In short
ICES vs SEG comes down to position. A secure email gateway filters mail before it reaches Microsoft 365 or Google Workspace and adds continuity, outbound filtering and encryption. ICES connects by API after the built-in filter, sees internal mail and removes threats after delivery. Cloud-only organisations often choose ICES; some run both.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
The short answer
If you are on Microsoft 365 or Google Workspace and your main worries are phishing, invoice fraud, impersonation and compromised accounts, an integrated cloud email security product is usually the quicker, lower-risk addition: no MX change, internal mail covered and automatic clean-up of every inbox.
If you need continuity during an outage, outbound filtering, encryption or an archive from one supplier, or you run your own mail server, a secure email gateway still earns its place. Where both sets of needs apply, running both, or choosing a vendor that offers both, is a normal design rather than duplication.
ICES vs SEG side by side
| ICES (API) | SEG (gateway) | |
|---|---|---|
| Where it sits | Inside the Microsoft 365 or Google Workspace tenant | In front of the mail platform, in the delivery path |
| How it connects | Administrator consent to API access | MX records point at the gateway, plus connectors |
| When it inspects | After the built-in filter: inline before the inbox, or just after delivery | Before Microsoft or Google receive the message |
| Internal mail | Usually inspected | Usually not seen |
| Post-delivery removal | Core feature, across every mailbox | Varies; often relies on the mail platform |
| Account takeover detection | Common, using sign-in and mailbox signals | Limited; often outbound scanning for signs of a compromised account |
| Collaboration apps | Offered by several products (Teams, SharePoint, OneDrive, Google Drive, Slack) | No |
| Google Workspace support | Most products we supply | Yes, through Gmail's Inbound gateway setting |
| On-premises mail servers | Rarely | Yes |
| Outbound filtering | Limited | Yes |
| Continuity and archiving | No continuity; archiving as an add-on in some products | Common |
| Set-up effort | Low; no change to mail flow | Moderate; MX change and tenant lock-down |
| Typical failure mode | If the API connection fails, mail still flows but without that layer | If the gateway is bypassed or misconfigured, mail can be lost, delayed or unfiltered |
"Usually" matters in this table: products vary, and several vendors blur the line. Ask any vendor exactly when a message is inspected and whether it can be held before a user sees it.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
What happens when something goes wrong
Thinking about failure is a useful way to choose.
With a gateway, the risks are in mail flow. If MX records, connectors or the tenant lock-down are wrong, legitimate mail can bounce or be delayed, and if the tenant is not locked to the gateway, attackers can send straight past it. A well-run gateway also protects you from the mail platform's own outages by queuing mail. Changes need planning and a quiet window.
With an ICES, mail flow is untouched, so a problem with the product rarely stops mail. The risks are different: if API permissions are revoked or the connection is interrupted, mail keeps arriving but without that layer's inspection, and in post-delivery mode there is a short window before a malicious message is removed. Good products alert you when the connection fails, and inline modes close the delivery window where they are supported.
Either way, Microsoft's or Google's own filtering keeps running underneath, which is why configuring Exchange Online Protection and the Gmail settings in our Google Workspace email security hub matters whichever you choose.
When to run both
Running a gateway and an ICES together gives pre-delivery blocking, outbound filtering and continuity from the gateway, and internal mail, account takeover detection and post-delivery clean-up from the API layer. You can do this with two products, or with one vendor that offers both deployments:
- Trend Micro: TrendAI Vision One Email and Collaboration Security has an API deployment and a Cloud Email Gateway Protection deployment; the Pro package counts each user once across both and adds XDR for Email. See Trend Micro email security
- Bitdefender: GravityZone Extended Email Security runs as an MX perimeter, a Microsoft 365 API layer, or both, in the GravityZone console. See Bitdefender email security
- Sophos: Sophos Email deploys as a gateway or through API integration with Microsoft 365, managed in the same Sophos console as your endpoints; we confirm at quote which deployment suits you. See Sophos Email
- Two products: for example Proofpoint Essentials as the gateway with IRONSCALES or Check Point Email Security behind it; our IRONSCALES vs Proofpoint page explains how they divide the work
When running two layers, agree which one quarantines what, send user reports to one place and keep policies aligned, so staff and administrators get a consistent experience.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
Decision steps
- List your mail platforms: Microsoft 365, Google Workspace, your own servers, or a mix
- Decide whether you need continuity, outbound filtering, encryption or archiving from your email security supplier
- Check whether attacks also reach you through Teams, Slack or shared files
- Check what you already own: Defender for Office 365 plan, Google Workspace edition, and any Acronis, Bitdefender, Sophos, ThreatDown or Trend Micro licences
- If you need gateway features or have your own servers, shortlist a gateway; if you are cloud-only and worried about phishing, BEC and account takeover, shortlist an ICES
- If both lists have entries, consider a vendor with both deployments, or a gateway plus an ICES
- Trial the ICES in monitoring mode on your own mail, and plan any gateway cut-over for a quiet time
The email security platforms compared table shows which architecture each product uses.
Examples by situation
| Situation | Usually fits | Examples we supply |
|---|---|---|
| Microsoft 365 only, targeted by invoice fraud | ICES | IRONSCALES, Check Point Email Security, Vade for M365, Acronis Email Security |
| Google Workspace, or Microsoft 365 and Google Workspace together | ICES that supports both | Check Point Email Security, IRONSCALES, FortiMail Workspace Security, Trend Micro |
| Heavy use of Teams, Slack or shared drives with outsiders | ICES with collaboration coverage | Check Point Email Security, FortiMail Workspace Security, Trend Micro |
| Own mail server or a hybrid estate | SEG | Proofpoint Essentials, Symantec Email Security.cloud, Trend Micro gateway |
| Want continuity, encryption and archiving from one supplier | SEG | Proofpoint Essentials |
| Already running Sophos, Bitdefender or Trend Micro endpoints | That vendor's email module, gateway or API | Sophos Email, Bitdefender Extended Email Security, Trend Micro |
| Want both layers | SEG plus ICES, or a hybrid product | Trend Micro Pro, Bitdefender in both modes, Proofpoint Essentials with IRONSCALES |
How we help
Because we supply both kinds of product, we have no reason to push one architecture. We can review your mail flow and licences, recommend ICES, a gateway or both, and test the choice with a monitoring-mode trial on your own mail where the product supports it. If a gateway is right, we can plan and carry out the MX and connector changes with you.
Pricing depends on the products, packages and user numbers, so ask us for a quote. Contact us for an impartial recommendation.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is the difference between ICES and SEG?
A secure email gateway (SEG) sits in front of your mail platform and filters mail before Microsoft or Google receive it, which needs an MX change. Integrated cloud email security (ICES) connects inside the tenant by API after the built-in filtering, needs no MX change, sees internal mail and removes threats after delivery.
Are secure email gateways obsolete?
No. Cloud-only organisations increasingly choose API-based protection, but gateways still offer things ICES products generally do not: continuity during an outage, outbound filtering, encryption, archiving and support for your own mail servers. Many organisations run a gateway with an API layer behind it.
Can I use ICES and a SEG together?
Yes. The gateway filters mail before delivery and the ICES inspects internal mail and removes anything that later turns out to be malicious. Agree which product quarantines what and route user reports to one place. Trend Micro and Bitdefender can run both deployments together from one console, and Sophos Email offers a choice of gateway or API deployment.
Which is easier to deploy, ICES or a SEG?
ICES is usually easier: an administrator grants API consent and mail flow does not change, so it can be trialled in monitoring mode during working hours. A gateway needs connector and MX changes and a tenant lock-down, best done at a quiet time.
Does ICES work with on-premises Exchange?
Most ICES products are built for Microsoft 365 and Google Workspace, so a gateway is the usual choice for your own mail servers. Acronis lists on-premises mailboxes among those its email security supports; we confirm the deployment method for your mail system at quote.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.