IRONSCALES is an AI-driven email security platform from IRONSCALES that detects and automatically remediates phishing, business email compromise and account takeover across Microsoft 365 and Google Workspace, sold on quote-only pricing with no published per-mailbox rate.
Listing updated . Checked by MSP Software .
IRONSCALES is an AI-driven email security platform from IRONSCALES for organisations that want phishing, business email compromise (BEC) and account takeover protection layered on top of Microsoft 365 or Google Workspace without changing mail routing. The platform connects by API rather than sitting as a gateway in front of the mail flow, so setup does not require MX record changes. Its self-learning detection model, paired with an agentic automation layer the vendor calls Themis, classifies and remediates threats across mailboxes, and is informed by a crowdsourced network the vendor says covers more than 36,000 security professionals. Coverage extends to malware and URL scanning, QR code and deepfake-based attacks, hosted DMARC and SPF management, and outbound email encryption and data loss prevention on its higher tiers.
IRONSCALES sells three business plans (Email Essentials, Email Protect and Email Protect 360) and separate MSP and MSSP plans (Email Protect, Email Protect Pro and Complete Protect), with encryption, DLP, DMARC management and account takeover protection appearing as add-ons on some tiers rather than included throughout. A Human Risk Management module, covering phishing simulation and security awareness training with per-user risk scoring, is sold as an add-on and bundled into Complete Protect. None of these plans carry a published price; every pricing page routes to a quote request, so starting_price_minor is not available (checked September 2026), though a free trial and a free email health scan are offered and there is no free version. IRONSCALES integrates with SIEM, SOAR, XDR and EDR platforms including Splunk, Microsoft Sentinel, IBM QRadar and Cortex XSOAR, and with identity providers including Okta, Microsoft Entra ID and Ping Identity, on top of its native Microsoft 365 and Google Workspace connections.
IRONSCALES is based in Atlanta, Georgia, and was founded in 2014. MSPs evaluating it should get a written quote covering the specific plan and add-ons they need, since encryption and DLP are not included on every tier, and should confirm during a demo which security-awareness features (such as automated post-simulation training or client-facing reports) their MSP plan actually includes, since the vendor does not document all of them publicly.
IRONSCALES suits an MSP or MSSP that wants API-based, mailbox-level email protection layered on top of Microsoft 365 or Google Workspace, with security awareness training and phishing simulation available from the same vendor rather than a separate tool. Because pricing is quote-only and features such as encryption, DLP and DMARC management shift between plans and add-ons, get the quote broken down by feature before comparing it against Mimecast, Proofpoint Essentials or Microsoft Defender for Office 365. On a demo, ask specifically about the multi-tenant MSP dashboard, what the Email Incident Management Service add-on covers, and whether self-service quarantine and continuity are available, since none of these are documented on the public site.
Coro A consolidated SMB and MSP cybersecurity platform sold via partners on quote-only, per-user pricing. No reviews yet 
Vade AI email security for Microsoft 365 with bundled contextual security awareness training. No reviews yet 
Barracuda Email Protection Cloud email security, archiving and awareness training bundled into three tiers, priced by quote only. No reviews yet 
Guardz Unified MDR, endpoint, email and identity security for MSPs, priced per user on request. No reviews yet All alternatives to IRONSCALES| Feature | Supported | Note |
|---|---|---|
| Phishing and malware filtering | yes | AI-powered phishing, BEC and VIP impersonation detection across Microsoft 365 and Google Workspace, backed by crowdsourced threat intelligence the vendor says covers 36,000+ security professionals. |
| Spoofing and impersonation protection | yes | Detects business email compromise, VIP/vendor impersonation and account takeover, with agentic automated remediation. |
| Email continuity | unknown | No email continuity or mail-flow failover feature is documented on the vendor site. |
| Archiving | unknown | No archiving feature is documented on the vendor site. |
| Security awareness training bundle | yes | Human Risk Management module (phishing simulation, training content, per-user risk scoring) sold as an add-on and bundled into the Complete Protect plan. |
| API-based post-delivery scanning | yes | API-based, mailbox-level integration with Microsoft 365 and Google Workspace; the vendor says no MX record changes are required. |
| DMARC monitoring | yes | Hosted DMARC and auto-flattening hosted SPF, with real-time authentication analytics; sold standalone or as an MSP Protect Pro add-on. |
| Attachment sandboxing | unknown | No built-in detonation sandbox is documented; the vendor lists Check Point SandBlast as a third-party integration for this instead. |
| Data loss prevention | yes | Email DLP is included in the Email Protect 360 business plan and offered as an add-on on the MSP Protect Pro plan. |
| Email encryption | yes | Outbound email encryption is included from Email Protect 360 up, and as an add-on on MSP Protect Pro. |
| Microsoft 365 integration | yes | Native API integration with a vendor-stated 3-click setup. |
| Self-service quarantine | unknown | No self-service quarantine feature for end users is documented on the vendor site. |
| Feature | Supported | Note |
|---|---|---|
| Phishing simulation campaigns | yes | Hyper-personalised, GPT-powered simulations targeted at high-risk employees and VIPs using social graph analysis. |
| Training content library | yes | Security awareness training modules are part of the Human Risk Management offering. |
| Automated remediation training | unknown | Vendor describes tailoring simulations to a user's risk profile but does not document automatic training assignment after a failed test. |
| Phish-reporting button | yes | Report Phishing add-in for Outlook, with an AI Copilot guiding the reporting user. |
| Multi-language content | unknown | Not documented on the vendor site. |
| Compliance training modules | unknown | Not documented on the vendor site. |
| Client-facing reporting | unknown | Not documented specifically for the Human Risk Management module. |
| Microsoft 365 and Google user sync | unknown | Not documented specifically for the Human Risk Management module. |
| Smishing and vishing simulation | unknown | Not documented on the vendor site. |
| Gamification | unknown | Not documented on the vendor site. |
| Campaign scheduling automation | unknown | Not documented on the vendor site. |
| PSA integration for billing | unknown | Not documented on the vendor site. |
IRONSCALES does not publish a per-mailbox or per-user price for any of its plans. Every plan, on both the business side (Email Essentials, Email Protect, Email Protect 360) and the MSP/MSSP side (Email Protect, Email Protect Pro, Complete Protect), routes to a quote request rather than a listed figure (checked September 2026). MSPs should get a written quote that specifies which add-ons, such as encryption, DLP and DMARC management, are included.
Yes, IRONSCALES offers a free trial through a request form on its site, along with a free email health scan and product tours. There is no separate free version of the product once a trial period ends, so ongoing use requires a paid subscription on one of its quote-only plans.
Yes, IRONSCALES sells a Human Risk Management module covering phishing simulation, security awareness training content and per-user risk scoring. It is offered as an add-on and is bundled into the Complete Protect plan on the MSP/MSSP side, rather than being included in every plan by default.
IRONSCALES connects to Microsoft 365 and Google Workspace through their native APIs at the mailbox level, rather than sitting in front of mail flow as a secure email gateway. The vendor says this means no MX record changes are needed and setup can be completed in a few clicks, which also lets it scan mail post-delivery and remediate threats retroactively across mailboxes.
IRONSCALES documents integrations with SIEM, SOAR, XDR and EDR platforms, including Splunk, Microsoft Sentinel, IBM QRadar, Palo Alto Networks Cortex XSOAR and CrowdStrike Falcon, plus identity providers including Okta, Microsoft Entra ID and Ping Identity. MSPs should confirm the current integration list for their specific stack, since coverage can change.
Reviews are moderated. How reviews work.
Share what it is like to use this product day to day. Your experience helps other MSPs choose with confidence.
Write the first review
