The CF List: 2022's 20 Top Email Security Providers You Should Know

Business email compromise (BEC) is driving demand for cloud-based API-enabled email security solutions (CAPES), creating more opportunities for email security providers.

BEC is an impersonation attack where emails appear to come from within the company, or from a trusted partner or supplier, and are mainly focused on fraud. Phishers imitate legitimate senders by spoofing their email addresses or compromising their accounts. In some BEC scams, attackers impersonate coworkers or executives to persuade victims to conduct wire transfers, buy gift cards, or steal sensitive personal information like tax documents.

The estimated losses due to BEC totaled $1.8 billion in 2020, according to the FBI’s Internet Crime Complaint Center (IC3). And in 2021, it was up to $2.4 billion. Since 2016, the IC3 estimates BEC is responsible for $43 billion in losses globally.

Our latest CF List focuses on email security providers. Analysts with Omdia, Frost & Sullivan and Forrester weighed in on email security market trends and what it takes to be a successful provider.

Moving Away from SEGs to CAPES

Jess Burn is senior analyst at Forrester.

Forrester’s Jess Burn

“The pandemic saw a mass migration to the cloud and that included email,” she said. “As more firms moved to cloud-based email infrastructure from providers like Microsoft and Google, they also moved away from secure email gateways (SEGs) and toward cloud-based email security. So we saw the rise of CAPES as an add on to the naïve security capabilities offered by the email infrastructure providers.”

Sarah Pavlak is security industry principal at Frost & Sullivan.

Frost & Sullivan’s Sarah Pavlak

“Email security market growth slowed down as a result of economic turmoil caused by the pandemic,” she said. “Growth has now picked back up and will be driven by the needs for increased security for continued remote working environments and growing number of cyber threats.”

Keeping Up with Cyber Threats and Trends

Cyber threats and trends are continually evolving and changing, Pavlak said. Therefore, email security providers must consistently adapt their offerings appropriately to remain innovative and competitive.

“How providers meet the demands for the changing threat landscape is a large factor in determining success,” she said. “Customers’ needs have changed due to remote working adaptations, as well as the bring-your-own-device movement, which also brings an increase in security concerns. The way people work has changed dramatically over the past few years and providers must adapt offerings to meet these changes.”

Rik Turner is principal analyst at Omdia, which shares a parent company with Channel Futures (Informa).

Omdia’s Rik Turner

“To be cutting-edge, a provider should definitely be able to address the newer generation of threats such as phishing, BEC and account takeover (ATO) attacks, and of course ransomware,” he said.

The Need for Security Awareness Training

There is an argument that an email security vendor should also provide security awareness training, Turner said.

“That certainly informed some acquisition activity such as Proofpoint’s acquisition of Wombat, Mimecast’s purchase of Ataata, and Barracuda’s buying PhishLine, all of which happened in 2018,” he said. “I am not sure I completely buy into this idea, though, as it seems to me that it’s perfectly reasonable to use a separate supplier for security awareness training/cyber awareness training (SAT/CAT) rather than relying on your email security vendor.”

We’ve compiled a list, in no particular order, of 20 top email security providers. It’s based on analysts’ feedback and recent news reports. The list, by no means complete, includes a mix of well-known providers as well as lesser-known ones making strides in email security.