Email security software is the layer that inspects mail before people see it: filtering what arrives, checking who really sent it, rewriting or detonating what it carries, and holding what it does not trust. Every mailbox platform ships a baseline of this for free, which is why the buying question for a small organisation is never whether to have email security software but whether to add a dedicated layer on top of the platform's own. The dedicated products earn their keep in three places: impersonation and payment fraud checks that go beyond spam scoring, an admin's view of what was blocked and why across the whole organisation, and consistent policy when mail flows through more than one platform. Everything is priced per user per month, so the arithmetic is visible on one page. This guide walks what the software actually does, where the platform baseline ends, and the two questions that decide whether the upgrade is worth its per-user price for an organisation your size.
What the software actually does
Four verbs cover the category. Filter: score and quarantine bulk and known-bad mail before the inbox. Authenticate: check that mail claiming your domain or your suppliers' domains really came from them, using the SPF, DKIM and DMARC records the senders publish. Inspect: rewrite links so the click is checked at click time, and open attachments in a sandbox before the reader can. Report: give an administrator one view of what was blocked, released and clicked across the organisation. The platform baseline does the first well; the dedicated products differentiate on the last three.
Where the platform baseline ends
The included filtering on the major platforms stops most bulk phishing. What it is weakest at is the mail that is engineered for you specifically: the supplier invoice from a lookalike domain, the payroll change request in the owner's name, the thread hijack that replies inside a real conversation. Dedicated email security software sells impersonation models, display name and lookalike domain checks, and payment fraud heuristics against exactly that traffic. Whether you need them is mostly a function of how much money moves on emailed instructions, which is a fact about your organisation, not about the software.
Pricing, and the two questions that decide
The category prices per user per month, typically a few dollars, with the impersonation and sandboxing features gating the higher tiers; for scale, endpoint suites in the same small-business market list at prices like Microsoft Defender for Business at $3.00 per user per month paid yearly. The two deciding questions: does money move on emailed instructions without a voice confirmation, and does anyone review what the filter catches? If payments move on email alone, buy the impersonation layer and also adopt the confirmation procedure, the free policy sheet on this site counts it into your set. If nobody will review a quarantine, buy less software and more procedure, because an unread report protects nobody.
Questions people ask about email security software
What does email security software do?
It filters arriving mail, authenticates senders against SPF, DKIM and DMARC, inspects links and attachments at click and open time, and reports what was blocked across the organisation. Platforms include a baseline; dedicated products add impersonation and payment fraud checks.
Is built-in email filtering enough for a small business?
For bulk phishing, usually. The gap is targeted impersonation, lookalike suppliers and boss-fraud requests, and the deciding fact is whether money moves on emailed instructions. If it does, add the impersonation layer and a written voice confirmation procedure; the free sheet counts that procedure into your policy set.
How is email security software priced?
Per user per month, with advanced impersonation checks and sandboxing in higher tiers. Comparable small business security products list in the low dollars per user per month, so a ten-person organisation is budgeting tens of dollars a month, which makes the compare against one prevented fraud straightforward.