The Situation

You run Microsoft 365. You may already have Defender for Office 365, or a gateway such as Proofpoint or Mimecast that you've had for years. Now vendors are pitching API-based tools that promise to catch what your current setup misses, especially business email compromise. Do you replace, add or stay put?

Start with the architecture. The brand comes second.

Option 1: Secure Email Gateway (SEG)

How it works: You point your domain's MX record at the gateway. All inbound mail goes there first, gets scanned, and the clean mail is passed on to Microsoft 365.

Good at:

  • Stopping known-bad mail before it reaches any mailbox
  • Detailed policy controls, encryption, data loss prevention and, with some vendors, long-term archiving
  • Consistent control if you run more than one mail platform

Weaker at:

  • Internal email. Mail between two of your own users never passes through the gateway.
  • Compromised partner accounts. A message from a real supplier's real account passes most authentication checks.
  • Setup and changes. Mail-flow changes, connector rules and keeping Microsoft's own filtering configured correctly alongside it.

Common examples: Proofpoint, Mimecast, Cisco Secure Email and Barracuda, several of which now offer API add-ons too.

Option 2: API-Based Email Security

How it works: The tool connects to Microsoft 365 through Microsoft's APIs. No MX change. It scans mail in the mailbox, builds a baseline of normal behavior for each person and supplier, and removes or flags messages that don't fit. Analysts sometimes call this category integrated cloud email security (ICES).

Good at:

  • Business email compromise and vendor fraud, because it knows what normal looks like for each relationship
  • Internal and lateral phishing from compromised accounts
  • Fast deployment, often the same day, with a retrospective scan of existing mail

Weaker at:

  • It typically acts just after delivery, so there's a short window before removal
  • It usually relies on Microsoft's own filtering as the first layer
  • Archiving and outbound encryption aren't its focus

Common examples: Abnormal, Check Point Harmony Email & Collaboration (formerly Avanan), Sublime Security, and API modes from Proofpoint, Mimecast and others.

Where Defender for Office 365 Fits

Microsoft's own filtering processes all your mail no matter what else you add. Defender for Office 365 Plan 1 adds protections such as Safe Links and Safe Attachments. Plan 2, included in Microsoft 365 E5, adds investigation and automated response tools plus attack simulation training.

Many companies under-use what they have. Before buying anything, check that preset security policies are applied, impersonation protection is set up for executives and key suppliers, and user-reported messages are actually reviewed.

The Three Common Setups

Setup Best for Watch for
Defender for Office 365 alone, tuned well Microsoft-standard companies with modest risk and limited budget Needs real configuration and someone reviewing reports
Defender plus an API-based tool Companies whose main concern is BEC, invoice fraud or supplier compromise Two consoles. Decide which tool handles user reports.
SEG plus Defender, sometimes plus API Heavily regulated firms, complex mail routing, archiving or encryption needs Most cost and admin effort. Watch for double-filtering problems.

How to Decide

  1. Name the threat that worries you most. Mass phishing and malware? A well-tuned Defender setup or a gateway handles most of it. Payment fraud and impersonation? Look hard at API-based tools.
  2. List the extras you depend on. If you use a gateway for archiving, encryption or compliance journaling, price replacements before you remove it.
  3. Run a retrospective scan. Most API vendors will scan the last few weeks of mail and show what got through your current setup. It's the most revealing test in email security, and usually free.
  4. Test user reporting. Report a test phish and see how long it takes to be pulled from every inbox.
  5. Compare three-year cost, including any archiving you'd need to replace and the admin time for each option.

What to Do Next

Pull your Microsoft 365 license list and confirm which Defender for Office 365 plan you have. Then ask one API-based vendor for a free retrospective scan. Those two facts will tell you more than any demo.

Buying or renewing soon? Stackcurve advisors help IT leaders compare vendors, benchmark pricing and negotiate contracts at no cost to you. Talk to an advisor → or get your free Cyber-Ready Score →

← Back to Blog

Stackcurve is independent. No vendor pays for placement or editorial influence on this blog.