What Email Security Is
Written by MSP Outpost.
In Short
Email security filters the mail your clients send and receive: phishing, impersonation, malware and spam, before it lands and after. The mail service already does basic filtering, and this category is the layer on top of it, either a gateway the mail passes through or a service that connects to the mailbox and pulls bad messages back out after delivery.
What It Does
- Inbound filtering. Spam, malware and known phishing stopped before or as it reaches the inbox.
- Impersonation. Catches mail pretending to be a supplier, a director or a lookalike domain, which a plain spam filter misses.
- Post-delivery removal. Pulls a message out of every mailbox once it is found to be malicious, including copies already opened.
- Link and attachment checks. Checks links at the moment they are clicked and opens attachments in a sandbox before the user does.
- User reporting. A report button in the mail client sends suspect messages to a queue the MSP can review.
- Extras. Some add outbound filtering, encryption, archiving or a fallback mailbox for when the mail service is down.
When You Need One
Filtering built into the client's mail service, set up properly, covers a lot. Add a post-delivery layer for clients who handle payments or sensitive data, because impersonation is what gets through.
Standardize on one product across every client so tuning, quarantine release and reporting are one job, not many. At this size a good multi-tenant console matters more than any single detection feature.
Quarantine requests and user reports arrive at volume, so look for automated handling of reported mail and user-controlled release so the helpdesk is not the bottleneck. Bundles with training, archiving and backup start to make sense here.
What to Look For
Must Have
- Multi-Tenant Console
- Impersonation Protection
- Post-Delivery Removal
- Link and Attachment Scanning
- Phish Report Button
- User Quarantine Release
Worth Having
- Security Awareness Training
- Email Archiving
- Outbound Filtering
- Email Encryption
- PSA Integration
- Continuity Mailbox
How It Is Priced
Email security is usually priced per user or per mailbox each month, and most vendors quote rather than publish a price. Watch for minimum user counts and multi-year terms, which some vendors require, and check whether archiving, encryption or training are included or sold as add-ons. Ask whether shared mailboxes and service accounts count as users.
Switching
A gateway sits in the mail flow, so leaving means changing DNS records and mail routing with a planned cutover for each client. A service that connects to the mailbox is easier to swap, but its quarantine history and tuning stay behind. Before you sign, find out how long archived or quarantined mail stays reachable after you cancel, and how you get it out.
Questions to Ask a Vendor
- Is it priced per user or per mailbox, and do shared mailboxes count?
- What is the minimum user count and term, and can the count drop when a client leaves?
- How many false positives should I expect in the first month, and who tunes the policies?
- Can users release their own quarantined mail, and can I limit which categories they may release?
- What happens to archived and quarantined mail when I cancel?
- Should the mail service's own filtering stay on alongside yours, and what breaks if it does?
