Guide to Finding the Best Email Security Gateways
Email remains the most reliable initial access vector for attackers at every sophistication level — from commodity phishing kits to nation-state spear phishing campaigns. The threat landscape has evolved well beyond malware attachments and credential-harvesting links: business email compromise (BEC) exploits trusted relationships without any malicious payload, AI-generated phishing defeats grammar-based detection, and ClickFix social engineering bypasses link scanning by relying on user execution rather than automated delivery.
This guide is for security engineers and messaging administrators evaluating email security platforms against the current threat landscape. We cover the detection approaches that differentiate vendors at the architecture level — not just feature checklists — and the deployment tradeoffs that determine whether your email security layer adds latency and operational complexity or delivers detection value.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts — distilled for practitioners. 50,000+ subscribers. No noise.
Detection Architecture: Beyond Signatures and URL Scanning
Legacy secure email gateways rely on signature-based malware detection and URL reputation databases. Both are defeated by attackers who change payloads for each campaign and register new domains minutes before sending. Modern email security requires detection approaches that work against previously unseen attacks.
Abnormal Security's behavioral AI approach is architecturally distinct from all other vendors in the market. Rather than scanning for malicious content, it models normal communication behavior for every user and flags deviations — an email from a new external domain claiming to be the CFO requesting a wire transfer deviates from the historical communication pattern of the CFO's account, regardless of whether the domain is listed in any reputation database. This approach is uniquely effective against BEC and vendor email compromise (VEC), where no malicious content exists to detect.
Proofpoint's threat intelligence network — drawing on email telemetry from tens of thousands of enterprise customers — provides the most comprehensive threat intelligence for identifying campaigns at scale. When a phishing kit is used against one Proofpoint customer, the indicators propagate to protect all others within minutes.
BEC and Impersonation Protection
Business email compromise is the highest-financial-impact email threat category, causing billions in annual losses through fraudulent wire transfers, payroll redirections, and gift card fraud. BEC attacks typically involve no malicious content — they succeed through social engineering alone, impersonating executives, vendors, or trusted contacts.
Evaluate BEC protection for three impersonation vectors: display name spoofing (sending as 'CFO Name' from an unrelated domain), domain lookalike impersonation (sending from cfom.company.com or company-finance.com), and compromised vendor account abuse (legitimate emails from a vendor's account that has been compromised).
Abnormal Security is the market leader for BEC detection, with the highest catch rates for zero-payload BEC attempts across independent evaluations. Proofpoint's Impostor Classifier provides strong lookalike domain and display name impersonation detection. Microsoft Defender for Office 365's anti-impersonation features (available in Plan 2) provide adequate BEC protection for organizations that cannot justify additional vendor spend beyond their M365 licensing.
API vs. MX-Record Deployment
Traditional secure email gateways deploy as an MX-record intermediary — all inbound email routes through the gateway before reaching the mail server. Modern API-based email security platforms (Abnormal Security, Tessian, Sublime Security) connect directly to M365 or Google Workspace via API, analyzing mail after delivery rather than before.
The API model has significant operational advantages: no DNS changes required, no email delivery latency introduced, no complex failover configuration, and the ability to retroactively remediate emails already delivered to inboxes. Abnormal's API deployment takes under an hour with zero DNS changes. The MX-record model provides pre-delivery blocking — preventing malicious emails from reaching the inbox at all — but at the cost of delivery latency and complex infrastructure management.
For M365 and Google Workspace deployments, the API model is now viable for most organizations. The question is whether you need pre-delivery blocking (MX-record gateway: Proofpoint, Mimecast) or post-delivery detection and remediation (API-based: Abnormal, Sublime Security). Organizations with high-risk environments (financial services, healthcare, critical infrastructure) should implement both layers: a gateway for pre-delivery filtering and an API-based platform for BEC and account takeover detection.
URL and Attachment Sandboxing for Advanced Threats
URL sandboxing (following links in emails to a cloud sandbox and testing for phishing pages or malware downloads) and attachment sandboxing (detonating attachments in an isolated environment before delivery) are foundational email security capabilities that all enterprise gateways provide. The differentiator is evasion resistance.
Modern phishing kits check visitor characteristics (browser fingerprint, IP geolocation, time of day) and serve a benign page to scanners and sandboxes while serving the phishing page to real users. Evaluate sandbox evasion resistance by testing known phishing kits that use visitor fingerprinting. Proofpoint's TAP (Targeted Attack Protection) and Mimecast's Targeted Threat Protection both include sandbox environments with evasion-resistance techniques. Microsoft Defender for Office 365's Safe Links and Safe Attachments provide adequate sandboxing for most organizations within M365 licensing.
For attachments, evaluate sandboxing support for the full range of file types relevant to your organization: Office documents (macro-enabled), PDFs (JavaScript), archive files (ZIP/RAR containing executables), and OneNote files (which became a popular malware delivery format after macros were disabled by default).
The bottom line
Proofpoint is the strongest choice for enterprises that need the broadest threat intelligence, the most comprehensive gateway, and advanced phishing simulation capabilities. Abnormal Security is the strongest choice for BEC and account takeover detection in M365 and Google Workspace environments. Mimecast is competitive for organizations needing email archiving bundled with security. Microsoft Defender for Office 365 Plan 2 is the correct baseline for any M365 E3/E5 customer. Combining Defender for Office 365 with Abnormal Security covers the full threat spectrum (Defender for commodity threats, Abnormal for BEC) at lower total cost than a standalone gateway for many M365-standardized organizations.
Frequently asked questions
Can email security gateways stop AI-generated phishing?
Partially. AI-generated phishing defeats grammar-based detection and makes content-quality filtering ineffective. The most effective defenses against AI-generated phishing are: (1) behavioral anomaly detection that identifies unusual sender-recipient relationships regardless of content quality (Abnormal Security's approach), (2) strong DMARC enforcement that prevents domain spoofing, and (3) user training focused on social engineering patterns rather than grammar mistakes. No email security platform stops 100% of AI-generated phishing — defense-in-depth with user awareness training remains necessary.
What is DMARC and should I enforce it?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that allows domain owners to specify what mail servers are authorized to send email on their behalf and what to do with emails that fail authentication. Enforcing DMARC at 'reject' or 'quarantine' policy prevents attackers from sending phishing emails that appear to come from your organization's domain to external recipients. You should enforce DMARC on all your domains. Start at 'p=none' (monitoring only), review the DMARC reports for legitimate mail flows that might break, add those mail flows to your SPF/DKIM configuration, then advance to 'p=quarantine' and eventually 'p=reject'.
How do I measure email security effectiveness?
Track four metrics: (1) Phishing simulation click rate over time (should decrease with training and detection improvement), (2) Malicious email catch rate from red team or simulation exercises that test detection, (3) BEC attempt volume and catch rate (requires logging of impersonation detection events), (4) Time-to-remediation for emails delivered before detection (API-based platforms provide retroactive remediation — measure how quickly they remove threat emails after detection).
What is ClickFix and can email gateways stop it?
ClickFix is a social engineering technique where emails (or websites) instruct users to copy and paste a PowerShell or command-line instruction into a Run dialog, bypassing all email-layer security controls because the malicious code is never delivered as an attachment or link. Email security gateways cannot stop ClickFix at the technical layer. The defense is user training to recognize the social engineering pattern and endpoint controls (AppLocker, Defender Application Control) that prevent unsigned scripts from executing.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.