Email Security
A Cyber SaaS Analysis 2026Key findings
- We ranked 17 solutions. Only a handful keep watching a message after it lands.02
- Phishing was the single largest cause of cyber incident data breaches notified to the OAIC, at 34%.04
- AI-written lures got past native Gmail and Microsoft filtering 1.8 times as often as human-written ones.04
- How a platform connects to your mail sets the ceiling on what it can catch.05
What’s actually landing in your inbox. This is Tekspace’s first publicly released assessment.
Email doesn’t sit at the edge of a business, it sits at the centre of it. Supply chain conversations, hiring decisions, financial approvals, the day-to-day traffic of how a company actually runs, all of it moves through someone’s inbox. That is what makes it worth defending properly, and it is also why most organisations are less protected than they assume.
We have spent years inside the systems that keep Australian businesses secure, running proof-of-concepts against live environments and seeing what a well-configured Microsoft or Google tenant still lets through. Until now, that research stayed in-house, shaping the recommendations we made client by client rather than the market as a whole.
This report changes that. In collaboration with our partners, we look at email as a threat vector, study what businesses actually need from an email security solution, and evaluate the leading vendors in the space.
Email security is the layer a business adds on top of what Microsoft or Google already build in. The better platforms watch all three flows of mail, what arrives from outside, what leaves the business and what moves between your own people, and the architecture underneath usually sets the ceiling on what they catch. The need has always been there, as email has been the most common way in for as long as we have used it. All that has changed in the last couple of years is how far AI has multiplied the attacker’s leverage.
Product Landscape
We’ve ranked 17 solutions, the market leaders and strong emerging players in email security, on the Tekspace Landscape to show what makes the top platforms so effective for buyers. It’s the architecture underneath that separates the leaders.
Focused
-
Mesh
-
HornetsecurityVade
-
Graphus
-
Material
-
Sublime
Features
- Access Management
- Advanced Threat Protection (ATP)
- Anti-Malware
- Anti-Phishing
- Anti-Spam
- Incident Data Management
- Allow and Block Lists
- Breach Detection Alerts
- Activity Monitoring / Auditing
- Compliance
- Safe Banners
- Autonomous Task Execution
- (AI) Proactive Assistance
- Internal to Internal Monitoring
- Quarantine
Broad
-
Sophos
-
Paubox
-
SpamTitan
-
Ironscales
-
Cloudflare
-
Mimecast
-
Barracuda
-
Proofpoint
Features
- Account Takeover Prevention
- Threat Intelligence Reporting
- Targeted Attack Prevention
- Email Archiving
- Single Sign-On
- Outbound Email Monitoring
- Policy Enforcement
- Real-Time Detection
- Reporting and Monitoring (General)
- API-based Architecture
- Email Encryption
- Data Loss Prevention
Comprehensive
-
KnowBe4Egress
-
Darktrace
-
Abnormal
-
Check PointHarmony
Features
- (AI) Adaptive Learning
- Data Exfiltration Detection
- Reporting (User Management)
- Digital Signatures
- End User Self Service Quarantine
- URL Re-Writing and Sandboxing
- DMARC, SPF and DKIM Management
- Reporting and Monitoring (Encryption)
- APIs and SDKs
- SMTP Mail Relay
- User-Controlled Email Access Revocation
- (AI) Anomaly Detection
To build it, we collated 400+ disparate features across the seventeen vendors, normalising them down to 39 scored features in 12 capability groups, each group sitting under one of the four security outcomes that follow, so vendors are compared like for like rather than on the size of their marketing claims.
Want to know which of these fits your environment? We help with that.
A logo on a chart does not tell you whether the tool holds up against the phishing your people actually receive, or how much your team ends up releasing by hand.
Book your sessionSecurity Outcomes
With the market mapped, what do information technology professionals prioritise when considering a new email security solution?
- Frank De Pasquale, Chief Executive Officer at Tekspace
- Matt Flack, Chief Services Officer at ASI Solutions
- Francisco Vera, Managing Director at Securelogic Solutions
Every organisation has its own priorities. Yet time and again, these four outcomes rise to the top. Open each to see what matters in email security.
Catches threats in every mail flow, before and after delivery, proven on your own mail.
- Phishing, account takeover and payload detection across inbound, internal and outbound mail
- Links and attachments reassessed after delivery, not only on the way in
- Efficacy provable in your own environment through a monitor-only trial
Threat Context
Insights from 
Phishing was the single largest cause of cyber incident data breaches notified to the OAIC in the second half of 2024, at 34%.1
It is tempting to picture the people behind those breaches as state agencies. A few are. Most are not. They are criminal businesses, run for profit, using email as a low-barrier, high-yield route to initial access, reconnaissance and persistence.
Email is their default for the same reason a burglar tries the back door before the front. It is the most common way in, and it is rarely locked properly. As a keystone of communication, it is also a delivery mechanism for malware, credential harvesting and social engineering, and that risk is rising. Total BEC losses reported by large businesses rose 138%.2
Email compromise leads what businesses report
-
19%
Email compromise
Without financial loss.
-
15%
Business email compromise fraud
With financial loss.
Up from 13% -
11%
Identity fraud
Average self-reported cost of a cybercrime report from an Australian business.2
Source: ASD Annual Cyber Threat Report 2024-25, business cybercrime reports. Other report types not shown; bars to scale on a 0 to 100% axis.2
What generative AI changed is not whether these attacks happen, but how cheaply they can be run well. If your protection begins and ends with Microsoft or Google’s own defaults, you are very likely already receiving mail that should never have reached an inbox.
AI-written lures get through nearly twice as often
-
50.3%
AI-written lures
1.8x the human rate -
28.5%
Human-written lures
Source: AegisAI, State of the AI Threat in Email 2025, the vendor’s own analysis of more than 20,000 phishing emails.3
Where legacy filters fall short
The most common thing we find is that organisations do not know how much is already reaching their people. A monitoring pass over a live environment will pick up the data you need: malicious mail already sitting in real inboxes, often addressed to the same handful of people every time.
That gap, between what a team believes is getting through and what actually is, is the problem a dedicated email security layer exists to close. Network and endpoint tools were never built to see inside the inbox. Comprehensive email security products can.
Legacy filters are built to look once, at the moment a message arrives, and a link that only turns malicious after it lands beats them easily. The four patterns below are built around that single blind spot.
Built around one blind spot
-
Mid-Campaign Defence Response
Attackers adapt as scanners improve, favouring links because the payload can change after the email lands. VIPRE’s Q1 2026 report, covering 1.8 billion emails, found attackers increasingly hiding behind trusted platforms: over 89% of phishing URLs started on a legitimate domain before redirecting.4
-
AI Deepfake Hybrids
Email scams paired with AI-generated voice or video: an email that appears to come from the CFO, then minutes later a voice note in the CFO’s own cadence confirming the transfer.
-
Chained Quishing
QR codes that route a target through several staged sites, slipping past filters. Abnormal Security’s H1 2024 threat report found C-suite executives 42 times more likely than other staff to receive QR code phishing attacks.5
-
Polymorphic AI Payloads
Malicious emails that use AI to rewrite themselves so they look different every time, defeating signature detection. And AI-written lures land: in a 2024 study of 101 people, fully AI-automated spear phishing emails got a 54% click-through rate, matching human experts, against 12% for generic phishing.6
Sources: VIPRE Q1 2026 Email Threat Trends4; Abnormal Security H1 20245; Heiding et al., 2024.6
Catching these attacks takes filtering mature enough to keep watching a message and its outcome all the way through the flow. Only a handful of the products assessed here can do that.
Category Findings
Email is where cybersecurity strategy for most Australian organisations begins.
Architecture sets the ceiling
The outcome a business needs from email security is fairly plain: dangerous mail stays out of the inbox, safe mail arrives without delay, and people get on with their work. Most of the products assessed here can describe that outcome. How they connect to your mail decides which of them deliver it:
- Connected by API:
- Platforms that connect to Microsoft 365 or Google Workspace by API can watch inbound, outbound and internal mail, which is usually where a taken-over account does its damage.
- A gateway in front of the mail server:
- Older gateways sit in the mail flow and typically see less of it, internal mail especially.
- Before or after the inbox:
- Even among the strongest platforms there is a split. Some let a message land and pull it back out if it proves malicious, while others analyse it before it reaches the inbox.
Microsoft and Google are a sensible foundation and catch well-known threats reliably, but even at the most expensive tier they sell, some malicious mail still gets through. Running nothing beyond the defaults, on the channel behind more Australian breaches than any other, is a hard thing to reconcile.
Settle the criteria before the shortlist
The most common misstep we see comes before the first vendor conversation. Agree the criteria you will judge solutions against, ideally ones you can measure, and let them change as you learn. A reasonable place to start is one check for each of the four security outcomes, in order:
- Prove detection on your own mail: run a shortlisted solution in monitor-only mode across inbound, outbound and internal mail.
- Weigh how much it takes off your team: false positives, threat removal, SPF, DKIM and DMARC, and the vendor’s support process.
- Ask to see the reporting: detail your administrators can act on, and summaries your board can read.
- Check what your people notice: click-time delays, and whether they can release their own quarantined mail.
You do not have to take our word for any of this. Within days of monitoring, you will see exactly what is reaching your people that should not be.
Addendum
Credits
In launching this report, Tekspace would like to acknowledge contributions from the following teams and individuals.
Contributors
- Lead Analysts — Frank De Pasquale, CEO at Tekspace.
- Threat Context — Martin Dybalski, Director; Stuart Shanahan, Director of Technical Services; and Kris Bowen, Senior Offensive Security Consultant, all at Parabellum.
- Security Outcomes — Francisco Vera, Managing Director at Securelogic Solutions; and Matt Flack, Chief Services Officer at ASI Solutions.
- Research and analysis by the Tekspace Research team.
Email Security category
What this report does and doesn’t claim to cover and how we compare products fairly. Further questions, disclaimers and references follow at the end of the page.
Scope
Tekspace’s Email Security Cyber SaaS Analysis 2026 is not an exhaustive survey of every email security product in Australia. Instead, it focuses on solutions that are widely regarded as either market leaders, or strong emerging players.
Feature Granularity Model
We compare products at what we call Level 2: The Functional Group: specific enough to be meaningful, broad enough to compare very different products fairly, without losing sight of how they're meaningfully different.
Focused
-
Mesh
-
HornetsecurityVade
-
Graphus
-
Material
-
Sublime
Features
- Access Management
- Advanced Threat Protection (ATP)
- Anti-Malware
- Anti-Phishing
- Anti-Spam
- Incident Data Management
- Allow and Block Lists
- Breach Detection Alerts
- Activity Monitoring / Auditing
- Compliance
- Safe Banners
- Autonomous Task Execution
- (AI) Proactive Assistance
- Internal to Internal Monitoring
- Quarantine
Broad
-
Sophos
-
Paubox
-
SpamTitan
-
Ironscales
-
Cloudflare
-
Mimecast
-
Barracuda
-
Proofpoint
Features
- Account Takeover Prevention
- Threat Intelligence Reporting
- Targeted Attack Prevention
- Email Archiving
- Single Sign-On
- Outbound Email Monitoring
- Policy Enforcement
- Real-Time Detection
- Reporting and Monitoring (General)
- API-based Architecture
- Email Encryption
- Data Loss Prevention
Comprehensive
-
KnowBe4Egress
-
Darktrace
-
Abnormal
-
Check PointHarmony
Features
- (AI) Adaptive Learning
- Data Exfiltration Detection
- Reporting (User Management)
- Digital Signatures
- End User Self Service Quarantine
- URL Re-Writing and Sandboxing
- DMARC, SPF and DKIM Management
- Reporting and Monitoring (Encryption)
- APIs and SDKs
- SMTP Mail Relay
- User-Controlled Email Access Revocation
- (AI) Anomaly Detection
We'll connect you with the right people
By making an enquiry you agree to Tekspace contacting you about it and sending related research. Unsubscribe any time.