Email Security
A Cyber SaaS Analysis 2026
Threat Context
How email exploits are evolving in Australia.
Security Outcomes Video
What Australian IT leaders prioritise when choosing an email security solution.
Product Landscape
17 leading vendors benchmarked on The Tekspace Cyber Continuum™.
Category Findings
Key takeaways, future outlook, and how to act on this research.
What’s actually landing in your inbox. This is Tekspace’s first publicly released assessment.
Email doesn’t sit at the edge of a business, it sits at the centre of it. Supply chain conversations, hiring decisions, financial approvals, the day-to-day traffic of how a company actually runs, all of it moves through someone’s inbox. That is what makes it worth defending properly, and it is also why most organisations are less protected than they assume.
We have spent years inside the systems that keep Australian businesses secure, running proof-of-concepts against live environments and seeing what a well-configured Microsoft or Google tenant still lets through. Until now, that research stayed in-house, shaping the recommendations we made client by client rather than the market as a whole.
This report changes that. In collaboration with our partners, we look at email as a threat vector, study what businesses actually need from an email security solution, and evaluate the leading vendors in the space.
Email security is the layer a business adds on top of what Microsoft or Google already build in. The better platforms watch all three flows of mail, what arrives from outside, what leaves the business and what moves between your own people, and the architecture underneath usually sets the ceiling on what they catch. The need has always been there, as email has been the most common way in for as long as we have used it. All that has changed in the last couple of years is how far AI has multiplied the attacker’s leverage.
Threat Context
Insights from 
Phishing was the single largest cause of cyber incident data breaches notified to the OAIC in the second half of 2024, at 34%.1
It is tempting to picture the people behind those breaches as state agencies. A few are. Most are not. They are criminal businesses, run for profit, using email as a low-barrier, high-yield route to initial access, reconnaissance and persistence.
Email is their default for the same reason a burglar tries the back door before the front. It is the most common way in, and it is rarely locked properly. As a keystone of communication, it is also a delivery mechanism for malware, credential harvesting and social engineering, and that risk is rising. Total BEC losses reported by large businesses rose 138%.2
Email compromise leads what businesses report
-
19%
Email compromise
Without financial loss.
-
15%
Business email compromise fraud
With financial loss.
Up from 13% -
11%
Identity fraud
Average self-reported cost of a cybercrime report from an Australian business.2
Source: ASD Annual Cyber Threat Report 2024-25, business cybercrime reports. Other report types not shown; bars to scale on a 0 to 100% axis.2
What generative AI changed is not whether these attacks happen, but how cheaply they can be run well. If your protection begins and ends with Microsoft or Google’s own defaults, you are very likely already receiving mail that should never have reached an inbox.
AI-written lures get through nearly twice as often
-
50.3%
AI-written lures
1.8x the human rate -
28.5%
Human-written lures
Source: AegisAI, State of the AI Threat in Email 2025, the vendor’s own analysis of more than 20,000 phishing emails.3
Where legacy filters fall short
The most common thing we find is that organisations do not know how much is already reaching their people. A monitoring pass over a live environment will pick up the data you need: malicious mail already sitting in real inboxes, often addressed to the same handful of people every time.
That gap, between what a team believes is getting through and what actually is, is the problem a dedicated email security layer exists to close. Network and endpoint tools were never built to see inside the inbox. Comprehensive email security products can.
Legacy filters are built to look once, at the moment a message arrives, and a link that only turns malicious after it lands beats them easily. The four patterns below are built around that single blind spot.
Built around one blind spot
-
Mid-Campaign Defence Response
Attackers adapt as scanners improve, favouring links because the payload can change after the email lands. VIPRE’s Q1 2026 report, covering 1.8 billion emails, found attackers increasingly hiding behind trusted platforms: over 89% of phishing URLs started on a legitimate domain before redirecting.4
-
AI Deepfake Hybrids
Email scams paired with AI-generated voice or video: an email that appears to come from the CFO, then minutes later a voice note in the CFO’s own cadence confirming the transfer.
-
Chained Quishing
QR codes that route a target through several staged sites, slipping past filters. Abnormal Security’s H1 2024 threat report found C-suite executives 42 times more likely than other staff to receive QR code phishing attacks.5
-
Polymorphic AI Payloads
Malicious emails that use AI to rewrite themselves so they look different every time, defeating signature detection. And AI-written lures land: in a 2024 study of 101 people, fully AI-automated spear phishing emails got a 54% click-through rate, matching human experts, against 12% for generic phishing.6
Sources: VIPRE Q1 2026 Email Threat Trends4; Abnormal Security H1 20245; Heiding et al., 2024.6
Catching these attacks takes filtering mature enough to keep watching a message and its outcome all the way through the flow. Only a handful of the products assessed here can do that.
Security Outcomes
With the threat context as a backdrop, what do information technology professionals prioritise when considering a new email security solution?
- Frank De Pasquale, Chief Executive Officer at Tekspace
- Matt Flack, Chief Services Officer at ASI Solutions
- Francisco Vera, Managing Director at Securelogic Solutions
What matters in your assessment? Whatever the domain, a security product earns its place against the same four outcomes. Choose each to see how we assess the email security category.
Catches threats in every mail flow, before and after delivery, proven on your own mail.
- Phishing, account takeover and payload detection across inbound, internal and outbound mail
- Links and attachments reassessed after delivery, not only on the way in
- Efficacy provable in your own environment through a monitor-only trial
Product Landscape
We’ve ranked 17 solutions, the market leaders and strong emerging players in email security, on the Tekspace Cyber Continuum™ to show what makes the top platforms so effective for buyers. It’s the architecture underneath that separates the leaders.
Focused
-
Mesh
-
HornetsecurityVade
-
Graphus
-
Material
-
Sublime
Features
- Access Management
- Advanced Threat Protection (ATP)
- Anti-Malware
- Anti-Phishing
- Anti-Spam
- Incident Data Management
- Allow and Block Lists
- Breach Detection Alerts
- Activity Monitoring / Auditing
- Compliance
- Safe Banners
- Autonomous Task Execution
- (AI) Proactive Assistance
- Internal to Internal Monitoring
- Quarantine
Broad
-
Sophos
-
Paubox
-
SpamTitan
-
Ironscales
-
Cloudflare
-
Mimecast
-
Barracuda
-
Proofpoint
Features
- Account Takeover Prevention
- Threat Intelligence Reporting
- Targeted Attack Prevention
- Email Archiving
- Single Sign-On
- Outbound Email Monitoring
- Policy Enforcement
- Real-Time Detection
- Reporting and Monitoring (General)
- API-based Architecture
- Email Encryption
- Data Loss Prevention
Comprehensive
-
KnowBe4Egress
-
Darktrace
-
Abnormal
-
Check PointHarmony
Features
- (AI) Adaptive Learning
- Data Exfiltration Detection
- Reporting (User Management)
- Digital Signatures
- End User Self Service Quarantine
- URL Re-Writing and Sandboxing
- DMARC, SPF and DKIM Management
- Reporting and Monitoring (Encryption)
- APIs and SDKs
- SMTP Mail Relay
- User-Controlled Email Access Revocation
- (AI) Anomaly Detection
To build it, we collated 400+ disparate features across the seventeen vendors, normalising them down to 39 scored features in 12 capability groups, each group sitting under one of the four outcomes above, so vendors are compared like for like rather than on the size of their marketing claims.
Want to know which of these fits your environment? We help with that.
A logo on a chart does not tell you whether the tool holds up against the phishing your people actually receive, or how much your team ends up releasing by hand.
Book your sessionCategory Findings
Email is where cybersecurity strategy for most Australian organisations begins.
Architecture sets the ceiling
The outcome a business needs from email security is fairly plain: dangerous mail stays out of the inbox, safe mail arrives without delay, and people get on with their work. Most of the products assessed here can describe that outcome. How they connect to your mail decides which of them deliver it:
- Connected by API:
- Platforms that connect to Microsoft 365 or Google Workspace by API can watch inbound, outbound and internal mail, which is usually where a taken-over account does its damage.
- A gateway in front of the mail server:
- Older gateways sit in the mail flow and typically see less of it, internal mail especially.
- Before or after the inbox:
- Even among the strongest platforms there is a split. Some let a message land and pull it back out if it proves malicious, while others analyse it before it reaches the inbox.
Microsoft and Google are a sensible foundation and catch well-known threats reliably, but even at the most expensive tier they sell, some malicious mail still gets through. Running nothing beyond the defaults, on the channel behind more Australian breaches than any other, is a hard thing to reconcile.
Settle the criteria before the shortlist
The most common misstep we see comes before the first vendor conversation. Agree the criteria you will judge solutions against, ideally ones you can measure, and let them change as you learn. A reasonable place to start:
- Check coverage of all three flows: inbound, outbound and internal mail.
- Weigh the vendor’s support process, not only its detection.
- Look for SPF, DKIM and DMARC managed in the same console.
- Run a shortlisted solution in monitor-only mode against your own mail.
You do not have to take our word for any of this. Within days of monitoring, you will see exactly what is reaching your people that should not be.
Addendum
Credits
In launching this report, Tekspace would like to acknowledge contributions from the following teams and individuals.
Contributors
- Lead Analysts — Frank De Pasquale, CEO at Tekspace.
- Threat Context — Martin Dybalski, Director; Stuart Shanahan, Director of Technical Services; and Kris Bowen, Senior Offensive Security Consultant, all at Parabellum.
- Security Outcomes — Francisco Vera, Managing Director at Securelogic Solutions; and Matt Flack, Chief Services Officer at ASI Solutions.
- Research and analysis by the Tekspace Research team.
References
- Office of the Australian Information Commissioner (2025), Notifiable Data Breaches Report: July to December 2024, Table 3 (phishing, compromised credentials, caused 84 of the 247 cyber incident breaches).
- Australian Signals Directorate (2025), ASD Annual Cyber Threat Report 2024-25 (business cybercrime report types, p.14: email compromise without financial loss 19%, business email compromise fraud 15%, up from 13%, identity fraud 11%; large-business BEC losses up 138%; $80,850 average self-reported cost per business report).
- AegisAI (2026), State of the AI Threat in Email: 2025 (the vendor’s own analysis of more than 20,000 phishing emails; AI-written lures got past native Gmail and Microsoft filtering 50.3% of the time, human-written ones 28.5%).
- VIPRE Security Group (2026), Q1 2026 Email Threat Trends Report (1.8 billion emails analysed; over 89% of phishing URLs started on a legitimate domain before redirecting).
- Abnormal Security (2024), H1 2024 Phishing Frenzy: C-suite receives 42x more QR code attacks than average employee.
- Heiding, Lermen, Kao, Schneier and Vishwanath (2024), Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects, arXiv:2412.00586 (101 participants; fully AI-automated spear phishing 54% click-through, matching human experts; generic phishing 12%).
Email Security category
What this report does and doesn’t claim to cover, how we compare products fairly, and what to do if you still have questions.
Scope
Tekspace’s Email Security Cyber SaaS Analysis 2026 is not an exhaustive survey of every email security product in Australia. Instead, it focuses on solutions that are widely regarded as either market leaders, or strong emerging players.
Feature Granularity Model
We compare products at what we call Level 2: The Functional Group: specific enough to be meaningful, broad enough to compare very different products fairly, without losing sight of how they're meaningfully different.
Further questions
Why isn’t Microsoft or Google’s built-in protection enough on its own?
Native protection has to be good at hundreds of things, not just at stopping email attacks specifically. It catches well-known threats reliably, but as this report’s threat context shows, a meaningful share of dangerous mail still gets through native filtering alone, which is why a dedicated layer exists.
How is this different from a traditional secure email gateway (SEG)?
A traditional SEG sits in front of mail flow and filters on the way in, so every rule change risks disrupting delivery. The platforms in this report connect by API instead, reading mail without sitting in the direct path, and in the strongest cases analysing it before it ever reaches an inbox rather than pulling it back out after the fact.
How were the 17 vendors in this report actually compared?
We normalised the market down to 39 scored features and assessed each vendor at what we call the Functional Group level: specific enough to be meaningful, broad enough to compare very different products fairly. See Feature Granularity Model above for how that scale works.
One of these vendors has been acquired since publication. Does that change the findings?
Vade was acquired by Hornetsecurity and appears here as Hornetsecurity Vade. It was assessed as a standalone product and has not been reassessed since. What changes is how you buy it, not what it was found to do. Where a product has been folded into a larger platform, check the packaging and commercial terms before comparing it against a standalone tool.
What happens if I want another vendor assessed?
Get in touch. This report focuses on solutions widely regarded as market leaders or strong emerging players, not every product on the market, and we are glad to look at ones we have not yet covered.
Disclaimers
Findings reflect our professional judgement at the time of publication, based on the data available to us. Product capabilities and roadmaps change, so organisations should treat this report as a guide to practical decision making, not as a substitute for their own due diligence.
If you have identified errors in this report, or wish to have another product assessed, please contact our team.
Contact our teamFocused
-
Mesh
-
HornetsecurityVade
-
Graphus
-
Material
-
Sublime
Features
- Access Management
- Advanced Threat Protection (ATP)
- Anti-Malware
- Anti-Phishing
- Anti-Spam
- Incident Data Management
- Allow and Block Lists
- Breach Detection Alerts
- Activity Monitoring / Auditing
- Compliance
- Safe Banners
- Autonomous Task Execution
- (AI) Proactive Assistance
- Internal to Internal Monitoring
- Quarantine
Broad
-
Sophos
-
Paubox
-
SpamTitan
-
Ironscales
-
Cloudflare
-
Mimecast
-
Barracuda
-
Proofpoint
Features
- Account Takeover Prevention
- Threat Intelligence Reporting
- Targeted Attack Prevention
- Email Archiving
- Single Sign-On
- Outbound Email Monitoring
- Policy Enforcement
- Real-Time Detection
- Reporting and Monitoring (General)
- API-based Architecture
- Email Encryption
- Data Loss Prevention
Comprehensive
-
KnowBe4Egress
-
Darktrace
-
Abnormal
-
Check PointHarmony
Features
- (AI) Adaptive Learning
- Data Exfiltration Detection
- Reporting (User Management)
- Digital Signatures
- End User Self Service Quarantine
- URL Re-Writing and Sandboxing
- DMARC, SPF and DKIM Management
- Reporting and Monitoring (Encryption)
- APIs and SDKs
- SMTP Mail Relay
- User-Controlled Email Access Revocation
- (AI) Anomaly Detection
We'll connect you with the right people
Vendors see your organisation's size and industry, never your name or contact details.
By making an enquiry you agree to Tekspace contacting you about it and sending related research. Unsubscribe any time. Privacy