API-Based BEC Protection Explained

What is API-based email security?

API-based email security connects directly to Microsoft 365 or Google Workspace through their APIs — rather than sitting in the mail flow like a secure email gateway (SEG). From inside the tenant it can read inbound, outbound and internal mail, apply behavioural AI to spot phishing, business email compromise and account takeover, and remove malicious messages after delivery. Analysts put this in the "integrated cloud email security" (ICES) category.

Why gateways miss BEC

A gateway inspects the message at the SMTP boundary. BEC often has no attachment, no malicious link and no spoofed domain. Attackers register a lookalike, warm it up, pass SPF/DKIM/DMARC on their own domain, and send a plausibly worded invoice-redirection email from a "vendor" the finance team has worked with for a year. There is nothing a signature or sandbox can grab.

Catching that message requires knowing who normally emails whom, what they normally ask for, and when the pattern breaks. That signal lives in the mailbox, not in the mail flow. API-based tools baseline every employee and vendor relationship from historic mail and flag the first message that doesn't fit.

The deployment difference

• Gateway (Proofpoint, Mimecast): change MX records, mail flows through the vendor, gateway blocks before delivery. Powerful but a traffic single point of failure.
• Native (Microsoft Defender for Office 365, Google native): already in the tenant, integrated with the ecosystem, baseline capability, weaker behavioural detection for sophisticated BEC.
• API (Abnormal, IRONSCALES, Sublime, Material, TigerGate): no MX change, grant admin consent, start in minutes. Removes malicious mail after delivery; sometimes briefly visible before removal.

Most teams run a native layer plus an API layer, and keep a gateway only if they need sandboxing, DLP or archiving.

What API-based tools detect

1. Credential phishing — adversary-in-the-middle kits (Evilginx, Tycoon 2FA) that steal session tokens even behind MFA.
2. CEO and executive impersonation — "quick favour" messages from an attacker-controlled lookalike.
3. Vendor email compromise and invoice fraud — a legitimate vendor's mailbox is compromised and used to redirect payment to a new bank account.
4. Account takeover and lateral phishing — once an attacker is inside a mailbox, they phish the rest of the company from a trusted internal address. This is the attack class SEGs cannot see because the mail never leaves the tenant.
5. Mailbox-rule abuse and OAuth app registration — the post-compromise moves that signal persistence.

Account takeover response

The best API-based tools don't just detect ATO, they contain it: revoke the suspicious session, force a password reset, reverse the inbox rule the attacker just added, revoke the OAuth grant, and alert the user. The response window on a hijacked session is measured in minutes, not days. If a vendor only lists "detection", ask them what the response action looks like.

Pricing and evaluation

Pricing is almost always per mailbox per month. Published anchors as of October 2026:

• Abnormal AI: quote-only. A State of Florida procurement document lists $40.48/mailbox for 150–2,999 mailboxes with a $25,000 minimum initial order (dms.myflorida.com).
• Avanan (Check Point Harmony Email): list pricing around $4–$6/mailbox depending on tier.
• Microsoft Defender for Office 365: Plan 1 $2/user/mo, Plan 2 $5/user/mo; included in M365 E5.
• IRONSCALES: published tiers per mailbox.
• TigerGate Email Security: usage-based per mailbox with a 14-day self-serve trial.

Run a passive proof-of-value: ask the vendor to analyse mail without remediating for 2–4 weeks. You will see what gets caught and what gets held, before changing production behaviour. See the full Abnormal AI alternatives roundup or the TigerGate vs Abnormal head-to-head.