Advanced Email Security for SMEs: Protection Against Phishing, Spoofing and BEC

Email is still the most widely used attack channel. Around 91 percent of all cyberattacks start with a phishing message, and Dutch SMEs receive CEO fraud attempts every week. In this article you will learn what advanced email security for SMEs actually involves, how SPF/DKIM/DMARC relate to a secure email gateway or a modern ICES solution, what it costs and how to choose an approach that fits your organisation.

How big is the problem?

Phishing remains the most common attack vector. Research by Searchlab shows that 72 percent of all cyber incidents in the Netherlands start with a phishing message, followed by ransomware and business email compromise (BEC). 75 percent of Dutch SMEs have already been hit by cybercrime, yet only a third train their staff to recognise phishing on a structural basis.

BEC is the most expensive category. The average loss per BEC incident is around €118,000, but individual cases run to €750,000 or more. The best-known Dutch example is still cinema chain Pathé, which lost more than €19 million in 2018 to CEO fraud in which an employee was persuaded to transfer money to a fake board of directors. According to the Dutch National Cyber Security Centre (NCSC), BEC is one of the fastest-growing forms of digital fraud, with a major impact.

The practical takeaway for SMEs: securing email is not an "extra". Without a layered approach, the question is not if but when a targeted message causes damage.

Two layers: authentication and detection

Effective email security consists of two layers, and you need both. They work together; one does not replace the other.

The authentication layer consists of DNS records (SPF, DKIM, DMARC and BIMI) that help receiving mail servers confirm that a message really comes from your domain. This layer is free, technical, and stops criminals from easily sending email in your name. We have written a detailed step-by-step plan for it in our article on SPF, DKIM and DMARC.

The detection layer is the anti-phishing and anti-malware technology that inspects your incoming mail: it filters messages, sandboxes attachments, rewrites links, scores BEC signals and detonates unknown content in an isolated environment. This layer lives in products such as Microsoft Defender for Office 365, Mimecast, Proofpoint and Abnormal. They are not free, but this is where modern attacks are stopped.

Authentication layer: SPF, DKIM, DMARC and BIMI

The four protocols complement each other and should be rolled out in this order:

1. SPF (Sender Policy Framework): a DNS record listing the servers allowed to send email on behalf of your domain. Receivers check whether the sender's IP address is on that list.
2. DKIM (DomainKeys Identified Mail): your mail server adds a digital signature to every outgoing message. The receiver verifies it using a public key published in your DNS.
3. DMARC (Domain-based Message Authentication, Reporting and Conformance): DMARC ties SPF and DKIM to an enforcement policy: monitor, quarantine or reject. It also produces reports showing who is sending email on behalf of your domain.
4. BIMI (Brand Indicators for Message Identification): displays your verified logo in supporting inboxes once DMARC is set to reject. It adds brand recognition and a subtle layer of protection.

According to Keurig Online, only 13 percent of Dutch organisations have DMARC configured correctly, and 41.5 percent have no DMARC record at all. That puts the Netherlands last among all the European countries studied. Poor email authentication is the number one cause of deliverability problems among Dutch SMEs.

This layer costs you nothing in licences, only time. It is the first step for every SME and should be set to reject within a few weeks.

Detection layer: SEG or ICES?

The detection layer comes in two flavours.

A Secure Email Gateway (SEG) sits in front of your mail flow. You point your MX record to the gateway, which scans all incoming mail before it reaches Microsoft 365 or Google Workspace. Classic examples: Mimecast, Proofpoint, Barracuda, Cisco IronPort. SEGs are strong at reputation filtering, sandboxing and compliance archiving. Mimecast is known for email continuity: if Microsoft 365 goes down, mail keeps flowing through the gateway.

Integrated Cloud Email Security (ICES) runs via API on top of Microsoft 365 or Google Workspace. There is no MX change; instead, machine learning learns the communication patterns between senders and recipients and flags anomalies. Examples: Abnormal, Egress, Check Point Harmony Email. As AI-generated phishing increasingly slips past classic signature-based detection, behavioural AI has become more dominant here.

Microsoft Defender for Office 365 is a hybrid: it sits inside the Microsoft 365 tenant itself and combines reputation, sandboxing (Safe Attachments), URL rewriting (Safe Links) and machine learning. For many SMEs, Defender is the most practical choice because it slots seamlessly into existing Microsoft 365 licences.

For Google Workspace environments, Abnormal, Google's own Advanced Protection and third-party products such as Barracuda and Trustifi are the usual choices. You can read more about the broader Microsoft 365 context in our Microsoft 365 licensing guide for SMEs.

What does advanced email security cost?

Prices are indicative per user per month, based on published 2026 rates, excluding VAT.

• Microsoft Defender for Office 365 Plan 1: around $2 per user per month (annual commitment). Includes Safe Attachments, Safe Links, anti-phishing and real-time detection reports. From July 2026, Plan 1 is included as standard in Microsoft 365 E3 and is also being added to Business Standard, with a price increase of $3 per user per month on the plan.
• Microsoft Defender for Office 365 Plan 2: around $5 per user per month. Adds Threat Explorer, Automated Investigation and Response, Campaign Views and Attack Simulation Training.
• Mimecast Advanced Email Security: no published per-user price; in practice €4 to €8 per user per month depending on bundle and volume. Archiving and continuity cost extra.
• Proofpoint Essentials: often comparable to Mimecast on price, strong on click-time URL protection.
• Abnormal: premium ICES, roughly $5 to $8 per user per month.

For an SME with 25 users, Defender for Office 365 Plan 1 therefore adds around $50 a month. A full stack with an SEG plus training comes to roughly €200 to €400 a month. Compared with a single BEC incident at €118,000, that is a small amount.

Which should you choose: Defender, SEG or ICES?

There is no single right answer; here are three profiles to help you decide.

Small business fully on Microsoft 365 (5 to 25 users): Defender for Office 365 Plan 1 or Plan 2 is enough in most cases. On top of that: SPF/DKIM/DMARC at reject, MFA everywhere, and annual phishing simulations.

Mid-sized organisation (25 to 250 users) with a mixed risk profile: Defender Plan 2 or Mimecast, supplemented by security awareness training and a quarterly review. For companies where CFOs and directors regularly approve payments, a dedicated BEC detection layer (ICES) is a sensible upgrade.

Business with a higher risk profile (compliance, financial flows, supply-chain dependency): ICES on top of Defender or an SEG. Behavioural AI complements signature-based detection against targeted BEC attacks that get past a classic gateway.

Additional measures that make the difference

A good stack is only half the story. The other half is process and behaviour:

• Multi-factor authentication on every account. Without MFA, a successful phishing attack immediately becomes an account takeover. See our guide to implementing MFA.
• Four-eyes principle for payments. Every transfer above a set threshold requires a second, out-of-band confirmation (not by email).
• Security awareness with simulations. Regular phishing simulations followed by micro-training. Attack Simulation Training in Defender Plan 2 works well for this; alternatively, choose security awareness training from an external provider.
• Actively monitor DMARC reports. Otherwise you will miss attacks on your brand, as well as third-party services sending email in your name without being listed in SPF.
• Retention and archiving. In sectors with retention obligations (finance, healthcare, government), archiving is often a legal requirement; check that your product covers it.
• Endpoint protection (EDR). If a link does get clicked, the laptop is the last line of defence. See our article on EDR for SMEs.

Common mistakes

• Leaving DMARC at p=none. Monitoring without enforcement does not protect you; only p=quarantine or p=reject really works.
• No DKIM for third-party services. Marketing email via Mailchimp or transactional email via SendGrid also has to pass SPF and DKIM; otherwise it ends up in spam or is rejected by DMARC.
• Relying on the gateway alone and ignoring internal mail. After an account takeover, phishing travels from colleague to colleague within the same tenant. An SEG does not see that internal mail; only ICES or Defender with internal scanning does.
• Unreviewed quarantine. If nobody looks at what is being filtered, false positives pile up and trust in the system erodes.
• No incident plan for compromised accounts. If someone signs in from Nigeria, you need to be able to isolate the account, reset the password, revoke sessions and check MFA methods within minutes.

Frequently asked questions about advanced email security

Isn't Microsoft 365 Exchange Online Protection (EOP) enough? EOP does a reasonable job against commodity spam and known malware. Against targeted phishing, spear phishing and BEC it falls short; for those you need Defender Plan 1 or higher, or a separate SEG/ICES layer. EOP lacks the dynamic URL scanning and behavioural AI that modern threats demand.

What is the difference between an SEG and ICES? An SEG sits in front of your mail flow (via the MX record) and filters everything before it reaches Exchange Online or Google Workspace. ICES runs via API on top and uses machine learning to analyse patterns between senders and recipients. An SEG is strong at classic signature-based detection and compliance archiving; ICES is stronger at detecting targeted BEC and AI-generated phishing.

Does advanced email security protect against ransomware? Partly. Email is a major initial infection route for ransomware, and good filtering catches a lot. Full protection requires multiple layers: EDR on endpoints, backups with immutable retention and network segmentation. See our ransomware protection guide for SMEs for the full approach.

Does DMARC also work for Google Workspace? Yes. SPF, DKIM and DMARC are DNS standards and work independently of your mail platform. Google Workspace follows exactly the same order: SPF, enable DKIM in the Admin console, then build DMARC up from p=none to reject.

How quickly can a BEC attack succeed? Faster than most people think. A single message with a well-timed request for an urgent payment can lead to money leaving the account within hours, especially around holiday periods or quarter-end. The four-eyes principle with verification outside email is the most important defence on the human side.

Should I use Defender's Attack Simulation Training or an external provider? For most SMEs, Attack Simulation Training in Defender Plan 2 is sufficient. Large or complex organisations with multilingual needs or specific sector profiles are often better served by KnowBe4, Phished or Hoxhunt. The key is not the tool but consistency: at least four campaigns a year, followed by short micro-lessons.

Conclusion

In 2026, advanced email security is no longer a luxury for any Dutch SME. A layered approach, with SPF/DKIM/DMARC at reject as a free foundation and a detection layer such as Defender for Office 365, Mimecast, Proofpoint or Abnormal on top, covers the bulk of modern threats. Add MFA, the four-eyes principle for payments and regular simulations, and you have an approach that is robust on both the technical and the human side.

TRON Group helps SMEs across the Netherlands set up modern cybersecurity and email protection: from a two-week DMARC rollout to a full ICES implementation with a matching awareness programme. We know what works for your size and risk profile, and we won't sell you more than you need. Want to know where your current email security stands? Call us on +31 85 303 5869 for a no-obligation scan of your SPF, DKIM and DMARC records and advice on the detection layer.