# IRONSCALES > API-based phishing and BEC protection for Microsoft 365 and Google Workspace, quote-based. IRONSCALES is an AI-driven email security platform from IRONSCALES that detects and automatically remediates phishing, business email compromise and account takeover across Microsoft 365 and Google Workspace, sold on quote-only pricing with no published per-mailbox rate. Listing updated 6 September 2026. Checked by MSP Software 6 September 2026. - Page: https://mspsoftware.net/software/ironscales - Vendor: IRONSCALES, https://mspsoftware.net/vendors/ironscales, website https://ironscales.com/ - Categories: Email security (primary), Security awareness and phishing simulation - Free trial: yes. Free version: no. - Deployment: cloud. Platforms: web. HQ: United States. Founded: 2014. - Support: knowledge base and 24/7. Training: documentation, videos and webinars. ## From the vendor IRONSCALES is an AI-driven email security platform from IRONSCALES for organisations that want phishing, business email compromise (BEC) and account takeover protection layered on top of Microsoft 365 or Google Workspace without changing mail routing. The platform connects by API rather than sitting as a gateway in front of the mail flow, so setup does not require MX record changes. Its self-learning detection model, paired with an agentic automation layer the vendor calls Themis, classifies and remediates threats across mailboxes, and is informed by a crowdsourced network the vendor says covers more than 36,000 security professionals. Coverage extends to malware and URL scanning, QR code and deepfake-based attacks, hosted DMARC and SPF management, and outbound email encryption and data loss prevention on its higher tiers. IRONSCALES sells three business plans (Email Essentials, Email Protect and Email Protect 360) and separate MSP and MSSP plans (Email Protect, Email Protect Pro and Complete Protect), with encryption, DLP, DMARC management and account takeover protection appearing as add-ons on some tiers rather than included throughout. A Human Risk Management module, covering phishing simulation and security awareness training with per-user risk scoring, is sold as an add-on and bundled into Complete Protect. None of these plans carry a published price; every pricing page routes to a quote request, so starting_price_minor is not available (checked September 2026), though a free trial and a free email health scan are offered and there is no free version. IRONSCALES integrates with SIEM, SOAR, XDR and EDR platforms including Splunk, Microsoft Sentinel, IBM QRadar and Cortex XSOAR, and with identity providers including Okta, Microsoft Entra ID and Ping Identity, on top of its native Microsoft 365 and Google Workspace connections. IRONSCALES is based in Atlanta, Georgia, and was founded in 2014. MSPs evaluating it should get a written quote covering the specific plan and add-ons they need, since encryption and DLP are not included on every tier, and should confirm during a demo which security-awareness features (such as automated post-simulation training or client-facing reports) their MSP plan actually includes, since the vendor does not document all of them publicly. ## Our take IRONSCALES suits an MSP or MSSP that wants API-based, mailbox-level email protection layered on top of Microsoft 365 or Google Workspace, with security awareness training and phishing simulation available from the same vendor rather than a separate tool. Because pricing is quote-only and features such as encryption, DLP and DMARC management shift between plans and add-ons, get the quote broken down by feature before comparing it against Mimecast, Proofpoint Essentials or Microsoft Defender for Office 365. On a demo, ask specifically about the multi-tenant MSP dashboard, what the Email Incident Management Service add-on covers, and whether self-service quarantine and continuity are available, since none of these are documented on the public site. ## Pricing IRONSCALES does not publish a list price. ## Features | Feature | Supported | Note | | --- | --- | --- | | Phishing and malware filtering | yes | AI-powered phishing, BEC and VIP impersonation detection across Microsoft 365 and Google Workspace, backed by crowdsourced threat intelligence the vendor says covers 36,000+ security professionals. | | Spoofing and impersonation protection | yes | Detects business email compromise, VIP/vendor impersonation and account takeover, with agentic automated remediation. | | Security awareness training bundle | yes | Human Risk Management module (phishing simulation, training content, per-user risk scoring) sold as an add-on and bundled into the Complete Protect plan. | | API-based post-delivery scanning | yes | API-based, mailbox-level integration with Microsoft 365 and Google Workspace; the vendor says no MX record changes are required. | | DMARC monitoring | yes | Hosted DMARC and auto-flattening hosted SPF, with real-time authentication analytics; sold standalone or as an MSP Protect Pro add-on. | | Data loss prevention | yes | Email DLP is included in the Email Protect 360 business plan and offered as an add-on on the MSP Protect Pro plan. | | Email encryption | yes | Outbound email encryption is included from Email Protect 360 up, and as an add-on on MSP Protect Pro. | | Microsoft 365 integration | yes | Native API integration with a vendor-stated 3-click setup. | | Phishing simulation campaigns | yes | Hyper-personalised, GPT-powered simulations targeted at high-risk employees and VIPs using social graph analysis. | | Training content library | yes | Security awareness training modules are part of the Human Risk Management offering. | | Phish-reporting button | yes | Report Phishing add-in for Outlook, with an AI Copilot guiding the reporting user. | ## Integrations - CrowdStrike Falcon, https://mspsoftware.net/software/crowdstrike-falcon - Okta, https://mspsoftware.net/software/okta - Microsoft Entra ID, https://mspsoftware.net/software/microsoft-entra-id - Ping Identity, https://mspsoftware.net/software/ping-identity - Splunk, https://ironscales.com/platform/integrations - Microsoft Sentinel, https://ironscales.com/platform/integrations - Cortex XSOAR, https://ironscales.com/platform/integrations - IBM QRadar, https://ironscales.com/platform/integrations ## Alternatives - Coro: A consolidated SMB and MSP cybersecurity platform sold via partners on quote-only, per-user pricing. https://mspsoftware.net/software/coro - Vade: AI email security for Microsoft 365 with bundled contextual security awareness training. https://mspsoftware.net/software/vade - Barracuda Email Protection: Cloud email security, archiving and awareness training bundled into three tiers, priced by quote only. https://mspsoftware.net/software/barracuda-email-protection - Guardz: Unified MDR, endpoint, email and identity security for MSPs, priced per user on request. https://mspsoftware.net/software/guardz ## FAQ ### How much does IRONSCALES cost? IRONSCALES does not publish a list price. No MSP price reports have been approved yet. ### Does IRONSCALES offer a free trial? IRONSCALES offers a free trial. There is no free version. ### What does IRONSCALES integrate with? IRONSCALES lists integrations with CrowdStrike Falcon, Okta, Microsoft Entra ID, Ping Identity, Splunk and Microsoft Sentinel. ### Is IRONSCALES cloud or on-premises? IRONSCALES is cloud-hosted; there is no on-premises version. ### Who is IRONSCALES for? MSPs report using IRONSCALES at sizes of 1-5, 6-15, 16-50, 51-200 and 200+ technicians. ### Is IRONSCALES priced per mailbox? IRONSCALES does not publish a per-mailbox or per-user price for any of its plans. Every plan, on both the business side (Email Essentials, Email Protect, Email Protect 360) and the MSP/MSSP side (Email Protect, Email Protect Pro, Complete Protect), routes to a quote request rather than a listed figure (checked September 2026). MSPs should get a written quote that specifies which add-ons, such as encryption, DLP and DMARC management, are included. ### Does IRONSCALES offer a free trial? Yes, IRONSCALES offers a free trial through a request form on its site, along with a free email health scan and product tours. There is no separate free version of the product once a trial period ends, so ongoing use requires a paid subscription on one of its quote-only plans. ### Does IRONSCALES include security awareness training? Yes, IRONSCALES sells a Human Risk Management module covering phishing simulation, security awareness training content and per-user risk scoring. It is offered as an add-on and is bundled into the Complete Protect plan on the MSP/MSSP side, rather than being included in every plan by default. ### Is IRONSCALES an API-based tool or a mail gateway? IRONSCALES connects to Microsoft 365 and Google Workspace through their native APIs at the mailbox level, rather than sitting in front of mail flow as a secure email gateway. The vendor says this means no MX record changes are needed and setup can be completed in a few clicks, which also lets it scan mail post-delivery and remediate threats retroactively across mailboxes. ### What does IRONSCALES integrate with beyond Microsoft 365 and Google Workspace? IRONSCALES documents integrations with SIEM, SOAR, XDR and EDR platforms, including Splunk, Microsoft Sentinel, IBM QRadar, Palo Alto Networks Cortex XSOAR and CrowdStrike Falcon, plus identity providers including Okta, Microsoft Entra ID and Ping Identity. MSPs should confirm the current integration list for their specific stack, since coverage can change.