Email Security evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 102 vendors in this category.

• baselineRFIDoes the platform operate as an API-based integration (Microsoft 365/Google Workspace) in addition to or instead of a traditional secure email gateway (SEG) / MX-record redirect, and what detection capability differs between the two deployment modes?weight 3
  Answer key — what a strong answer shows

  Look for clarity on deployment-model tradeoffs — API-based tools see mailbox-native signals but may act post-delivery, while a SEG blocks pre-delivery but requires MX changes.

• baselineRFPDescribe detection coverage for business email compromise (BEC) and vendor email compromise specifically, distinct from generic phishing/malware detection, and provide a measured detection-rate figure from a customer reference.weight 3
  Answer key — what a strong answer shows

  BEC/VEC often has no malicious link or attachment, so detection relies on behavioral/relationship analysis — strong answers explain that mechanism specifically, not generic 'AI detection.'

• baselineRFIHow does the product detect and act on compromised internal accounts sending malicious email (account takeover), versus only inbound threat filtering?weight 3
  Answer key — what a strong answer shows

  Look for outbound/internal anomaly detection (unusual sending behavior, forwarding-rule abuse) as a distinct capability from inbound filtering.

• baselineRFIWhat is the false-positive rate on legitimate business email, and what mechanism exists for end users or admins to release/allowlist a quarantined message without disabling protection broadly?weight 3
  Answer key — what a strong answer shows

  Strong answers give a measured false-positive rate and a scoped release mechanism, not an all-or-nothing allowlist that weakens protection.

• baselineRFPDetail attachment and URL sandboxing — is detonation performed in a real sandbox environment, what added latency does it introduce to mail delivery, and can time-of-click URL re-scanning catch weaponization that happens after initial delivery?weight 3
  Answer key — what a strong answer shows

  Look for a stated latency figure and confirmation of time-of-click re-scanning — a link benign at delivery but weaponized later is a common evasion.

• baselineRFIHow does the platform handle detection of QR-code-based phishing (quishing) and other payloads that evade traditional URL/attachment scanning?weight 3
  Answer key — what a strong answer shows

  This is a newer, fast-growing evasion technique — a vendor with no answer likely hasn't kept pace with current threats.

• baselineRFPExplain integration with identity/SSO providers for correlating email-based credential phishing attempts with actual sign-in attempts using those credentials, and describe the automated response (e.g., forced password reset, session revocation).weight 3
  Answer key — what a strong answer shows

  Strong answers describe closed-loop automated response, not just detection-and-alert requiring manual follow-up.

• baselineRFIWhat email authentication support is provided for outbound domains (DMARC monitoring/enforcement, SPF, DKIM), and does the platform help the customer move from monitor-only to a reject policy safely?weight 3
  Answer key — what a strong answer shows

  Look for guided DMARC policy progression (monitor → quarantine → reject) with visibility into legitimate senders that would break, not just raw report parsing.

• baselineRFIDoes the platform offer native encryption for outbound sensitive email (e.g., regulated PII, financial data), and is encryption policy-driven/automatic based on content inspection, or does it require the sender to manually choose to encrypt each message?weight 3
  Answer key — what a strong answer shows

  Automatic, policy-driven encryption based on content inspection is materially stronger than a manual opt-in the sender can simply forget to use.

• baselineRFPDescribe historical mailbox search/forensics capability — when a new IOC or compromised-vendor domain is identified, can the platform retroactively search all historical mail for that indicator across the whole organization, and how far back does that search reach?weight 3
  Answer key — what a strong answer shows

  Look for a genuine retroactive, organization-wide search capability with a stated retention window; a platform that can only act on mail going forward from detection is materially weaker for incident response.

• baselineRFIDoes the platform score or monitor third-party/vendor email risk (e.g., flagging when a known supplier's domain shows signs of compromise before they send a malicious invoice), or is risk scoring limited to the customer's own domain and inbound traffic?weight 3
  Answer key — what a strong answer shows

  Proactive vendor-domain risk monitoring is a more advanced capability than purely reactive inbound filtering — ask for a concrete example of a caught vendor-compromise incident.

• baselineRFPExplain the pricing model — per mailbox/per month, tiered by feature set (basic filtering vs full BEC/account-takeover protection) — and what is included at each tier versus requiring an upsell.weight 3
  Answer key — what a strong answer shows

  Strong answers give transparent per-tier economics and are explicit about which protections (e.g., BEC detection) are gated behind a premium tier rather than included in the base product.

• baselineRFIWhat mobile email client coverage is provided — does protection apply equally to native mobile mail apps and third-party mobile clients, or only to webmail/desktop clients with mobile left as a gap?weight 3
  Answer key — what a strong answer shows

  A real coverage gap on mobile (a common attack surface given time-pressured, distracted reading on phones) should be disclosed explicitly, not glossed over.

• baselineRFIIs a named incident-response or breach-coach service available specifically for email-borne incidents (e.g., a successful BEC wire-fraud event), and what is the average engagement time from detection to resolution?weight 3
  Answer key — what a strong answer shows

  Strong answers cite a concrete, named IR capability and timeline, not a generic 'we have support' answer — email-borne fraud incidents often need fast, specialized response.

• baselineRFIWhat data residency and compliance options exist for where email content is processed and stored during scanning (relevant for GDPR/regulated customers who can't have email content leave-region), and is this configurable per customer or fixed to a single region?weight 3
  Answer key — what a strong answer shows

  Look for genuine regional processing options; a vendor scanning all customer email content in a single fixed region regardless of customer location is a real compliance gap for many regulated buyers.

• baselineRFPDetail integration with the customer's security awareness training platform — can a real phishing email caught by this product automatically become training content or trigger targeted follow-up training for the specific user who almost clicked it?weight 3
  Answer key — what a strong answer shows

  Real-time integration between actual caught threats and targeted training is materially more effective than disconnected simulated-only phishing training.

• baselineRFPProvide spam filtering administration.weight 3

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.