Email Security for SMEs: Defender for Office 365 vs Gateways

Built-in protection vs Defender vs a third-party gateway

There are three realistic levels for a small business on Microsoft 365. Google Workspace users have a similar choice between their edition's built-in protection and a third-party product.

Prices from Microsoft's Defender for Office 365 page (Singapore, annual commitment, before GST), checked 19 October 2026.

What Microsoft 365 blocks already: Exchange Online Protection

Microsoft's EOP overview says built-in protection is included in every organisation with cloud mailboxes. It covers anti-malware, anti-spam (sorting mail into bulk, spam, high-confidence spam and phishing) and anti-phishing spoof detection.

That stops the bulk of junk and known malware. What it does not do is check a link again at the moment someone clicks it, open unknown attachments in a sandbox, or apply the stronger impersonation protection that catches a message pretending to be your director or a regular supplier.

Microsoft 365 Business Basic (US$7) and Business Standard (US$14) rely on EOP alone. Business Premium (US$22) includes Defender for Office 365 Plan 1, per Microsoft's service description. Our guide on whether Business Premium is worth it weighs the rest of that bundle.

What Defender for Office 365 Plan 1 adds

Microsoft lists Plan 1 at US$2.00 per user a month, paid yearly, before GST. Its features page describes real-time protection for malicious links and QR codes, protection against zero-day malware in attachments, protection for internal email and coverage of Teams, SharePoint and OneDrive.

Plan 2 (US$5) adds attack simulation training, threat hunting and automated investigation. Most SMEs do not have the staff to use Plan 2's tools; Plan 1 plus separate staff training is usually better value.

Google Workspace email security by edition

Gmail includes spam, phishing and malware filtering on every edition, and admins can turn on stronger options under advanced phishing and malware protection, such as warnings for unusual attachment types and protection against spoofed domain or employee names.

Google's Security Sandbox help page lists it for Business Standard, Business Plus, Enterprise Standard and Enterprise Plus, and Frontline Plus. Business Starter does not get attachment sandboxing. Many of the stronger Gmail protections are off by default; our Google Workspace security checklist shows where to switch them on.

What Mimecast and other gateways add, and the MX change

A secure email gateway such as Mimecast or Proofpoint receives your email first. You point your domain's MX record at the gateway; it filters mail and passes clean messages to Microsoft 365 or Google. Mimecast's site offers quotes rather than published prices.

Typical reasons to pay for a gateway: email continuity (reading and sending mail through the vendor if Microsoft or Google has an outage), long-term archiving, one policy across several mail systems after a merger, or a client contract that names a specific control.

The newer alternative is an API-based tool that connects to Microsoft 365 or Google Workspace and scans mail after delivery, with no MX change. Microsoft notes these usually need full access to every mailbox, so check the vendor's security practices before granting it.

Which email security set-up suits your business

No filter catches everything; Microsoft itself says total protection never reaches 100 percent. Pair whatever you choose with MFA on every mailbox and staff who know how to spot a phishing email.

Do it yourself or get help?

Turning on Microsoft's preset security policies or Gmail's advanced protections takes an admin under an hour. Tuning quarantine notifications, impersonation lists for your directors and suppliers, and testing that real invoices still arrive takes longer.

Our Email Threat Protection (S$290) sets up Defender for Office 365 or Gmail's advanced protections, impersonation rules for your key people and suppliers, and quarantine alerts, so phishing is blocked without losing genuine mail.