Managed email security is the arrangement where a provider owns your mail protection end to end: the gateway or platform policies, the tuning, the quarantine, the sender authentication, the user reports and the response when an account is taken over. It is the email slice of the broader managed security market, bought either as part of a managed IT contract or standalone from a security provider. The word managed is doing precise work: you are not buying software with support, you are delegating an operational duty, and the contract should read like a delegation, who does what, in what time, with what evidence. For a small organisation the service makes sense exactly when nobody on staff owns mail security as a job; the risk is paying management fees for what is really an unwatched licence. This guide walks the scope worth demanding, the pricing, and the handoff details that decide whether the management is real.
The scope worth demanding
A real managed email security scope has six lines: policy ownership, the provider maintains the filtering and impersonation rules; quarantine, reviewed on a stated schedule with a stated release turnaround; authentication, SPF, DKIM and DMARC brought to enforcement and kept correct as senders change; reporting, a monthly view of volumes, catches and clicks; user reports, a verdict on forwarded suspicious mail within a stated time; and incident response, a written compromise procedure the provider executes. Fewer lines than that and you are buying a licence with a logo; each line should name a turnaround, because scope without time is decoration.
What it costs, and against what
Standalone managed email security prices per user per month, above the raw software cost, since attention is the product. For scale against the wider per-thing security market: endpoint protection lists at figures like $3.00 per user per month for Microsoft Defender for Business paid yearly, and $59.99 per device per year for CrowdStrike Falcon Go, both licensed list prices read for these guides. Managed mail typically lands in the same order of magnitude per user before bundling. The in-house compare is an owned hour a week of quarantine review plus the compromise responses you hope never to run; price your own hour with the free policy sheet and the comparison stops being rhetorical.
The handoff that makes or breaks it
Three handoff details predict the experience. Admin access: the provider needs it, but so do you, and losing your own admin rights to a provider is an exit problem you discover too late. Communication: where do user reports go and who tells staff a message was a test or a threat. And the boundary with payments: no managed service reads intent, so the rule that payment changes are confirmed by voice on a known number stays inside your walls, written into the finance procedure. The free sheet on this site counts that procedure and the mail policy in your set; Hardenvo Pro generates both with your names and turnarounds in them, so the delegation to the provider starts from a document rather than a hope.
Questions people ask about managed email security
What does managed email security include?
Provider-owned filtering policy, scheduled quarantine review with a release turnaround, SPF, DKIM and DMARC at enforcement, monthly reporting, verdicts on user-reported mail, and a written compromise response the provider executes. Each line should carry a time commitment.
Is managed email security worth it for a small business?
When nobody on staff owns mail security as a job, yes: the product is attention, and unwatched filters drift. Compare the per-user fee against an in-house hour a week plus incident judgement. If you buy it, keep your own admin access and your own payment confirmation rule.
What stays my responsibility under managed email security?
Payment authorisation procedure, staff behaviour and your own admin access. A provider filters and responds; it cannot confirm that the owner really asked for the bank detail change. That confirmation rule is a policy line, and the free sheet counts it into your written set.