A fraudulent invoice sent from a familiar supplier address can reach the finance team, look entirely routine and lead to a costly payment within minutes. That is why a secure email gateway review should focus on more than a supplier’s threat-detection claims. For a UK business, the right service must reduce real risk without delaying legitimate work, creating an administrative burden or leaving staff unsure who to call when something looks wrong.
Email remains the route into many serious security incidents. Phishing, malware, account takeover and business email compromise all exploit the fact that people need to receive, open and act on messages quickly. A secure email gateway sits between the internet and your mailbox platform, inspecting email before it reaches users and applying policy to messages leaving the business too.
What a secure email gateway should do
At a basic level, a gateway filters unwanted mail. A business-grade service should go much further. It should assess the sender’s identity, inspect links and attachments, identify impersonation attempts and use threat intelligence to spot known malicious activity. It should also help control outbound email, reducing the chance that sensitive information is sent to the wrong recipient or that a compromised account is used to distribute phishing messages.
The distinction matters because spam is mostly an inconvenience. A convincing phishing email aimed at a director, payroll colleague or accounts team is a commercial risk. The best protection considers the context of a message, not only whether a file or website has already been identified as dangerous.
No gateway will make email risk disappear entirely. A well-crafted message sent from a compromised supplier mailbox may contain no obvious malware and may use language that fits an existing relationship. That is why email protection must work alongside multi-factor authentication, sensible access controls, staff awareness and a clear process for verifying payment-detail changes.
Secure email gateway review: what to assess
A useful review starts with your own exposure. A manufacturer exchanging drawings with customers has different requirements from a legal practice sharing sensitive documents, while a business with a busy finance department may place particular weight on impersonation and invoice fraud controls.
Protection against the threats you actually face
Ask how the service deals with phishing, spoofing, malicious links, attachments and impersonation. Good answers are specific. For example, does it rewrite or inspect links at the point a user clicks them, rather than relying only on a check when the email first arrives? Can it analyse suspicious attachments safely before delivery? Does it identify display-name impersonation, where the visible sender name resembles a senior colleague but the address does not?
Also examine protection for your domain. Email authentication controls such as SPF, DKIM and DMARC help receiving systems determine whether a message claiming to come from your business is legitimate. They need correct configuration and monitoring, not simply a box ticked during initial setup. A provider should explain the practical implications in plain English and help avoid legitimate messages being rejected.
Compatibility with Microsoft 365 and your wider estate
Many businesses assume Microsoft 365’s built-in email security is enough. For some lower-risk environments with carefully configured licensing and active management, it may be. For others, an additional gateway adds useful layers, richer visibility, stronger impersonation controls or a managed response capability.
The question is not whether one platform is universally better. It is whether the controls work together without creating gaps, duplicate quarantines or confusing user experience. Your review should establish where filtering happens, which system is the source of truth for policy and who investigates a missed email or a false positive.
If you use hybrid mail, legacy applications, scanners or third-party systems that send email on your behalf, test those workflows too. Security that disrupts order confirmations, production updates or customer communications becomes a business problem very quickly.
Accuracy and the cost of false positives
A gateway that blocks every suspicious message may sound attractive until it holds a genuine purchase order, court correspondence or a time-sensitive customer request. False positives waste staff time and can undermine confidence in the service.
Ask suppliers how quarantine is managed. Can users safely review and release low-risk messages within defined limits? Are high-risk messages held for IT review? Is there a clear audit trail? The aim is not to let every employee override security controls, but to create a proportionate process that keeps the business moving.
A trial or pilot is particularly valuable here. Use representative mail flows and include messages from key customers, suppliers and industry systems. Measure not only detection rates, but how easily legitimate communication is recovered when it is incorrectly filtered.
Administration, reporting and accountability
Security tools often look impressive in a demonstration but become difficult to manage after handover. Consider who will own day-to-day policy changes, review alerts and respond to user queries. If your internal team is small, a technically capable managed service can be more valuable than an extensive dashboard no one has time to monitor.
Reporting should answer business questions. How many phishing messages were stopped? Which users or departments are repeatedly targeted? Are there patterns that require training or changes to internal processes? Can you evidence the controls for customers, insurers or auditors?
Look for clear escalation arrangements as well. If a malicious message reaches an inbox, you need to know whether the provider can find and remove similar messages across the organisation, assess whether anyone interacted with them and advise on the next steps. Rapid response is often more important than another page of configuration options.
Questions to put to a prospective provider
A productive conversation should move beyond a generic feature list. Ask how the supplier would configure protection around your business, which controls they actively manage and what happens when there is an incident outside normal working hours. Establish whether support is delivered by people who can make decisions, or whether every issue is passed through several layers of triage.
You should also ask about data location, retention, licensing boundaries and exit arrangements. Some services charge separately for advanced threat analysis, continuity, encryption or archiving. Others include capabilities that are not needed for your risk profile. Transparent pricing makes it easier to compare the true cost rather than the headline monthly figure.
For regulated organisations, confirm how the service supports your obligations around confidentiality, retention and auditability. The gateway is not a compliance solution by itself, but it should fit cleanly into the policies and evidence your organisation needs to maintain.
Do not overlook email continuity
Email continuity is sometimes included with gateway services and sometimes treated separately. It can provide temporary access to recent messages if Microsoft 365 or another mail platform becomes unavailable. That may be valuable for businesses where customer service, operations or field teams depend on email throughout the day.
However, continuity has limits. Check how long messages are retained, what users can do during an outage and how mail is reconciled afterwards. It should support a wider business continuity plan, not replace one.
Making the decision with confidence
The lowest-cost gateway may be perfectly reasonable if your needs are straightforward and you have the in-house expertise to manage it. A more comprehensive managed option may be better value where one successful fraud attempt, prolonged outage or regulatory issue would outweigh the additional monthly cost.
At Blowfish Technology, the starting point is always the way the business operates: who sends sensitive information, how payments are approved, which systems rely on email and who will manage the service after it is deployed. That approach avoids buying security for its own sake and keeps the decision tied to operational risk.
Choose a service that gives your people protection they can work with, your managers useful visibility and your business a clear route to support when an email threat becomes more than a suspicious message.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.