Email is still the front door to your business. Here is how to tell whether the service guarding it is actually doing the job.
Most small and mid-sized businesses buy email security twice. First they get whatever came bundled with Microsoft 365 or Google Workspace, then a year later they bolt something on after an invoice gets paid to the wrong bank account. The second purchase usually happens in a hurry, which is the worst way to choose a security control.
The FBI’s Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints in 2025, more complaints than any other crime type it tracks, and business email compromise accounted for just over $3 billion in reported losses. Those losses do not come from exotic malware. They come from a convincing message that landed in an inbox that was not watched closely enough.
The evaluation looks different depending on which chair you sit in. An owner or IT manager is choosing one stack for one company. An MSP is choosing something it will run across dozens of tenants, where a control that takes twenty minutes to tune per client is a control it will quietly stop tuning. Both are asking the same seven questions, just with different weights. Here are the factors worth working through before you sign anything.
1. Start with the email protection you already pay for
Every Microsoft 365 mailbox includes Exchange Online Protection: anti-malware, anti-spam, spoof protection, quarantine, and zero-hour auto purge. Microsoft 365 Business Premium adds Defender for Office 365 Plan 1, which brings Safe Links, Safe Attachments, and impersonation protection. As of July 1, 2026, Office 365 E3 and Microsoft 365 E3 include Plan 1 as well. Attack simulation training and automated investigation and response only appear in Plan 2.
Before you evaluate a single vendor, find out which of those tiers you are on and whether the features are actually turned on. A surprising number of SMBs are paying for Business Premium and running default policies that were never tuned. Sometimes the right answer is configuration, not another subscription. For an MSP, this is also the cheapest first deliverable in a new tenant: a licensing and policy review usually finds SMB email protection that the client already owns and has never switched on.
2. Phishing prevention has to cover the attacks that beat MFA
Attachment scanning and link rewriting stop yesterday’s phishing. The campaigns that hurt SMBs now are adversary-in-the-middle kits that proxy a real Microsoft login page, harvest the session cookie, and walk straight past multi-factor authentication. Others carry no payload at all: a plain-text message from a compromised supplier asking to update remittance details. We have written about how attackers turn trusted Microsoft workflows like SharePoint into phishing lures, and about the return of QR code scams that sidestep link scanning entirely.
Ask any vendor how their product detects a message with no attachment, no malicious link, and a legitimate sending domain. If the answer is only “we scan attachments,” the phishing prevention story is incomplete. You want behavioral and relationship analysis on top of signature filtering, plus a fast way for a user to report something suspicious and get it pulled from every other mailbox.
3. Spam filtering and deliverability are the same conversation
Aggressive filtering feels safe until a customer’s purchase order sits in quarantine for three days. Loose filtering feels convenient until someone clicks. Every email security service picks a point on that curve, and the ones built for enterprises tend to sit further toward “block it” than an SMB can tolerate.
What matters more than the marketing catch rate is the release workflow. Can a user see and release their own quarantined mail, or does every false positive become a helpdesk ticket? How long are messages held? Who gets the daily digest? Spam filtering and deliverability are a single operational problem, and the service that handles both gracefully will save you more hours than the one with the better detection chart. For a provider running many tenants, that ticket volume is the whole economics of the product.
4. Email authentication is now a delivery requirement
SPF, DKIM, and DMARC used to be housekeeping. They are gatekeeping now. Google requires bulk senders, meaning anyone sending close to 5,000 or more messages in 24 hours to personal Gmail accounts, to authenticate with SPF and DKIM, publish a DMARC record, support one-click unsubscribe on marketing and subscribed mail, and keep spam complaints below 0.30%. Microsoft went further in May 2025: high-volume mail to outlook.com, hotmail.com, and live.com that fails SPF, DKIM, and DMARC alignment is rejected outright with a 550 5.7.515 error rather than dropped in junk. Passing one of the three is not enough.
If you send invoices, appointment reminders, or newsletters, ask whether the service manages your DNS records and reports on DMARC alignment, or whether that is left to you. Authentication also protects your brand from being spoofed at other companies, which is the part most SMBs never think about until a customer calls to ask about an invoice they did not send.
5. Business mailbox management is where most SMB email protection fails
The control failures we find during assessments are rarely filtering failures. They are mailbox hygiene failures. A departed employee’s mailbox still licensed and still receiving. A shared mailbox with six people delegated to it and no audit trail. An auto-forward rule to a personal Gmail address that an attacker created eight months ago and nobody noticed.
Good business mailbox management means someone owns the lifecycle: provisioning, delegation, forwarding rules, retention, and clean offboarding. Ask a prospective provider what they do when an employee leaves on a Friday afternoon, and what alerting exists when a new inbox rule quietly redirects mail out of the tenant. Those two answers tell you a great deal. If you are the MSP, ask yourself the same two questions and check whether the answer is written down anywhere or lives in one technician’s head.
6. Industry-specific email security raises the bar
Some businesses do not get to choose their controls. If you handle protected health information, email is regulated territory. Under the HIPAA Security Rule, encryption is an addressable specification, which means you either implement it or document an equally effective alternative and the reasoning behind it. “We decided not to” is not documentation. HHS has proposed removing the addressable category and making encryption mandatory. That rule is not final as of September 2026, but if you are choosing controls now, choose as though it will be.
You also need a signed business associate agreement with any provider that has persistent access to ePHI, which includes your email platform and usually your MSP. Audit controls, transmission security, and access controls under 45 CFR 164.312 all apply to mail.
Healthcare is the clearest example, not the only one. A defense supplier working toward CMMC has to show how controlled unclassified information is handled in mail. A merchant under PCI DSS should not have card data traveling by email at all, and needs to be able to demonstrate that. A firm covered by a state privacy law has notification clocks that depend on knowing what was in a compromised mailbox. Industry-specific email security usually comes down to three practical things: encryption a recipient can actually open, retention and archiving that survives a records request or an audit, and a vendor willing to sign the paperwork without a three-week negotiation. Ask about all three before the contract, not during the incident.
7. Managed service provider (MSP) support: who actually runs this?
A tool nobody watches is shelfware with a login page. Decide up front whether your team is going to run the console daily or whether your managed service provider (MSP) will. Then check that the service supports that model: multi-tenant administration, role-based access so your MSP can act without owning your global admin account, alerting that goes somewhere staffed, and reporting you can read without a training course.
Ask about response, not just detection. When a mailbox is compromised at 2 a.m. on a Sunday, who revokes the sessions, resets the credential, hunts for the forwarding rule, and tells you what was accessed? If the answer is “you file a ticket,” you have bought a filter, not a service. Most MSP agreements cover the protection side of email well and stop short of the detection and response side. That is a scope boundary rather than a failing, but it is worth knowing exactly where the boundary sits, in writing, before something crosses it.
Where to start with email security services
If you are reviewing email security services this quarter, do the cheap work first. Confirm what your current licensing already includes, check your DNS records for SPF, DKIM, and DMARC, and pull a list of every mailbox with a forwarding rule or delegated access. Most SMBs find something in that last list they cannot explain.
iFlock works with small and mid-sized businesses and with the MSPs that support them: simulated phishing campaigns that show where people actually click, compliance and risk work on the policy and audit side, and managed security monitoring for the hours nobody is watching the console. If you would rather know where you stand before a vendor tells you, start with a free security assessment.
Talk to us at iflockconsulting.com/contact-us or call 1-833-4-HAXORS (1-833-442-9677).
Fly with confidence.
Frequently asked questions
What are email security services?
Email security services are the filtering, authentication, and mailbox controls that protect a business’s email from phishing, business email compromise, and data loss. They typically combine inbound threat filtering, link and attachment inspection, SPF/DKIM/DMARC authentication, mailbox lifecycle management, and monitoring, delivered either in-house or through a managed service provider.
Is Microsoft 365 email protection enough for a small business?
For many small businesses it is a solid foundation, but not a finished one. Exchange Online Protection covers spam, malware, and spoofing on every mailbox, and Microsoft 365 Business Premium adds Defender for Office 365 Plan 1 with Safe Links, Safe Attachments, and impersonation protection. What it does not include at that tier is attack simulation training or automated investigation and response, and none of it is effective if the policies are left at default and nobody monitors the alerts.
Does HIPAA require email encryption?
Not outright. Under the HIPAA Security Rule, encryption is an addressable implementation specification, so a covered entity must either encrypt ePHI in transit or implement an equally effective alternative and document why. In practice, encrypting email that contains PHI is the defensible choice, and you also need a signed business associate agreement with any email provider that has persistent access to that data.
Sources
