AegisAI Perspectives · 072
Compare where each approach sits in mail flow, what each one sees and misses, and what running a gateway and an API layer together costs in Microsoft 365.
A secure email gateway sits in the mail path, because the domain's MX record points to it, and filters mail before delivery1. AI-native email security reads mail through the Microsoft 365 or Google Workspace API after delivery6. AegisAI works the second way and investigates every inbound email for what it is trying to do20. The criteria below come from Microsoft and Google documentation and name no vendor.
A secure email gateway is a filtering service that receives your mail first. In Exchange Online the setup rule is direct: "Your domain's MX record must point to your third-party service provider". The gateway scans each message in transit, then relays the clean ones on to Microsoft 365 through a connector.
Google Workspace works the same way. An admin enters the gateway's IP address or range in the Inbound gateway setting so Gmail knows which hop to trust12.
That position changes what Microsoft 365 sees. With a service in front, each message reaches Microsoft 365 from a different source IP address4. Microsoft's own filters then see the gateway as the sender unless you tell them otherwise.
Question to ask a vendor: which DNS and connector changes does your product need, and who owns them after go live?
AI-native email security connects to the mailbox platform instead of the MX record. Microsoft documents this model: some non-Microsoft services "use the Microsoft Graph API to scan messages after they're delivered to user mailboxes". Nothing in DNS changes, and mail keeps its original route.
Because it reads the mailbox, an API layer judges more than the message headers. It can compare a request with the thread it sits in and with what this sender has asked for before. This matters when authentication passes: Microsoft notes that impersonation can pass email authentication when the attacker registers a lookalike domain with valid DNS records15.
Microsoft says Graph integration commonly requires granting the outside service full access to mailboxes7.
Question to ask a vendor: which Graph or Gmail permissions does the product request, and which of them can it act with on its own?
The key architectural differences are position and timing. A SEG decides once in transit, while an API layer decides inside the mailbox, both before the user opens a message and after. The table sets out the criteria by approach. Built-in platform controls are the third column because every Microsoft 365 and Google Workspace tenant already has them.
| Criterion | Secure email gateway | API-based, AI-native | Built-in platform controls |
|---|---|---|---|
| Where it sits | In the mail path, MX record points to it | Outside the mail path, reads the mailbox through the API | Inside Microsoft 365 or Gmail |
| When it decides | Once, before delivery | After delivery, and again when evidence changes | At delivery, with ZAP after delivery for 48 hours9 |
| Internal mail between employees | Not routed through the MX record | Visible in the mailbox | Safe Links can scan internal mail13 |
| Sender IP that Microsoft 365 sees | Changes to the gateway's IP | Unchanged | Unchanged |
| Access it needs | Connector and DNS control | Mailbox access granted by an admin | None beyond the license |
| Removal after delivery | No reach into the mailbox | Pulls a message from every mailbox it reached | ZAP acts on messages already in a mailbox10 |
A gateway is strongest on the first row of the table, and an API layer on the last two.
Each approach has a blind spot, and Microsoft states the general rule: "total protection never reaches 100 percent"8.
A gateway misses mail it never handles. Messages sent between employees inside one Exchange Online organization stay inside Microsoft 365, which is why Safe Links has its own setting for internal senders. A compromised internal account therefore writes to colleagues without crossing the gateway. A gateway also cannot change its verdict once a message is delivered.
An API layer misses the moment before delivery. It reads a message after it lands, so a user can see the email in the seconds before removal. It also depends on the platform: if the API connection fails, its detection stops while mail keeps flowing.
In Microsoft 365, ZAP's search covers only the last 48 hours of delivered email. A message that turns bad after that window stays in the inbox unless something else removes it.
Question to ask a vendor: show me one message your product missed last quarter, and the reason it missed it.
Running a gateway and an API layer together costs mail flow work in Exchange Online, and Microsoft documents each step.
Point the MX record at the gateway and add a connector from it to Exchange Online.
Turn on Enhanced Filtering for Connectors, which "is intended for scenarios where the MX record for the domain doesn't point to Microsoft 365"5.
Skip that step and Microsoft warns that inbound mail gets misclassified2.
Without it, mail from every internet sender appears to originate from the gateway3, so sender signals flatten.
Check authentication: services that modify messages in transit break SPF and DKIM checks, and DMARC with them16. SPF fails because the message has a new source IP17.
Pick one link rewriter. Another service that wraps links first might stop Safe Links from processing them14.
The API layer adds one cost of its own: full access to mailboxes for the outside service7, which your identity team must approve and review.
A secure email gateway still makes sense when you must stop mail before it reaches any mailbox. That is the one thing an API layer cannot do, because it reads mail after delivery.
A policy may require that certain mail never lands, such as attachments from a blocked file type. An organization may route several mail systems through one control point. Or a team may already own a gateway with tuned rules that catch volume spam well.
The case is weaker for business email compromise. These messages often carry no link or file. IC3 logged business email compromise losses of $3,046,598,558 in 202518, and businesses reported losses over $30 million to BEC scams involving AI19. A rule that looks for bad attachments has nothing to match in a plain text payment request.
Question to ask a vendor: which of your detections need to sit before delivery, and which would work the same from the mailbox?
For compliance and audit readiness, ask each approach what record it leaves of a decision, and who approved any action. Neither architecture is compliant by itself; the evidence it keeps is what an auditor reads.
A gateway keeps a log of messages it blocked or released in transit. An API layer keeps the verdict and the removal against a mailbox. Microsoft's own automated investigation queues remediation actions "for SecOps personnel to approve"11, which gives an approval trail.
Question to ask a vendor: export one verdict with its reason and the person or rule that approved the action.
Evaluate email security for your organization by running the candidate on your own tenant and checking these items. Answer each yes or no.
Illustrative example, figures are fictional. A 900 person company runs a gateway in front of Microsoft 365. Over 30 days it adds an API layer in monitoring mode. The API layer flags 14 messages the gateway delivered: 9 internal messages from one compromised account and 5 payment requests from a lookalike vendor domain that passed DMARC. None of the 14 crossed the gateway in a way it could judge again. The team keeps the gateway for attachment policy and lets the API layer handle removal.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing21. It works with an existing gateway or Defender22. It runs in monitoring mode first, and removal needs write access the admin grants and can revoke25. When a message fails, it is pulled from every inbox it reached, forwards included23. Every verdict comes with its reason in plain language, so the team can check it and share it24.
Run the API layer in monitoring mode beside the gateway on your own tenant, then track three numbers.
For the migration plan itself, read how to replace a secure email gateway without breaking mail flow. For the detection gaps in more depth, read why a secure email gateway still misses phishing.
A gateway sits in the mail path through the MX record and filters mail once before delivery. AI-native email security reads the mailbox through the Microsoft 365 or Google Workspace API after delivery. The gateway can block before anyone sees a message. The API layer sees internal mail and can remove a message later.
Yes, on Microsoft 365 or Google Workspace the platform's own filters still run at delivery, and the API layer reads mail after it lands. Some teams keep a gateway for policies that must act before delivery. Run both side by side and compare what each caught before deciding.
Not by default: Microsoft 365 filters mail at delivery and ZAP removes some messages for 48 hours afterwards. A gateway adds a control point before delivery, at the cost of connector work and Enhanced Filtering for Connectors. Keep it if a policy needs mail stopped before any mailbox receives it.
No, because it is not in the mail path. It reads messages after Microsoft 365 or Gmail delivers them, so routing and delivery time stay as they were. The trade is a short window after delivery in which a user can see a message before the API layer removes it.
Microsoft says these Graph integrations commonly require full access to mailboxes. Ask the vendor for the exact permission list. Check that read and write access are separate grants an admin can revoke. Record the grant in your access review.
