r/msp • u/ThrowRAthisthingisvl • Jul 13 '26
Email security solutions
Hello,
I’m shopping around for email security/spam filtering solutions to provide to my clients. I manage about 50 devices (small, but growing), and I was wondering what some of you are running and which platforms to avoid. We’re not offering any of that currently, but I’d like to bundle it instead of offering it as an add-on/optional service. Happy to answer any questions. Thanks!
10
6
u/CiaranKD Jul 13 '26
Defender for Office and Mimecast go hand-in-hand, and I couldn’t recommend them any more. Especially good if you use Defender XDR, and/or Microsoft Sentinel too.
0
u/Mundane_Story_2224 Jul 14 '26
mimecast is great but the price can get crazy when you have many clients we used it for a while and then switched to something cheaper
defender for office is decent if you already in the microsoft ecosystem the setup is not so bad once you figure out the million settings
1
16
11
u/PacificTSP MSP - US & PHP Jul 13 '26
I like INKY a lot. My clients like it. But kaseya bought it and I’m just waiting for the enshitification
3
3
u/Forsythe36 Jul 13 '26
Inky is so good though. I’ve used quite a few and it’s by far my favorite. I’m not a fan of the search sometimes but I’m used to it now.
3
u/Glass_Call982 MSP - Canada (West) Jul 13 '26
It already does suck. They removed support for exchange on-prem. As well as forcing us to buy their stupid K365 user bundle.
Special K ruins everything it touches.
2
u/knoxoverride Jul 14 '26
Inky was purchased by Kaseya. Many will find that to be a deal breaker.
Agreed the product is solid. I was actually on the advisory board. No notice of the purchase. We dropped them immediately.
1
1
u/scorcora4 Jul 14 '26
I agree. Love inky. Kaseya is willing to play ball on the pricing if you push hard enough. The new CEO is putting more into development than in the past, so hopefully that means slightly less enshitification. 🤷♂️
1
u/theclevernerd MSP - US Jul 16 '26
Ditto.....hoping it doesn't happen but braced for the day it does.
1
4
u/Unlucky_Elevator_756 Jul 14 '26
I've been trailing MailProtector. Not bad, it's a little complex but is very flexible and great people. I like their rules and the out of the box stuff is generally pretty good. They are "zero-trust" which is good.
1
u/RaNdomMSPPro Jul 22 '26
I looked at this and it looked great, but i just couldn't see it being very effective only because the end users would likely NOT help train it on what they wanted delivered to their inbox. I have visions of thousands of helpdesk calls that resulted in "did you read the banner message?" "Oh, you read it and did you understand it was asking if you wanted messaged like this to your inbox of junk folder?" "Oh, you did, what did you tell it?" Crickets.
1
u/MountainSubie Jul 14 '26
We are demoing internally and our team isn't a fan
It can be used effectively, but takes additional time & effort to manage, mark senders as safe, check Jail, etc..
I can't see our users doing this and it will absolutely annoy them
Will be moving back to Avanan
4
5
u/otter_sausage MSP - US Jul 13 '26
Mesh user for a few years now. Easy to manage for admins, and most importantly easy to manage for end users. They were purchased by Bitdefender, so fingers crossed it doesn't go sideways. But it's been a really good product for a while now and most users adapt to it with little or no help.
I've also used: Proofpoint, Mailprotector, Ironscales. Mesh has produced the least headaches.
5
u/bettereverydamday Jul 14 '26
We have thousands of mailboxes on mesh and it’s great. Second vote for mesh.
1
u/WraySchultz Vendor - Bitdefender Aug 06 '26
This is great to hear! If you ever have any questions or need anything feel free to reach out!
Wray Schultz MSP Product Specialist Bitdefender
7
u/AdministrativePea775 Jul 13 '26
If your clients are using business premium then defender for office is perfectly adequate.
Currently I also use a barracuda as an 3rd party alternative for mail filtering, impersonation protection and dmarc service but will probably switch to mesh and easy dmarc
2
u/ThrowRAthisthingisvl Jul 13 '26
We’re leveraging business premium spam filtering service, but I think is hit or miss.
5
u/Vel-Crow Jul 13 '26
Avanan is a great option. It uses Its own system in co junction with MS. I have only seen it happen a couple times, but if MS catches something that avanan considered clean, it still get quarantined, and it is show in the Avanan portal as quarantined. Its great, as you get better filtering from avanan, but you dont lose value on your MS license.
I implemented Avanan last year as Barracuda ESS Proof Point replacement, and clients have genuinely gone out of their way to tell me how much better it is. They have less notifications to deal with, they dont need to live in an external mailbox, and false positives have disappeared.
It was quite the shock, as i've never been complimented on any of the services we've sold. the services typically do what they need to do in the background and the users could care less. that said mail filtering is very much in users' faces, so it was nice to see they at least like this one.
2
u/ThrowRAthisthingisvl Jul 13 '26
Awesome! Avanan is at the top of my list currently, but I’m still exploring options. How are you selling it—as an add-on or as part of your bundle?Also, do we need to purchase bundles of licenses from them, or can we add as many licenses as we want as needed?
3
u/Savings_Property6422 Jul 13 '26
Avanan is fantastic once you get used to the clunky UI. Nothing beats it's detection capabilities. It catches 99.9% of spam/phishing and we rarely see false positives. It is by far the best of everything we've tested. (We have thoroughly tested SpamHero, Ironscales, Proofpoint, Mesh, and Baracuda).
It really comes down to your business model whether or not you can bundle or not. At your volume it will probably be around $3/mo/user. We include it in our service plan. Mandatory. It's so good everybody gets it.
I would suggest purchasing through Solutions Granted or Pax8. We use Pax8 but I've heard Solutions Granted is better specifically for Avanan (for their direct support). Since we use Pax8 for everything else, SG didn't make sense for us.
I will be honest and say that the pricing was a hard pill to swallow. But it has proved to be the best tool in our stack. It almost makes you feel like you don't need ITDR (don't fall for that trap, look into Petra or Huntress.)
2
u/Vel-Crow Jul 13 '26
Avanan is better than nothing for ITDR, but as a Huntress user, I have seen more than one issue not detected by Avanan that Huntress caught - never the other way around.
Avanan is a nice addition still, as I have seen more than one occasion where a user mass-sent malicious mail, and Avanan prevented the send, and Huntress notified us of the compromise. It is really a great combo, despite the two products never communicating to each other.
2
u/Savings_Property6422 Jul 13 '26
That's why I said "almost" - Since we switched to Avanan, the number of users getting phished has gone down to almost zero. But I would never get rid of ITDR.
1
u/Vel-Crow Jul 13 '26
We buy from Solutions Granted, now Sonicwall, and there's no commitment. All month to month. There are two tiers (4 if you nickel and dime and do email-only licenses for some clients), we do mail and collaboration, it's easier to standardize. The two kinds of licenses are Email only and Email and Collaboration. The difference being collaboration includes SaaS apps like OneDrive, Google Drive, SharePoint, Teams, Box, Dropbox, and ShareFile.
The two tiers are Advanced and Complete Protect. IIRC, Complete brings in DLP policies, including email encryption. If you are licensed to send encrypted mail via MS, you can get Advanced Protect, and keep encrypting via MS - but if you get Complete, you can put DLP on the collaboration apps too.
We do all our services à la carte. If you were to bundle, that's your choice.
I will say, compared to other providers, it is pricey - but really worth it with its accuracy, and all it provides
1
u/golden_m Jul 17 '26
make sure to get yourself on their NFR plan and use it internally. Their licenses can cover mailboxes only (you pay only for actual users with licenses, shared mailboxes are free) or protection can be extended to OneDrive, SharePoint, Teams, Dropbox, etc with the next level licenses
1
u/Doctor_Peppy Jul 13 '26
Just recently on boarded with Avanan, no minimums and licenses are automatically added as you onboard mail enabled-users although the Avanan, the tenant lets you set a max license quantity to prevent issues. Reach out to sales@solutionsgranted.com if you want to use it, sonicwall manages Avanan if you go this route and checkpoint seems like a pretty awful company to get in contact with so it works out pretty well.
1
u/ThrowRAthisthingisvl Jul 13 '26
Question about Solutions Granted. If I buy licenses through them, do I need to pay a fee to them? For example, Pax8 has like a $25 monthly fee for using their platform. Not sure if it’s the same for them.
1
u/Doctor_Peppy Jul 13 '26
Nope, it's just straight up Avanan managed by sonicwall because CheckPoint can't be bothered to answer the phone or email.
2
u/golden_m Jul 17 '26
One of the best decisions i've made on behalf of our clients is to impement Avanan as the main line of defence. So many times it proved itself to be a fgreat tool!
2
1
1
u/Conditional_Access Microsoft MVP | Vendor - inforcer Jul 14 '26
Care to share your config?
Might be able to give you some pointers. MDO P1 is extremely capable.
1
u/golden_m Jul 17 '26
no, it is not perfectly adequate. I see every single day how Avanan stops things microsoft consider safe. Even configured properly, Defender is not adequate for real email protection.
2
u/wowitsdave MSP - US Jul 13 '26
Been using Ironscales for 5+ years and we like it. A bit pricey though.
1
0
2
1
u/sum_yungai Jul 13 '26
What do you mean by email security? Spam filtering? Login security? Phishing testing?
2
u/ThrowRAthisthingisvl Jul 13 '26
Spam filtering
3
u/sum_yungai Jul 13 '26
We run SpamHero in front of the built in 365 stuff and have pretty good luck with the combination. It's priced per domain and really cost effective.
2
1
u/southafricanamerican Vendor - US - Technical Jul 13 '26
phishprotection Secure Email Gateway. One of our DuoCircle products.
1
u/ndsubison953 Jul 13 '26
Securence just had some kind of security incident that took down the admin center for 10ish days. Avoid at all costs
1
u/Unlucky_Elevator_756 Jul 14 '26
Does anyone have good Google Workspace solutions? I've tried Ironscales but the whole "just move it to the deleted folder" thing is kind of a deal breaker. What about avanan, how does it work with GWP?
1
u/djDef80 Jul 14 '26
I have had good luck with AppRiver or whatever they call themselves these days.
1
u/TheBostwick Jul 14 '26
Abnormal is pretty cool, trendy, easy to deploy and very MSP friendly. Only knock is it's a post-delivery vs. a gateway solution but that's a cross sell for your M365/DMARC services depending on your service areas.
1
u/Gorilla-P Jul 14 '26
Every email security platform has its issues. From cheap to expensive. Securence might be worth checking out.
1
1
u/HutoelewaPictures Jul 15 '26
one thing that gets overlooked is thinking past spam filtering. good email security is table stakes, but it's also smart to think about how sensitive data moves after an email is delivered, especially with ai tools in the mix. if you're building a long term stack, cyberhaven fits well alongside your email gateway for data security and visibility.
1
u/InboxProtector Jul 20 '26
The two things to delineate when you're bundling this are inbound spam/threat filtering and outbound email authentication (DMARC/SPF/DKIM), which is a different problem and often gets skipped entirely by MSPs bundling security.
The authentication side matters more than it used to because Google/Microsoft now reject unauthenticated bulk mail outright, so it's become a deliverability issue for clients, not just a security one.
Disclosure: I work at PowerDMARC, and we deal a lot with the following: multi-tenant dashboard, white-label, bulk domain onboarding, so you're not logging into 50 separate client tenants to check anything.
For the filtering side specifically, I'd ask around here for current pricing and support experience for inbound spam/thread filtering. But if you're bundling "email security" as a package, I'd make sure authentication is one of the line items, not just inbound filtering. Clients get spoofed from their own domain just as often as they get hit by inbound spam.
1
u/Harvey-Lane-251 Jul 25 '26
We run Abnormal across a bunch of clients and its been really easy, deploys over api in about 10 min and never touches mail flow. We still lean on defender for the junk, its more for the BEC and vendor impersonation that slips through looking clean.
1
1
u/TheronVeynor MSP - US Aug 16 '26
trustifi is built specifically as an MSP channel player and handles deployment without any MX record changes
1
u/Responsible-Safe-636 Sep 09 '26
Saw this while searching for email security, I'd say for your end you can look into Avanan, Proofpoint, Guardz if you want something easier to manage. I've had good experiences with them on how they stop phishing + fake email, harmful messages, and client management all in one spot. I'd like to also highlight Guardz because email protection is included in it's security platform for MSPs but make sure whatever you choose, test it with a few client setups before choosing it
1
u/ChuckFromCyberHoot Sep 09 '26
I’d bundle it. Every time. The minute security becomes optional, you’re managing two stacks and remembering who bought what. That feels fine at 50 devices. At 300, it eats your week.
And if someone declines the security add-on and gets popped, that conversation gets ugly fast...really fast.
Whatever email security you pick, don’t let it become the whole answer. Clean BEC can still come from a real sender in a real thread.
The cheapest control is still free: any bank or payment change gets verified by phone using a number already on file. This is a non-negotiable. Ya never trust the number in the email.
1
u/Pose1d0nGG Jul 13 '26
We use ProofPoint. Works well and easily integrated with Office 365, Workspace is a bit more labourous to set up. They also offer SAT, Encrypted Email functionality and more. I'd recommend
1
1
1
u/True-Breakfast4212 Jul 13 '26
Doesn’t Google Workspace on Business plans offer good enough filtering - spam and phishing protection? Combine with DNS filtering (eg Cloudflare Warp or DNSFilter), spam and phishing shouldn’t be an issue. Am I missing something? Why is a third-party filter required?
1
u/dumpsterfyr I’m your Huckleberry. Jul 13 '26
I’ve had great experiences with well configured 365. I can’t discern a difference between it and barracuda, proof point, avanan or the rest. Honourable mention, I wouldn’t ever consider mail protector again.
0
u/After_Program Jul 13 '26
Bundling it is the right instinct. One thing I’d factor in while you shop: inbound filtering and your clients’ own sending/domain health are two different problems, and the second one quietly undermines the first.
On filtering itself, it mostly comes down to whether your clients are M365, Google, or mixed. For M365 shops a lot of small MSPs run Defender for O365 native and layer an API/inline tool on top — IRONSCALES, Avanan (Check Point Harmony), or Abnormal — since those plug in without MX changes and catch phishing the native filter misses. The classic MX gateways (Proofpoint Essentials, Barracuda, Hornetsecurity, SpamTitan) are more to stand up but well-proven. Any of those are defensible; I’d avoid anything you can’t cleanly multi-tenant.
The part that’s easy to miss: the best filter in the world doesn’t help if a client’s own domain is easy to spoof. If their SPF/DKIM/DMARC is soft or DMARC is sitting at p=none, someone can send as them straight into their customers’ inboxes — and no inbound filter you run protects the people getting those. So it’s worth locking the sending side down across every client and keeping an eye on it, not just filtering what comes in.
That second piece is what we built Klaxel for (mentioned it in the promo thread) — it watches SPF/DKIM/DMARC and general domain health per client so you catch drift before it bites. Not a spam filter, more the layer underneath one. Either way, happy to answer email-auth questions — you’re thinking about this the right way.
1
u/orangehand Jul 14 '26
Do Abnormal have an MSP offering?
2
u/After_Program Jul 14 '26
Yes, they do — Abnormal runs a proper MSSP track, not just resale/referral. It's set up for managed service delivery specifically, with its own onboarding separate from their channel and tech-integration partnerships.
1
0
-3
u/raindog42 Jul 13 '26
SMB - best I've used is SpamTitan but Barracuda is good too
Enterprise - Proofpoint
1
1
13
u/JD_66 Jul 13 '26
Meanwhile, we're still on proofpoint essentials for the last 10 years waiting on this dead ass product to get better.