Tekspace

From our 2026 analysis of 18 email security products

See what your email security misses

Check Point ranked in the top tier of the 18 products our Cyber Lab evaluated. Run it across your live mail flow and measure exactly what your current defences let through. Free, and without touching a single MX record.

  • Connects to Microsoft 365 or Google Workspace by API in minutes
  • Monitor-only. Runs alongside your current defences
  • No MX record changes, no mail flow disruption

Run it in your tenant

Four fields. We take it from there.

Free evaluation. No obligation. If it is not a fit, we exit your journey.

Trusted by Australian IT teams

  • TAFE NSW
  • Pitcher Partners
  • Koala
  • PetStock
  • Aurora Healthcare
  • St John
  • Beforepay

The research

Independent research, not a vendor pitch

Our Cyber Lab evaluated 18 email security products against the Cyber Continuum, our framework for how products perform across efficacy, operations, reporting, and user experience. Check Point reached the top maturity tier. The full methodology and rankings are public.

  • 57% of Australian breaches start with an email
  • 2x business email compromise attacks doubled in a year
  • 200% longer attacker dwell time with low-maturity email tools
  • 18 products evaluated, four reached the top tier

Products evaluated include

  • Check Point
  • Microsoft
  • Abnormal
  • Darktrace
  • Mimecast
  • Proofpoint
  • Barracuda
  • Sophos
  • IRONSCALES
  • Cloudflare
  • KnowBe4

Read the full analysis

Breach statistics drawn from Australian government reporting, including the Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC). Full sources in the analysis.

The problem

Native filters miss the attacks that matter

More than half of Australian breaches start with an email, and the attacks behind them carry no malware payload. There is nothing for a signature filter to detect, just a well-written email from a domain that checks out.

Filters tuned for spam and malware wave these straight through. That is not a configuration problem you can fix. It is a detection model built for a different threat.

What email attacks look like now

  • Business email compromise (BEC) 45%
  • Spear phishing 30%
  • Calendar phishing 15%
  • Trusted platform exploitation 10%

Threat mix observed across our 2026 email security research. Full breakdown in the analysis.

The evaluation

Three steps, none of them disruptive

The evaluation runs in your tenant, against your real mail, with nothing rerouted and nothing installed on an endpoint.

Connect

We connect Check Point to your Microsoft 365 or Google Workspace tenant by API. It takes minutes, and there are no MX record changes.

Monitor

It runs in detect-only mode alongside your current defences. Your mail flow is untouched and your users notice nothing.

Measure

You get a report of every threat it caught that your current stack let through. Real emails, your tenant, no simulations.

Remove it at any time. The API connection disconnects in one click and leaves nothing behind.

The product

Why we recommend Check Point

Of the 18 products we evaluated, four reached the top maturity tier. Check Point sat among them across all four priorities our framework measures.

Already running a secure email gateway? Check Point connects behind it by API, so the evaluation quantifies exactly what your current vendor lets through. For most clients, that number is the whole conversation.

  • Efficacy

    AI anomaly detection built for payload-free attacks: BEC, spear phishing, and account takeover.

  • Operations

    Deploys by API and tunes itself to your tenant, with low alert noise for a small team.

  • Reporting

    Clear evidence of what was caught and why, which is exactly what the evaluation report draws on.

  • User experience

    Invisible to your users until something is wrong, with quarantine they can actually understand.

From the field

Tested by a real attack

An Australian engineering consultancy of about 800 staff moved from their long-standing email gateway to Check Point through us. The change ran without incident: connected by API, tuned in days, and quiet ever since.

Then, a few weeks ago, an attacker began phishing their users. Check Point recognised the campaign and immediately blocked every email the attacker sent. No clicks, no compromise, no cleanup. That is what a top-tier detection model looks like in production, and it is exactly what the evaluation measures in your tenant.

A Tekspace client. National engineering consultancy, about 800 staff.

Questions

What IT leads ask before they start

It uses the standard Microsoft and Google application APIs with scoped permissions, granted by you through your own admin console. During the evaluation it inspects mail to detect threats and quarantines nothing. You can see, audit, and revoke the permissions at any time.

No. The evaluation is monitor-only and sits behind your existing defences. There are no MX record changes, no rerouted mail, and nothing in the delivery path. If your mail works today, it works identically during the evaluation.

Nothing. The evaluation and the findings report are free, and there is no obligation at the end of it. Our model is simple: if the evidence does not justify a change, we tell you so and exit your journey.

You keep the findings report either way. If you want to proceed, the same connection moves from monitoring to protection, so there is no second deployment. If not, we disconnect the API and the evaluation leaves nothing behind. There is no auto-renewal and no trailing contract.

Tekspace engineers, with your team. Setup is a single call of about 15 minutes, where you grant the API access from your own console. After that the evaluation runs itself, and we walk you through the findings at the end.

Find out what gets through

Run Check Point across your live mail flow and see the evidence for yourself. Free, monitor-only, and gone in a click if it is not a fit.

Start my free evaluation
Start my free evaluation