The CF List: 2022's 20 Top Email Security Providers You Should Know
The email security market has picked up after slowing during the pandemic.
![Twenty, 20, SD-WAN providers Twenty, 20, SD-WAN providers](https://eu-images.contentstack.com/v3/assets/blt10e444bce2d36aa8/blt1623fbe456f4d7d3/6523f96f6868b42e553c7c45/shutterstock_790434142.jpg?width=700&auto=webp&quality=80&disable=upscale)
Jörge röse-oberreich/Shutterstock
Omdia’s Rik Turner cited Perception Point as an email security leader. In July, Perception Point launched a new web security solution which adds enterprise-grade security to native Chrome and Edge browsers.
“I like the Perception Point guys, who have gone in an interesting direction with their acquisition of Hysolate,” he said.
Turner said Avanan, which was acquired by Check Point Software Technologies last year, is a noteworthy email security provider. Check Point said Avanan is the the fastest growing cloud email security company. Avanan’s features have been integrated into Check Point’s Infinity consolidated security architecture.
“I’d certainly recommend keeping an eye of them even now,” he said.
Turner said Material Security is one to watch in email security. This summer, the company announced $100 million in new funding led by Trae Stephens at Founders Fund that values the company at $1.1 billion.
“I really like an outfit called Material Security, who have a bit of a punk rock ethic about them and are definitely worth taking a look at,” he said. “Not sure now, but at one time they even had a manifesto on their website, which made me smile. But I also think their technological approach is an interesting one.”
Google is a noteworthy email security provider.
“It’s no longer possible to offer just the secure email gateway (SEG) method of email security deployment due to that mass migration to cloud email infrastructure,” said Forrester’s Jess Burn. “Legacy SEG players are now offering both a SEG and a cloud-based API-enabled email security solutions (CAPES) deployment option to keep from being displaced.”
Cisco is among security vendors with a broad portfolio of products that sought to bolster the attraction of their SEGs, to justify their customers sticking with their SEGs instead of ditching them in favor of Microsoft plus a non-SEG, by pushing the extended detection and response (XDR) narrative, Turner said.
“In other words, the pitch is ‘stick with my SEG and it can feed telemetry to my XDR brain in the back end (usually a data lake in the cloud), along with any other security tools you have from me such as for network or endpoint, then receive remedial instructions from the brain and enforce those policy decisions,'” he said. “The most explicit example of this is Cisco, which actually gives away its SecureX XDR technology to customers running any of its security tools, including its SEG.”
Proofpoint is listed as a leader on the latest Forrester Wave for Enterprise Email Security. Last year, Thoma Bravo acquired Proofpoint for $12.3 billion. The deal bolstered Thoma Bravo’s cybersecurity play in a big way.
Because Proofpoint is a private equity acquisition, Turner says he’s watching it to see what direction it takes.
“The email security market is highly fragmented – there are a lot of providers with various differing capabilities,” said Frost & Sullivan’s Sarah Pavlak. “A list of noteworthy providers includes those who have been in the market for a long time, know what customers are looking for, and adjust accordingly to customer needs and changing threat landscape, but also includes newer and smaller providers that are highly innovative and bring new ideas to the industry. Threat intelligence capabilities are also a factor in determining noteworthy providers because timely and accurate sources of threat intelligence have a big impact on detecting and stopping attacks.”
Microsoft is listed as a leader on the latest Forrester Wave for Enterprise Email Security.
“Microsoft continues to beef up its own email security capabilities, and while it may still not be anything beyond good enough, its Exchange Online Protection (EOP) product, being bundled into all three SKUs of Office 365 … is a compelling alternative to many more expensive SEGs, at least for more price-sensitive customers,” Turner said.
Turner said Hornetsecurity is a noteworthy email security provider. He said the company started out as a SEG and continues to “plough that furrow despite the looking presence of Microsoft.”
“They actually pooh-pooh the API-based approach of the non-SEGs and reckon they can address the modern email threat in other ways, which I found quite refreshing,” he said.
Turner said Retarus is an email security provider worth watching. It offers a slightly differentiated email security platform that he finds intriguing.
“The current threat landscape includes many different types of trending attacks such as phishing, malware, spam, BEC and supply chain compromise,” Pavlak said. “New attack techniques will inevitably be used by attackers, and it is important for email security providers to have a multi-faceted solution to be able to deal with constant threats and adapt technologies to deal with latest attack trends.”
Turner said Fortinet is among security vendors with a broad portfolio of products that have sought to bolster the attraction of their SEGs by pushing the XDR narrative.
“The key players continue to have a very heavy presence in the market, but there are new players entering at a rapid pace,” Pavlak said. “Some of these new players are offering very innovative solutions and growing quickly, which will likely set them up to be acquired by the larger key vendors.
Turner said it will be interesting to see what Palo Alto Networks does in email security. Its Wildfire cloud malware protection engine identifies previously unknown malware and generates signatures that the company’s firewalls can use to then detect and block the malware.
“They’ve never owned a SEG, but of course they are XDR providers and so must take telemetry from whatever email security platform the customer has in place,” he said.
Barracuda Networks is listed as a leader on the latest Forrester Wave for Enterprise Email Security. This month, the company announced it has added a range of capabilities that collectively tighten integration across its portfolio of cybersecurity and backup and recovery platforms.
Turner said Barracuda Networks is among security vendors with a broad portfolio of products that have sought to bolster the attraction of their SEGs by pushing the XDR narrative.
Email security is part of the vendor’s Broadcom Software Group, which delivers a suite of Symantec security capabilities. The email security solution integrates with other Symantec capabilities like web security gateway, browser isolation, endpoint detection and response (EDR) and data loss prevention (DLP). It delivers email security in multiple form factors, including cloud, on-premises appliances, software and hybrid deployments.
Turner said Acronis is one to watch in email security.
“Certainly the second coming of ransomware during the pandemic has thrown a spotlight on how email security vendors can help keep their customers safe,” he said. “It has also raised the profile of that old stalwart of IT governance, backup and recovery software as a necessary part of defenders’ armory in fighting ransomware. And indeed it is no coincidence that we are seeing firms from that side of the industry like Acronis now portraying themselves as providers of cyber protection. Acronis also cut an OEM deal with a non-SEG provider, Perception Point, to complete its portfolio in the context of protection from ransomware, i.e. email security plus backup and recovery.”
Turner said Sophos is among security vendors with a broad portfolio of products that have sought to bolster the attraction of their SEGs by pushing the XDR narrative.
Sophos Email is a cloud-based SEG solution for Sophos Central. Built to integrate with popular email platforms, Sophos Email is engineered to keep businesses safe from email threats by stopping spam, phishing, malware and data loss.
Mimecast is listed as a leader on the latest Forrester Wave for Enterprise Email Security. The company went private in a $5.8 billion all-cash acquisition by private equity firm Permira.
Turner said he’s watching Mimecast to see what direction it takes in the months ahead.
“The most effective solutions combine standard capabilities like email filtering, anti-malware, authentication, security awareness and training, phishing protection, and incident response capabilities combined with newer capabilities like artificial intelligence (AI)-enabled BEC detection and integration with XDR,” Burn said. “Email is an important input to XDR solutions as so many attacks continue to come from phishing. That telemetry aids in quicker detection and response.”
This past spring, Cloudflare acquired Area 1 Security for $162 million in cash and stock to beef up its zero trust platform. Area 1 Security’s cloud-native platform works with any email offering. It stops phishing attacks by preemptively discovering and eliminating them before they can inflict damage in a corporate environment.
Last December, OpenText completed its acquisition of Zix for $860 million. Zix provides SaaS-based email encryption, threat protection and compliance cloud solutions for SMBs. The acquisition deepens OpenText’s technology and its relationship with Microsoft.
Trend Micro is listed as a leader on the latest Forrester Wave for Enterprise Email Security. This summer, Trend Micro announced a dedicated U.S. federal business unit. Backed by significant investment and staffed by specialist hires, the company is expanding its mission to U.S. federal organizations and citizens by protecting data as it moves to the cloud.
Turner said Trend Micro is among security vendors with a broad portfolio of products that have sought to bolster the attraction of their SEGs by pushing the XDR narrative.
Last year, HelpSystems acquired Agari, a provider of enterprise solutions protecting against advanced email threats. Agari’s SaaS offering protects organizations against phishing, BEC and email threats.
Agari was a founding member of the industry consortium that developed the Domain Message Authentication Reporting and Conformance (DMARC) email authentication standard. It enables organizations to authenticate email from their domains to prevent cybercriminals from impersonating their brand, helping them protect their customers and partners from email attacks.
Last year, HelpSystems acquired Agari, a provider of enterprise solutions protecting against advanced email threats. Agari’s SaaS offering protects organizations against phishing, BEC and email threats.
Agari was a founding member of the industry consortium that developed the Domain Message Authentication Reporting and Conformance (DMARC) email authentication standard. It enables organizations to authenticate email from their domains to prevent cybercriminals from impersonating their brand, helping them protect their customers and partners from email attacks.
Business email compromise (BEC) is driving demand for cloud-based API-enabled email security solutions (CAPES), creating more opportunities for email security providers.
BEC is an impersonation attack where emails appear to come from within the company, or from a trusted partner or supplier, and are mainly focused on fraud. Phishers imitate legitimate senders by spoofing their email addresses or compromising their accounts. In some BEC scams, attackers impersonate coworkers or executives to persuade victims to conduct wire transfers, buy gift cards, or steal sensitive personal information like tax documents.
The estimated losses due to BEC totaled $1.8 billion in 2020, according to the FBI’s Internet Crime Complaint Center (IC3). And in 2021, it was up to $2.4 billion. Since 2016, the IC3 estimates BEC is responsible for $43 billion in losses globally.
Our latest CF List focuses on email security providers. Analysts with Omdia, Frost & Sullivan and Forrester weighed in on email security market trends and what it takes to be a successful provider.
Moving Away from SEGs to CAPES
Jess Burn is senior analyst at Forrester.
Forrester’s Jess Burn
“The pandemic saw a mass migration to the cloud and that included email,” she said. “As more firms moved to cloud-based email infrastructure from providers like Microsoft and Google, they also moved away from secure email gateways (SEGs) and toward cloud-based email security. So we saw the rise of CAPES as an add on to the naïve security capabilities offered by the email infrastructure providers.”
Sarah Pavlak is security industry principal at Frost & Sullivan.
Frost & Sullivan’s Sarah Pavlak
“Email security market growth slowed down as a result of economic turmoil caused by the pandemic,” she said. “Growth has now picked back up and will be driven by the needs for increased security for continued remote working environments and growing number of cyber threats.”
Keeping Up with Cyber Threats and Trends
Cyber threats and trends are continually evolving and changing, Pavlak said. Therefore, email security providers must consistently adapt their offerings appropriately to remain innovative and competitive.
“How providers meet the demands for the changing threat landscape is a large factor in determining success,” she said. “Customers’ needs have changed due to remote working adaptations, as well as the bring-your-own-device movement, which also brings an increase in security concerns. The way people work has changed dramatically over the past few years and providers must adapt offerings to meet these changes.”
Rik Turner is principal analyst at Omdia, which shares a parent company with Channel Futures (Informa).
Omdia’s Rik Turner
“To be cutting-edge, a provider should definitely be able to address the newer generation of threats such as phishing, BEC and account takeover (ATO) attacks, and of course ransomware,” he said.
The Need for Security Awareness Training
There is an argument that an email security vendor should also provide security awareness training, Turner said.
“That certainly informed some acquisition activity such as Proofpoint’s acquisition of Wombat, Mimecast’s purchase of Ataata, and Barracuda’s buying PhishLine, all of which happened in 2018,” he said. “I am not sure I completely buy into this idea, though, as it seems to me that it’s perfectly reasonable to use a separate supplier for security awareness training/cyber awareness training (SAT/CAT) rather than relying on your email security vendor.”
We’ve compiled a list, in no particular order, of 20 top email security providers. It’s based on analysts’ feedback and recent news reports. The list, by no means complete, includes a mix of well-known providers as well as lesser-known ones making strides in email security.
Want to contact the author directly about this story? Have ideas for a follow-up article? Email Edward Gately or connect with him on LinkedIn. |
About the Author(s)
You May Also Like