Email security software filters inbound and sometimes outbound messages for phishing links, malicious attachments, spam and business email compromise (BEC) before they reach an inbox, deploying either as an inline gateway between the internet and the mail server or via API alongside Microsoft 365 or Google Workspace. This ranking is aimed at IT and security buyers choosing a vendor to trust with every message an organization sends and receives, not at enterprises that have already standardized company-wide. We judged whether a vendor's actual ownership and jurisdiction match its marketing (this category has seen heavy consolidation), how much deployment flexibility it genuinely offers beyond a single cloud-only option, what a quote-only price becomes once mailbox count and add-on modules are factored in, and which company or jurisdiction ultimately holds the message content and metadata.
Visibility in this ranking can be paid for. Payment moves a vendor's position within the
shortlist; it never adds a vendor, and it never changes a word of the review. The largest vendors in email security software
cannot hold places 1 to 3. How it works: placement disclosure ·
editorial process.
How we ranked these
Ownership: what a vendor's marketing says versus who actually owns it
This category has consolidated hard in the last three years, and the gap between a vendor's brand story and its current ownership is the first thing worth checking. Hornetsecurity is the clearest case: founded in Germany in 2007, still branded and headquartered there, and now a subsidiary of Proofpoint, a US company, with its own site reading “Hornetsecurity by Proofpoint” and linking to Proofpoint's position on the US CLOUD Act. Barracuda has been owned by KKR since 2022 and Mimecast was taken private by Permira the same year, which for both means the roadmap and pricing now answer to a private equity timeline rather than public markets. None of this is disclosed prominently on a pricing page; it takes checking the company registration and the footer branding.
Deployment: inline gateway, API, or a genuine choice
Two different architectures dominate this category and they are not interchangeable. An inline gateway, the classic model used by Proofpoint, Mimecast, Barracuda, Libraesva, NoSpamProxy, Retarus, Mailinblack, SpamTitan and IKARUS mail.security, sits between the internet and the mail server and can block a message before delivery. An API-based product, the model Abnormal Security uses and Retarus offers as an alternative to its gateway, connects to Microsoft 365 or Google Workspace after the platform's own filtering has already run, which means it complements rather than replaces a primary filter. Only Libraesva and NoSpamProxy in this ranking offer a genuine on-premises deployment alongside cloud, relevant for a buyer whose compliance rules exclude cloud-hosted mail filtering outright.
The real price: nobody publishes one, and that is normal here
Every one of the 12 products in this ranking quotes pricing per organization rather than publishing a number, which is unusual for a software category this size and reflects how enterprise-skewed the buying process still is: pricing scales with total mailbox count, and a vendor wants to know that number before naming a price. Libraesva is the closest exception, publishing a 30-day free trial even though its ongoing price is still quoted on request. Budgeting for this category means requesting a quote from every vendor on a shortlist before comparing anything, and asking explicitly which capabilities (archiving, awareness training, encryption, backup) are bundled into the headline number versus sold as separate modules.
The 12 tools, reviewed
#1 Barracuda
The widest feature bundle in this list: spam/ATP, account takeover protection, DMARC, encryption, training and backup in one line · United States · barracuda.com
Widest feature bundle Account takeover protection KKR-owned since 2022
Barracuda Networks, headquartered in Campbell, California and owned by KKR since 2022, sells Email Protection as a bundle rather than a single point product: spam, malware and advanced threat protection sit alongside account takeover protection, DMARC-based domain fraud protection, security awareness training, email encryption, Microsoft 365 backup and cloud archiving. It supports both Microsoft 365 and Google Workspace. Account takeover protection is named as its own capability rather than folded into generic threat detection, which matters specifically for catching an already-compromised internal mailbox being used to attack others. Pricing is quoted on request and scaled by plan and mailbox count.
Where it falls short
US-headquartered and under private-equity ownership (KKR) since 2022. Broad bundling can mean paying for modules, like backup or archiving, a buyer with existing tools for those does not need.
Wrong for
A buyer who only wants inbound threat filtering and already has separate backup, archiving and training tools in place.
Pricing: Quoted on request; no published pricing (no free plan)
Visit Barracuda →
#2 Cisco Secure Email
Cisco's cloud-scale gateway, deployable inline or via API, with FedRAMP High certification · United States · cisco.com
FedRAMP Class D (High) Gateway or API deployment SE Labs AAA rated
Cisco Secure Email Threat Defense is Cisco's email security product, delivering what Cisco describes as cloud-scale, AI-driven gateway capabilities that inspect messages before delivery, using relationship graphs and contextual analysis to judge intent rather than scoring content alone. It deploys as an inline gateway or via API, and holds FedRAMP Class D (High) certification alongside an SE Labs AAA rating. Cisco is headquartered in San Jose, California. The product's clearest advantage shows up inside an existing Cisco security stack, where identity, network and endpoint signals it already collects can feed the same threat picture; as a standalone point solution it competes on roughly the same terms as the other US gateways in this list.
Where it falls short
US-headquartered. Best value is realized inside an existing Cisco security stack rather than as a standalone product.
Wrong for
A buyer with no other Cisco security products, who will not see the cross-product signal advantage that justifies the price for existing Cisco shops.
Pricing: Quoted on request; no published pricing (no free plan)
Visit Cisco Secure Email →
#3 Hornetsecurity
German-founded, MSP-channel-scale email security suite — now a Proofpoint subsidiary, not an independent European alternative · Germany · hornetsecurity.com
125,000+ customers 12,000+ channel partners Now a Proofpoint subsidiary
Hornetsecurity was founded in Germany in 2007 by Daniel Hofmann and built a large MSP-channel business: the company says it serves over 125,000 customers in 120+ countries through more than 12,000 channel partners. Its 365 Total Protection suite bundles spam, phishing, malware, ransomware and advanced-threat filtering with email archiving, business continuity, compliance and security-awareness features for Microsoft 365. In 2024, France-based Vade joined the Hornetsecurity Group, and Hornetsecurity had already absorbed France's Altospam (altospam.com now redirects straight to hornetsecurity.com). The detail that matters most for a European buyer: Hornetsecurity is now a subsidiary of Proofpoint, a US company. The current site is branded "Hornetsecurity by Proofpoint," its CEO and COO hold titles inside "Proofpoint MSP Platform," and the legal footer links to "Proofpoint's Position on the U.S. CLOUD Act." Whatever its German engineering heritage, it does not currently offer EU-independent jurisdiction, which is why it is listed here as a global option rather than a European one.
Where it falls short
Now a Proofpoint (US) subsidiary — the site itself is branded "Hornetsecurity by Proofpoint" and links to Proofpoint's CLOUD Act position, so it is not an EU-independent jurisdiction choice. Absorbed Vade and Altospam, both France-based, so those brands no longer exist as separate, independent EU options.
Wrong for
A buyer specifically seeking an EU-owned alternative to US email security vendors — despite the German roots, the current parent is Proofpoint.
Pricing: Quoted on request; no published pricing (no free plan)
Visit Hornetsecurity →
#4 Libraesva
Italian, privacy-first email gateway with AI-layered filtering and a rare genuine on-premises option · Italy · libraesva.com
Genuine on-premises option Privacy-first positioning 30-day free trial
Libraesva has protected business email since 2013 from its base in Lecco, Italy. In 2025 the company combined with Cyber Guru, another Italian cybersecurity firm, to form LibraCyber S.p.A., which the two describe as "a new European cybersecurity leader." The core product, Libraesva Email Security, uses AI-powered layered protection to stop threats before they reach an inbox, and the combined group now also offers email archiving, DMARC protection and phishing-simulation training alongside it. Libraesva markets itself explicitly as "privacy-first" and serves regulated sectors including financial services, healthcare and government. It is one of the few vendors in this category still offering a genuine on-premises deployment option alongside private cloud, not cloud-only. It also runs regional entities in the UK (Libraesva Limited) and the US (Libraesva Inc), which is worth knowing even though the parent company and controlling entity remain Italian. Pricing is not published; a 30-day free trial is offered.
Where it falls short
Pricing is not published; requires a request quoting mailbox count. The LibraCyber restructuring is recent (2025), so a buyer should confirm current contracting entity and terms directly.
Wrong for
A buyer who wants published, self-service pricing without a sales conversation.
Pricing: Quoted per mailbox on request; 30-day free trial offered (free trial)
Visit Libraesva →
#5 NoSpamProxy
Independent, owner-managed German gateway with genuine cloud-or-on-premises choice and encryption built in · Germany · nospamproxy.com
Cloud or on-premises Independent, owner-managed S/MIME & PGP built in
NoSpamProxy is built and sold by Net at Work GmbH, an independent, owner-managed company based in Paderborn, Germany, that says it operates with no external investors. The gateway sits between the mail server and the internet, filtering spam, malware and ransomware while also detecting phishing and CEO-fraud attempts. It carries the "IT Security made in Germany" certification and reports more than 6,000 customers. What separates NoSpamProxy from most of this list is genuine deployment choice: NoSpamProxy Cloud or NoSpamProxy Server (on-premises), not a cloud-only product with an on-prem story bolted on. S/MIME and PGP email encryption with automated certificate management, large-file transfer direct from the email client, and GDPR-compliant disclaimer management are bundled in rather than sold as separate add-ons.
Where it falls short
Pricing is quote-only. Brand recognition is concentrated in the DACH region rather than internationally.
Wrong for
A buyer who specifically wants a cloud-only product with nothing to patch or maintain.
Pricing: Quoted on request; not published (no free plan)
Visit NoSpamProxy →
#6 Retarus
Privately owned Munich vendor marketed explicitly as email security 'made in Europe', gateway or API · Germany · retarus.com
Post-delivery re-checking Gateway or M365 API “Made in Europe”, 100% GDPR
Retarus is a privately owned, independent company headquartered in Munich, Germany, that describes itself directly: "we answer to customers not investors." Its Email Security product is offered as a classic secure email gateway or as an API for Microsoft 365, and it includes advanced threat protection with sandboxing, post-delivery protection that keeps re-checking links and attachments after arrival, and email continuity for outages. Retarus markets the product explicitly as "the comprehensive solution for email security made in Europe" and states its infrastructure is 100% GDPR compliant. Email security is one line in a broader Retarus messaging portfolio that also includes fax and SMS services, rather than the company's sole focus.
Where it falls short
Pricing is quote-only. Email security is one product line within a broader messaging portfolio (fax, SMS) rather than the company's sole focus.
Wrong for
A buyer who wants a single-purpose email security specialist rather than one line inside a broader messaging portfolio.
Pricing: Quoted on request; not published (no free plan)
Visit Retarus →
#7 Mailinblack
French SMB-focused gateway with named anti-spearphishing detection and click-time link analysis · France · mailinblack.com
Click-time link analysis Named anti-spearphishing layer 6bn+ emails/year analyzed
Mailinblack is a French cybersecurity publisher based in Marseille with more than 20 years of experience. Its Protect product filters inbound email across six named threat types: anti-phishing, anti-spam, anti-malware, anti-spearphishing, anti-ransomware and link analysis that examines URLs at the moment they are clicked, not only at delivery. The company says it analyzes more than 6 billion emails a year and integrates natively with Microsoft 365. Naming spearphishing as its own detection layer, separate from generic phishing, signals a specific focus on targeted attacks against individuals rather than mass spam campaigns. Pricing is not published; the company directs prospects to request a demo rather than offering a self-service trial.
Where it falls short
Pricing is entirely demo-gated with no published trial terms. Smaller processing scale (6 billion emails a year) than the largest global gateways processing similar volumes daily.
Wrong for
A buyer who wants to see a price or start a trial before talking to sales.
Pricing: Demo required; no published pricing (no free plan)
Visit Mailinblack →
#8 SpamTitan (TitanHQ)
Irish, MSP-channel-established gateway with layered BEC detection, sold under the TitanHQ brand · Ireland · titanhq.com
MSP-channel established Layered BEC detection Companion products: WebTitan, ArcTitan
SpamTitan is built by TitanHQ, the trading name of Copperfasten Technologies Ltd, registered in the Republic of Ireland. It blocks spam, viruses, malware, ransomware and links to malicious websites, and the company markets "multiple layers of analysis and detection methods" specifically for business email compromise. It works natively alongside Microsoft 365. TitanHQ is long established in the managed-service-provider channel, also selling WebTitan (DNS filtering) and ArcTitan (email archiving), which makes SpamTitan an easy add for an MSP already reselling those. Pricing is not published; prospects choose or design a bundle and TitanHQ's sales team follows up.
Where it falls short
Pricing is quote-only via a "Get a Quote" form, no published rates. MSP/channel orientation means the direct-to-enterprise self-service buying experience is thinner than some rivals.
Wrong for
A large enterprise wanting a single global vendor already embedded across every regional office, rather than an MSP-friendly specialist.
Pricing: Quoted on request; not published (no free plan)
Visit SpamTitan (TitanHQ) →
#9 IKARUS
Vienna-built gateway with all development, processing and support kept in-house in Austria · Austria · ikarussecurity.com
All-Austrian processing Real-time URL re-check at click Optional ATP sandboxing add-on
IKARUS Security Software GmbH is headquartered in Vienna, Austria, and states that all software development, data processing and support for mail.security are conducted in-house in Austria, with no subsidiary network to track. The product blocks spam, phishing, malware and dangerous URLs through content and behavior analysis, and re-checks links in real time both when a message is delivered and again at the moment a user clicks. An optional Advanced Threat Protection add-on adds sandboxing through Trellix Intelligent Virtual Execution for suspicious files and zero-day exploits, and IKARUS offers S/MIME certificates through a partnership with Certum for encryption and digital signing. It is the smallest vendor by public footprint in this EU set, and pricing is quoted on request.
Where it falls short
Smallest public footprint of the EU vendors in this ranking. Sandboxing for zero-day threats is a paid add-on (Advanced Threat Protection), not included by default.
Wrong for
A buyer who wants zero-day sandboxing included in the base product rather than as an add-on.
Pricing: Quoted on request; not published (no free plan)
Visit IKARUS →
#10 Proofpoint
The category's default enterprise choice, analyzing roughly 2.6 billion emails a day via gateway or API · United States · proofpoint.com
Roughly 2.6bn emails inspected/day Gateway or API deployment Owns Hornetsecurity
Proofpoint is the name most enterprise security teams default to first in email security: Core, Advanced and Prime Email Protection deploy as an inline gateway or via API, and the company says it inspects roughly 2.6 billion emails a day for threats and compliance risk. It is a US company, founded in 2002 and headquartered in Sunnyvale, California. Proofpoint also now owns Hornetsecurity (see below), which means two products in this ranking answer to the same US parent. Pricing is quoted per organization rather than published, and deals are typically sized for mid-market and enterprise mailbox counts rather than small teams.
Where it falls short
US-headquartered, so customer data is reachable under US legal process regardless of hosting location. Pricing is quote-only and typically enterprise-scaled, not built for small teams.
Wrong for
A small team wanting a self-service signup and a published price rather than a sales conversation.
Pricing: Quoted per organization based on mailbox count; not published (no free plan)
Visit Proofpoint →
#11 Abnormal Security
Behavioral-AI platform built specifically for BEC and executive impersonation, deployed via API alongside your existing filter · United States · abnormal.ai
Behavioral AI for BEC API deployment, not inline 30%+ of Fortune 500
Abnormal Security is a San Francisco company, founded in 2018, built around a single idea: model normal behavior for every identity in an organization well enough that a deviation, a vendor invoice from a new bank account, an executive suddenly asking for a wire transfer, stands out on its own. It connects via API to Microsoft 365 or Google Workspace rather than sitting inline as a traditional gateway, so it complements rather than replaces primary spam/malware filtering. The company says its platform protects more than 30% of the Fortune 500, and it is configured to act autonomously on threats once given the access to do so. It is US-headquartered and prices strictly on request.
Where it falls short
API-only model means it is not a substitute for a primary inline gateway that also handles malware/attachment scanning at the perimeter. US-headquartered; pricing is quote-only with no published tiers.
Wrong for
An organization that needs a single product to handle both perimeter malware/attachment scanning and BEC detection, rather than two products working together.
Pricing: Quoted on request; no published pricing (no free plan)
Visit Abnormal Security →
#12 Mimecast
Mature UK-founded suite mapping the attack chain across email, human behavior, endpoints and data · United Kingdom · mimecast.com
Attack-chain correlation Continuity + archiving heritage Taken private by Permira, 2022
Mimecast is a London-headquartered company founded in 2003, and Advanced Email Security is its core threat-detection product: AI-powered analysis that the company says maps the full attack chain across email, human behavior, endpoints, AI agents and data rather than scoring messages in isolation. Continuity and archiving, Mimecast's original heritage, are still sold alongside it. Mimecast was taken private by Permira in 2022, so it no longer carries the public-market disclosure it once did. It remains UK-headquartered, which for European Purpose readers means UK, not EU or EEA, law applies, even though the company has long marketed itself around European compliance needs.
Where it falls short
UK-headquartered: not EU or EEA under European Purpose's own listing rule. Taken private by Permira in 2022, reducing public financial and governance disclosure.
Wrong for
A buyer whose compliance mandate specifically requires EU or EEA incorporation rather than UK.
Pricing: Quoted on request; no published pricing (no free plan)
Visit Mimecast →
What the data says about this market
Ownership in this category has consolidated around a small number of large acquirers. Proofpoint, itself US-headquartered, now also owns Hornetsecurity, folding a German-founded, MSP-channel-scale vendor and its own prior acquisitions (France's Vade and Altospam) into one group. Barracuda Networks has been owned by KKR since 2022 and Mimecast was taken private by Permira the same year, meaning three of the twelve vendors ranked here now answer to a private equity or acquirer timeline rather than to public markets or independent ownership. Of the twelve, four are US-headquartered, three are German (Hornetsecurity, NoSpamProxy, Retarus), one is British (Mimecast), and four are single-country EU vendors with no larger parent: Libraesva (Italy), Mailinblack (France), SpamTitan/TitanHQ (Ireland) and IKARUS mail.security (Austria).
Pricing has stayed almost uniformly opaque across this category, unlike software categories where a usage-based or per-seat number is published by most vendors. All twelve products here quote per organization based on mailbox count; only Libraesva publishes a concrete term, a 30-day free trial, though its ongoing price is still quoted on request like the rest. Deployment flexibility varies more than pricing transparency does: Libraesva and NoSpamProxy both offer genuine on-premises deployment alongside cloud, Abnormal Security and Retarus offer an API-based option that layers on top of Microsoft 365 or Google Workspace rather than replacing the primary filter, and the rest are inline-gateway-only.
ICT services have grown faster as a share of global trade than most other service categories, from 9.1% of world service exports in 2013 to 14.48% in 2023, with the European Union's share rising even further, from 10.58% to 17.55% over the same period (World Bank). Email security sits in an unusually exposed part of that trade: it is one of the few IT service categories where the vendor is granted access to the full content of an organization's inbound correspondence, which is why this category's consolidation into fewer, larger, and increasingly non-European owners is worth tracking as closely as the growth of ICT services trade itself.
The 12 ranked vendors, counted
- Headquarters by region: Europe 8, North America 4
- By country: United States 4, Germany 3, Austria 1, France 1, Ireland 1, Italy 1, United Kingdom 1
- Pricing model: Quote only 11, Free trial + quote only 1
- Free option: No free plan 11, Free trial 1
Counted from the 12 vendors on this page. More in our market data.
For the wider market behind email security software, read our report The Global Shift to ICT Services,
or browse all industry reports.
Questions and answers
What is the best email security software in 2026?
Proofpoint leads this ranking on enterprise threat-intelligence scale: the company says it inspects roughly 2.6 billion emails a day, deployable as an inline gateway or via API. Abnormal Security is the stronger pick specifically for business email compromise and executive impersonation, built around behavioral AI rather than content filtering, and Libraesva is the strongest independent EU option, with a genuine on-premises deployment most cloud-native rivals no longer offer.
Is Hornetsecurity a German or a US company?
Both, in a way that matters to a buyer. Hornetsecurity was founded in Hannover, Germany in 2007 and still operates from there with deep DACH-market penetration, but it is now a subsidiary of Proofpoint, a US company: the current site is branded “Hornetsecurity by Proofpoint,” its CEO and COO hold titles inside “Proofpoint MSP Platform,” and the legal footer links to Proofpoint's position on the US CLOUD Act. Treat it as a US-owned product with genuine German engineering roots, not as an independent European alternative to Proofpoint.
Which of these vendors are independently owned, with no external parent?
Four: Libraesva (Italy, parent LibraCyber S.p.A.), NoSpamProxy (Germany, owned by independent, owner-managed Net at Work GmbH), Mailinblack (France) and IKARUS mail.security (Austria). Retarus (Germany) is also privately owned and independent. The rest have a US or private-equity parent: Proofpoint owns Hornetsecurity, KKR owns Barracuda, and Permira took Mimecast private in 2022.
Which of these tools offer on-premises deployment?
Libraesva and NoSpamProxy both offer a genuine on-premises option alongside cloud, unusual in a category that has moved almost entirely to cloud-only or SaaS delivery. The rest are cloud/gateway-hosted or, for Abnormal Security and optionally Retarus, delivered via API on top of Microsoft 365 or Google Workspace rather than as a self-hosted product.
Is there a free email security tool?
Not a permanent free tier anywhere in this category. Libraesva is the only vendor here publishing a concrete trial term, 30 days, free. The other eleven require a demo or a direct quote before any trial terms are discussed, which is typical for enterprise, per-mailbox-licensed security software.
What is the difference between a gateway and an API-based email security product?
A gateway (Proofpoint, Mimecast, Barracuda, and most of the EU vendors here) sits between the internet and the mail server and can block a message before it is ever delivered, usually by changing the domain's MX record to route mail through it first. An API-based product (Abnormal Security, and optionally Retarus) connects to Microsoft 365 or Google Workspace after the platform's own filtering has already run, adding detection, particularly for behavioral BEC signals, without changing mail flow. The two approaches are complementary rather than strictly competing.
How much does email security software cost?
None of the twelve vendors ranked here publish pricing. Enterprise email security is licensed per mailbox and quoted per organization, with the number appearing only after a sales conversation that typically starts with total mailbox count. Budgeting requires requesting a quote from every vendor on a shortlist and asking which capabilities are bundled into that number versus sold separately.
Which vendors here were acquired or taken private recently?
Three of the twelve changed hands in the last several years in ways that affect who ultimately controls the product: Barracuda Networks has been owned by KKR since 2022, Mimecast was taken private by Permira in 2022, and Hornetsecurity became a Proofpoint subsidiary, absorbing France's Vade in 2024 and having already folded in France's Altospam. A buyer evaluating any of the three should ask directly about the current parent company rather than relying on the product's founding story.
Do you get paid for these rankings?
Visibility in this ranking can be paid for. Payment moves a vendor's position within the shortlist; it never adds a vendor, and it never changes a word of the review. The largest vendors in email security software cannot hold places 1 to 3 through payment alone. How it works: placement disclosure and editorial process are both linked at the top of this guide.
How often is this ranking updated?
Whenever a fact underneath it changes: an acquisition like Hornetsecurity's move under Proofpoint, a pricing model shift, or a product that stops being maintained. The published and last-reviewed dates at the top of this guide are real, and a review means someone checked the vendor's current documentation and ownership structure, not that a date was moved forward without a re-check.
