AegisAI Perspectives · 105
A gateway replacement business case sets the gateway's licence, analyst hours, outage exposure and risk against a parallel run, with a rollback threshold.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Build the case in seven lines: price the gateway today, measure the same lines in a parallel run, and fix a rollback threshold. AegisAI makes no change to mail routing12, and mail keeps flowing if the service stops. Fill the one-page template below from your own records.
The ticket system, the helpdesk, the quarantine release log and the FBI's IC3 report cover most of them.
Measure three baselines first. Take weekly analyst hours on email triage and false positive complaints from the ticket system, then count messages users reported after the gateway delivered them. Record all three before the trial starts, so the parallel run has a fixed starting point.
Open a shared sheet with the seven lines as rows before you collect a single number.
Short on time? Watch the explainer, or book a demo.
Take the licence from your own contract and renewal quote, since none of the neutral pages read for this article publishes per-user gateway prices. Count analyst hours spent triaging gateway quarantine and user-reported phishing, and hours spent writing and testing rules.
AegisAI's migration guide also tells you to add the cost of change control17. Count last year's routing and rule change tickets for that line.
Microsoft says there is no charge for the integration that passes a non-Microsoft vendor's verdict data to Defender for Office 3654. Enter that integration as a zero line.
Pull the last full quarter of ticket and change records before you write a single cost figure.
Price it from your own incident history. A gateway sits in the mail path because the domain's MX record must point to the third-party provider5. Microsoft's setup also tells you to lock down Exchange Online to accept mail only from that service.
Count the hours of gateway incidents in your own records, multiply by inbound messages per hour, and name the business processes that stopped. Ask every candidate the questions in what happens to my mail flow if you go down before the trial.
Write the outage line in hours and delayed messages, each taken from your own logs.
Put two risks in the case: fraud losses and the cost of layering a product on top of the gateway. For fraud, the FBI's IC3 recorded 24,768 business email compromise complaints in 2025, up from 21,442 in 202411. Reported BEC losses were $3,046,598,558 in 2025, against $2,770,151,146 in 2024. Label them as national losses reported to IC3, separate from any gateway number.
Microsoft notes that the rate of false positives increases as more products are added1. In-and-out routing through a second service counts messages twice in most reporting tools, including Threat Explorer and Advanced Hunting. And no number of layers reaches 100 percent protection.
Show in the risk section which layer the case removes, so the false positive line goes down.
Copy these seven lines onto one page; each line says what to fill in and where its number comes from.
Enter the licence per year, analyst hours a week on triage and rules, and change control tickets a year; source: the contract and renewal quote, plus the ticket system and change records.
Enter weekly analyst hours on email triage, false positive complaints a week and user-reported messages the gateway delivered; source: the ticket system, plus the helpdesk and quarantine release log.
Multiply gateway incident hours a year by inbound messages per hour, and note that the MX record points to the gateway; source: incident records and mail flow reports.
Enter $3,046,598,558 in reported 2025 BEC losses across 24,768 complaints, labelled as national figures; source: the FBI IC3 2025 report.
Count products in the mail path before and after, since false positives rise with each one added and in-and-out routing double counts messages; source: the mail flow diagram and Threat Explorer.
Enter Line 2's three numbers again, measured on live mail in monitoring mode15; source: the new layer's verdict log and the helpdesk.
Enter the Line 6 value that sends you back to the gateway, and the decision date; source: Lines 2 and 6 of this page.
Send the filled page to finance and security together, so both teams sign the same seven numbers.
Score the current gateway and any candidate on the rows the business case uses.
| Criterion | Legacy gateway in the MX path | AegisAI |
|---|---|---|
| Mail routing | The MX record points to the gateway | No change to mail routing |
| If the service stops | Microsoft's setup locks Exchange Online to accept mail only from it | Mail keeps flowing, detection pauses |
| Trial on live mail | Needs the MX record to point to it first | Monitoring mode on a connected tenant |
| A pilot that goes badly | Mail runs through it once MX points to it | Zero effect on mail delivery16 |
| Filtering before delivery | Yes, the MX record sends mail to it first | No edge. It sits outside the mail path |
| Total protection | Never reaches 100 percent | No edge. No layer reaches 100 percent |
The last two rows give the gateway the edge or a tie, because mail reaches it first and no layer reaches 100 percent. The wider design comparison is in secure email gateway or AI-native email security. Score your current gateway on all six rows before the renewal meeting.
AegisAI runs alongside your gateway or Defender, and many teams use it to retire a gateway14. A pilot that goes badly has zero effect on mail delivery, because nothing about routing changed. Detection pauses until the service returns. Connect a tenant, run it in monitoring mode, and compare it with what your current stack delivered.
Illustrative example, figures are fictional: Westfield Logistics (fictional) has 1,800 mailboxes and a gateway renewal due in 90 days. Line 1 shows a licence of $86,000 a year, 12 analyst hours a week on triage and rules, and 14 change tickets a year. Line 2 records 11 false positive complaints a week before the trial. Line 3 shows 2 gateway incidents that lasted 5 hours in total last year. Line 4 carries the IC3 figure of $3,046,598,558 in 2025 BEC losses, labelled as national. Line 6 shows that over a 30-day parallel run the post-delivery layer flagged 23 messages the gateway delivered, and complaints fell from 11 to 4 a week. Line 7 sets rollback at more than 11 complaints a week, the Line 2 baseline.
Copy this structure and replace every fictional figure with one from your own records.
Track three numbers during the parallel run, each in a system you already run.
Put the three weekly figures into Line 6 of the template on day 30 and take the decision on them.
Set the gateway's current cost and risk against the same numbers measured in a parallel run, then fix a rollback threshold. Fill the seven-line template on this page, with fraud losses from the FBI's IC3 report.
Take the licence from your contract and renewal quote. Take analyst hours from the ticket system and change control from your change records.
Use your own incident history: outage hours times inbound messages per hour, plus the processes that stopped. A gateway is in the mail path because the MX record points to it, and Microsoft's setup locks Exchange Online to accept mail only from it.
Price both options. Microsoft notes false positives increase as more products are added, and in-and-out routing counts messages twice in most reporting tools.
Use the FBI's IC3 figure: $3,046,598,558 in reported BEC losses in 2025, against $2,770,151,146 in 2024. Label it as reported national losses.
No. Microsoft's FAQ for the integration of non-Microsoft verdict data with Defender for Office 365 says there is no charge for the integration. List it in the cost section as a zero line.
