IRONSCALES vs Avanan: two API email security platforms compared

The short answer

Both products are integrated cloud email security (ICES) platforms. They connect to your Microsoft 365 or Google Workspace tenant by API, let Microsoft's or Google's own filtering run first, inspect internal mail as well as inbound mail, and can deal with threats without any change to your MX records. So this is not an ICES vs SEG decision; it is a choice between two products built on the same idea.

Avanan is the original name of what Check Point now calls Check Point Email Security. Check Point acquired Avanan in 2021, sold it as Harmony Email & Office and then Harmony Email & Collaboration, and gave it its current name on 25 March 2026. Our sister site explains the history on its Avanan page.

In broad terms:

• Check Point Email Security tends to suit organisations that want one platform for mail and collaboration apps, the option of inline prevention before the inbox, sandboxing and file sanitisation, and add-ons such as archiving, or that already use other Check Point products.
• IRONSCALES tends to suit organisations whose main problem is targeted phishing and business email compromise reaching inboxes, that want reported and detected threats removed from every mailbox automatically, and that like the idea of staff reports feeding detection.

Both protect Gmail as well as Microsoft 365.

IRONSCALES vs Check Point Email Security compared

IRONSCALES details are from ironscales.com; Check Point details are from checkpoint.com's Email Security pages and plans. Both vendors change their packaging, so we confirm what each plan includes when we quote. We have not repeated either vendor's detection-rate, engine-count or analyst-ranking claims.

Plans side by side

The two vendors package their products differently.

IRONSCALES sells plans that build on each other. The ones we supply are:

IRONSCALES also lists Email Essentials and Email Protect 360 (Email Protect plus encryption and DLP) for organisations buying direct, and a separate Human Risk Management plan for training and simulation. DMARC management is an add-on, and IRONSCALES lists Microsoft Teams protection and deepfake meeting protection as add-ons too; we confirm which add-ons are available on the plan we supply when we quote.

Check Point Email Security is a choice of coverage and tier:

Check Point's add-ons include Archiving (up to 10 years), DMARC Management, Incident Response as a Service and AI phishing training, and it also lists Browse, Leaked Credentials, SaaS Security Posture Management and Security Awareness Training. Our sister site has the full Check Point Email Security plans comparison.

Collaboration apps: the biggest difference

If your staff share files and messages in Teams, SharePoint, OneDrive, Slack or Google Drive all day, this is usually what decides it.

Check Point's Email & Collaboration coverage applies the same phishing, malware and DLP protection to Teams, SharePoint, OneDrive, Google Drive, Slack, Box, Dropbox and ShareFile. A malicious file uploaded by a guest, or a phishing link pasted into a chat, is treated much like a malicious email. This matters because an attacker who has taken over one account can use it in collaboration apps as well as email, and people tend to trust messages and files from colleagues.

IRONSCALES is built around the mailbox. Beyond email it lists Microsoft Teams protection and deepfake meeting protection, which looks for AI-generated impersonation in Teams meetings, both as add-ons. If Slack, Box, Dropbox or file sharing outside Microsoft 365 matter to you, Check Point covers more of them today.

On Google Workspace the gap is similar. Check Point protects Gmail and, with Email & Collaboration coverage, Google Drive in the same console as any Microsoft 365 tenants you run. IRONSCALES protects Gmail mailboxes and its report button works for Gmail users, but its account takeover protection and Teams add-ons are aimed at Microsoft accounts. Our Google Workspace email security guide covers what Google includes before you add either.

If collaboration apps are a minor concern, this difference matters less, and the comparison turns on how each handles phishing and what you want around it.

Phishing, BEC and account takeover

Both platforms are designed to catch what Microsoft's or Google's filtering lets through, including BEC attacks that carry no link or attachment.

• IRONSCALES analyses behaviour at mailbox level, continuously learning normal mail patterns, and detects lookalike domains, image-based and QR code phishing and VIP impersonation. Its distinctive feature is the loop between people and the platform: staff report suspicious mail with one click, reports and detections are clustered, and a confirmed threat is removed from every mailbox at once. Dynamic banners warn users in plain language.
• Check Point Email Security inspects messages, links and attachments, with URL emulation, sandboxing of unknown files and CDR, which delivers a cleaned copy of a document with risky active content removed. Inline prevention means suspicious mail can be held before the user sees it, and Detect & Remediate removes it after delivery on Microsoft 365.

Both include or offer account takeover protection; the IRONSCALES version covers Microsoft user accounts. Our email account takeover guide explains the signs and first steps whichever product you use, and phishing protection covers the wider set of controls.

Managed services and how much work each needs

For a small IT team, the day-to-day effort can matter as much as detection.

• IRONSCALES leans on automation: agentic AI remediates threats from detections and user reports, with thresholds and workflows you can tune. The Email Incident Management Service, included in Email Protect Pro, has IRONSCALES analysts investigate, remediate and tune on your behalf.
• Check Point offers Incident Response as a Service, an add-on in which Check Point analysts handle users' phishing reports and requests to release quarantined mail. Unified Quarantine shows mail held by Microsoft and by Check Point in one place.

These are vendor services, delivered by IRONSCALES or Check Point. We help you choose whether you need one, set it up and handle the licensing.

Running one, not both

Because both products do the same job in the same place, we rarely recommend running them on the same mailboxes: two API platforms acting on the same messages adds overlap and makes it harder to see which one did what. The usual approach is to trial the one that fits best, or both on separate groups, in monitor mode, and then commit.

Switching from one to the other is usually straightforward, since neither changes mail flow. Connect the new product, run it alongside for a short period, then disconnect the old one and remove its add-ins and banners. If you used the outgoing product's DMARC service or archive, plan those moves first.

If you also run a gateway, either product can work behind it. Our IRONSCALES vs Proofpoint page covers running an API layer behind a gateway.

How we help you choose

Forever Systems supplies both IRONSCALES and Check Point Email Security, so we can be impartial about which suits you. We can:

1. Look at your mail platform, the collaboration apps your staff use and what is reaching inboxes today
2. Shortlist the plan and coverage on each side, including add-ons you would otherwise buy separately, such as DMARC or archiving
3. Arrange a trial on your own mail, without changing mail flow
4. Recommend one, with the plan, add-ons and terms confirmed at quote
5. Connect it to your tenant, tune banners, policies and remediation, and roll out user reporting

For more depth on either side, read Check Point Email Security on our Check Point site and IRONSCALES on cloud-security.cloud, or compare every platform we supply on our email security platforms hub. Contact us to arrange a comparison on your own mail.