checks and remote isolation before mail reaches the tenant.
Nine capabilities. Filter, contain, govern.
Symantec Email Security.cloud checks every message at a hosted gateway before your mail platform stores it.
Bulk and malicious mail stopped
Reputation checks, multiple antivirus engines and anti-spam signatures block bad attachments, weaponised links and bulk mail.
Spoofed executives caught
Controls look for credential harvesting, domain spoofing and executive impersonation aimed at finance teams and other high-value users.
Links rechecked when clicked
URLs and files are analysed as mail arrives and again when a user clicks, so a link armed after delivery can still be stopped.
Risky content opened remotely
Suspicious links and attachments render in a remote, read-only session, so the user reads the content while the code stays off the device.
Trace an attack across users
Investigators follow one campaign through every recipient and indicator of compromise, then act on all of it rather than one ticket.
Sandbox and clawback, add-on
The Email Threat Detection, Response and Isolation module adds cloud sandboxing, automated clawback and deeper analytics for targeted attacks.
Sensitive mail handled by rule
Built-in content, compliance and encryption policies act on outbound messages so regulated data leaves only on the terms you set.
Encryption in transit enforced
Enforced TLS between your mail servers and the service can be set up by admins themselves, as Broadcom’s March 2026 walkthrough shows.
Deeper DLP and encryption
Symantec DLP brings richer dictionaries and workflow across mail, endpoint and network; the PGP Encryption Service covers partner mail.
Watch Symantec Email Security.cloud in action
Enforcing TLS yourself, a 2025 office-hours session, and an older 2022 update on subscription management.
Self-serve TLS: Enforcing TLS encryption between you and the Email Security Service
How an administrator turns on enforced TLS for the connection between their mail servers and the service.
March 2025 - Symantec Email Security Office Hours
A product-team office-hours session on the email security line, recorded in March 2025 and posted later that year.
Email Security.cloud Technical Update: Subscription Management Tool
An older 2022 update on the tool for managing Email Security.cloud subscriptions; screens may have changed since.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Phishing now targets people, not servers. Email Security.cloud screens every message before it lands.
Here’s what genuinely sets it apart — and exactly where it stops.
A gateway in front of the tenant, not behind it
Routed by MX record, every inbound message is filtered before Microsoft 365 or Google Workspace stores it, and outbound mail meets the same policies. One place blocks, quarantines and applies data rules to all mail entering or leaving the domain.
Isolation for the click you could not prevent
Instead of blocking a doubtful link or letting it through, the service opens the page or file in a remote, read-only session: the user sees the content, the code never runs on the laptop, and links are checked again at click time.
Service targets you can hold Broadcom to
Public KB 381821 sets 99.999% availability, spam capture above 99%, spam false positives below 0.0003% and malware false positives below 0.0001%, then posts monthly results; August 2025 to July 2026 show 100% availability.
Where it stops
No published price; sandboxing, clawback, full DLP and PGP encryption are separately licensed. No Indian data region is documented. Chat apps and awareness training are not on the product page, and deployment is an MX cut-over, not an API link.
The numbers behind the platform
What your Symantec Email Security.cloud rollout looks like
Map domains and mail flow
List every domain, MX record, outbound relay and third-party sender, and note which ones Microsoft 365 or Google handles.
Decide the add-ons up front
Choose whether the ETDR and Isolation module, Symantec DLP or PGP encryption belong in the quote before the order is placed.
Pilot one domain
Lower the TTL, point one domain’s MX at its cluster hosts, lock the tenant to accept only Broadcom’s ranges, and watch quarantine.
Tune impersonation and TLS
Add executives to the impersonation rules, enforce TLS to the partners who need it, and agree who releases held mail.
Move the rest and review
Cut over the remaining domains, then check catch rate and false positives against the monthly KB 381821 figures.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Moving the MX records was the whole project. We lowered the TTL a week early and the cut-over finished over one lunch break.”
“A fake invoice from our own CFO’s name was held overnight; the impersonation rules flagged the display name, not a link.”
“Isolation won the argument with the business. Users still open the odd supplier link, just never on their own laptop.”
“Clawback is not in the base licence. We learnt that after a phish landed, so price the detection and response module up front.”
“Enforced TLS to two auditors and our regulator took an afternoon once we found the self-serve option in the console.”
“Filtering is solid, but the console feels older than the threats it stops, and our renewal quote came late again.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the email security market — tap any vendor to see why it sits where it does.
TechBag Email Security Grid
Execution strength vs product vision — the classic market map, minus the paywall.
KuppingerCole Overall Leader 2025; 99.999% target.
Deployment Choice × Containment Depth
The grid nobody publishes — how many ways the product can be deployed, India data included, vs how far it goes to contain a message that gets through.
MX only; isolation built in, sandbox and clawback add-on.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Symantec Email Security.cloud vs the email security field
Against Proofpoint, Mimecast, Abnormal, Trend Micro and Barracuda — on deployment, price, what is extra, service targets, post-delivery response and India.
| Dimension | Symantec Email Security.cloud | Proofpoint Email Protection | Mimecast Email Security | Abnormal Inbound Email Security | Trend Micro Email Security | Barracuda Email Protection |
|---|---|---|---|---|---|---|
| What it is | Hosted mail gateway | Gateway plus behavioural | Gateway or integrated | Behavioural AI layer | Mail inside Vision One | Gateway plus API suite |
| Deployment and platforms | MX cut-over only | MX gateway or API | MX or Microsoft 365 API | API only, no MX change | Gateway or API | MX, API and appliance |
| Pricing model | Per user, via partners | Per user, by tier | Per user, S1–S3 bundles | Per employee, yearly | Per user or credits | Per user, tiered |
| Published entry price | Not published | From $2/user/month | Reported only | ~$15–35 reported | ~$60/user/year | From $3/user/month |
| Included vs add-on | Sandbox is an add-on | Suite adds up | Collab costs extra | ATO is a module | Phish Insight included | Awareness at top tiers |
| Scale and service targets | 99.999% published | ~$2B ARR, no SLA here | 42,000+ customers | 3,000+ customers | Not published here | Not published here |
| Phishing and BEC depth | Rules plus reputation | Intel plus behaviour | All directions | Behaviour-first BEC | Content and behaviour | Gateway plus API AI |
| Post-delivery response | Clawback is add-on | TRAP auto-pull | Click-time recheck | Auto-remediation | XDR correlation | Incident Response |
| Beyond email | Email only | Cloud and chat apps | Separate add-on | Slack, Teams, Zoom | Teams and file shares | Email only |
| Data protection and training | Basic DLP, PGP add-on | Broadest platform | Archive heritage | Email-first | Simulations included | Training and backup |
| India data region | Not documented | Mumbai data centre | Not documented | Not documented | Not documented | Not documented |
| Buying and support | Partners; Westcon | Thoma Bravo-owned | Permira-owned | Quote per mailbox | Listed, Tokyo-based | KKR-owned since 2022 |
| Lock-in and exit | Repoint MX to leave | MX or API to unwind | Archive to migrate | Disconnect the API | Tied to Vision One | Suite unbundling |
| Best fit | Gateway with isolation | Broadest platform | Email plus archive | BEC on top of native | Trend XDR estates | Price-led mid-market |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Symantec Email Security.cloud if…
- ✓You want a hosted gateway that screens every message before Microsoft 365 or Google Workspace stores it
- ✓Remote, read-only isolation for doubtful links and attachments matters more to you than blocking them outright
- ✓You want availability and catch-rate targets that the vendor posts publicly every month
Compare alternatives if…
- ✓You need an Indian data centre on paper today — Proofpoint documents one in Mumbai
- ✓You want behavioural BEC detection without touching MX — Abnormal connects by API in minutes
- ✓Teams, Slack or SharePoint are where the links now arrive — Trend, Proofpoint and Abnormal cover them
Do not expect…
- ✓Sandboxing or clawback in the base licence; both arrive with the ETDR and Isolation module
- ✓A documented Indian data region, a published price, or a Gartner Leader badge
- ✓Awareness training or collaboration-app coverage from the same product
Symantec Email Security.cloud is one of 30 email security products TechBag carries. The Email Security guide narrows them to a shortlist and shows the reasoning. →
What does phishing clean-up cost you?
Drag the sliders (protected mailboxes; IT-hour cost). Estimates model IT and security time spent on reported phish, quarantine requests and clean-up at an assumed 1.5 hours per mailbox a year, with 70% of it removed by gateway filtering, isolation and campaign tracing. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Not published: Broadcom prints no price for Symantec Email Security.cloud and sells it through partners as a subscription. Email Threat Detection, Response and Isolation (sandboxing and clawback), Symantec DLP and the PGP Encryption Service are separately priced add-ons. TechBag maps your domains first, then gets the quote itemised in INR with GST.
Email Security.cloud
Best for MX-routed Microsoft 365 or Google estates
- Quote-only, per user, through partners
- Filtering, impersonation controls, click-time checks, isolation
- Basic content, compliance and encryption policies
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
With add-on modules
Best for SOC-led and regulated estates
- ETDR and Isolation: cloud sandbox, automated clawback
- Symantec DLP for richer outbound policy
- PGP Encryption Service for partner mail
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Are all mailboxes on Microsoft 365 or Google Workspace, or do on-prem servers still receive mail directly?
Who owns DNS for each domain, and can the TTL be lowered a week before the cut-over window?
Will the tenant be set to accept inbound mail only from the service, so attackers cannot bypass it?
Do you need sandboxing and clawback now? They need the ETDR and Isolation module, not the base licence.
Where are messages, quarantine and logs stored? No Indian region is documented, so get it in writing.
Do phishing links now arrive in Teams or Slack? This product names only email, so plan cover for chat.
Does the contract cite the 99.999% availability and catch-rate targets, and what credits apply if missed?
Is the quote per user, which add-ons are itemised, and is it in INR with GST and a fixed renewal rate?
Questions buyers ask
Ready to evaluate Symantec Email Security.cloud?
Model the cost of phishing triage across your mailboxes first, or let a TechBag advisor plan an MX cut-over that pilots one domain before the rest.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.