Best 9 Email Security Solutions For Google Workspace (2026)
We reviewed the leading email security platforms built for Google Workspace on how effectively they extend native protection, the depth of BEC detection, and how well they handle threats that arrive through legitimate-looking senders.
Written by
Joel Witts
Technical Review by
Craig MacAlpine
Google Workspace delivers a clean, collaborative email platform. Native security catches obvious threats. What it doesn’t catch is nuanced. Sophisticated business email compromise targeting your finance team. Vendor account takeovers where the email looks legitimate because it actually came from a legitimate vendor. Lateral phishing spreading internally because it came from someone people recognize. These attacks slip past Google’s native filters because they rely on context Google doesn’t have.
The market offers multiple approaches to fill those gaps. Traditional secure email gateways apply rules and signatures. Behavioral AI learns your communication patterns to spot anomalies. Transparent detection lets you see and modify the rules driving decisions. Each approach handles different threat models and team capabilities differently.
We evaluated multiple email security solutions built for Google Workspace across cloud environments, evaluating threat detection accuracy, deployment friction, behavioral learning time, and operational simplicity. We reviewed customer feedback from organizations managing sophisticated attack surfaces and teams lacking dedicated security staff. What we found: the gap between native Google protections and what threat actors actually send is significant. More importantly, closing that gap requires matching your threat model to the right detection approach.
This guide maps email security solutions to specific threat scenarios so you can choose the right approach for your organization’s attack surface.
What is Email Security?
Email security for Google Workspace refers to the third-party platforms that extend Gmail's native protections against phishing, business email compromise, account takeover, and data loss. Google's built-in filters catch spam and known malware effectively, but sophisticated attacks that rely on social engineering, impersonation, and compromised sender accounts bypass native controls. Third-party solutions add behavioral AI, post-delivery remediation, and compliance controls that Google's native security stack does not provide.
Google Workspace email security platforms deploy via API integration with Google's Admin SDK and Gmail API, inspecting messages post-delivery without altering MX records or mail routing. This architecture provides access to internal and outbound message flows that gateway-based tools cannot inspect. Detection approaches range from behavioral AI that baselines per-user communication patterns and flags deviations, to programmable rule engines that give security teams transparent control over detection logic. Key differentiators include whether the platform treats Google Workspace as a first-class integration or a secondary add-on, the depth of post-compromise controls (inbox data protection, OAuth monitoring, identity controls), and whether detection extends beyond email into Google Drive, Google Meet, and connected SaaS applications. The strongest platforms correlate signals across email, identity, and file-sharing activity to catch multi-stage attacks that email-only tools miss.
Email Security for Google Workspace Solutions Compared
These 9 platforms cover the full range of email security approaches for Google Workspace, from behavioral AI and programmable detection to traditional gateway filtering.
| Product | Best For | Type | GWS First-Class | Internal Email | Post-Compromise |
|---|---|---|---|---|---|
|
Material Security
|
Full workspace security with post-compromise controls
|
ICES
|
Yes
|
Yes
|
Yes
|
|
IRONSCALES
|
Crowdsourced phishing defense with awareness training
|
ICES
|
Yes
|
No
|
No
|
|
Abnormal AI
|
Behavioral AI with vendor supply chain scoring
|
ICES
|
Yes
|
No
|
No
|
|
Check Point Email Security
|
Cross-channel scanning including internal traffic
|
ICES
|
Yes
|
Yes
|
No
|
|
Darktrace Email
|
Self-learning AI across email and SaaS
|
ICES
|
Yes
|
No
|
No
|
|
FortiMail Email Security
|
Organizations in the Fortinet ecosystem
|
SEG
|
No
|
No
|
No
|
|
Mimecast Advanced Email Security
|
Enterprise security with compliance tooling
|
SEG + API
|
Yes
|
Yes
|
No
|
|
Sublime Security
|
Programmable, transparent detection rules
|
ICES
|
Yes
|
Yes
|
No
|
|
TitanHQ, powered by CyberSentriq
|
SMBs and MSPs on a budget
|
SEG
|
No
|
No
|
No
|
How We Tested
We evaluated nine email security platforms for Google Workspace, assessing threat detection accuracy, deployment ease, behavioral learning periods, and operational overhead. We reviewed customer feedback from organizations managing sophisticated attack surfaces. This guide was written by Joel Witts and technically reviewed by Craig MacAlpine. Read our full methodology
Material Security
Best for full workspace security with post-compromise controls for Google Workspace
Material Security is a cloud workspace security platform built specifically for organizations running Google Workspace.
It tackles email, identity, and data security threats, with a multi-layered platform that provides inbound threat detection, account compromise protection, and automated threat response for the email channel.
Material is deeply integrated with Google Workspace through an API: no MX record changes, no mail routing disruption. It sits on top of what Google provides and extends it.
- AI agentic automation and LLM analysis detects and blocks advanced email threats in Google Workspace including VIP impersonation and BEC.
- Policy-based step-up authentication on sensitive mailbox content (tax documents, password reset links, OTPs, confidential files) as a standing control.
- File security permissions controls extend protection into Google Drive, correlating file sharing with email and identity signals.
- Identity security controls restrict what a compromised account can do across the workspace.
- OAuth Threat Remediation Agent monitors every third-party connection and remediates malicious or overly-permissive grants automatically.
Material’s account compromise protection is highly effective at slowing down attacks and limiting data exposure, according to current customers. Security teams say the automated remediation and phishing investigation tools speed up incident analysis. Customers also report that Material integrates directly with Google Workspace, offering helpful reporting and intuitive controls for managing GWS identities. Some teams do state that rules configuration can be challenging without in-house email security expertise. But the Material support team is responsive and can help address these issues.
Google Workspace has strong native security, built by a company that takes infrastructure seriously. But native controls were designed to secure Google’s platform, not to provide a complete security posture for every organization running on it. The gaps are well-documented: limited visibility into post-compromise account behavior, no correlation between email, identity, and file activity, and virtually no insight into the OAuth connections accumulating across the environment as employees adopt AI tools and third-party apps. Material is built to close those gaps, natively, without disrupting anything Google already does well. Inbound detection catches threats that bypass Gmail’s filters. Policy-based data protection locks down sensitive mailbox content regardless of how an attacker got in. Identity controls contain the blast radius of a compromised account. And the OAuth Threat Remediation Agent provides continuous, behavioral monitoring of every third-party connection in the environment, a capability with no direct equivalent in the market. For organizations running Google Workspace, Material is the security layer the platform was always missing.
Strengths
Cautions
IRONSCALES
IRONSCALES
Best for crowdsourced phishing defense with minimal setup for Google Workspace
IRONSCALES is an API-based email security platform that sits at the mailbox level inside Microsoft 365 or Google Workspace. It’s designed to catch inbound email threats, like phishing, BEC, and impersonation attacks, missed by traditional email gateways. It uses adaptive AI systems alongside end-user based threat intelligence to learn what malicious emails look like, and block them everywhere, all at once. We found it works well for Google-first teams that want strong post-delivery protection with minimal setup.
- Integrates directly with Google Workspace via API with no MX record changes or mail flow disruption.
- Behavioral baselines flag suspicious activity in real time with one-click Gmail reporting fed into 17,000+ customer organizations.
- Themis virtual SOC conducts autonomous investigation and remediation with admin context on threats.
- Machine learning, AV engines, URL scanning with standalone spam and grey-mail filtering.
- Deepfake meeting protection extends coverage to Google Meet.
- Predictive red team agent and built-in AI phishing simulations.
We are impressed by IRONSCALES. The platform is constantly adding new features, like email spam filtering, encryption, and deepfake protection. The core of the product is the crowdsourced threat intelligence built on end-user email reporting, which is an effective way of blocking phishing, alongside powerful threat protection engines. If you are running Google Workspace and looking for effective phishing and account compromise detection beyond native protections, IRONSCALES delivers. The free Starter tier offers phishing simulation and testing for up to 500 mailboxes, though full email protection requires a paid plan.
Strengths
Cautions
Abnormal AI
Abnormal AI
Best for behavioral AI with vendor supply chain scoring for Google Workspace
Abnormal AI is a behavioral AI email security platform for Google Workspace and Microsoft 365 that goes beyond traditional secure email gateways. We think the VendorBase capability is the standout here. It scores third-party vendors and detects supply chain compromise attempts in real time, which is a gap most tools ignore entirely.
- Builds risk profiles for every email relationship, mapping internal, cross-functional, and vendor connections into a global supply chain graph.
- VendorBase catches account takeovers from trusted external contacts that other tools miss.
- Protection extends beyond email into connected SaaS apps like Slack, Workday, and Salesforce.
- API deployment with no mail flow changes required.
Customers consistently highlight major time savings and reduced phishing volume reaching end users. Implementation gets high marks across company sizes from mid-market to large enterprise. Support teams earn praise for patience during transitions from legacy gateways. Some customer reviews note that heavy automation means admins forget interface navigation between infrequent logins, which speaks to effectiveness but requires some relearning when manual intervention is needed.
We think Abnormal AI is well worth considering if your threat model includes business email compromise and vendor impersonation. The VendorBase supply chain scoring fills a gap most tools leave open. The behavioral AI catches attacks that signature-based tools miss entirely, with minimal ongoing tuning required after the initial baseline learning period.
Strengths
Cautions
Check Point Email Security
Check Point Software
Best for cross-channel scanning including internal traffic for Google Workspace
Check Point Email Security, formerly known as Harmony Email & Collaboration, is a cloud-native security layer for Google Workspace and Microsoft 365 that deploys via API. We think the cross-channel scanning is the differentiator here. The platform scans inbound, outbound, and internal traffic with machine learning, catching lateral phishing and compromised accounts spreading threats inside your organization.
- Internal email scanning catches lateral phishing and compromised accounts that inbound-only gateways miss.
- Sandboxing for malware and URL protection adds depth beyond basic content filtering.
- Setup takes just a few clicks for cloud environments.
- Centralized admin console provides granular controls and reporting from one place.
- DLP and encryption capabilities for compliance-heavy industries.
Customers praise the simple interface and quick integration. Account teams get strong marks for responsiveness. Government and healthcare organizations highlight how rarely emails bypass the filters during normal operations. Some customer reviews note that the reporting interface creates difficulties when pulling detailed threat analytics. Based on customer feedback, default configuration may leave protection gaps without additional tuning.
We think Check Point Email Security is well worth considering for organizations already invested in the Check Point ecosystem or those wanting broad coverage without mail flow changes. If you need internal email scanning and DLP alongside phishing protection, this consolidates multiple capabilities from a single console. It’s a good option for mid-market budgets.
Strengths
Cautions
Darktrace Email
Darktrace
Best for self-learning AI across email and SaaS for Google Workspace
Darktrace Email is an AI-powered security platform that learns behavioral patterns for every employee to detect threats in context across Google Workspace and Microsoft 365. We think the self-learning AI approach is the standout here. Instead of relying on static rules or signatures, the platform builds individual baselines for each user, flagging anomalies like unusual access locations or atypical sending patterns.
- Context-aware detection handles sophisticated BEC and spear phishing that signature-based tools struggle with.
- Misdirected email prevention stops accidental data loss before it happens.
- Monitors SaaS applications and network devices through the same AI engine for unified visibility.
- Native API integration with no MX changes, running within minutes.
Customers consistently report dramatic improvements during proof-of-concept trials, with multiple teams describing catching hundreds of threats their existing gateways missed. Support and training teams earn strong marks for hands-on assistance during rollout. Some customer reviews note that the platform learning curve takes time for teams new to behavioral security tools. Based on customer feedback, the AI baseline needs weeks to fully understand your organization’s normal patterns.
We think Darktrace Email is well worth considering for organizations ready to invest in AI-driven detection that adapts over time. If you already use Darktrace for network monitoring, adding email creates a unified view across your environment. The extension into SaaS apps and network devices gives broader coverage than most email-only tools.
Strengths
Cautions
FortiMail Email Security
Fortinet
Best for organizations already running Fortinet infrastructure
FortiMail Email Security is a multi-layered email security platform with flexible deployment across on-premises, cloud, and hybrid environments. We think the native integration with Fortinet Security Fabric is the key advantage here. For organizations already running Fortinet firewalls or endpoint tools, adding email security creates unified visibility and automated response across the stack. The platform uses ML and LLMs alongside FortiGuard threat intelligence for real-time detection.
- FortiMail Cloud SaaS scans 100% of traffic to detect phishing, BEC, malware, account takeover, and zero-day threats across Google Workspace and other cloud email platforms.
- Deployment flexibility across on-premises, cloud, and hybrid environments.
- Multi-tenant support and managed security services for MSPs and MSSPs.
- Lightweight agent handles inbound and outbound scanning without noticeable performance impact.
- FortiMail Workspace Security adds protection for web browsers and collaboration tools.
Customers praise the reduction in spam and malicious emails reaching inboxes. Integration with third-party tools works smoothly, and setup is straightforward enough that teams deploy without dedicated specialists. Some customer reviews note that the interface feels dated compared to newer cloud-native tools. Based on customer feedback, reporting functions lack depth for teams wanting detailed threat analytics.
We think FortiMail is a good option to consider if you’re already running Fortinet infrastructure and want email security that integrates natively with your existing stack. The deployment flexibility across on-premises, cloud, and hybrid environments is a genuine advantage. Competitive pricing makes it accessible for mid-market budgets. Organizations without existing Fortinet investment will find better value elsewhere.
Strengths
Cautions
Mimecast Advanced Email Security
Mimecast
Best for enterprise security with compliance tooling for Google Workspace
Mimecast Advanced Email Security is an enterprise email security platform that combines AI-powered detection with deep policy customization for organizations running Google Workspace and Microsoft 365. We think the Targeted Threat Protection suite is where Mimecast earns its reputation. Impersonation protection catches BEC and CEO fraud attempts that basic filters miss. In March 2026, Mimecast launched full API deployment and expanded integrations to over 350 security vendors.
- URL rewriting and attachment sandboxing work effectively out of the box with minimal tuning.
- Deep policy customization supports layered defenses tailored to different user groups, risk profiles, and threat types.
- Smooth integration with Google Workspace and M365 with minimal disruption to existing mail flow.
- Broader Mimecast ecosystem integrates archiving, continuity, and security awareness training alongside core threat protection.
Customers praise the consistent, low-noise protection and clear reporting. Small security teams appreciate that daily monitoring and threat investigation stay manageable. The ability to review suspicious emails before delivery gives analysts control over borderline cases. Some customer reviews note that the admin interface feels clunky with settings buried in nested menus. Based on customer feedback, URL protection runs aggressive by default, sometimes breaking legitimate links.
We think Mimecast is well worth considering for enterprise security teams who need full email protection with deep customization and can invest time learning the platform. The March 2026 update addressing API deployment and 350+ vendor integrations strengthens its position. If you’re a smaller team wanting something simpler, this might be more platform than you need.
Strengths
Cautions
Sublime Security
Sublime Security
Best for security teams wanting programmable, transparent detection for Google Workspace
Sublime Security is a programmable email security platform that replaces black-box detection with transparent, customizable rules for Microsoft 365 and Google Workspace. We think the rule-based approach is refreshing for security teams who want to own their detection logic. You see exactly why an email was flagged or blocked, with no guessing at vendor logic.
- MQL query language for custom detections, automated triage workflows, and Slack or email alert integration.
- AI-assisted policy builder combines MQL with GenAI to simplify rule creation without sacrificing control.
- Automated remediation workflows and end user report triage run without manual intervention.
- Proactive threat hunting surfaces attacks that slipped past initial detection.
- Over 700 built-in rules with flexible deployment supporting cloud-native or self-hosted environments.
Customers highlight the POC experience as eye-opening, with multiple teams discovering threats their existing tools missed within days of deployment. Support earns consistent praise for responsiveness and technical depth throughout implementation and production. The management portal gets marks for clarity and quick configuration. Some customer reviews note that the query language requires investment to use effectively for custom rules.
We think Sublime is well worth considering if your security team wants full visibility into detection logic and the ability to tune rules across your environment. If you prefer transparency over convenience, this delivers. The free tier for single accounts lets you evaluate before committing to enterprise pricing.
Strengths
Cautions
TitanHQ, powered by CyberSentriq
CyberSentriq
Best for SMBs and MSPs needing cost-effective gateway filtering
CyberSentriq Email Security is an anti-spam and email filtering platform built for straightforward deployment without dedicated hardware. We think the price-to-protection ratio makes it one of the strongest picks for SMBs and MSPs who want solid inbound filtering without a steep learning curve. The platform serves over 12,500 customers and 2,500 MSPs, with cloud and on-premises deployment options.
- No additional hardware or software required with a manageable interface for smaller IT teams.
- Multi-domain management works smoothly for MSPs handling multiple clients from one console.
- Dual antivirus engines, sandboxing, and DLP capabilities with SPF, DKIM, and DMARC verification.
- Over 99% spam detection rates with minimal false positives in daily operation.
- Pricing at $1.95 per user monthly at 250 users.
Customers praise the user-friendly interface and quick implementation. Pre-sales demos and pricing conversations earn positive marks for being straightforward. Long-term customers report reliable performance over multiple years.
We think CyberSentriq is well worth considering for SMBs and MSPs prioritizing value and simplicity over advanced features. The dual-engine approach and included sandboxing put it ahead of most single-engine solutions at this price point. If you need affordable multi-tenant management, this delivers.
Strengths
Cautions
Other Email Security for Google Workspace Services
Beyond our top 9, these platforms are worth considering for Google Workspace email security.
Integrated email security solution for Microsoft 365, Exchange, and Google Workspace.
Robust cloud-based email gateway designed to combat email compromise and phishing.
Cloud-based email protection with API-first security and integrated Zero Trust.
Cloud-native email security platform with AI-driven detection, user training, and remediation.
A comprehensive email security solution offering inbound and outbound account protection.
Multi-layered content analysis and reputation analysis provides effective security and protection.
Email Security for Google Workspace Pricing
Google Workspace email security pricing varies by platform, deployment model, and organization size. Several vendors require a sales conversation. The prices below reflect publicly available starting rates where published.
| Product | Starting Price | Billing | Link |
|---|---|---|---|
|
Material Security
|
From $3.00/user/month
|
Annual
|
|
|
IRONSCALES
|
From $3.89/user/month
|
Annual
|
|
|
Abnormal AI
|
Contact for quote
|
|
|
|
Check Point Email Security
|
Contact for quote
|
|
|
|
Darktrace Email
|
Contact for quote
|
|
|
|
FortiMail Email Security
|
Contact for quote
|
|
|
|
Mimecast Advanced Email Security
|
Contact for quote
|
|
|
|
Sublime Security
|
Free tier available; enterprise pricing on request
|
|
|
|
TitanHQ, powered by CyberSentriq
|
From $1.95/user/month
|
Annual
|
|
Email Security for Google Workspace Checklist
These are the criteria we recommend evaluating when selecting email security for Google Workspace.
Some email security tools treat Google Workspace as a secondary add-on behind Microsoft 365; confirm full API integration, feature parity, and Google-specific controls.
Lateral phishing from compromised internal accounts is a significant threat in Google Workspace; inbound-only scanning misses this vector entirely.
Protecting sensitive mailbox content, restricting compromised account access, and monitoring OAuth connections provide defense depth that inbound filtering alone cannot.
Some platforms need weeks to learn normal patterns; understand what protection exists during this learning period and how quickly detection accuracy reaches production levels.
API-based deployment preserves existing mail flow and avoids the complexity of routing Google Workspace email through a third-party gateway.
These are the attack types most likely to bypass Google's native filters; validate detection accuracy against realistic impersonation scenarios before committing.
Attackers use file sharing and video calls for phishing and social engineering; email-only protection leaves these collaboration surfaces exposed.
Platforms with integrated training let you measure and reduce human risk without adding a separate vendor to your stack.
The Bottom Line
Email security platform selection depends on matching threat detection approach to your threat model and team capacity.
If business email compromise and vendor account takeovers keep your security team awake, Abnormal AI maps communication relationships and detects supply chain attacks other tools miss.
If you need strong phishing protection with minimal overhead, IRONSCALES deploys in under an hour with crowdsourced threat intelligence handling the heavy lifting.
If you want post-compromise data protection beyond inbound scanning, Material Security enforces MFA on sensitive historical emails during active breaches.
If behavioral AI and learning your organizational patterns matters, Darktrace Email extends threat detection across email, SaaS, and network devices.
If security engineers want transparent, customizable detection rules, Sublime Security makes every decision visible and editable through its MQL query language.
Read the individual reviews above to understand deployment complexity, threat detection approaches, and the operational trade-offs for your environment.
Everything You Need To Know About Email Security For Google Workspace (FAQs)
Google Workspace (formerly G-Suite) is a comprehensive suite of tools for managing your work environment. Included in the suite is Gmail, Calendar, Meet, Docs, Drive, Slides, and many others. There are 14 applications in total. The solution is designed to manage your entire work needs. This utility also makes it a worthwhile target for attackers.
If an attacker can access one of these applications, they may be able to continue their attack laterally.
For instance, if your Google Account or Gmail account is jeopardised, it may be used as part of a business email compromise (BEC) attack. Your authentic email address will be used to convince other users that the attackers requests are valid. They may send emails to your contacts that install malware or attempt to exploit money from them.
Alternatively, attackers may harvest data from your Sheets, Docs, Slides, and Forms applications. Depending on the type of data that was stolen, attackers could have valuable information on your customers, business plan, or finances. In some cases, your organization could be liable for the data leak. If this data is not copied, it could be edited or deleted, preventing your organization from operating as it should.
Yes. There are several features that Google has included to give you greater control, and peace of mind, over your Google Workspace accounts. These features include:
- Administrator has configuration control to ensure that authentication, asset protection, and operational expectations are met
- Conforms to ISO/IEC 27001, 27017, 27018, SOC 2/3, FedRAMP, PCI DSS
- You own your data, not Google
- At-rest and in-transit data encryption
- Enhanced security with the use of FIDO2 security keys to prevent account takeovers and phishing
- The Enterprise package unlocks several security tools and additional advanced email security measures like enhanced security and management controls, eDiscovery, retention, Vault, and advanced endpoint management
To set up basic and enterprise email for Google Workspace, start by logging into the admin console using your credentials. Google Workspace admins can access several features within the security menu based on their licensing levels. User access, establishing email encryption, defining DLP rules, enabling automation for incident response, and pushing down policies to the various Gmail Workspace accounts all become managed through this security menu.
For more information on Google’s native security features, read their white paper here.
When evaluating email security solutions for Google Workspace, consider the following factors:
- Cost: What is the total cost of ownership, including license fees, cloud storage, and training expenses for security operations engineers?
- Consolidation: Can the solution consolidate multiple security features into a single platform?
- Ease of use: How easy is it for users to adopt and use the solution?
- Effectiveness: How effective is the solution in detecting and blocking advanced threats like malicious emails, including spear phishing, and other sophisticated phishing tactics?
- Integration: How well does the solution integrate with Google Workspace and other third-party providers?
By considering these factors, organizations can make an informed decision when evaluating email security solutions for Google Workspace.
There are several ways to measure the effectiveness of an email security solution:
- Phishing simulation results: Track the percentage of employees who fall victim to simulated phishing attacks before and after implementation to assess improvement.
- Training completion rates: Monitor the percentage of employees who complete the training modules within the specified timeframe.
- Knowledge assessments: Use quizzes or tests to evaluate employees’ understanding of the training material.
- Security incident reports: Analyze the number and type of security incidents caused by human error related to email before and after implementation to determine if there is a reduction.
- Employee feedback: Gather feedback from employees about the training content and delivery methods to identify areas for improvement.
- Compliance audits: Verify that the email security solution meets the requirements of relevant regulations and industry standards.
Google Workspace users face a range of email-based threats, including:
- Phishing: Deceptive emails designed to steal credentials or sensitive information.
- Malware: Malicious software delivered via email attachments or links.
- Business Email Compromise (BEC): Attacks aimed at tricking organizations into making fraudulent wire transfers.
- Spoofing: Emails disguised to appear as if they are from a trusted source.
- Spam: Unsolicited bulk emails that can carry threats or waste productivity.
Google Workspace administrators can implement several measures to bolster email security:
- Enable multi-factor authentication (MFA): This adds an extra layer of security, requiring users to verify their identity through multiple methods.
- Implement strong spam filters: Utilize advanced filters to block unwanted and potentially malicious emails.
- Configure advanced threat protection: Enable features like sandboxing and behavioral analysis to detect sophisticated threats.
- Educate users: Provide regular security awareness training to help users recognize and avoid phishing and other email attacks.
- Enforce data loss prevention (DLP) policies: Prevent sensitive data from being shared via email.
- Regularly review security settings: Ensure that all security features are properly configured and up-to-date.
Email Security Resources
Further reading on email security from Expert Insights — buyers' guides, comparison articles, and platform-specific shortlists.
Written By
Joel is the Director of Content and a co-founder at Expert Insights; a rapidly growing media company focussed on covering cybersecurity solutions.
He’s an experienced journalist and editor with 8 years’ experience covering the cybersecurity space. He’s reviewed hundreds of cybersecurity solutions, interviewed hundreds of industry experts and produced dozens of industry reports read by thousands of CISOs and security professionals in topics like IAM, MFA, zero trust, email security, DevSecOps and more.
He also hosts the Expert Insights Podcast and co-writes the weekly newsletter, Decrypted. Joel is driven to share his team’s expertise with cybersecurity leaders to help them create more secure business foundations.
Technical Review
Craig MacAlpine is CEO and Founder of Expert Insights. Before founding Expert Insights in August 2018, Craig spent 10 years as CEO of EPA Cloud, an email security provider that rebranded as VIPRE Email Security following its acquisition by Ziff Davis, formerly J2Global (NASDAQ: ZD) in 2013.
Craig is a passionate security innovator with over 20 years of experience helping organizations to stay secure with cutting-edge information security and cybersecurity solutions.
Using his extensive experience in the email security industry, he founded Expert Insights with the singular goal of helping IT professionals and CISOs to cut through the noise and find the right cybersecurity solutions they need to protect their organizations.