Choosing email security

What it is

Email is still the most common way attackers reach your people. The threats have shifted from obvious spam and attachments toward messages that look ordinary: a fake invoice, a password reset page, or a note that appears to come from your CEO asking for a quick wire transfer. That last type, business email compromise (BEC), often contains no link or attachment at all, which is why older filters miss it.

The main product types are:

• Secure email gateways sit in front of your mailbox and filter mail before it arrives. They change your mail routing records.
• API-based protection connects directly to Microsoft 365 or Google Workspace, scans mail inside the mailbox, and can pull messages back after delivery. It usually looks at behavior and relationships (who normally emails whom, about what) rather than only known bad content.
• Built-in platform security from your email provider. Many organizations already pay for more than they have turned on.
• Domain authentication tools help you deploy Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC), which stop others from sending mail that claims to be from your domain.
• Security awareness training and phishing simulation, which address the person reading the message.

Signs you need it

• Staff regularly forward suspicious messages to IT and you handle each one by hand.
• Someone in finance received a convincing request to change a supplier's bank details.
• A user's mailbox was taken over and used to send phishing to your customers.
• Your DMARC policy is missing or set to monitor only, and you do not know who sends mail as your domain.
• Partners or customers report receiving fake emails that look like they came from you.
• You have never reviewed the security settings in your Microsoft 365 or Google Workspace tenant.

What to look for

• Detection of attacks without links or attachments. BEC and vendor fraud rely on wording and context, so content-only filters are not enough.
• Post-delivery remediation. The ability to pull a message from every mailbox after delivery shortens your response from hours to minutes.
• Account takeover detection. Spotting unusual sign-ins, forwarding rules and outbound mail catches the compromise that phishing produced.
• Fit with your platform. Check how it works with your email provider and whether it duplicates features you already own.
• User reporting workflow. A simple report button that feeds an automated triage saves your team from inbox-by-inbox investigation.
• DMARC reporting you can read. Raw aggregate reports are hard to use, and clear sender inventories make enforcement realistic.
• Low false positive rate. Quarantining legitimate invoices or customer mail creates pressure to loosen rules.

Mistakes to avoid

• Buying a new product before tuning the security features already in your email platform.
• Jumping DMARC straight to reject without finding every legitimate sender, such as your marketing, billing and ticketing tools.
• Stacking a gateway and an API tool without planning how they interact, which can cause duplicate quarantines and delivery delays.
• Treating training as a yearly video. Short, regular practice and an easy way to report do more.
• Ignoring the payment process itself. A call-back rule for bank detail changes stops fraud that no filter catches.
• Forgetting shared and service mailboxes, which often lack MFA and monitoring.

Questions to ask vendors

• How do you detect business email compromise that contains no link or attachment?
• Can you remove a message from all mailboxes after delivery, and how quickly?
• What changes do we make to mail routing or DNS to deploy you?
• Which of your features overlap with what our email platform already includes?
• How do user-reported messages get triaged, and what do we see?
• Do you detect compromised accounts and suspicious inbox rules, and what actions can you take?
• What is the process when legitimate mail is quarantined?
• Can you show a DMARC report or sender inventory from a customer our size?

What drives the cost

Email security is usually priced per mailbox, so user count drives the base cost. Shared mailboxes may or may not count, so ask. Bundled features such as account takeover protection, awareness training, phishing simulation and DMARC management move the price up, and buying them separately can cost more or less than a bundle depending on what you already own.

Effort depends on the product type. API-based tools are generally quicker to connect; gateways require mail flow changes and testing. DMARC enforcement is mostly effort rather than license: finding senders, fixing their records and moving the policy up in stages. Training programs need someone to schedule campaigns and follow up.

Where Tabor Point can help

Tabor Point runs cybersecurity audits that include your email setup, domain authentication and tenant configuration, with findings ranked by risk and a remediation roadmap. Tabor Point also provides policies and security awareness training, covering practical rules such as payment verification and training your staff will actually use. If you want a second opinion before you buy, Tabor Point can help.