AegisAI Perspectives · 059
Choose email security for a lean IT team with no SOC by the work it removes: who approves removal, how many alerts reach you, and if it explains itself.
Choose email security for a lean IT team with no SOC by how much work it removes, not how many alerts it raises. Business email compromise drew $3,046,598,558 in reported losses in 202512. AegisAI investigates every inbound email for what it is trying to do, and this page turns that job into criteria you can test on any product.
The first question is who presses the button. A lean team has no one watching a console at 2 AM, so a tool that only recommends removal leaves the email in the inbox until someone logs in.
Microsoft states the default plainly. When automated investigation and response (AIR) identifies threats, it queues remediation actions for SecOps personnel to approve1. It approves its own actions for malicious similarity clusters, such as malicious URL and file clusters.
Ask the vendor: which verdicts remove mail with no human approval, and can I set that per threat type?
Every alert a product raises is work for your team. Microsoft's own guidance says it is up to the security operations team to review each alert and respond to it3. With no SOC, that team is one or two administrators.
One widely cited small business ranking gives management overhead, how much the tool runs on its own, only 10% of its score14. For a team with no analysts, weight it far higher.
Ask the vendor: in a trial on my tenant, how many items per week needed a person, and why?
A verdict you cannot read is a verdict you cannot defend. When one administrator releases or removes a message, they need the reason in words they can forward to the user or the finance lead.
Look for a summary of what the email asked for, the warning signs found and a recommended next step. A score with no explanation sends you back to header analysis, which is the work you wanted to remove.
Ask the vendor: show me five verdicts from my own mail, with the reason as the user would see it.
Start from what you already pay for. The built-in security in every cloud mailbox prevents broad, volume-based, known email attacks5. Defender for Office 365 Plan 1 comes with some small and medium business plans, for example Microsoft 365 Business Premium.
Automation sits higher up. Plan 2 adds post-breach investigation, hunting, response and automation7, and that is the plan that includes AIR2. The deeper Microsoft 365 view is in how to choose email security for Microsoft 365.
Ask yourself: which features are on in my tenant today, and who acts on what they find?
Google Workspace teams need the same answer for a different console. In the security investigation tool, an admin can delete messages, mark them as phishing, or send them to quarantine8.
That tool is listed for Enterprise, Education, Frontline and a few other editions, not for every plan9. If your edition lacks it, removal after delivery depends on the product you add. The full Workspace view is in how to choose the best email security for Google Workspace.
Ask the vendor: on my edition, how is one message removed from every mailbox, and who does it?
An API product reads mail with access an admin grants. In Google Workspace that is domain-wide delegation, which lets a super admin grant an app permission to access users' data10. Google advises deleting clients you no longer need.
Treat read access and write access as two decisions. A product can run read-only first, and you add the right to remove mail once its verdicts hold up.
Ask the vendor: which scopes do you need to monitor mail? Which do you need to remove it, and how do I revoke each one?
Phishing campaigns rarely arrive as one message. The product should find every copy, forwards included. It should then pull them all in one action, not one ticket per user report.
If you already run a triage queue, the steps in how to reduce SOC time spent on phishing triage show how to group reports into one incident. The choice here is simpler: does the product do that grouping for you?
Ask the vendor: when ten people get the same lure, how many incidents does my team see?
Each approach meets these criteria in a different way. The table compares approaches, not products.
| Criterion | API-based | Gateway (SEG) | Built-in platform controls | Managed service |
|---|---|---|---|---|
| Who approves removal | Set by policy, can run with no approval | Blocks before delivery; after delivery depends on add-ons | Microsoft AIR queues actions for approval, apart from some clusters | The provider's analysts |
| Alerts that reach your team | Only cases the product cannot decide | Quarantine reviews and release requests | Alerts for the security operations team | Escalations from the provider |
| Reason for each verdict | Depends on the product; ask for plain language | Usually a rule or score | Alert details in the admin portal | The analyst's write-up |
| Mail routing change | None, reads through the API | MX record change | None | Depends on the tools it runs |
| Removal from every mailbox | Through the API with write access | Limited once delivered | Investigation tool on supported editions | Done by the provider |
| Access to revoke | API grant | Mail flow and connectors | Already part of the platform | Accounts and grants you give |
For a deeper look at the API model, read how to evaluate API based email security.
Run the checks on a trial in your own tenant, not on a vendor demo.
Does it remove clear phishing with no human approval?
Can you choose which threat types need approval?
Did fewer than ten items a week need a person during the trial?
Does every verdict give a reason a user can read?
Can one admin release a wrong verdict in under a minute?
Does it pull every copy of a campaign, forwards included?
Does it work on your Microsoft 365 plan or Google Workspace edition as licensed today?
Can it run read-only before you grant removal rights?
Can you revoke its access from your own admin console?
Does it work without an MX record change?
Is there nothing to write or tune as attacks change?
Can you export a verdict and its reason for an auditor the same day?
Illustrative example, figures are fictional. Ridgeway Freight (fictional) has 180 staff on Microsoft 365 Business Premium and two IT generalists. On a Monday, 14 staff receive the same fake invoice link. Before the trial, the IT lead spent about 3 hours each Monday on user reports. During the trial, the product removes all 14 copies, including 2 forwards, within a minute of delivery and logs one incident. The IT lead reads the reason, "login page on a domain registered yesterday", and closes it in 4 minutes. Over two weeks, 6 items needed a person.
A lean IT team with no SOC is a group of generalists who run email security alongside help desk, devices and accounts, with no one assigned to watch alerts full time. Microsoft's guidance hands alert review to a security operations team. On a lean team, that is whoever is free.
The test is simple. If an alert raised at 6 PM on Friday waits until Monday, you have no SOC for email, whatever the org chart says.
For most lean teams on Microsoft 365 or Google Workspace, API-based email security fits better because it reads mail after delivery with no mail routing change15. A gateway sits in the mail path and filters before delivery, so moving to one means changing MX records.
The deciding question is what happens after delivery. A message that looked clean at 9 AM and turns malicious at 11 AM needs removal, and that is where approval queues cost a lean team the most.
Weight the criteria by the hours they save your team. Detection quality still matters, but one ranking gives threat detection 25% of its score and management overhead 10%. For a team with no analysts, those weights belong closer together.
Score removal without approval and alerts per week first. Readable reasons and revocable access come next. Then compare detection on your own mail, not on vendor figures.
Automate the removal of clear phishing first, then the handling of user reports.
Microsoft's AIR already approves its own removals for malicious URL and file clusters, so check which of your alerts fall outside that. The page on how autonomous email threat response reduces SOC workload covers what an analyst still owns once that is in place.
Keep a record of every verdict with its reason and the action taken, and make sure you can export it. That record is the evidence you hand an auditor or insurer after an email incident.
In Microsoft 365, AIR requires audit logging to be turned on, which it is by default20. Whatever product you choose, ask where its verdict log lives, how long it is kept and who can export it.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing15. It runs in monitoring mode first, and removal needs write access your admin grants and can revoke. Every verdict comes with its reason in plain language, so your team can check it and share it. One bad email is pulled from every inbox it reached, forwards included. There is nothing to write or maintain as attacks change.
Track three numbers from the first day of a trial.
You can run that trial on your own tenant through the demo page, after reading the inbound email security page.
The best fit is a product that removes clear threats with no human approval, explains every verdict in plain words and leaves only a short weekly queue. Test it in your own tenant and count the items that needed a person.
It stops broad, known attacks. Automated investigation sits in Defender for Office 365 Plan 2 and queues removals for approval, apart from some clusters, so a team with no SOC needs someone on that queue or a product that acts on its own.
It depends on your edition. The security investigation tool, which can delete or quarantine delivered messages, is listed for Enterprise, Education, Frontline and a few other editions. On other editions, removal after delivery depends on what you add.
It needs read access to monitor and write access to remove mail. Grant them as two steps, and keep the right to revoke both from your own admin console.
It costs real money and arrives as ordinary mail. The FBI logged 24,768 business email compromise complaints in 2025, out of 1,008,597 complaints and $20.877 billion in reported losses overall.
