Bottom line: Microsoft’s benchmarking shows only marginal added value (under 0.05%) for additional email security tools, but experts emphasize that a percentage figure does not reveal the full risk picture and a single missed threat can be critical.
Microsoft presents benchmarking data showing that additional email security tools alongside Defender for Office 365 offer only marginal added value (under 0.05%). Security experts, however, warn against placing too much trust in such vendor claims.
Microsoft published a new quarterly benchmarking report in July 2025 with data on email security. The company compares itself with seven established Secure Email Gateway (SEG) providers: Mimecast, Proofpoint, Hornetsecurity, Trend Micro, Cisco IronPort, Barracuda, and FireEye/Trellix. For pre-delivery detection, Defender misses 59% fewer high-severity threats than competing SEG solutions. The rate is 194 missed threats per 1,000 employees, while Mimecast achieves 478 and Proofpoint 483. For post-delivery removal, Defender removes an average of 96.03% of malicious emails from the inbox, an increase from an initial 45% in Microsoft’s own earlier measurements.
Integrated Cloud Email Security (ICES) solutions deployed together with Defender improve detection rates for malware by 0.29% and for spam by 0.68% according to Microsoft. This keeps the theoretical rationale for an additional tool in the sub-1% range. Jeff Pinkston, VP and General Manager for Microsoft Defender, positions Defender as a “critical fallback” that provides value even when deployed alongside ICES.
Security analysts, however, point out that percentage figures obscure the actual volume and severity of content that gets through. Seva Ioussoufovitch from Info-Tech Research Group warns: “It only takes one message to trigger an incident.” David Shipley from Beauceron Security notes that the report itself demonstrates that “much malicious content still gets through email filters”. His analyses of hundreds of thousands of emails reveal a spectrum ranging from obviously malicious to highly sophisticated time-delayed attacks.
A key factor is whitelisting practices: strict security settings achieve high detection rates but also generate many false positives – a problem organizations know well when, for example, business-critical PDF files are incorrectly blocked. Additionally, there is a risk for AI-based email filters: agent-supported LLM analyses can be “poisoned” by hidden content, compromising their reliability.
Source: www.csoonline.com · Published 17 June 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.1.