Email · API-based · Microsoft 365 & Google Workspace

AI Email Security That Stops
Phishing, BEC and Account Takeover

Quick answer
TigerGate Email Security is API-based email protection for Microsoft 365 and Google Workspace. It uses behavioural AI to detect phishing, business email compromise and account takeover, removes malicious messages from inboxes, and needs no MX changes. Findings appear in the same console as your code, cloud, runtime and endpoint risk, and map to SOC 2 and ISO 27001.
Start Free TrialCompare vs Abnormal

The Attacks That Get Past Microsoft and Google Filters

Native M365 and Google Workspace filters catch volumetric spam and known-bad URLs. They miss the targeted attacks that cost real money:

  • Payload-free BEC — pure social engineering, no links or attachments, impersonating a CFO or vendor
  • Vendor and invoice fraud — a compromised supplier mailbox sends a payment-detail change request from a real address
  • Credential phishing — pixel-perfect Microsoft/Google login pages hosted on fresh domains
  • AiTM / MFA-bypass phishing — session-token theft via adversary-in-the-middle proxies (Evilginx, Tycoon2FA)
  • QR-code phishing (quishing) — malicious URL hidden inside an image or PDF, bypassing URL scanners

How TigerGate Detects Them

Sender history & relationships

Builds a per-employee and per-vendor baseline of normal communication patterns. Flags first-time senders, unusual relationships and reply-to anomalies.

Identity & sign-in context

Correlates email events with Entra ID / Google Workspace sign-ins. A message from a user who just signed in from a new country gets scrutiny.

Impersonation & lookalike domains

Detects display-name spoofing, lookalike domains (Unicode homoglyphs, close-match TLDs) and reply-to mismatches.

Language & intent

LLM-based classification of invoice-change requests, urgency signals, gift-card requests, and vendor-impersonation tropes.

Link & attachment analysis

Full URL expansion, redirect-chain evaluation, destination page screenshotting, and attachment inspection including QR codes in images and PDFs.

Explainable verdicts

Every flagged message shows the exact signals that drove the verdict — admins can tune, release and mark trusted senders.

Automatic Remediation and User-Reported Phishing

Delivered threats are pulled from every affected mailbox in seconds. Campaign clustering groups look-alike messages so remediation covers users who haven't reported yet. A dedicated phish-report mailbox ([email protected]) triages user reports with ML-based verdicts and routes false positives back to the sender.

Account Takeover Protection

Behavioural baselines per user — sign-in locations, devices, mailbox-rule patterns, forwarding rules — surface ATO before the attacker sends internal phishing. Response actions available from the console:

  • Revoke all active sessions (Entra ID / Google Workspace)
  • Force password reset + MFA re-enrollment
  • Reverse malicious mailbox rules and auto-forwarding rules
  • Quarantine OAuth apps granted by the compromised user
  • Flag internal messages sent during the compromise window

Email Posture Included

Microsoft 365 and Google Workspace settings are continuously evaluated: external forwarding, anti-phish policies, Safe Links, Safe Attachments, DMARC enforcement, legacy auth. Your domains' SPF, DKIM, DMARC and MTA-STS records are validated. Fix tasks map to specific tenant settings and admin-console paths.

Connected to Code, Cloud, Endpoint and Runtime

A phished user's compromised session is linked to the cloud roles that user can assume, the repos they can read, and the production workloads their credentials unlock. One email incident becomes one full attack path, not six disconnected alerts across six tools.

Deploy in Minutes, No MX Changes

  1. Connect: admin consent to a Microsoft 365 or Google Workspace API app
  2. Passive mode: TigerGate runs read-only for 2–4 weeks, reporting what it would have caught
  3. Review: compare TigerGate verdicts against your current filter, tune the few edge cases
  4. Enable remediation: turn on auto-pull and ATO response

Pricing You Can See

Per-mailbox usage-based pricing. No minimum contract. 14-day free trial, no credit card. Bundle with other TigerGate modules for a discount. See pricing.

Compliance Evidence

  • SOC 2 CC7.2 / CC7.3: anomaly detection and incident evaluation
  • ISO 27001 A.5.14: information transfer; A.8.23: web filtering; A.6.3: security awareness
  • PCI DSS 4.0 Req. 5.4: anti-phishing mechanisms
  • CERT-In Directions (India): incident reporting with 6-hour SLA for compromised mailboxes

TigerGate vs Abnormal, Sublime and Material

TigerGateAbnormalSublimeMaterial
DeploymentAPIAPIAPIAPI
Public pricingYesNo (quote)Free ≤100 mailboxes$4/$6 per user/mo
Self-serve trial14-dayDemoYes—
Platform breadthCode, cloud, runtime, endpoint, emailEmail + identity + AI governanceEmail onlyEmail + Workspace
Minimum contractNone$25K min initial (public RFP)——

Full comparison: TigerGate vs Abnormal AI · 10 Abnormal alternatives compared

Email Security FAQ

API-based email security connects directly to Microsoft 365 or Google Workspace through their APIs instead of sitting in the mail flow like a secure email gateway. It can analyse internal and inbound mail, remove malicious messages after delivery, and deploy without changing MX records. Analysts often call this category integrated cloud email security (ICES).
Credential phishing, business email compromise including CEO and vendor impersonation and invoice fraud, account takeover and lateral phishing from compromised internal accounts, and malicious links and attachments.
No MX changes are needed. TigerGate connects via the Microsoft 365 or Google Workspace API. It can run alongside Microsoft Defender for Office 365, Google's built-in protection or an existing secure email gateway.
Connecting a tenant takes minutes with an admin consent. TigerGate can start in a passive mode that only reports what it would have caught, so you can evaluate it before turning on automatic remediation.
Both use API-based, behaviour-driven detection for Microsoft 365 and Google Workspace. TigerGate is priced per mailbox with a self-serve trial and no minimum contract, and email findings sit in the same platform as code, cloud, Kubernetes, runtime and endpoint security. Abnormal does not publish pricing. See /abnormal-alternatives for a dated comparison.
Any behavioural email filter can flag legitimate mail. TigerGate shows the reason for every verdict, lets admins release messages and mark senders as trusted, and learns from those decisions.
Yes. Email Security includes posture checks for Microsoft 365 and Google Workspace settings and validates SPF, DKIM, DMARC and MTA-STS for your domains. Fix tasks map to the specific tenant setting and admin-console path.
Per mailbox per month, usage-based, with a 14-day free trial and no credit card. It can be bundled with other TigerGate modules for a discount.

Try Email Security Free

Connect your Microsoft 365 or Google Workspace tenant. 14-day trial, no credit card, no MX changes.

Start Free TrialTigerGate vs Abnormal AI