Microsoft 365 Email Security Compared: Defender, Proofpoint, Mimecast, Abnormal AI and Cisco

For Windows and Microsoft 365 admins, the short version is this: Defender is the baseline you probably already pay for. The add-on vendors are working to plug into Defender rather than replace it, and anyone still running a self-hosted gateway needs to treat patching as part of their email security.

The news hooks that actually check out​

Proofpoint joins Microsoft's ICES ecosystem​

The lead item checks out. On October 26, 2026, Proofpoint announced it is joining the Microsoft Defender for Office 365 Integrated Cloud Email Security (ICES) vendor ecosystem. According to Proofpoint, the integration lets Microsoft 365 customers layer Proofpoint's Core Email Protection API into their existing Microsoft security environment and view Proofpoint detections directly within the Microsoft Defender portal.

Not every customer qualifies. Proofpoint's own blog says the integration is available to customers with Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5 licenses who are running Proofpoint Core Email Protection deployed via API (included in Collaboration Security Tier 2, Tier 3, and Prime). In practice, that means:

• The API product, not the gateway. As WindowsForum's earlier coverage pointed out, that is Proofpoint's API-based email security offering, not its traditional secure email gateway.
• Shared workflows. Proofpoint says customers can integrate Proofpoint verdicts into the Microsoft Defender portal and quarantine workflows already being run by security teams.
• Scale. Proofpoint claims it protects more than 1.8 million Microsoft customers worldwide. That's a vendor figure.

Proofpoint isn't the first ICES partner. Microsoft's announcement blog says Proofpoint joins existing members Darktrace, KnowBe4, Cisco, and VIPRE Security Group. But Microsoft's ICES integration guide on Microsoft Learn, last updated July 17, 2026, lists four approved vendors: Darktrace/EMAIL, KnowBe4 Defend Platform, Proofpoint Core Email Protection API and VIPRE Integrated Email Security (IES). Cisco is missing from that list, so Cisco shops should ask which Cisco product is covered before assuming their tool qualifies.

Shattered.io also says the ICES link carries no extra integration fee for eligible customers. I couldn't confirm that in Microsoft or Proofpoint primary material, so get it in writing. Either way, the Proofpoint license itself is a separate purchase.

Proofpoint Flex: contract terms that can change​

Two days later, on October 28, 2026, Proofpoint announced Proofpoint Flex. Its press release says qualifying customers can:

• move eligible committed spending between Proofpoint products at contract anniversaries
• use "Flex Credits" to lower the cost of adding new protection
• use programs meant to make technology transitions cheaper and simpler

Proofpoint says Flex is available now to qualifying enterprise customers. Neither the announcement nor anything else I reviewed publishes prices or eligibility thresholds.

Proofpoint–Varonis: signed, not closed​

A Varonis exhibit filed with the SEC confirms an all-cash deal of about $6.3 billion, dated October 15, 2026. Varonis shareholders would get $49.75 per share. The deal is expected to close in the first half of 2027, subject to shareholder and regulatory approval, and until then the two companies operate independently. It doesn't change Core Email Protection today, but it shows Proofpoint is shifting toward data and AI security, which matters if you're signing a multi-year contract.

Cisco: the patching problem​

Cisco's section is the most urgent. Cisco's advisory for CVE-2026-76461 describes a flaw in email parsing in AsyncOS for Secure Email Gateway. An unauthenticated remote attacker could send a crafted email with malicious SQL statements and end up running commands with root privileges. Cisco says there are no workarounds.

The advisory has changed since September, and some summaries haven't caught up:

• 16.5.0-780 is the fixed release. Cisco strongly recommends that anyone on a release earlier than 16.5 migrate to it.
• 15.5.5-014 received an updated fix on October 31 after exploit code appeared online. If you're on 15.5.5-014, run the CLI command retroscannerstatus and confirm Cisco Retro Remediation Engine is at version 4.0.2 or later. Being on 15.5.5-014 alone doesn't prove you have the updated fix.
• Cisco Secure Email Cloud devices have already been upgraded to 16.5.0-780 by Cisco. Cisco says it has contacted cloud customers where it found signs of compromise.

For incident response, Cisco says to check mail_logs for suspicious SQL statements on every member of a cluster. An attacker with root access may have erased local evidence, so also check firewall and network logs for unexpected uploads to external IP addresses. Cisco also warns that a compromised appliance can expose the SSH keys clusters use to authenticate with each other. If one member is compromised, rebuild every member of that cluster in a secure configuration.

Cisco's hardening advice applies to any gateway:

1. Block internet access to the appliance's management interface, or restrict it to known hosts.
2. Put mail and management traffic on separate network interfaces.
3. Put the appliances behind a firewall that filters management traffic.
4. Send logs to an external server and keep them long enough for a forensic investigation.
5. Turn off HTTP on the admin portal and any network services you don't need.
6. Use stronger authentication such as SAML or LDAP.

Shattered.io also cites further critical gateway disclosures in October and reports of active exploitation. I couldn't confirm those beyond the September advisory, so treat them as reported, not verified. The lesson holds regardless: if you run a gateway yourself, how fast you patch is part of your security.

Defender for Office 365: check what you already own​

Microsoft's documentation explains why shattered.io calls Defender the floor:

Microsoft's "What's new" page says plainly that Microsoft 365 E3 now includes Defender for Office 365 Plan 1. It also says that from July 2026, new Plan 2 organizations use Unified RBAC by default. Admins used to the older Email & collaboration permissions should expect that change. Microsoft also offers a 90-day Plan 2 trial from the trials hub in the Defender portal.

Microsoft gives a quick way to tell which plan you have. Open the Defender portal and look under Email & collaboration:

• Real-time detections means Plan 1.
• Explorer means Plan 2.

This matters for the ICES story too. Proofpoint's integration needs Plan 2 or E5, so an E3 shop with Plan 1 doesn't qualify yet. The licensing alone could force a budget decision.

Mimecast and Abnormal: vendor claims, clearly labelled​

Most of what shattered.io reports about Mimecast and Abnormal comes from the vendors themselves, and I couldn't verify it independently. Here it is with that label attached:

• Mimecast says it has 42,000+ customer organizations and offers both MX gateway and API deployment. It says Multi-Vector Threat Protection is now on by default and caught three million additional phishing messages during rollout. It also claims big drops in incident response times. Shattered.io notes that no test method has been published for any of these numbers.
• Abnormal AI says it serves 5,000+ organizations and sells behavioral detection aimed at business email compromise and hijacked accounts. Shattered.io reports a new Sender Compromise model on October 30, 2026, plus posture checks against the CIS Microsoft 365 Foundations Benchmark v7.0.0. An Abnormal engineering post reports recall at 99% precision rising from 7% to 66%. But the test set was roughly 40% attacks, far more than a real inbox, and shattered.io rightly treats it as research, not a head-to-head result.
• Proofpoint's own numbers, such as "27% more novel threats," 18-minute global protection updates and "up to 75%" breach-risk reduction, are also first-party claims. Shattered.io found no independent test reproducing them.

Treat these as questions for the vendor, not evidence. Shattered.io's advice: when a number has no denominator, ask which competitors, which threats and which time period it covers.

Gateway, API or ICES​

The three ways of deploying these tools are what really separate the products:

• Secure email gateway (SEG): you point your MX records at the vendor, and mail is scanned before it reaches a mailbox. It can block earliest. But it's also a single point of failure, and if you host it yourself, it's an internet-facing appliance you have to patch (see Cisco above).
• API-based: the tool connects to Microsoft 365 and removes threats after delivery, with no MX change. You can deploy and roll back quickly, but a user can click a malicious link before it's pulled.
• ICES: an API vendor reports its verdicts into Defender, so analysts work from one queue and Microsoft's remediation tools act on those verdicts.

Shattered.io makes a sharp point here: gateways are judged on blocking mail before delivery, and API tools on removing it after. A vendor quoting a detection rate without saying how many minutes a message sat in the inbox is giving you half the picture.

A practical buying plan​

Shattered.io recommends layering tools rather than replacing them. That's sensible, and it's what Microsoft's ICES program is built for. A version scoped to Microsoft 365:

1. Check your licenses first. Confirm whether you have Plan 1 or Plan 2 using the Real-time detections / Explorer check above.
2. Tune Defender before you buy anything. Turn on Safe Links, Safe Attachments and impersonation protection, and confirm SPF, DKIM and DMARC are set up for every domain, including domains that don't send mail.
3. Record a baseline. Collect 30 days of reported phishing, quarantine releases and incident tickets.
4. Pilot one or two API tools in monitor-only mode. Track four numbers: missed malicious messages, false positives, time from delivery to removal, and analyst minutes per incident.
5. Turn on automatic remediation only for high-confidence verdicts, and keep a human review queue for borderline cases.
6. If you're moving MX records, lower DNS TTLs in advance, cut over one pilot domain first, write down the old MX values and keep the old path running for a full business cycle.

Shattered.io's guide lists these commands for checking your current records:

dig +short MX example.com
dig +short TXT _dmarc.example.com

On Windows, Resolve-DnsName example.com -Type MX in PowerShell does the same job.

Three mistakes come up again and again. Forgetting a third-party sender, such as a billing or HR platform, sends its mail to quarantine. Turning on auto-remediation before tuning pulls real invoices out of executives' inboxes. And leaving old gateway allow lists in place quietly exempts senders the new tool never checks.

Who fits where​

With those caveats, here is shattered.io's ranking with my notes:

• Proofpoint Core Email Protection: strongest for E5 shops whose security team works in Defender. The ICES integration is confirmed, and the eligibility rules are now public.
• Defender for Office 365: best value. If you're on E3 or E5, you already own a solid filter, so tune it before buying anything else.
• Abnormal AI: worth piloting if payment fraud and compromised vendor accounts are your main losses. Price the core email module on its own.
• Mimecast: suits teams that want a gateway plus archiving and governance. Push for clear pricing.
• Cisco Secure Email: mainly for existing Cisco customers. Self-hosted gateway owners should confirm 16.5.0-780, or check the Retro Remediation Engine version on 15.5.5-014, today.

None of the five publishes a standard per-mailbox list price, so every evaluation starts with a sales call. The ranking only reflects how these tools compare on paper. To know which one works for you, run a month-long pilot on your own mail.