Protoxol
Request a demo
Platform Modules Plans Blog Request a demo
MX · Module

Email protection

Inbound analysis. URL & attachment sandboxing. BEC defense.

Compare with 5 alternatives ↓

Overview

What MX does.

Email Protection inspects every inbound message, attachment and URL via API integration with Microsoft 365 and Google Workspace — no MX record changes required. Suspicious URLs are detonated in an isolated sandbox; attachments are statically and dynamically analyzed; sender reputation, header anomalies and tone-of-voice are all scored. When a user clicks anyway, the click becomes an EDR signal in the same timeline.

Features

Inside MX.

API-native integration

Microsoft Graph + Google Workspace API. No MX rerouting, no DNS surgery.

URL sandboxing

Detonate suspicious links in isolated VM. Catch credential phish and drive-by malware.

BEC detection

Sender reputation, tone analysis, financial keyword scoring, lookalike domain matching.

User-reported phish flow

One-click report from Outlook/Gmail plugin into the same SOC queue.

Auto-remediation

Pull malicious mail from all recipients' inboxes when a phish is confirmed, with audit.

Use cases

Where MX earns its keep.

Phishing protection

Pre-delivery scoring blocks the message before it reaches the inbox when scoring is conclusive.

BEC and CEO fraud

Behavioral models flag wire-transfer requests from impersonated execs.

Account takeover defense

Detect impossible-travel OAuth grants, mass forwarding rules, MFA bombing.

Technical specs

MX under the hood.

Integration M365 Graph API, Google API
Detection latency Pre-delivery in under 8s p95
Sandbox capacity 100k URL detonations / hour
Languages 12 languages tone-aware

Figures from internal testing; test method and date to be published.

Compare alternatives

Protoxol Email protection compared with five alternatives

Email remains a common route for initial access: credential phishing, CEO fraud, attachments with a malicious payload. This comparison follows what you actually do in the SOC with mail: decide what gets blocked, review what was held, see who clicked and pull the message out of mailboxes. It sets Protoxol Email protection next to five relevant alternatives a buyer may weigh, from gateways to API products and the native Microsoft 365 layer. Each cell separates what is verified on official pages from what is still unconfirmed.

What Protoxol offers

Comparison table

Each cell shows the status and the scope. Statuses are explained below the table.

Show alternative:

Scroll the table sideways to see every column.

Protoxol Email protection compared with five alternatives
CriterionProtoxol Email protectionProofpoint Core Email ProtectionMimecast Email SecurityMicrosoft Defender for Office 365Abnormal Inbound Email SecurityDarktrace / EMAIL
Architecture (gateway, API or hybrid) AvailableAPI integration with Microsoft 365 and Google Workspace, no MX change. Mail-path (gateway) filtering is not stated. AvailableDeployed by API (Microsoft Graph) or as an SEG, and the two can be combined. The gateway needs an MX change. ↗ AvailableTwo modes: an MX-based gateway that intercepts inline, or an API connection with no MX change. ↗ AvailableA layer on top of the built-in protections of Microsoft 365 cloud mailboxes. Third-party or on-premises steps are not described. ↗ AvailableAPI-based with no MX changes, per the product page. ↗ Depends on setupAPI only (analysis after delivery) or API plus journaling (before delivery). Not an inline gateway. ↗
SPF, DKIM and DMARC Not confirmedThe page scores header anomalies but does not describe SPF, DKIM or DMARC evaluation or management. Needs another productDomain protection and DMARC are handled in separate products (Email Fraud Defense, Secure Email Relay). ↗ Needs another productDMARC Analyzer is listed as a supporting solution, not as part of the core email product. ↗ Depends on setupDepends on publishing SPF, DKIM and DMARC in your DNS; Microsoft 365 uses them to detect spoofing, with spoof intelligence. ↗ Not confirmedThe page mentions authentication in general terms, with no detail on SPF, DKIM or DMARC. Needs another productDarktrace / EMAIL - DMARC has its own product specification, separate from the EMAIL one. ↗
Phishing and BEC detection AvailableSender reputation, tone, financial keywords and lookalike domains. No public efficacy data backs it up. AvailableLanguage models, relationship graphs, machine learning and computer vision against BEC, QR phishing and impersonation. ↗ AvailableAnomaly detection with social graphing and computer vision for brand and login-page impersonation. ↗ AvailablePlan 1 adds user and domain impersonation, mailbox intelligence and phishing thresholds. Plan 2 adds priority account protection. ↗ AvailableBehavioural fingerprint per employee and vendor; each message is measured against its real baseline, including payload-less attacks. ↗ AvailableComputes over a thousand metrics per message and learns from your users' activity to separate normal from risky. ↗
Attachment analysis and sandbox Not confirmedThe page mentions static and dynamic attachment analysis; there is no evidence the sandbox is operating today. AvailableThe page lists sandboxing of attachments and URLs within the protection. It does not detail the mechanism. ↗ AvailableAdvanced attachment sandboxing and malware detection included in all three plans. ↗ AvailableSafe Attachments detonates attachments in a virtual environment before delivery; scanning typically takes up to about 15 minutes. ↗ Not confirmedThe page does not detail attachment sandboxing or detonation; it only shows detection of uncommon attachment types. AvailableAnalyses attachment composition and can neutralise it, for example with a flattened version. No sandbox is described in the spec. ↗
Link protection Not confirmedDetonation of suspicious URLs in an isolated VM is described; real operation and click-time rewriting are not confirmed. AvailableClick-time protection, alongside pre-delivery and post-delivery, within the continuous architecture. ↗ AvailableOn-click URL analysis and browser isolation included in all three plans. ↗ AvailableSafe Links rewrites URLs and verifies them at click time in email, Teams and Office apps. ↗ AvailableURL protection with a per-link explanation and standardised click data sent to the SIEM. ↗ AvailableLock and double lock actions divert the link to a hosted page and run extra checks when the user clicks. ↗
Quarantine, release and removal AvailablePulls the message from every recipient mailbox after a phish is confirmed, with audit. User release is not described. Not confirmedThe pages opened do not detail quarantine or the release workflow; they do mention post-delivery remediation. Not confirmedThe pages opened mention rapid remediation but do not detail quarantine or release. AvailableQuarantine policies per detection type. For malware and high-confidence phishing the user can only request release. ↗ AvailableQuarantine release view showing Abnormal's score next to Microsoft's verdict, plus a daily or weekly digest. ↗ AvailableHolds high-risk messages and tells the provider to remove them; the operator can override actions and hold manually. ↗
Message traceability Not confirmedNo message trace equivalent is described. The removal action does carry an audit record. AvailableThreat Protection Workbench rebuilds the chain: messages, users, clicks and remediation. Classic message trace is not detailed. ↗ AvailableMessage tracking is listed among the management capabilities. ↗ AvailableMessage Trace and the audit log for all cloud mailboxes; Threat Explorer and campaigns in Plan 2. ↗ AvailableThreat Log, time-based search in quarantine and click events exported to the SIEM. ↗ AvailableEmail log filterable with over 250 metrics and a permission-restricted Mailbox Inspector view of mailboxes. ↗
Microsoft 365 and Google Workspace AvailableMicrosoft Graph and the Google Workspace API. Microsoft 365 needs read permissions. AvailableProtects Microsoft 365 and Google Workspace; detections also show in the Microsoft 365 console. ↗ AvailableMicrosoft 365 and Google Workspace by API; the gateway also supports on-premises and hybrid environments. ↗ AvailableBuilt for Microsoft 365. The pages consulted do not describe coverage of Google Workspace mailboxes. ↗ AvailableSimultaneous search across Microsoft 365 and Google Workspace. ↗ AvailableMicrosoft 365 and Google Workspace; for Google it requires an Enterprise or Education Plus edition and journaling. ↗
User reporting AvailableOne-click report from the Outlook or Gmail add-in into the same SOC queue. Not confirmedThe pages opened do not describe a user-reporting flow; they only mention dynamic warning banners. AvailableIncludes capabilities for employees to report threats, with no further detail on the page. ↗ AvailableReport Message add-in in both plans and a configurable user-reported mailbox. ↗ AvailableAI Security Mailbox classifies reports, removes messages from the same campaign and connects to existing buttons and mailboxes. ↗ AvailableOutlook add-in to analyse and report, and a security mailbox assistant that triages the reports. ↗
Correlation with endpoint and identity AvailableThe user click becomes a signal in the EDR module within the same timeline. Requires EDR to be active. Needs integrationIntegrations with CrowdStrike, Okta, Palo Alto Networks, Microsoft Defender, Splunk and Sentinel. ↗ Needs integrationIntegrations with CrowdStrike, Netskope and Palo Alto Networks to share intelligence and automate response. ↗ AvailablePlan 2 integrates with Microsoft Defender XDR: incidents, alerts and advanced hunting, plus automated investigation (AIR). ↗ Needs another productAccount Takeover Protection and Identity Threat Protection are separate modules. Endpoint signals are not described. ↗ Needs another productLinks entities with Darktrace / NETWORK, ENDPOINT or IDENTITY when those products are deployed. ↗
Licensing model AvailableModule activated separately, included in the Starter, Team and Enterprise plans. No public prices: custom quote. Not confirmedThe pages consulted do not state the licence unit or the packages for Core Email Protection. Depends on licenceThree tiers (Critical, Advanced, Premium); the second adds data protection and the third collaboration. Prices not public. ↗ Depends on licencePlan 2 ships in Microsoft 365 E5, A5 and G5, or as an add-on. Plan 1 ships in Business Premium and, from July 2026, in E3. ↗ Not confirmedThe page does not state a licence unit or packages. Not confirmedThe specification refers to the order form; it states neither unit nor price.

What each status means

Available
Native feature of the product or plan compared.
Needs integration
Works through a connector or a third-party product.
Depends on setup
Exists, but its scope depends on deployment or configuration.
Depends on licence
Only in a higher plan or as a paid add-on.
Needs another product
Covered by a different product from the same vendor.
In development
Announced or being built; not generally available.
Not confirmed
Not enough evidence. It does not mean “no”.

Five comparisons

One per product, naming the plan that was compared.

Proofpoint Core Email Protection

Plan or edition: Core Email Protection (SEG or API; part of the Collaboration Security Prime family). The cells describe the Core product, not the higher tiers.

Proofpoint Core Email Protection deploys as a gateway (SEG) or by API over Microsoft Graph, and you can combine both with an investigation console that links message, user, click and remediation. It covers pre-delivery, post-delivery and click time, and lists integrations with Okta, CrowdStrike or Sentinel. Protoxol does not state mail-path filtering and its sandbox is still unconfirmed; in exchange, the click arrives as an EDR signal on the same timeline. Proofpoint fits if you need a mature gateway and large-enterprise support. Condition: DMARC is a separate product and the pages consulted do not show the licensing model.

Official source ↗

Mimecast Email Security

Plan or edition: Critical, Advanced and Premium plans. According to the plans page, all three share the core email protection that the cells describe; deployed via MX (Cloud Gateway) or via API.

If your team needs to decide in the mail path, Mimecast offers an MX gateway and also an API connection, with attachment sandboxing, on-click URL analysis and message tracking in the same offer. Protoxol works through the API only according to its page and does not state control in the mail path, so it does not replace a continuity gateway or hybrid coverage. Its angle is different: the click and the user report are investigated next to endpoint signals. Condition: Mimecast tiers differ by scope (data, collaboration) and prices are not published, so ask for a per-user quote before comparing costs.

Official source ↗

Microsoft Defender for Office 365

Plan or edition: Plan 2 (includes all of Plan 1 plus Threat Explorer, AIR and attack simulation). The cells state when something is Plan 2 only.

Defender for Office 365 Plan 2 is the logical option if you already pay for Microsoft 365 E5: it is licensed, and covers Safe Attachments, Safe Links, policy-driven quarantine, Message Trace and, in this plan, Threat Explorer, AIR and Defender XDR integration. Protoxol offers something different: email and endpoint in one console, with user reports in the SOC queue, but with less documented maturity and an unconfirmed sandbox. Scenario: a Microsoft tenant whose team already works in the Defender portal. Condition: the value depends on the licence you hold, and Plan 1 does not include Threat Explorer or AIR.

Official source ↗

Abnormal Inbound Email Security

Plan or edition: Inbound Email Security, an API-based product. Account Takeover Protection and Identity Threat Protection are listed as separate modules and are not described here.

Abnormal relies on behaviour: it builds a baseline for each employee and vendor and flags what deviates. It connects by API with no MX change, removes messages from mailboxes and automates triage of user reports with the related campaign. Protoxol does not publish an equivalent behavioural model and its strength is elsewhere: the click ends up on the EDR timeline. Abnormal fits if your main risk is payment fraud and vendor impersonation. Condition: the page does not detail attachment sandboxing or DMARC, and account and identity signals are separate modules.

Official source ↗

Darktrace / EMAIL

Plan or edition: Darktrace / EMAIL deployed via API or API plus journaling. Not mixed with Darktrace / NETWORK; DMARC is a separate product.

Darktrace / EMAIL comes with an architecture decision worth understanding before you buy: with API alone it acts after delivery, and with journaling in Microsoft 365 it analyses before the message reaches the mailbox. Its actions (hold, lock links, flatten attachments) and a filterable log are documented in detail, and it can link events with other Darktrace products. Protoxol has no such public documentation and still does not confirm a sandbox, but it shares a console with EDR without going through another vendor. It fits if you already run Darktrace on network or identity. Condition: for Google Workspace it asks for an Enterprise or Education Plus edition.

Official source ↗

When to choose Protoxol

  • You want phishing reports and the user click investigated in the same console as the EDR, with the EDR module active.
  • Your mail is on Microsoft 365 or Google Workspace and you prefer API integration without touching the MX record.
  • You need to pull a confirmed phish from every mailbox and keep the action audited.
  • You accept validating, in a proof of value with your own messages, the parts still unconfirmed, such as the sandbox and DMARC.

When to consider something else

  • You need an MX-based gateway with mail continuity or coverage of on-premises and hybrid environments: Mimecast or Proofpoint SEG fit better.
  • You already run Microsoft 365 E5 and your team works in the Defender portal: Defender for Office 365 Plan 2 is licensed and documented.
  • You require attachment and URL sandboxing with documented operation, or DMARC management in the same offer: Proofpoint, Mimecast or Defender describe it today.
  • Your main risk is payment fraud and vendor impersonation, and you want an identity-based behavioural model: Abnormal or Darktrace.

See the module in a demo

Questions about this comparison

01Do I have to change the MX record to use Protoxol Email protection?

Not according to the module page: integration is by API with Microsoft 365 and Google Workspace. That also means it does not state mail-path filtering, and the exact detection timing relative to delivery is not confirmed.

02Can I keep my current mail gateway?

Yes. The page says you can keep your gateway if you need it, since the module integrates by API. Check in the proof of value how decisions are split between the two.

03What is the difference between Defender for Office 365 Plan 1 and Plan 2?

Plan 1 includes Safe Attachments, Safe Links, impersonation protection and real-time detections. Plan 2 adds Threat Explorer, campaigns, AIR, attack simulation training and Defender XDR integration.

04How do I check that an email sandbox really works?

Ask for a test with your own attachments and links, including password-protected files, and measure the delivery delay. Protoxol's sandbox is described on the page but not confirmed; there is a 30-day proof of value on a real subset.

Sources and review date

Reviewed on October 2, 2026. Reviewed by The Protoxol team.

Protoxol capabilities are based on the current commercial documentation on this site and were not technically validated in this review; anything undocumented is shown as “Not confirmed”. Vendor data comes from each vendor's public documentation on the date shown and may have changed.

Selection

See MX against your data.

Thirty minutes. Your environment. The modules that fit. No slideware.

Book a demo See pricing