Email Security: Proofpoint vs Mimecast and the Phishing Reality

Email remains the primary way attackers get in — phishing, business email compromise, malicious attachments and links are the front door for a large share of breaches — and dedicated email-security platforms like Proofpoint and Mimecast exist because the built-in protection in productivity suites, while improved, often is not enough for a firm that is genuinely targeted. Choosing among them, or deciding whether you need dedicated email security at all, is a decision worth making on the reality of the threat rather than the feature comparison, because email security is one of the highest-leverage controls a firm has: it defends the channel attackers use most against the target they exploit most, which is people.

Why email security is high-leverage

The case for investing in email security is simply that email is where the attacks come. Phishing and business email compromise are consistently among the most common and most damaging attack types, precisely because they target people rather than technology, and people are manipulable — a convincing email asking for a payment, a credential, or a click succeeds often enough to be worth the attacker’s effort. Dedicated email-security platforms add layers the built-in protection may lack: more sophisticated detection of phishing and impersonation, protection against malicious links and attachments that evade basic filtering, and defences against the business-email-compromise attacks that plain filtering misses. For a firm that is genuinely targeted — and regulated firms with money and data are — the marginal protection over built-in filtering can be the difference between a blocked attack and a breach.

What the selection should weigh

• Detection of what actually threatens you. The platforms differ in how well they detect phishing, impersonation, business email compromise and evasive malicious content; assess them against the attacks you actually face, not a generic threat.
• The gap over your built-in protection. Your productivity suite already filters email; the question is what a dedicated platform adds over that for your risk, and whether that marginal protection justifies the cost. For a targeted firm it usually does.
• The human layer. Email security is partly technology and partly people; how the platform supports user awareness, reporting suspicious mail, and reducing the human success rate of attacks matters, because the target is people.
• Operational fit. How the platform integrates with your environment and how much it burdens the team affects whether its protection is actually realised or generates friction that undermines it.

Choosing well

• Assess against your real threat. Choose based on how well the platform defends against the attacks your firm actually faces — phishing, impersonation, business email compromise — rather than the feature list.
• Weigh the marginal protection. Judge the dedicated platform on what it adds over your built-in email protection for your risk; for a targeted regulated firm, that increment is usually worth it.
• Address the human layer too. Pair the technology with the awareness and reporting that reduce the human success rate, because email attacks target people and technology alone does not close the gap.
• Value high-leverage protection. Email security defends the channel attackers use most; treat it as one of the highest-return security investments rather than a commodity filter.

Email security is one of the highest-leverage controls a firm has, because it defends the channel attackers favour most against the target they exploit most. Proofpoint, Mimecast and their peers add real protection over built-in filtering for a firm that is genuinely targeted, and the choice among them should turn on how well each defends against the attacks you actually face, the increment over your existing protection, and the human layer that technology alone cannot close. The firms that get it right invest here proportionately to the reality that email is the front door — because a control this close to the primary attack vector repays getting right far more than its cost.

Who this is for

This reading is for:

• CISOs and IT leaders choosing an email-security platform
• Firms whose people are the target of phishing and business email compromise
• CTOs weighing dedicated email security against built-in protection
• Boards aware that email remains the primary attack vector

Sixteen Pillars helps firms choose email security on how well it defends the attacks they actually face, weighs the increment over built-in protection, and addresses the human layer too. Pricing is published at /pricing/. If this is live for your organisation and you would like an independent reading, the place to start is a conversation.

Sixteen Pillars is a technology governance consultancy based in Cyprus. Engagements run remote across the EU, UK, and Middle East, with on-site time where the engagement requires it.