Email security

Email security sits in front of or alongside a client's mailbox platform and filters phishing, malware and business email compromise attempts that native Microsoft 365 or Google Workspace filtering misses, particularly targeted attacks that impersonate a real contact rather than obvious spam. Coverage typically includes spoofing and impersonation protection, attachment sandboxing, and either inline filtering before mail is delivered or API-based scanning that reviews mail after it lands and can pull back a malicious message. Email continuity, keeping mail flowing during a platform outage, and archiving for compliance or e-discovery are common additions but are separate features, not guaranteed with every product. It does not cover general security awareness training as its core job, though several vendors bundle a training module.

Pricing is per mailbox or per user per month in most cases, with some vendors bundling continuity and archiving into a higher tier rather than pricing them separately. Volume discounts are common at higher mailbox counts.

Phishing and malware filtering plus spoofing and impersonation protection are the baseline; beyond that, decide whether you need inline filtering, API-based post-delivery scanning, or both, since the two approaches catch different things and some vendors only offer one. DMARC monitoring helps stop a client's own domain being spoofed by others, which is a different problem from filtering incoming mail. Data loss prevention and email encryption matter for clients in regulated industries, and self-service quarantine, letting a user release their own falsely flagged mail, reduces support tickets if configured carefully.

Microsoft 365 integration is the connection that matters most, since most MSPs' clients run on Microsoft 365 and the product needs to work with its mail flow and authentication without breaking native features. Security awareness training integration matters if you want phishing simulation results and filtering data in one place rather than two separate reports for a client.

Ask whether pricing is per mailbox or per user, and what happens when a client's mailbox count changes mid-contract. Ask whether continuity and archiving, if needed, are included or billed as separate add-ons, and what the contract term and any minimum mailbox count are.

A small MSP with mostly Microsoft 365 clients on standard plans can usually cover the baseline risk with straightforward filtering and impersonation protection, without needing continuity or archiving for every client. A larger MSP serving clients in regulated industries or with compliance obligations more often needs data loss prevention, encryption and archiving as standard, and benefits from a vendor that bundles those rather than stacking separate products.