The Forrester Wave™: Enterprise Email Security, Q2 2023

Enterprise Email Security Vendor Product Comparisons 2023

Key features and pros and cons of top Enterprise Email Security products:

Check Point Software Technologies - Leaders

Pros:

Novel in-line CAPES deployment option that works with both Microsoft 365 and Google Workspace
Provides gateway-like capabilities (spam/graymail filtering, antimalware, DLP) with API-enabled deployment power
One of the only vendors to provide full protection for communication and collaboration applications like Teams, SharePoint, Slack, and Dropbox
Superior efficacy according to reference customers
Easy investigations within one screen in the tool

Cons:

Does not currently offer its own email authentication capabilities
Alerts could use more context according to reference customers
Roadmap gaps include DMARC monitoring, proprietary security awareness and training, and data residency in more geographies

Cloudflare - Leaders

Pros:

Preemptive crawling approach to discover phishing campaign infrastructure as it's being built
SPARSE combines multiple machine learning models including natural language modeling, sentiment and structural analysis, and trust graphs
Ease and speed of search capabilities during investigations
Managed email IR and threat hunting service (PhishGuard) with unique dashboard showing time and money saved
Zero Trust approach to email security with easily communicated data and insights

Cons:

Relies on email infrastructure providers and partnerships for encryption rather than offering proprietary encryption
Recently acquired Area 1 Security in 2022, still integrating capabilities

Microsoft - Leaders

Pros:

Streamlined analyst experience with unified approach to detection, investigation, response, and remediation
Backed by trillions of native signals and massive threat research organization
Delivers protection across all native communication and collaboration channels like Teams and SharePoint
Comprehensive DLP and easy-to-use email encryption
Simple integrations with third-party tools

Cons:

Lacks hosted and managed authentication management and reporting services offered by competitors
Inconsistencies in reporting across dashboards
Number of malicious emails continue to reach inboxes despite well-regarded detection and response capabilities
Less integrated user experience when expanding to third-party applications like Slack and Box

Proofpoint - Leaders

Pros:

Released CAPES deployment option in 2022 with key features like Very Attacked Person threat reporting and browser isolation
Expansive inbound and outbound email protection including DLP and encryption
Threat feeds and hosted email fraud protection services
Out-of-the-box integrations with major identity, detection and response, and security analytics solutions
Strong security awareness and training platform
Infrastructure-and-platform-agnostic solution

Cons:

Needs to better integrate with itself for more seamless user reporting and investigation experience
Reference customers noted desire for improved internal integration across Proofpoint solutions

Abnormal Security - Strong Performers

Pros:

Superior ability to block malicious email from inboxes
Excellent at combating account takeovers and compromised third-party vendors
Behavioral AI engine continuously trained by blocked malicious emails
Detection 360° provides direct feedback loop for false positive and negative reporting
Six months of email behavior absorption to learn what normal looks like

Cons:

Narrow focus on BEC and advanced phishing - limited vision beyond current capabilities
Lacks malware sandboxing, browser isolation, web security, encryption, and email authentication support
Best suited as an additional layer rather than comprehensive solution
Only limited plans to add capabilities covered by email infrastructure providers

Barracuda Networks - Strong Performers

Pros:

Strong efficacy especially against impersonation attempts
Built-in incident response capabilities including SOAR for fast, intuitive investigation and remediation
One-click URL blocking with incident response capability
Proprietary multilanguage security awareness and training capabilities well regarded across geographies
Early mover releasing CAPES deployment option in 2016

Cons:

CAPES option does not yet cover Google Workspace
Lacks cohesive vision beyond further improvements and integrations
Limited out-of-the-box EDR and XDR integrations beyond its own platform
Does not include browser isolation or protection for messaging and collaboration apps

Google - Strong Performers

Pros:

Security-by-design approach built on BeyondCorp Zero Trust framework
End-to-end client-side email encryption with customer-maintained encryption keys
Major supporter of email security protocols and open standards like BIMI
Simple licensing model with options for organizations of any size
Contextually rich dynamic content warning banners
DLP capabilities cover all Workspace applications

Cons:

Reference customers noted dissatisfaction with logging and reporting capabilities
Users prefer to use third-party security analytics tools for analysis, investigation, and reporting
Outside messaging and collaboration apps only covered through Context-Aware Access offering

Mimecast - Strong Performers

Pros:

Strong malicious URL protection and web security in single console
Proprietary browser isolation solution
Full library of security awareness and training content plus SAFE Phish simulation
Hosted DMARC reporting tool and services offerings
Technology Alliance partner program with over 200 applications for shared threat intelligence
Useful reporting capabilities with easy data export

Cons:

Vaguely timed roadmap
CAPES deployment only available for Microsoft 365, Google Workspace is roadmap item
Messaging and collaboration app protections are roadmap items
Reference customers cited usability and configuration issues with CyberGraph that broke workflows

Tessian - Strong Performers

Pros:

Focus on protecting the human layer with real-time security coaching
Behavioral Intelligence Model (BIM) social graph ingests 12 months of historical data per user
Soft email quarantine with detected anomalies
Dynamic, contextual warning banners for end users
Strong support and willingness to customize features
Easy-to-use interface

Cons:

Lacks malware sandboxing, browser isolation, web security, encryption, and email authentication support
User risk scoring noted as overly generic by reference customers
Hard and soft quarantine inconsistencies
Still building out full solution - more capabilities than other CAPES vendors but gaps remain

Trend Micro - Strong Performers

Pros:

Vision One cybersecurity platform integrates XDR with email security
Threat intelligence bolstered by Zero Day Initiative bug bounty program (1,600+ advisories in 2022)
Wide range of AI and heuristic content analysis and processing capabilities
Protection for chat and collaboration in Microsoft 365, Google Workspace, and other file-sharing apps
Global customer support and strong two-way communication
Integration with Vision One platform for detection and response strategies

Cons:

Solutions not yet fully integrated - requires jumping between toolsets
Email security offerings only integrate with Trend Micro's own EDR and XDR platform
Working to enhance analyst experience with minimal jumping between toolsets
Building proprietary security awareness and training solution (currently only offers Phish Insight)

Broadcom - Contenders

Pros:

Comprehensive enterprise and email DLP
Easy-to-use email encryption through partnership with Echoworx
Standard content analysis and processing, antimalware and sandboxing, malicious URL protection
Web security and browser isolation included
Periodic health check reports to ensure proper configuration

Cons:

Poor efficacy according to reference customers
Outdated consoles and user interfaces
Weak vision - languished after Broadcom acquisition
Starting to offer CAPES deployments and advanced phishing/BEC protection customers want in 2023
Relies on partnerships for email fraud protection (Valimail) and security analytics (Splunk)

Cisco - Contenders

Pros:

SecureX XDR platform integration with Email Threat Defense
Backed by Talos threat intelligence feeds
Orchestrated remediation actions easily taken within ETD interface
Good usability according to reference customers
API integrations for major SIEM and SOAR solutions

Cons:

Staid vision focused on becoming best-in-class by improving detections and aggressive pricing
Transparency about model training is lacking
Uses third parties for several key capabilities (DMARC via dmarcian, SA&T and DLP via OEM)
Does not integrate with third-party EDR or XDR solutions
Messaging and collaboration protection limited to Cisco CASB offering under Umbrella

Fortra - Contenders

Pros:

Standout email authentication technology and services under Agari DMARC Protection
Threat feeds for domain impersonation
Machine learning-based trust scoring and attack classifications via Agari Phishing Defense
Anti-steganography capabilities via Clearswift to prevent data exfiltration in images
Search-and-destroy capabilities

Cons:

Portfolio of loosely coupled solutions from multiple acquisitions
Lacks cohesive analyst experience and central dashboard for reporting
Limited EDR and XDR integrations
Moving from separate solutions to single sign-on to unified UI within 12 months
Forrester unable to reach reference customers for evaluation

Fortinet - Contenders

Pros:

Standard capabilities for email filtering and malicious email detection
Comprehensive enterprise and email DLP
Easy-to-use email encryption via Echoworx partnership
Integrations with sandbox and browser isolation technology (BIT)
On-premises or hybrid deployments including physical or virtual appliances available

Cons:

Vision limiting - definition of 'beyond email' doesn't include communication/collaboration apps
Not transparent in communication of how ML models are trained
EDR and XDR integrations beyond Fortinet platform are limited
Usability issues with cluttered dashboards and outdated user interfaces
Difficulty configuring incident response capabilities and unintuitive interfaces
Only vendor to place emphasis on hardware email security appliances

Sophos - Contenders

Pros:

Proprietary DLP and encryption capabilities for outbound protection
Phish Threat provides phishing simulations and security awareness training in console
Good dashboard detail
Ease of setup and policy creation
Integrations with Azure AD for targeted training to risky users

Cons:

Still needs basics - Google Workspace integration, on-demand email claw-back, DMARC reporting on roadmap
Limited insight into machine learning models
Limited support for web security
Only integrates with Sophos platform technologies, not third-party solutions
Reference customers noted middling customer support and need for encryption improvement

FAQs

Q: Which vendors are Leaders in 2023?

A: Check Point Software Technologies, Cloudflare, Microsoft, Proofpoint

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in the Forrester Wave for Enterprise Email Security offer the strongest current offerings and strategies in the market. These vendors demonstrate robust capabilities across content analysis and processing, machine learning models, malicious URL detection, antimalware, and email authentication. Leaders also show strong vision for the future of email security, innovative roadmaps, active community engagement, and significant market presence. They typically provide comprehensive deployment options (both SEG and CAPES), strong integrations with security ecosystems, and are well-positioned to meet evolving customer needs in protecting communication and collaboration environments.

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Enterprise Email Security in 2023

Enterprise Email Security Vendor Product Comparisons 2023

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2023?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference