- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Heimdal Email Security
The mail platform catches bulk spam. The supplier email with new bank details is the one that costs money — Heimdal Email Security scans inbound and outbound mail as an MX gateway or through a Microsoft 365 connector, with sandboxing, sender authentication checks, a year of cloud archive and an add-on for payment fraud.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Heimdal platform family
This page covers Heimdal Email Security — the mail filter, with the Email Fraud Prevention add-on folded in. The rest:
Quick facts
30-second orientation- Product
- Cloud mail filter for inbound and outbound mail, deployed by MX record or a Microsoft 365 connector
- Maker
- Heimdal, Copenhagen, founded 2014; acquired by Marlin Equity Partners in 2020; CEO Jesper Frederiksen
- Tiers
- “Email Security 365” and “Email Security ATP & Fraud Prevention”, as named on Heimdal’s product page
- Price
- No published price; quote only, with a free trial offered before you commit
- Licence unit
- Heimdal’s calculator says per device per year; TechBag confirms whether that means mailboxes
- Mail platforms
- Microsoft 365 and Google Workspace are both named; the no-MX connector mode is for Microsoft 365
- Archive
- 365 days of cloud archiving, listed among the filter’s features
- Fraud add-on
- Email Fraud Prevention: 125 analysis vectors, switched on inside Email Security settings
- India
- No India data region; tenant data in Europe, US, UK or UAE; Mumbai office for sales and support
- In India via
- TechBag — mail-flow review, quote in INR with GST, cut-over and coexistence plan
Understand email security before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is a cloud email filter?
A hosted service that checks every message for spam, phishing, malware and forged senders before users see it.
The mail platform’s own filter alone vs Heimdal Email Security — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | The mail platform’s own filter alone | Heimdal Email Security |
|---|---|---|
| Where mail is checked | Only by the mail platform’s defaults | At Heimdal, by MX record or M365 connector |
| Invoice and CEO fraud | Left to staff noticing the odd detail | 125 fraud vectors with the add-on |
| Forged senders | Authentication results rarely acted on | SPF, DKIM and DMARC tested on arrival |
| Mail kept for audit | Whatever users have not deleted | 365 days in Heimdal’s cloud archive |
| Outgoing mail | Leaves the building unscanned | Outbound scanning in the gateway path |
| What it is NOT | — | Collaboration-app cover, an India region, a list price |
The cheapest test is the free trial: put a finance team behind the filter for a month and count the fraud attempts it flags.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
MX gateway
Repoint the domain’s MX record to Heimdal and every inbound message is scanned before it reaches Microsoft 365, Google Workspace or your own server; outbound mail can route through it too.
M365 connector
Microsoft 365 tenants can skip the DNS change: Heimdal documents a connector mode in which mail is handed to the filter while the MX record keeps pointing at Microsoft.
Scan engines
Anti-spam with greylisting, anti-phishing and malware scanning run on incoming mail, attachments can go to a sandbox, and senders are tested against SPF, DKIM and DMARC.
Fraud and archive
Email Fraud Prevention, a separate calculator line, applies 125 analysis vectors to mail already flowing through the filter; the product also keeps 365 days of mail in a cloud archive.
A hosted mail filter reached by MX record or M365 connector — with a fraud add-on that only reads mail it already filters.
Nine capabilities. Filter, verify, govern.
Heimdal Email Security checks every message before users see it — by MX record or Microsoft 365 connector.
Spam held back by greylisting
Spam filtering is paired with greylisting, which defers first attempts from unknown senders, so bulk-mail bots that never retry fall away.
Phishing and malware scans
Incoming mail is checked for phishing and scanned for malware before delivery, whether it reached Heimdal by MX record or the M365 connector.
Attachments opened in isolation
Sandboxing is listed among the filter’s engines, for attachments whose intent a signature scan alone cannot settle before they are delivered.
SPF, DKIM and DMARC tested
Senders are tested against their SPF, DKIM and DMARC records, so mail forged from a domain that publishes a strict policy can be stopped.
125 checks for payment fraud
Email Fraud Prevention runs 125 unique analysis vectors against BEC, CEO impersonation and messages that alter invoice or account numbers.
Alerts after the inbox
Post-delivery alerts are on Heimdal’s feature list, so a message recognised as harmful once it has landed is still raised to an administrator.
Outgoing mail scanned too
Outbound scanning means a hijacked mailbox has a harder time pushing phishing or malware on to your customers and suppliers.
A year of mail kept
Heimdal lists 365 days of cloud archiving, a copy of a year’s mail held apart from the mailboxes users can delete from.
Storage region chosen per tenant
Tenant data is stored in the region picked for the customer — Europe, the US, the UK or the UAE — and no Indian region is offered today.
Watch Heimdal Email Security in action
Heimdal’s recommended filter settings, setting up inbound and outbound mail flow, and a 2026 explainer on mailbox forwarding-rule risk.
Heimdal Email Security Recommended Settings
The configuration Heimdal recommends for its mail filter — a useful checklist for the first week after cut-over.
Email Security - Inbound & Outbound setup
Setting up inbound and outbound mail flow through Heimdal Email Security, step by step.
How to Prevent Email Forwarding Rules Risks
A topical Heimdal explainer on mailbox forwarding rules, a quiet way stolen mail keeps leaving an organisation.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Most fraud arrives as a polite email. Heimdal checks mail and payment requests before they reach the inbox.
Here’s what genuinely sets it apart — and exactly where it stops.
Two ways to put it in the mail path
It can sit in front of your mail server as a classic MX gateway, scanning traffic both ways, or take Microsoft 365 mail through a connector so the MX record never moves. A cautious team can pilot without a DNS cut-over and decide later whether the gateway route is worth it.
Fraud checks aimed at the money
The costly email often carries no attachment: a supplier’s ‘new bank details’ or a director’s urgent transfer. Email Fraud Prevention applies 125 analysis vectors to BEC, CEO fraud and account-number changes, but Heimdal’s KB says it reads only mail passing through Email Security.
Mail on the same platform as the endpoints
Email is one module of Heimdal’s unified platform, and its XDR is described as spanning email beside endpoint, network, vulnerability and PAM. If Heimdal already guards your laptops, the filter joins the same vendor and contract, with a REST API for the rest.
Where it stops
No price is published, and ‘per device per year’ is an odd unit for mail, so confirm the count. There is no India data region, no documented Teams or Slack cover, no awareness-training product, and no analyst placement in email security.
The numbers behind the platform
What your Heimdal Email Security rollout looks like
Map how mail flows today
List domains, the mail platform, existing connectors and every system that sends mail, then choose MX gateway or connector.
Pin down unit and tier
Get the licence count agreed in writing — devices or mailboxes — and decide whether the ATP & Fraud Prevention tier is needed.
Pilot on a few mailboxes
Run the free trial on a finance team and IT, watch quarantine daily and allow-list the partners greylisting slows down.
Cut over and tune
Move MX or widen the connector to all users, check SPF, DKIM and DMARC outcomes, and make sure outbound mail routes cleanly.
Turn on fraud checks
Enable Email Fraud Prevention, agree who handles bank-detail alerts, and confirm how the 365-day archive is searched and exported.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We started on the Microsoft 365 connector so DNS stayed put; two months later we moved MX across once quarantine felt right.”
“A ‘vendor’ asked accounts to update bank details. Fraud Prevention flagged the change before anyone keyed the new number.”
“Greylisting cut the junk noticeably, though one partner’s bulk mailer was delayed until we allow-listed its server.”
“Having laptops and mail with the same vendor helped; the email screens still feel separate from the endpoint views.”
“The year of archive answered an auditor’s request without restoring old mailboxes. Ask how export works before you sign.”
“Our quote counted devices, not mailboxes, and shared inboxes muddied it. Get the unit pinned down in writing early.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the email security market — tap any vendor to see why it sits where it does.
TechBag Email Security Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote only; one module of Heimdal’s 12+-product platform.
Deployment Choice × Fraud Depth
The grid nobody publishes — how many ways a filter can enter the mail path vs how deeply it checks for BEC and payment fraud.
MX or M365 connector; 125-vector fraud add-on.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Heimdal Email Security vs the email security field
Against Sophos Email, Proofpoint Email Protection, Mimecast, Bitdefender GravityZone Extended Email Security and Coro — on deployment, coverage, price, fraud detection, archive, lock-in and India.
| Dimension | Heimdal Email Security | Sophos Email | Proofpoint Email Protection | Mimecast Email Security | Bitdefender GravityZone Extended Email Security | Coro Email Protection |
|---|---|---|---|---|---|---|
| What it is | Cloud mail filter | Mail in Sophos Central | Gateway plus API layers | Gateway or integrated | New in April 2026 | Module of a suite |
| Deployment | MX or M365 connector | Gateway or M365 API | Gateway, API, appliance | SEG or Microsoft API | Gateway + API, thin docs | API only |
| Mail and app coverage | M365 and Google, mail | Mail only | Mail plus collaboration | Collab is an add-on | Mail only | Collab separate |
| Pricing model | Per device per year | Per user | Per user per month | Per user, S1–S3 | Bundle listing | Per user |
| Published entry price | Not published | ~$28–48/user/yr | $2–5.86/user/month | ~$5–15/user/month | $479.47 a year | ~$10.50/user (old) |
| Included vs add-on | Fraud is its own line | Training included | Suite pieces add up | Archive, DMARC extra | Bundle with endpoint | Awareness bundled |
| Scale and limits | No limits published | Not published | SMB to enterprise | 42,000+ customers | Small listing only | SMB and mid-market |
| Detection and BEC | Sandbox + 125 vectors | AI phishing, BEC | Gateway + behavioural | Click-time, sandbox | Pre- and post-delivery | Solid, not deepest |
| Console and integrations | Heimdal platform, API | Sophos Central + XDR | Human-risk platform | Human Risk platform | GravityZone console | The Actionboard |
| Admin and governance | SSO not documented | Not published | DLP and archiving | Archive, legal hold | Not documented | Protection first |
| India storage region | No India region | Mumbai region | Mumbai data centre | Not documented | Not documented | Not documented |
| Support in India | Mumbai office | Via partners | Via partners | Via resellers | Local distributor | No India entity |
| Lock-in and exit | Ask about archive export | Tied to Central | Suite gravity | Archive is the anchor | Bundled with endpoint | API disconnects |
| Best fit | Heimdal endpoint estates | Sophos estates in India | Enterprise, India data | Archive-led buyers | GravityZone shops | Lean SMB teams |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Heimdal Email Security if…
- ✓Heimdal already protects your endpoints and you want mail filtering from the same vendor and platform
- ✓Invoice and bank-detail fraud is the email risk that worries your finance team most
- ✓You want to pilot on Microsoft 365 through a connector before deciding on an MX cut-over
Compare alternatives if…
- ✓Email data must stay in India — Proofpoint and Sophos both document a Mumbai region
- ✓Teams, Slack or SharePoint links are a live threat — Proofpoint and Mimecast’s add-on cover them
- ✓Budgeting needs a printed rate card — Proofpoint lists Essentials seats from $2 a month
Do not expect…
- ✓Email Fraud Prevention to inspect mail that bypasses Heimdal’s own filter
- ✓A published price, or a per-mailbox unit stated on Heimdal’s calculator
- ✓A Gartner Magic Quadrant placement — Heimdal has none in email security
Heimdal Email Security is one of 30 email security products TechBag carries. The Email Security guide narrows them to a shortlist and shows the reasoning. →
What does unfiltered email cost you?
Drag the sliders (mailboxes protected; IT-hour cost). Estimates model IT and finance time spent on spam triage, phishing clean-up and checking suspicious payment requests at an assumed 1.5 hours per mailbox a year, with 70% of it removed by filtering and fraud checks before delivery. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Heimdal publishes no price for Email Security or Email Fraud Prevention; its calculator lists both per device per year, an unusual unit for mail, so TechBag confirms how mailboxes are counted. A free trial comes first. TechBag maps your mail flow, then quotes in INR with GST.
Email Security 365
Best for filtering, sandbox and archive
- Quote only; no published price
- MX gateway or Microsoft 365 connector
- 365 days of cloud archiving listed
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Email Security ATP & Fraud Prevention
Best where invoice and CEO fraud is the worry
- Quote only; Fraud Prevention is its own line
- 125 analysis vectors for BEC and payment fraud
- Works only on mail through Heimdal’s filter
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Will mail arrive by MX record or through the Microsoft 365 connector, and who owns the DNS change if you move later?
Does the quote count devices or mailboxes, and how are shared, service and room mailboxes counted?
Is Email Security 365 enough, or do you need the ATP & Fraud Prevention tier for BEC and invoice fraud?
Is all inbound mail passing through Heimdal’s filter? Email Fraud Prevention only inspects mail that does.
Is storage in Europe, the US, the UK or the UAE acceptable under your DPDP Act and sector obligations?
Do Teams, Slack or SharePoint links need cover? Heimdal documents none, so budget a separate tool if so.
Is 365 days of cloud archive enough for your retention rules, and how is it exported if you leave?
Which Microsoft or Google filtering stays on, and who owns quarantine so mail is not double-filtered?
Questions buyers ask
Ready to evaluate Heimdal Email Security?
Map your mail flow and licence unit first, or let a TechBag advisor run a trial on your finance team’s mailboxes through the Microsoft 365 connector.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.