Email Security Gateway Solutions & Companies to Consider

Email has long been one of the most popular forms of business communication, valued for its speed and efficiency. Even in the age of Slack, Google Chat and other instant messaging programs, email remains dominant, accounting for 91% of client communications and 61% of internal company communications.

With popularity comes risk. Companies often rely upon email to send and receive sensitive or confidential information, making it a prime target for cybercriminals. From phishing attacks to malware-based attacks, cybercriminals have devised increasingly sophisticated methods for gaining access to company and customer data through email.

But not all email-based breaches are caused by threat actors — in some cases, the call is coming from inside the house. According to one study,  92% of organizations have experienced a data breach caused by an end-user making a mistake on email, such as sending an email to the wrong person or attaching the wrong file to an email.

All told, some 83% of organizations have dealt with data breaches — both internal and external, intentional and accidental — that started with email. These breaches can have severe, far-reaching consequences, including financial losses, reputational damage, employee turnover, compliance violations and even civil penalties. Given what’s at stake, companies can’t afford to skimp on safety and should consider making email security solutions such as an email gateway part of their larger cybersecurity strategy.

An email gateway — also known as a secure email gateway (SEG) — is a solution that sits on top of a company’s internal email server and acts as an additional security layer, similar to a firewall. Using message transfer agent functionality and rules-based orchestration, an email gateway reroutes all inbound and outbound emails to a proxy, where each message is scanned to ensure that it does not contain malicious content (for incoming emails) or proprietary information (for outbound emails). Once an email is deemed safe, it is sent on to its final destination.

Email gateways are not device-specific, but rather work on a network level, which enables businesses to implement strong email security for all employees, regardless of where they’re located or which devices they use. This also means that secure email gateways do not impact device performance.

There are a wide variety of free and paid email security gateway products on the market today, some of which we’ll discuss in greater detail later on in this article. Depending on the solution, an email gateway may include capabilities such as email encryption, virus and malware protection, spam filtering and so on.

Any company that chooses to invest in a secure email gateway has the option of using either an on-premise or cloud-based system.

On-premise email gateways, which require physical hardware to operate, are best suited for organizations that currently utilize an on-premise email server such as Microsoft Exchange and have no immediate plans to migrate to the cloud. These organizations might also take comfort in knowing that all of their services and data are entirely in-house. As with any on-prem solution, though, on-premise secure email gateways can be expensive to operate, maintain and update over time — which can be challenging for smaller businesses — and lack the scalability that cloud-based solutions can offer.

By comparison, cloud-based email gateways are highly scalable and can offer long-term cost savings, as third-party providers are responsible for operating, maintaining and upgrading systems, rather than their customers. Most cloud-based email gateways also utilize a subscription-based pricing model, which offers customers more flexibility. Despite these conveniences, some organizations — especially those with the resources to maintain their own systems — may be reluctant to entrust their services and data with a third-party.

When evaluating email security gateway products, organizations should look for the following features and functionalities:

• Multiple deployment options: Select your choice of on-premise, cloud-based or hybrid installation.
• Anti-virus and anti-malware protection: Strengthen your security posture by adding another layer of security on top of your email gateway.
• Threat intelligence: Utilize information from internal and external data sources to identify emerging threats, analyze suspicious behavior and mitigate risk.
• Domain-based message authentication, reporting and conformance (DMARC): Use confirmation keys from recognized domains to verify the authenticity of email addresses.
• Post-delivery protection (PDP): Survey all emails that have passed through your secure email gateway against a regularly updated list of threats and automatically eliminate any messages containing malicious content.
• Phishing protection: Combat one of the most pervasive forms of email-based cybercrime with anti-phishing software that uses either allowlisting or blocklisting for access control.
• Data loss prevention (DLP): Scan outgoing emails for classified, confidential or proprietary information — either in the message itself or its attachments — to prevent the transmission of data to unauthorized parties.
• Sandboxing: Create isolated environments in which to execute suspicious URLs and files included in — or attached to — emails intercepted by your email gateway.
• Outbound content control: Automatically encrypt outgoing emails that contain sensitive information to ensure that the information stays private until it arrives safely at its intended destination.

Ready to make an email gateway part of your cybersecurity strategy? Check out these email gateway solutions from some of the leading providers in the email security software market:

Abnormal Security

An advanced secure email gateway that leverages the latest in artificial intelligence (AI), Abnormal’s Inbound Email Security solution builds behavioral profiles to help detect anomalous — or, well, abnormal — activity and immediately block malicious or unwanted emails.

Key features:

• AI-powered behavioral profiling and anomaly detection
• Single application programming interface (API) deployment, no configuration needed
• Native integration with Microsoft 365 and Google Workspace
• Searchable federated knowledge bases
• Automatic remediation (sandboxing) of malicious emails
• Threat intelligence reporting

The reviews are in…

“Abnormal’s email security platform delivers on what they state it will do, it effectively removes malicious emails that have made it past Microsoft 365 and Exchange Online Protection without the end user knowing they ever received a phishing link or BEC attack message. The product is very easy to configure and can easily integrate into popular cloud based email and collaboration suites (M365 and Google Workspace).”

— Cybersecurity Engineer, Gartner Peer Insights

Avanan

Multi-layer security designed not only to protect email, but also entire collaboration suites, Avanan uses a single API for easy deployment and AI and machine learning (ML) to assess and address threats — including malware and ransomware — in real time.

Key features:

• AI-powered threat detection and analysis
• One-click deployment
• Anti-malware protection
• Phishing protection
• Custom rules and policies for email deliverability and threat extraction
• Threat intelligence reporting

The reviews are in…

“Avanan is a powerful all-in-one security solution for email, online messaging, and collaboration applications. It’s a perfect solution for security Office 365 and Google Workspace, with powerful security and seamless deployment into these environments, with no changes needed to MX or SPF records. While initial deployment is straightforward, we do note that configuring some rules and policies is granular, and therefore can be complex.”

— Craig MacAlpine, Expert Insights

Cisco Secure Email

Formerly known as Cisco Email Security, Cisco Secure Email draws upon Cisco’s entire ecosystem of email security solutions — including Cisco Advanced Malware Protection, Cisco Domain Protection for DMARC and more — to provide a first line of defense against spam, phishing attacks, malware and other emerging threats.

Key features:

• Searchable threat analysis data
• Spam filtering
• Anti-malware protection
• Phishing protection
• DMARC
• DLP

The reviews are in…

“Cisco Secure Email is an excellent solution for detecting and eliminating cyber attacks that are targeted toward our emails. My company has been using it for a few years and it has been paramount in securing our emails and actively preventing targeted threats. It has integration with Microsoft 365 which is an excellent feature for us. Filtering is extremely effective in detecting both spam and other kinds of malicious emails.”

— Engineer, TrustRadius

IRONSCALES

IRONSCALES is self-learning, cloud-native email security software that provides fast and powerful protection against advanced threats such as business email compromise, credential harvesting, account takeover and more.

Key features:

• Automated mailbox incident response
• AI-powered incident suggestions
• Anti-phishing simulations and customized training
• Mobile application for security analysts
• Anti-malware protection
• Crowd-sourced threat hunting

The reviews are in…

“Since implementing Ironscales, phishing emails that reach our Inboxes have decreased significantly. When a questionable email reaches a user’s mailbox, the user is able to easily report the message to Ironscales [sic] through a button in Outlook. Makes it so easy for both the user and IT support to manage threats. I love that there is an App on my mobile phone. When a user Reports an email, I receive an alert and then can handle the resolution via my phone app.”

— Stephanie M., G2

Microsoft Defender for Office 365

As its name would suggest, Microsoft Defender for Office 365 uses AI and automation to deliver native protection against advanced threats for Office 365. Microsoft Defender for Office 365 users can extend the platform’s functionality with Microsoft’s native security information and event management (SIEM) and extended detection and response (XDR) systems.

Key features:

• Integration with SIEM and XDR
• Anti-malware protection
• Phishing protection
• AI-powered threat detection and response
• Threat monitoring and investigation
• Simulation-based user training

The reviews are in…

“Microsoft 365 Defender is for the die-hard Microsoft enthusiast who knows how to work around its quirks. If you can fight through the confusing menus and have a high threshold for reading, there is a lot of power here, though you’ll need to pay for it.”

— Daniel Brame, PCMag

Proofpoint Essentials

A cost-effective and easy-to-manage security bundle — including Proofpoint Essentials Email Security, a powerful email gateway — Proofpoint Essentials Threat Protection was designed with small- and medium-sized businesses in mind.

Key features:

• Link and attachment sandboxing
• Automated email encryption
• Phishing protection
• Policy-driven DLP filter
• Business continuity protection
• Threat intelligence and reporting

The reviews are in…

“Proofpoint Essentials Email Security is a very strong email gateway solution that makes enterprise-grade email security accessible to SMBs. It is highly effective at identifying and blocking spam, graymail and Denial of Service attacks, and is particularly well suited to Microsoft 365 environments. Proofpoint Essentials doesn’t identify highly targeted attacks such as spear phishing, but this is a weakness of all traditional secure email gateways (SEGs).”

— Craig MacAlpine, Expert Insights

Trustifi

Full-service email security software that claims to offer “full compliance in one click,” Trustifi offers advanced inbound threat protection and outbound email encryption for leading local email clients, including Office 365 and Google Workspace, using a single API.

Key features:

• Rapid deployment using a single API
• AI-powered threat detection and analysis
• HIPAA/HITECH, GDPR, FINRA and FERPA-compliant
• Phishing protection
• Anti-malware protection
• Administrative quarantine (sandboxing)

The reviews are in…

“My overall experience with Trustifi has been great. I can easily send encrypted or private information to whoever I need to, and I can trust that the information is protected and know that I am not inconveniencing my correspondents by making them sign up for an account to receive my emails.”

— Michael G., Capterra

Q: What is an email gateway?
A: An email gateway is essentially a form of firewall that adds a layer of security to an organization’s internal email server. Email gateways are also known as secure email gateways.

Q: How does an email gateway work?
A: Email gateways use message transfer agent functionality and rules-based orchestration to scan all incoming emails for malicious content and all outgoing emails to ensure that confidential information isn’t accidentally shared with unauthorized parties.

Q: What kinds of threats do email gateways protect against?
A: An email gateway can help protect against a wide range of threats, including phishing attacks, malware, ransomware, spam and even user error. It’s important to note that not all email gateways offer the same level of protection, so be sure to weigh your options carefully before choosing.

Q: What features should I look for in an email gateway?
A: A truly robust email gateway will offer anti-malware and antivirus protection, phishing protection, PDP, DMARC, DLP, outbound content control, sandboxing, threat intelligence and multiple deployment options.

Q: Should I invest in an on-premise or a cloud-based email gateway?
A: Whether you choose to use an on-prem or cloud-based email gateway depends entirely upon the needs of your organization. Generally speaking, on-prem email security solutions can offer greater transparency and peace of mind, but are expensive to manage, maintain and update.

Cloud-based solutions offer greater scalability and flexibility, and the solution provider is responsible for all management and maintenance, which usually translates to lower costs. With that said, migrating to the cloud can be expensive for organizations that are currently on-prem, and some companies prefer the visibility on-prem systems can provide.

Q: Is an email gateway enough to fully secure my company’s email-based communications?
A: No, but it is an essential component of any company’s cybersecurity strategy. In order to assume a strong security posture, organizations should invest in other email security solutions, including spam filters, antivirus software, data encryption and an archiving platform.