# Your mail platform already filters spam. What it doesn’t stop is a message with no attachment, no link and no malware. *Email Security — a TechBag decision guide. Last reviewed 2026-10-03.* > Exchange Online Protection and Gmail catch the commodity threats; the remaining purchase is behavioural — who normally writes to whom about what — and architectural: a gateway in front of the tenant, or an API behind it. **The checkable fact:** Defender for Office 365 Plan 1 is in Business Premium and, from 1 July 2026, in Microsoft 365 E3; Plan 2 is in E5. Check which you hold before pricing a third filter. - Canonical: https://www.thetechbag.com/browse/security/email-security - Category: [Security](https://www.thetechbag.com/browse/security) - Products compared: 36 ## What email security actually is A filter between the internet and your people’s inboxes — and increasingly their chat windows. It removes malware and phishing links (the commodity job your platform already does well), and it tries to catch the message that carries neither: the supplier “changing bank details”, the CEO asking for gift cards, the lookalike domain. That second job is **behavioural**: it needs to know who normally writes to whom, about what, from where. Two architectures do it. A **gateway** takes your MX record and filters before mail reaches the tenant — strong for commodity threats, outbound DLP and continuity, slow to cut over. An **API** deployment reads the mailbox through Microsoft’s or Google’s interfaces — live in an hour, no MX change, and (depending on the product) removing a message seconds after delivery or blocking it inline. Enterprises increasingly run one of each; SMBs increasingly run the API layer on top of what the platform includes. **The most common mis-purchase.** **Gateway or API** is not a feature; it is the deployment model, and it sets cut-over risk, what the tool can see, whether it can block before delivery, and who owns the quarantine. Decide it before the vendor shortlist, not after. ## Gateway vs API deployment · what the mail platform already filters Two things this buyer confuses, and nothing more. Neither pair is a ladder: gateway and API are different places to stand, and the platform’s own filtering is the floor you are adding to, not replacing. ### Gateway (MX) deployment Your MX record points at the vendor; mail is filtered before it reaches Microsoft 365 or Google. Sees everything inbound and outbound, blocks before delivery, carries DLP and continuity — and the cut-over is a project with a rollback plan. Proofpoint, Mimecast, Barracuda, FortiMail, Forcepoint, Trend, Cloudflare inline. ### API deployment The vendor reads and acts on mailboxes through Microsoft Graph or Google APIs. No MX change, live in an hour, sees internal and collaboration traffic — and some products scan post-delivery (remove within seconds) while others (Check Point inline mode) block before the user sees it. Abnormal, Check Point, Coro; Proofpoint, Mimecast, Sophos, Barracuda, Trend, Cloudflare and Kaspersky also offer it. ### What the platform already filters Exchange Online Protection in every Microsoft 365 plan; Defender for Office 365 P1 in Business Premium and (from July 2026) E3; P2 in E5. Gmail's 99.9% spam/phishing/malware block and advanced phishing controls in every edition. The floor is high; what it lacks at depth is behavioural BEC detection, collaboration scanning and third-party DLP. **These are widening scopes, not tiers.** Platform filtering → an API behavioural layer → a full gateway each adds visibility and control, costs more, and adds a console someone must run. Buy the deployment your change-control and your threat actually require — and read what your tenant already includes before adding a third filter. ## The decision variables Six variables decide this purchase. The instrument tests deployment, threat focus, collaboration scope, awareness, hosting and published pricing; India residency and the platform floor are prose because the honest answers are “documented twice” and “it depends on your licence”. **Gateway vs API deployment.** The architectural split that decides cut-over risk, pre- vs post-delivery blocking, and who owns the quarantine. Many vendors now do both — the chip shows which. **BEC and impersonation vs malware filtering.** The commodity job is done by the platform; the purchase is the message with no payload. Behavioural detection is documented at most vendors here — Kaspersky's is anti-phishing first. **What Microsoft 365 / Google already include.** EOP and Defender P1/P2, Gmail's controls — the floor. Know which plan you hold before you price a third filter. **Collaboration coverage beyond mail.** Teams, Slack, SharePoint, OneDrive, Google Drive — where the links now arrive. An add-on almost everywhere; in-policy at Check Point and Abnormal. **Awareness training — bundled or separate.** Barracuda and Coro bundle it (Trend's Phish Insight was retired in June 2025); Proofpoint, Mimecast, Sophos and Kaspersky sell it as a separate SKU; Abnormal, Check Point, FortiMail, Cloudflare, Forcepoint and Bitdefender do not sell it. Bought and never run is the failure mode. **India data residency for mail content.** Documented at Proofpoint (India data centre, 2025) and Sophos (Mumbai); unknown elsewhere. Flagged, never eliminated — ask in writing. ## The 36 products Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one. ### N-able Mail Assure — N-able - **Who it's for:** MSPs administering email security across many client tenants who want ONE console instead of thirty Microsoft admin centres — which is frequently the real business case. Filtering runs both directions (outbound limits how far a compromised account travels), with continuity when the mail platform is down and archiving whose retention survives mailbox deletion and platform migration. - **The honest limitation:** Its mechanism is collective intelligence — threat data pooled across the customer base — which is fast and effective against VOLUME attacks and has no prior sighting to learn from on a message written for one organisation. Not the deepest product here: Proofpoint and Mimecast go further on targeted attack and Abnormal AI's behavioural approach is strong precisely where pooling is weakest. And check first whether the client's existing M365 tier already includes Defender for Office 365 — many own it and have never configured it. - **Price:** Quote — Quote-only, and a separate product from N-able's RMM platforms. Establish whether archiving is included or an add-on, how retention beyond the standard window is charged, and whether counting is per seat or per domain across your client base - **Details:** https://www.thetechbag.com/n-able/n-able-mail-assure ### Abnormal Inbound Email Security — Abnormal AI - **Who it's for:** Estates on Microsoft 365 or Google Workspace that keep the native gateway and add behavioural AI for the message with no attachment, no link and no malware. - **The honest limitation:** API-only — it does not replace the gateway; reported minimum contract values rule out very small estates; no awareness training; India residency not documented. - **Price:** ~$15–35 (≈ ₹1,245) — per employee / year reported; API-only (no MX change); minimum contracts reported $25–50k - **Details:** https://www.thetechbag.com/abnormal/abnormal-inbound-email ### Abnormal Account Takeover Protection — Abnormal AI - **Who it's for:** Abnormal estates adding account-compromise detection to inbound protection. - **The honest limitation:** An add-on to Abnormal, not a mail filter on its own; quote-only. - **Price:** Quote — add-on module; detects compromised mailboxes and identities via behavioural baselines - **Details:** https://www.thetechbag.com/abnormal/abnormal-account-takeover ### Proofpoint Email Protection (Essentials · Core) — Proofpoint - **Who it's for:** The reference gateway — now also API-deployable — for estates that want Proofpoint's threat intelligence, DLP and archiving lineage with an India data centre. - **The honest limitation:** Essentials is the published SMB line; enterprise Core is quote-only and the suite (awareness, DMARC, DLP) is separate SKUs that add up; on-prem is the legacy appliance path. - **Price:** $2.75–5.33 (≈ ₹228) — per user / month on Proofpoint's undated US MSRP sheet (Essentials Business → Professional); Core / enterprise on quote; India data centre (2025) - **Details:** https://www.thetechbag.com/proofpoint/proofpoint-email-security ### Proofpoint Email Fraud Defense (DMARC) — Proofpoint - **Who it's for:** Teams that must stop their own domain being spoofed — DMARC to enforcement with supplier visibility. - **The honest limitation:** Stops spoofing of your domain; does not filter inbound mail — a companion, not a filter. - **Price:** Quote — DMARC authentication and supplier-risk visibility; gateway-agnostic; Proofpoint's India DC release does not name this product - **Details:** https://www.thetechbag.com/proofpoint/proofpoint-email-fraud ### Proofpoint Security Awareness — Proofpoint - **Who it's for:** Estates that want the training fed by the same threat intelligence that filters their mail. - **The honest limitation:** Training, not detection; bought and never run is the category's quietest failure. - **Price:** Quote — per user / year; simulations + training tied to Proofpoint threat data; India hosting not confirmed - **Details:** https://www.thetechbag.com/proofpoint/proofpoint-awareness-training ### Mimecast Email Security (Cloud Gateway · Cloud Integrated) — Mimecast - **Who it's for:** Mid-market and enterprise estates wanting a mature gateway with an API option, archiving and continuity from one vendor. - **The honest limitation:** No published list; the collaboration, awareness and DMARC pieces are separate SKUs; no India data centre (a Singapore centre was announced in December 2025). - **Price:** ~$5–15 (≈ ₹415) — per user / month reported (UK G-Cloud shows ~$58–88 / user / year for mid tiers); gateway or API-integrated for Microsoft 365 - **Details:** https://www.thetechbag.com/mimecast/mimecast-advanced-email-security ### Mimecast Collaboration Security — Mimecast - **Who it's for:** Mimecast estates extending protection to the messages that are not email. - **The honest limitation:** An add-on — the gateway is a separate SKU; quote-only. - **Price:** Quote — Teams, SharePoint and OneDrive protection, tied to Cloud Integrated; Slack and Zoom appear in marketing only, not in technical documentation; API-based add-on - **Details:** https://www.thetechbag.com/mimecast/mimecast-collaboration-security ### Mimecast Engage (awareness training) — Mimecast - **Who it's for:** Mimecast estates adding training from the same console. - **The honest limitation:** Training, not detection; separate SKU. - **Price:** Quote — per user / year; video-led training and simulations - **Details:** https://www.thetechbag.com/mimecast/mimecast-engage ### Mimecast DMARC Analyzer — Mimecast - **Who it's for:** Teams getting their own domains to DMARC enforcement, whatever gateway they run. - **The honest limitation:** Protects your domain's reputation; filters nothing inbound. - **Price:** Quote — DMARC, SPF, DKIM reporting to enforcement; gateway-agnostic - **Details:** https://www.thetechbag.com/mimecast/mimecast-dmarc-analyzer ### Sophos Email — Sophos - **Who it's for:** Sophos Central estates that want mail filtering in the same console as endpoint, firewall and MDR — with a Mumbai data region. - **The honest limitation:** No published list; no Teams / Slack coverage; awareness (Phish Threat) has been included since December 2025; strongest inside a Sophos estate. - **Price:** ~$28–48 (≈ ₹2,324) — per user / year reported (Advanced; Email Plus tier from April 2026 on quote); gateway or Microsoft 365 API; Mumbai region - **Details:** https://www.thetechbag.com/sophos/sophos-email ### Sophos Phish Threat — Sophos - **Who it's for:** Sophos estates running simulations from the console they already use. - **The honest limitation:** Training only; included with Sophos Email licences since December 2025, or sold standalone. - **Price:** Quote — per user / year; simulations and training in Sophos Central - **Details:** https://www.thetechbag.com/sophos/sophos-phish-threat ### Check Point Email Security — Check Point - **Who it's for:** Microsoft 365 / Google Workspace estates that want API deployment that can still block before delivery, plus collaboration apps in scope. - **The honest limitation:** API-only (no MX gateway); no awareness SKU; no published list; India data region not documented. - **Price:** ~$15–40 (≈ ₹1,245) — per user / year reported; formerly Harmony Email & Collaboration (renamed March 2026); API-based for Microsoft 365 and Google Workspace with inline prevent mode; Teams, SharePoint, OneDrive, Google Drive - **Details:** https://www.thetechbag.com/checkpoint/checkpoint-harmony-email ### Barracuda Email Protection — Barracuda - **Who it's for:** Mid-market estates that want gateway filtering, API-based impersonation protection, awareness training and backup in one tiered bundle. - **The honest limitation:** Collaboration apps are not covered; the useful pieces (forensics, awareness) sit in the higher tiers; India data centre not documented. - **Price:** Quote — no official list price published (the $3–12 per user / month seen online is a reseller figure); gateway plus API impersonation protection; awareness training bundled at higher tiers; appliance option - **Details:** https://www.thetechbag.com/barracuda/barracuda-email-protection ### Fortinet FortiMail — Fortinet - **Who it's for:** Fortinet Security Fabric estates — and anyone who needs an on-prem mail gateway they own. - **The honest limitation:** Gateway-first; no collaboration coverage; no awareness SKU on TechBag; quote-only. - **Price:** Quote — appliance, VM or FortiMail Cloud; per mailbox / domain on quote; Microsoft 365 API integration is documented for the cloud service - **Details:** https://www.thetechbag.com/fortinet/fortinet-fortimail ### Trend Micro Email Security / Vision One Email & Collaboration — Trend Micro - **Who it's for:** Trend Vision One estates wanting mail and collaboration telemetry in the same XDR as the endpoint. - **The honest limitation:** Quote-only, and Phish Insight, the simulation tool once included, reached end of life on 30 June 2025; Vision One credit billing for the XDR side is opaque; India data region not documented. - **Price:** Quote — per user under an annual contract; Trend publishes no list price (the ~$60 / user / year online is a third-party figure); gateway or API (Cloud App Security for Microsoft 365 / Google) - **Details:** https://www.thetechbag.com/trendmicro/trendmicro-email-security ### Cloudflare Email Security (Area 1) — Cloudflare - **Who it's for:** Cloudflare One estates adding pre-emptive phishing and BEC detection to the zero-trust bundle. - **The honest limitation:** Sold inside the Zero Trust bundle — no standalone list; no collaboration or awareness; strongest when Cloudflare already fronts your traffic. - **Price:** Quote — per user, inside Cloudflare Zero Trust; MX (inline) or API deployment - **Details:** https://www.thetechbag.com/cloudflare/cloudflare-email-security ### Bitdefender GravityZone Extended Email Security — Bitdefender - **Who it's for:** GravityZone estates adding mail filtering to the console they already run. - **The honest limitation:** New in 2026 — deployment mode, collaboration coverage and depth are thinly documented; listed as a small bundle rather than per mailbox. - **Price:** $479.47 (≈ ₹39,796) — per year listing for a small bundle (5 devices, 2 file servers, 8 mailboxes); launched April 2026 - **Details:** https://www.thetechbag.com/bitdefender/bitdefender-email-security ### Kaspersky Security for Mail Server / for Microsoft Office 365 — Kaspersky - **Who it's for:** Kaspersky estates wanting anti-phishing and malware filtering on-prem or inside Microsoft 365, with collaboration stores in scope. - **The honest limitation:** Behavioural BEC detection is not documented at the level of Abnormal or Check Point; procurement caveats apply in some sectors; quote-only. - **Price:** Quote — per mailbox / year; on-prem mail-server gateway or API for Microsoft 365 (Exchange Online, SharePoint, OneDrive, Teams) - **Details:** https://www.thetechbag.com/kaspersky/kaspersky-email-security ### Kaspersky Security Awareness (ASAP) — Kaspersky - **Who it's for:** Teams wanting automated, adaptive training independent of the mail filter. - **The honest limitation:** Training only; procurement caveats apply. - **Price:** Quote — per user / year; automated training platform - **Details:** https://www.thetechbag.com/kaspersky/kaspersky-security-awareness ### Forcepoint Email Security — Forcepoint - **Who it's for:** Regulated estates that want an on-prem or hybrid gateway with DLP from the same vendor. - **The honest limitation:** Gateway only (no API mode); no collaboration or awareness; strongest paired with Forcepoint DLP. - **Price:** Quote — no official list price published (the $2.40 per user / month online is an aggregator figure); cloud, on-prem or hybrid gateway with Forcepoint DLP integration - **Details:** https://www.thetechbag.com/forcepoint/forcepoint-email-security ### Coro Email Protection — Coro - **Who it's for:** SMBs that want mail protection in the same modular agent and bill as endpoint and cloud apps. - **The honest limitation:** API-only; collaboration apps are a separate module; price now quote-only; India residency not documented. - **Price:** ~$10.50 (≈ ₹872) — per user / month historical (public list withdrawn in 2026); API for Microsoft 365 and Google; awareness module bundled - **Details:** https://www.thetechbag.com/coro/coro-email-security ### INKY Email Security (Advanced · Pro) — Kaseya - **Who it's for:** Microsoft 365 and Google Workspace tenants — and the MSPs running them — that want colour-coded warning banners on every message and Graphus customers moving to its replacement. - **The honest limitation:** No published price and no documented India hosting region; GenAI analysis is Pro-only; it inspects mail inline through connectors, so plan the mail-flow change; Graphus reaches end of life in June 2027. - **Price:** Quote — per user, quote-only; Advanced is inside Kaseya 365 User since January 2026, Pro adds GenAI intent analysis, outbound DLP and encryption; mail flows through INKY by connectors while MX records stay with Microsoft or Google - **Details:** https://www.thetechbag.com/kaseya/inky-email-security ### OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption) — OpenText - **Who it's for:** Microsoft 365 firms and the MSPs running them that want inbound, outbound and internal filtering, click-time link checks, sandboxing and retraction, plus policy-based encryption that outside recipients can reply to. - **The honest limitation:** Retraction and internal filtering are documented for Microsoft 365 only — Google Workspace is not named — and no India data centre is listed. OpenText classes its SMB and consumer security line as non-core and is divesting non-core units — ask about the roadmap. - **Price:** Quote — quote-only; the filter’s licence unit is not published, while Zix-heritage Core Email Encryption is per user on monthly, annual or multi-year terms; Continuity, Message Privacy and Core Security Awareness Training are separate products; mail flows through the hosted filter - **Details:** https://www.thetechbag.com/opentext/opentext-core-email-threat-protection ### Symantec Email Security.cloud (Broadcom) — Broadcom - **Who it's for:** Estates that want a long-running cloud email filter with contractual availability and catch-rate targets. - **The honest limitation:** A gateway (MX change) rather than API protection inside Microsoft 365; an Indian data region is not documented. - **Price:** Quote — quoted; an MX-based cloud filter with 99.999% availability and spam-capture targets in Broadcom’s service terms; threat detection with isolation and PGP encryption are add-ons - **Details:** https://www.thetechbag.com/broadcom/broadcom-symantec-email-security-cloud ### Heimdal Email Security — Heimdal - **Who it's for:** Small teams that want mail filtering on the same dashboard as their Heimdal endpoint modules. - **The honest limitation:** Teams, Slack and SharePoint protection is not documented; how mailboxes are counted needs confirming, and tenant data sits in Europe, the US, the UK or the UAE, not India. - **Price:** Quote — quoted; filters inbound and outbound mail as an MX gateway or through a Microsoft 365 connector that leaves the MX record alone; Email Fraud Prevention works only on mail passing through it - **Details:** https://www.thetechbag.com/heimdal/heimdal-email-security ### SpamTitan Email Security (TitanHQ) — TitanHQ - **Who it's for:** MSPs and small businesses that want an inexpensive, multi-tenant MX gateway in front of Microsoft 365 or their own mail server, cloud or on their own hardware. - **The honest limitation:** Gateway only: in-mailbox API protection and post-delivery removal are PhishTitan, a separate product. No collaboration-app coverage, no India mail cluster, and no published price. - **Price:** Quote — quoted per user through MSPs or direct, with a free trial; an MX gateway with sandboxing and dual antivirus, plus the self-hosted SpamTitan Gateway virtual appliance; sold with PhishTitan as the “Secure” bundle - **Details:** https://www.thetechbag.com/titanhq/titanhq-spamtitan ### PhishTitan (TitanHQ) — TitanHQ - **Who it's for:** Microsoft 365 tenants, usually run by an MSP, that keep Microsoft’s filtering and add a phishing layer inside the mailbox with one-click clean-up across tenants. - **The honest limitation:** Microsoft 365 mail only, with no Google Workspace, Teams or Slack. An add-on layer, not a gateway, so pair it with SpamTitan or Defender. No published price. - **Price:** Quote — quoted; Microsoft 365 only, connected through the API and scanning internal and external mail behind Microsoft’s own filtering, with link rewriting, warning banners and tenant-wide post-delivery removal - **Details:** https://www.thetechbag.com/titanhq/titanhq-phishtitan ### TitanHQ SAT (formerly SafeTitan) — TitanHQ - **Who it's for:** MSPs that want awareness training and phishing simulation running across many small customers without building each campaign by hand. - **The honest limitation:** Training, not detection. Managed campaigns help only if someone reads the monthly reports, and no India-specific content or data residency is documented. - **Price:** Quote — quoted per user; short training modules with randomised phishing simulations, campaigns TitanHQ runs automatically at no extra cost, and monthly reports per customer - **Details:** https://www.thetechbag.com/titanhq/titanhq-sat ### Darktrace Email — Darktrace - **Who it's for:** Microsoft 365 or Google Workspace estates that keep the native filter and add behavioural detection for BEC, impersonation and account takeover, with response extended to Teams, Slack, Zoom and SharePoint. - **The honest limitation:** Not a gateway: it does not replace the MX filter, outbound encryption or continuity. Quote-only. No India hosting region is documented — the customer chooses an Azure or AWS region and Darktrace lists none in India. - **Price:** Quote — quoted per estate; sits outside mail flow (API plus connector and journaling — no MX change) across Microsoft 365, Google Workspace and hybrid or on-premises Exchange (on dedicated hardware); DMARC is a separate self-service SKU on Azure Marketplace - **Details:** https://www.thetechbag.com/darktrace/darktrace-email ### Aquila I CASA (Cyber Attack Simulation & Awareness) — Aquila I - **Who it's for:** Indian organisations that want simulation and training from one Indian vendor, including the SMS, QR-code and voice lures that email-only simulators miss. - **The honest limitation:** Training and measurement, not detection: it filters no mail. Which Indian languages the courses cover, and where results are hosted, are not published. - **Price:** Quote — quoted; phishing simulations over email, SMS, QR codes and voice, instant micro-training when a test is failed, role-based courses with assessment and accreditation, and a human-risk score per employee, group and organisation - **Details:** https://www.thetechbag.com/aquilai/aquilai-casa ### Aquila I DMARC (with BIMI) — Aquila I - **Who it's for:** Indian teams that want someone else to take their domains to DMARC enforcement and keep them there, with BIMI logos in the inbox once they arrive. - **The honest limitation:** Protects your domain’s reputation; filters nothing inbound. No public price, and BIMI needs a paid VMC certificate on top. - **Price:** Quote — quoted to scope; SPF, DKIM and DMARC deployment and upkeep run as a managed service, aggregate and forensic (RUF) report analysis and DNS monitoring, plus BIMI logo and VMC certificate management - **Details:** https://www.thetechbag.com/aquilai/aquilai-dmarc ### Fortra Cloud Email Protection — Fortra - **Who it's for:** Enterprises facing BEC and supplier fraud that want impersonation detection, a post-delivery purge across every inbox and Fortra analysts triaging user-reported mail, often alongside Fortra DLP or awareness training. - **The honest limitation:** No published price or stated meter; no Teams, Slack or shared-drive coverage documented; no India data region (the July 2026 hosting addition is for the EU); Fortra cites no current analyst ranking for it. - **Price:** Quote — quoted per user mailbox or by message volume, standalone or in Fortra’s Core, Advanced and Elite email bundles; API connection to Microsoft 365, Exchange and Google Workspace, with inline gateway functions per Fortra’s FAQ; EU hosting added July 2026, no India region published - **Details:** https://www.thetechbag.com/fortra/fortra-cloud-email-protection ### Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway) — Fortra - **Who it's for:** Regulated estates that must keep mail on infrastructure they control and want outbound DLP that redacts only the offending content, OCR on images included, instead of bouncing the message, with S/MIME, PGP or portal encryption. - **The honest limitation:** Not built for behavioural BEC detection (Fortra sells Cloud Email Protection for that); you run and patch the RHEL hosts; no collaboration-app coverage; no published price or meter; the optional Sophos cloud sandbox detonates files off-site. - **Price:** Quote — quoted; the licence meter is not published; self-hosted on your hardware, VMware or Hyper-V, Azure or AWS (RHEL stack) or Fortra-managed, so mail stays where you host it, which is a deployment choice rather than a Fortra India region; Exchange Gateway, ICAP Gateway and the Cryoserver archive sold alongside - **Details:** https://www.thetechbag.com/fortra/fortra-secure-email-gateway ### Fortra DMARC Protection (formerly Agari) — Fortra - **Who it's for:** Teams that want the vendor to host their authentication records and automate the move to p=reject, with spoofing of their own staff reported and DMARC data sent to Splunk, Sentinel or Cortex XSOAR. - **The honest limitation:** Guards the domains you own, not your inbox. No public price, no published hosting region, and BIMI is not documented. - **Price:** Quote — quoted alone or inside Fortra’s Advanced and Elite email bundles (priced by mailboxes or mail volume); Fortra-hosted DMARC, SPF and DKIM records, third-party sender alerts, and inbound DMARC visibility for Microsoft 365 and Exchange - **Details:** https://www.thetechbag.com/fortra/fortra-dmarc-protection ### Fortra Security Awareness Training (formerly Terranova Security) — Fortra - **Who it's for:** Organisations with a multilingual workforce, or an HR LMS that must host the courses as SCORM files, that want simulation and training run in-house or by Fortra’s managed team. - **The honest limitation:** Training, not detection. Simulations are documented for email only, the Indian languages among the 40 are not listed, and no hosting region is published. - **Price:** Quote — quoted per deal, cost varying with the services chosen; also sold as Human Risk Management in Fortra’s Core and Training & Response bundles; email phishing simulation with 300+ templates, courses and templates in 40 languages, a SCORM-compliant LMS and an optional managed service - **Details:** https://www.thetechbag.com/fortra/fortra-security-awareness-training ## Why each constraint rules out what it does The full narrowing logic, as prose. Nothing here is hidden behind an interaction. **API deployment.** Rules out N-able Mail Assure, Fortinet FortiMail, Forcepoint Email Security, INKY Email Security (Advanced · Pro), OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption), Symantec Email Security.cloud (Broadcom), SpamTitan Email Security (TitanHQ) and Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway) — MX gateway only; Proofpoint Email Fraud Defense (DMARC), Mimecast DMARC Analyzer, Aquila I DMARC (with BIMI) and Fortra DMARC Protection (formerly Agari) — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Engage (awareness training), Sophos Phish Threat, Kaspersky Security Awareness (ASAP), TitanHQ SAT (formerly SafeTitan), Aquila I CASA (Cyber Attack Simulation & Awareness) and Fortra Security Awareness Training (formerly Terranova Security) — awareness training, not a mail filter. That leaves Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Proofpoint Email Protection (Essentials · Core), Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Sophos Email, Check Point Email Security, Barracuda Email Protection, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Kaspersky Security for Mail Server / for Microsoft Office 365, Coro Email Protection, Heimdal Email Security, PhishTitan (TitanHQ), Darktrace Email and Fortra Cloud Email Protection. It flags Bitdefender GravityZone Extended Email Security — Deployment mode not documented — marked, not removed. **MX gateway deployment.** Rules out Abnormal Inbound Email Security, Check Point Email Security, Coro Email Protection, PhishTitan (TitanHQ) and Darktrace Email — API-only; it does not sit in front of the tenant; Abnormal Account Takeover Protection — an account-takeover add-on, not the mail filter; Proofpoint Email Fraud Defense (DMARC), Mimecast DMARC Analyzer, Aquila I DMARC (with BIMI) and Fortra DMARC Protection (formerly Agari) — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Engage (awareness training), Sophos Phish Threat, Kaspersky Security Awareness (ASAP), TitanHQ SAT (formerly SafeTitan), Aquila I CASA (Cyber Attack Simulation & Awareness) and Fortra Security Awareness Training (formerly Terranova Security) — awareness training, not a mail filter; Mimecast Collaboration Security — a collaboration add-on, not the mail filter. That leaves N-able Mail Assure, Proofpoint Email Protection (Essentials · Core), Mimecast Email Security (Cloud Gateway · Cloud Integrated), Sophos Email, Barracuda Email Protection, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Kaspersky Security for Mail Server / for Microsoft Office 365, Forcepoint Email Security, INKY Email Security (Advanced · Pro), OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption), Symantec Email Security.cloud (Broadcom), Heimdal Email Security, SpamTitan Email Security (TitanHQ), Fortra Cloud Email Protection and Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway). It flags Bitdefender GravityZone Extended Email Security — Deployment mode not documented — marked, not removed. **BEC and impersonation without a payload.** Rules out N-able Mail Assure, Kaspersky Security for Mail Server / for Microsoft Office 365, Symantec Email Security.cloud (Broadcom), Heimdal Email Security, SpamTitan Email Security (TitanHQ) and Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway) — anti-phishing and malware filtering; behavioural BEC detection not documented; Abnormal Account Takeover Protection — an account-takeover add-on, not the mail filter; Proofpoint Email Fraud Defense (DMARC), Mimecast DMARC Analyzer, Aquila I DMARC (with BIMI) and Fortra DMARC Protection (formerly Agari) — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Engage (awareness training), Sophos Phish Threat, Kaspersky Security Awareness (ASAP), TitanHQ SAT (formerly SafeTitan), Aquila I CASA (Cyber Attack Simulation & Awareness) and Fortra Security Awareness Training (formerly Terranova Security) — awareness training, not a mail filter; Mimecast Collaboration Security — a collaboration add-on, not the mail filter. That leaves Abnormal Inbound Email Security, Proofpoint Email Protection (Essentials · Core), Mimecast Email Security (Cloud Gateway · Cloud Integrated), Sophos Email, Check Point Email Security, Barracuda Email Protection, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Forcepoint Email Security, Coro Email Protection, INKY Email Security (Advanced · Pro), OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption), PhishTitan (TitanHQ), Darktrace Email and Fortra Cloud Email Protection. **Collaboration apps too.** Rules out N-able Mail Assure, Mimecast Email Security (Cloud Gateway · Cloud Integrated), Sophos Email, Barracuda Email Protection, Fortinet FortiMail, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Forcepoint Email Security, Coro Email Protection, INKY Email Security (Advanced · Pro), OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption), Symantec Email Security.cloud (Broadcom), Heimdal Email Security, SpamTitan Email Security (TitanHQ), PhishTitan (TitanHQ), Fortra Cloud Email Protection and Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway) — email only; no collaboration-app coverage; Abnormal Account Takeover Protection — an account-takeover add-on, not the mail filter; Proofpoint Email Fraud Defense (DMARC), Mimecast DMARC Analyzer, Aquila I DMARC (with BIMI) and Fortra DMARC Protection (formerly Agari) — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Engage (awareness training), Sophos Phish Threat, Kaspersky Security Awareness (ASAP), TitanHQ SAT (formerly SafeTitan), Aquila I CASA (Cyber Attack Simulation & Awareness) and Fortra Security Awareness Training (formerly Terranova Security) — awareness training, not a mail filter. That leaves Abnormal Inbound Email Security, Proofpoint Email Protection (Essentials · Core), Mimecast Collaboration Security, Check Point Email Security, Trend Micro Email Security / Vision One Email & Collaboration, Kaspersky Security for Mail Server / for Microsoft Office 365 and Darktrace Email. **Awareness training in the same contract.** Rules out N-able Mail Assure, Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Proofpoint Email Fraud Defense (DMARC), Mimecast DMARC Analyzer, Check Point Email Security, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Forcepoint Email Security, Symantec Email Security.cloud (Broadcom), Heimdal Email Security, Aquila I DMARC (with BIMI) and Fortra DMARC Protection (formerly Agari) — no awareness training from this vendor. That leaves Proofpoint Email Protection (Essentials · Core), Proofpoint Security Awareness, Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Mimecast Engage (awareness training), Sophos Email, Sophos Phish Threat, Barracuda Email Protection, Kaspersky Security for Mail Server / for Microsoft Office 365, Kaspersky Security Awareness (ASAP), Coro Email Protection, INKY Email Security (Advanced · Pro), OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption), SpamTitan Email Security (TitanHQ), PhishTitan (TitanHQ), TitanHQ SAT (formerly SafeTitan), Darktrace Email, Aquila I CASA (Cyber Attack Simulation & Awareness), Fortra Cloud Email Protection, Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway) and Fortra Security Awareness Training (formerly Terranova Security). It flags Proofpoint Email Protection (Essentials · Core) — Same vendor, separate SKU, Mimecast Email Security (Cloud Gateway · Cloud Integrated) — Same vendor, separate SKU, Mimecast Collaboration Security — Same vendor, separate SKU, Sophos Email — Same vendor, separate SKU, Kaspersky Security for Mail Server / for Microsoft Office 365 — Same vendor, separate SKU, INKY Email Security (Advanced · Pro) — Same vendor, separate SKU, OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption) — Same vendor, separate SKU, SpamTitan Email Security (TitanHQ) — Same vendor, separate SKU, PhishTitan (TitanHQ) — Same vendor, separate SKU, Darktrace Email — Same vendor, separate SKU, Fortra Cloud Email Protection — Same vendor, separate SKU and Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway) — Same vendor, separate SKU — marked, not removed. **On-prem or hybrid gateway.** Rules out N-able Mail Assure, Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Sophos Email, Check Point Email Security, Cloudflare Email Security (Area 1), Bitdefender GravityZone Extended Email Security, Coro Email Protection, INKY Email Security (Advanced · Pro), OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption), Symantec Email Security.cloud (Broadcom), Heimdal Email Security, PhishTitan (TitanHQ) and Fortra Cloud Email Protection — cloud-only service; Proofpoint Email Fraud Defense (DMARC), Mimecast DMARC Analyzer, Aquila I DMARC (with BIMI) and Fortra DMARC Protection (formerly Agari) — DMARC tooling, not a mail filter; Proofpoint Security Awareness, Mimecast Engage (awareness training), Sophos Phish Threat, Kaspersky Security Awareness (ASAP), TitanHQ SAT (formerly SafeTitan), Aquila I CASA (Cyber Attack Simulation & Awareness) and Fortra Security Awareness Training (formerly Terranova Security) — awareness training, not a mail filter. That leaves Proofpoint Email Protection (Essentials · Core), Barracuda Email Protection, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Kaspersky Security for Mail Server / for Microsoft Office 365, Forcepoint Email Security, SpamTitan Email Security (TitanHQ), Darktrace Email and Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway). It flags Trend Micro Email Security / Vision One Email & Collaboration — On-prem option not documented either way — marked, not removed. **Vendor-published list price.** Rules out N-able Mail Assure, Abnormal Inbound Email Security, Abnormal Account Takeover Protection, Proofpoint Email Fraud Defense (DMARC), Proofpoint Security Awareness, Mimecast Email Security (Cloud Gateway · Cloud Integrated), Mimecast Collaboration Security, Mimecast Engage (awareness training), Mimecast DMARC Analyzer, Sophos Email, Sophos Phish Threat, Check Point Email Security, Barracuda Email Protection, Fortinet FortiMail, Trend Micro Email Security / Vision One Email & Collaboration, Cloudflare Email Security (Area 1), Kaspersky Security for Mail Server / for Microsoft Office 365, Kaspersky Security Awareness (ASAP), Forcepoint Email Security, Coro Email Protection, INKY Email Security (Advanced · Pro), OpenText Core Email Threat Protection (formerly Zix and AppRiver, with Core Email Encryption), Symantec Email Security.cloud (Broadcom), Heimdal Email Security, SpamTitan Email Security (TitanHQ), PhishTitan (TitanHQ), TitanHQ SAT (formerly SafeTitan), Darktrace Email, Aquila I CASA (Cyber Attack Simulation & Awareness), Aquila I DMARC (with BIMI), Fortra Cloud Email Protection, Fortra Secure Email Gateway (formerly Clearswift SECURE Email Gateway), Fortra DMARC Protection (formerly Agari) and Fortra Security Awareness Training (formerly Terranova Security) — quote-only (reported ranges at most). That leaves Proofpoint Email Protection (Essentials · Core) and Bitdefender GravityZone Extended Email Security. **India data residency for mail content.** Documented: Proofpoint (India data centre, 2025) and Sophos Central (Mumbai). Not documented either way for the rest — Mimecast has no India region (a Singapore centre was announced in December 2025); Abnormal, Check Point, Barracuda, Trend, Cloudflare, Bitdefender, Kaspersky, Forcepoint and Coro publish no India region for mail content. Nothing is ruled out on it; ask where the message body is stored and scanned, in writing. **What Microsoft 365 and Google Workspace already filter.** Not a chip because it removes nothing from this list — it removes part of the purchase. Exchange Online Protection is in every Microsoft 365 plan; Defender for Office 365 Plan 1 (Safe Links / Attachments, anti-phishing) is in Business Premium and, from 1 July 2026, in E3; Plan 2 (Threat Explorer, automated investigation, attack simulation) is in E5. Gmail blocks 99.9% of spam, phishing and malware and exposes advanced phishing and malware controls in every edition. What neither does at depth is behavioural BEC detection, collaboration-app scanning and third-party DLP — that is the gap these products price. **Double-filtering.** Two filters in series (a gateway and the platform's own) is fine; two that both quarantine, with two admin consoles and two release paths, is the usual source of 'the mail never arrived'. Decide which one holds the quarantine before cut-over. ## Eight situations, eight shortlists — with the deployment decided first Every shortlist starts from your mail platform and whether MX may change. The filter is the second decision. ### Microsoft 365, a BEC scare, and no appetite to touch MX **Shortlist:** Abnormal Inbound Email Security, Check Point Email Security, Coro Email Protection **Why:** API-based behavioural detection sits behind Exchange Online Protection and Defender P1 without a gateway cut-over; Check Point can still block inline, Coro bundles it for SMBs. **Trade-off:** Abnormal's reported minimums rule out very small estates; API-only tools do not replace the gateway you may need for outbound DLP and continuity. ### Google Workspace estate **Shortlist:** Check Point Email Security, Abnormal Inbound Email Security, Trend Micro Email Security / Vision One Email & Collaboration **Why:** All three document Google Workspace API deployment (Check Point and Trend also cover Google Drive / collaboration); Gmail keeps the commodity filtering. **Trade-off:** Gateway-first vendors (Proofpoint, Mimecast, Barracuda, FortiMail) work on Google too — but via MX, with the cut-over that implies. ### Regulated — an on-prem or hybrid gateway, or an India data centre **Shortlist:** Forcepoint Email Security, Fortinet FortiMail, Proofpoint Email Protection (Essentials · Core) **Why:** Forcepoint and FortiMail ship appliances and VMs you own; Proofpoint documents an India data centre; Kaspersky and Barracuda also offer on-prem gateways. **Trade-off:** On-prem means you patch the gateway; an India region for cloud (Proofpoint, Sophos) may satisfy the regulator without the appliance — ask before you buy hardware. ### You already run Sophos, Trend, Kaspersky, Bitdefender or ESET on the endpoint **Shortlist:** Sophos Email, Trend Micro Email Security / Vision One Email & Collaboration, Kaspersky Security for Mail Server / for Microsoft Office 365 **Why:** Mail inside the console you already run (Sophos Central, Vision One, Kaspersky Security Center) — one agent estate, one vendor, and often one bundle price. **Trade-off:** Suite email is rarely the deepest BEC detection; if impersonation is the threat, layer an API tool on top rather than assume the suite covers it. ### Enterprise — gateway and API, layered **Shortlist:** Proofpoint Email Protection (Essentials · Core), Abnormal Inbound Email Security, Mimecast Email Security (Cloud Gateway · Cloud Integrated) **Why:** The common enterprise shape: a gateway (Proofpoint or Mimecast) for commodity threats, outbound DLP and continuity, plus an API behavioural layer (Abnormal, Check Point) for BEC. **Trade-off:** Two contracts, two consoles, one quarantine owner — decide which before cut-over or the double-filtering failure mode finds you. ### Teams, Slack and SharePoint are where the links now arrive **Shortlist:** Check Point Email Security, Mimecast Collaboration Security, Abnormal Inbound Email Security **Why:** Check Point covers Teams / SharePoint / OneDrive / Google Drive in the same policy; Mimecast sells Collaboration Security as an add-on; Abnormal extends to Slack, Teams and Zoom messaging; Trend and Kaspersky cover the Microsoft stores. **Trade-off:** Collaboration coverage is an add-on almost everywhere — price it as one; and the platform's own DLP for those apps may already be on your invoice. ### Awareness training and DMARC on the same contract **Shortlist:** Proofpoint Email Protection (Essentials · Core), Mimecast Email Security (Cloud Gateway · Cloud Integrated), Barracuda Email Protection **Why:** Proofpoint (Security Awareness + Email Fraud Defense), Mimecast (Aware + DMARC Analyzer) and Barracuda (awareness bundled at Premium Plus) put filter, training and domain protection under one vendor. **Trade-off:** Same vendor is not the same SKU — Proofpoint's and Mimecast's pieces are priced separately; Barracuda's bundle is tier-gated. Training bought and never run is the failure mode, whoever sells it. ### SMB — entry-tier price, short sales cycle **Shortlist:** Proofpoint Email Protection (Essentials · Core), Barracuda Email Protection, Forcepoint Email Security **Why:** Proofpoint's US MSRP sheet prices Essentials at $2.75–5.33 per user per month; Barracuda and Forcepoint publish no list, so get their quotes side by side. **Trade-off:** Entry tiers are gateway filtering; BEC behavioural AI and collaboration coverage cost more at every vendor — check which tier you are actually pricing. ## At scale Mail security scales by mailboxes and by the number of domains, tenants and collaboration apps in scope — and by how many people will answer user reports. ### 250 mailboxes — The floor plus one layer - What the platform includes is most of the answer; an API behavioural layer or a published-price gateway is the purchase. - Abnormal's reported minimums rule it out; Proofpoint Essentials, Barracuda, Forcepoint, Coro and the suite vendors are priced for this band. - One admin owns the quarantine and the user-report queue. **The test:** Send yourself a payload-free impersonation from a lookalike domain during the trial; count which layer caught it. ### 2,000 mailboxes — Domains, DLP and the report queue - Multiple domains and DMARC enforcement become a project; outbound DLP starts to matter — which pulls toward a gateway or the platform's own DLP. - User-reported phish at this size needs triage tooling or it becomes noise. - Collaboration apps are now in scope whether you bought coverage or not. **The test:** Run DMARC to p=reject on one domain; measure the user-report volume for a month and who triaged it. ### 20,000 mailboxes — Architecture, residency and two layers - Gateway plus API is the common shape; continuity and archiving are separate decisions with their own vendors. - Data residency for mail content becomes a board question — two vendors document an India centre. - Tenant consolidation and M&A mean the filter must handle many tenants and many MX records. **The test:** Test cut-over on a pilot domain with full rollback; confirm where the message body is scanned and stored, in writing. Proofpoint, Mimecast, Barracuda, Trend, Sophos, Check Point, Cloudflare, Kaspersky and Forcepoint document very large estates; Abnormal does too (enterprise-first); Coro is SMB-positioned; Bitdefender’s email product is new (April 2026). Where a specific filter strains for your estate: [TechBag to confirm]. ## Switching filters is a DNS change — or an API revoke — plus everything you tuned The technical swap is small; the policy, the allow-lists, the quarantine history and the users’ habits are what move slowly. **MX gateway** — Lower TTL, point MX at the new gateway, keep the old for a week, then remove it and lock the tenant connector to the new IPs. A DNS change with a project around it. *(DNS + connector)* **API product** — Authorise the new app, run both for a fortnight in report-only, revoke the old. The lightest switch in security. *(Authorise / revoke)* **Policies and allow-lists** — Impersonation lists, trusted senders, DLP rules and quarantine policies are rebuilt by hand — no import format. *(Rebuild)* **Quarantine and reports** — Quarantined mail, investigation history and user-report records stay in the old console. Export or release what you need before it closes. *(Export or lose)* **Cut-over plan and rebuild hours for your tenant:** [TechBag to confirm] — TechBag scopes it from your domains, policies and collaboration apps in scope. ## Per mailbox per month, layered on what you already pay for What your tenant already includes, what the filters cost in USD and INR at three estate sizes, and what the licence leaves out. ### Do you already own one? Four licences you may hold already filter mail. Usually they are the floor, not the answer — but know the floor. - **Microsoft 365 — Partly.** Exchange Online Protection everywhere; Defender for Office 365 P1 in Business Premium and (from 1 July 2026) E3; P2 in E5. Commodity filtering, Safe Links / Attachments, basic impersonation — not behavioural BEC AI, not third-party DLP. - **Google Workspace — Partly.** Gmail blocks 99.9% of spam, phishing and malware with advanced controls in every edition. Behavioural BEC, collaboration-app scanning and DLP depth are what the products here add. - **Your endpoint suite — Often.** Sophos Email, Trend, Kaspersky, Bitdefender and ESET PROTECT Complete bundle mail filtering with the endpoint contract. Read the tier — it is rarely the deepest BEC detection. - **Your SASE / CDN — Sometimes.** Cloudflare Zero Trust includes Email Security; Cisco and Fortinet bundle mail into their platforms. If you already pay, ask what is switched on. If the plan you hold already does the job, we say so before the quote — and then show you the message it would have missed. ### What the rest actually cost Published and reported prices normalised to per mailbox per month (INR for scale), then worked at 250 / 2,000 / 20,000 mailboxes. The platform’s own add-ons are in the grid because they are the honest comparator. ### What isn't in the licence price - **The cut-over.** An MX change with rollback, connector lock-down and a week of dual-running; or an API authorisation and a fortnight in report-only. People-hours, not licence dollars — in [the switching-cost section](#migration); your number is [TechBag to confirm]. - **The quarantine owner and the report queue.** Someone releases quarantined mail and triages user reports every working day. At 2,000 mailboxes that is a role, not a task — and two products with two quarantines doubles it. - **Training that nobody runs.** Awareness SKUs bundled or separate (Barracuda, Coro bundle; Proofpoint, Mimecast, Sophos, Kaspersky sell separately) need a person to schedule simulations and read the results. Budget the hour a month or skip the SKU. ## What goes wrong Documented deployment behaviour, cross-checked against TechBag engagements before any becomes a named case. Most of these are seams, not products. - **Double-filtering with the native platform.** A gateway and Defender / Gmail both quarantining, two consoles, two release paths. 'The mail never arrived' — decide which product owns the quarantine before cut-over. - **MX record changes during a gateway cutover.** TTL not lowered, no rollback record, tenant connector not locked to the gateway — mail bounces or bypasses for a day. A DNS change is a project. - **API deployments that only scan post-delivery.** The message was read in the seconds before removal. If that window matters, choose an inline-capable API (Check Point) or a gateway. - **Awareness training bought and never run.** The SKU was on the quote; nobody scheduled a simulation. The cheapest line in the contract and the most often wasted. - **BEC assumed covered by the suite.** The endpoint suite's mail tier filtered malware well and missed the supplier's changed bank details. Behavioural detection is the top tier or a separate vendor. - **Collaboration apps left out of scope.** The link arrived in Teams; the contract said mail. Coverage beyond mail is an add-on almost everywhere. - **Your own domain spoofed.** No inbound filter stops a spoof of you arriving at your customers. DMARC to enforcement is a separate project — Proofpoint EFD, Mimecast DMARC Analyzer, or your platform. - **Residency assumed.** Two vendors document an India data centre for mail content. For the rest, where the message body is scanned and stored is a question to ask in writing — not a box on the datasheet. ## Questions this guide answers ### What is the difference between gateway and API email security? A gateway takes your MX record and filters mail before it reaches Microsoft 365 or Google — pre-delivery blocking, outbound DLP and continuity, with a DNS cut-over. An API product reads mailboxes through Microsoft Graph or Google APIs — no MX change, live in an hour, visibility into internal and collaboration traffic; some remove messages seconds after delivery, others (Check Point's inline mode) block before the user sees them. Many vendors now offer both; enterprises often run one of each. ### Does Microsoft 365 already include email security? Yes, a floor: Exchange Online Protection in every plan; Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing) in Business Premium and, from 1 July 2026, in E3; Plan 2 (Threat Explorer, automated investigation and response, attack simulation) in E5. Standalone P1 is about $2 and P2 $5 per user per month. What it lacks at depth is behavioural BEC detection, collaboration-app scanning and third-party DLP. ### Which email security vendors document an India data centre? Proofpoint (India data centre, launched 2025) and Sophos (Sophos Central Mumbai region). Mimecast has no India region and has only announced a Singapore centre; Abnormal, Check Point, Barracuda, Trend Micro, Cloudflare, Bitdefender, Kaspersky, Forcepoint and Coro publish no India region for mail content — ask in writing before assuming. --- *Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.* *TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/security/email-security*