In short: IRONSCALES is an API-based email security platform for Microsoft 365 and Google Workspace. It connects without an MX change, uses AI and reports from its user community to detect phishing, business email compromise and account takeover, and removes malicious messages from every affected mailbox automatically. Plans add encryption, DLP, account takeover protection and awareness modules.
What IRONSCALES is
IRONSCALES is an email security platform built around the mailbox. Instead of filtering mail before it reaches Microsoft or Google, it connects to your tenant by API and works alongside the built-in protection, focusing on the messages that get past it: targeted phishing, impersonation and business email compromise.
It is designed to reduce the work of handling suspicious email as much as to detect it. When a message is found to be malicious, whether by the platform itself or because a user reported it, IRONSCALES can remove every copy from every mailbox in the organisation, rather than leaving an administrator to search and delete by hand.
How it works
Deployment is an API connection with no change to MX records or mail flow:
- Mailbox-level behaviour analysis: IRONSCALES builds a baseline for each mailbox, such as who normally writes to whom and how, and flags messages that do not fit, including payload-free BEC
- Crowdsourced threat intelligence: reports and verdicts from the organisations using IRONSCALES feed back into detection for everyone
- Automatic remediation: malicious messages are clawed back from all affected inboxes, with options to customise what happens automatically
- User reporting and banners: an Outlook Report Phishing add-in and alert banners in email help users judge borderline messages and report them
- Link and file scanning: URLs are scanned in every plan, with advanced URL scanning and malicious attachment scanning from Email Protect upwards
Because it works after Microsoft's or Google's filtering, it complements Microsoft Defender for Office 365 or an existing gateway rather than replacing them.
Plans and modules
IRONSCALES sells its protection in plans that build on each other, plus add-on modules. Plan names and contents change, so we confirm the current line-up when we quote.
| Plan | What it adds |
|---|---|
| Email Essentials | AI detection of phishing, BEC and VIP impersonation, autonomous remediation, alert banners, the Report Phishing add-in, crowdsourced threat intelligence, basic spam and graymail filtering and URL scanning |
| Email Protect | Email Essentials plus advanced spam and graymail filtering, advanced URL scanning, malicious attachment scanning and customisable remediation |
| Email Protect 360 | Email Protect plus email encryption and email DLP |
| Email Protect Pro | Email Protect plus encryption and DLP, centralised threat analysis, account takeover protection and the Email Incident Management Service |
| Complete Protect | Email Protect plus account takeover protection, integrated security awareness training and phishing simulation testing |
Modules available on top include account takeover protection, email encryption and DLP, DMARC management and monitoring, Microsoft Teams protection, deepfake meeting protection and the Email Incident Management Service. A separate Human Risk Management plan covers security awareness training and phishing simulation. For DMARC options more widely, see our DMARC guide; for staff training, see security awareness training.
Who it suits
IRONSCALES suits organisations on Microsoft 365 or Google Workspace that:
- Are targeted by invoice fraud, supplier impersonation or credential phishing that the built-in filter misses
- Want a quick deployment without touching MX records or mail flow
- Spend too much time investigating user-reported phishing and want it handled automatically
- Already have a gateway and want a mailbox-level layer behind it
It is less of a fit if your main requirement is email continuity or a compliance archive, which gateways such as Proofpoint Essentials provide, or if you want one platform covering Slack and file-sharing apps too, where Defender for Office 365 vs Harmony Email & Collaboration is a better starting point.
How IRONSCALES compares
| IRONSCALES | Secure email gateway | Defender for Office 365 | |
|---|---|---|---|
| Deployment | API, no MX change | MX change | Built into Microsoft 365 |
| Inspects internal mail | Yes | Usually not | Yes |
| Removes messages after delivery | Yes, across all mailboxes automatically | Varies | Zero-hour auto purge; manual or automated remediation in Plan 2 |
| Google Workspace | Yes | Yes | No |
| Continuity and archive | No | Often | Archiving through Microsoft licences |
The products are not mutually exclusive: IRONSCALES is often added behind Defender for Office 365 or a gateway. Compare more options on our email security hub.
How we help
We connect IRONSCALES to your tenant, agree with you which actions run automatically and which need approval, roll out the Report Phishing add-in, and tune banners so they help rather than annoy. We also review your Microsoft or Google settings so the two layers work together. Pricing depends on the plan and user count: ask us for a quote.
Contact us to discuss IRONSCALES.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does IRONSCALES need an MX record change?
No. IRONSCALES connects to Microsoft 365 or Google Workspace by API at the mailbox level, so mail flow and MX records stay as they are. It works after the built-in filtering and alongside any gateway you already have.
Does IRONSCALES work with Google Workspace?
Yes. IRONSCALES supports both Microsoft 365 and Google Workspace mailboxes.
Does IRONSCALES replace Microsoft Defender for Office 365?
It is designed to work alongside Microsoft's protection rather than replace it. Many organisations keep Exchange Online Protection or Defender for Office 365 and add IRONSCALES to catch targeted phishing and BEC and to automate the handling of reported messages.
Can IRONSCALES manage DMARC?
Yes. IRONSCALES lists DMARC management and monitoring as an add-on module, which helps you move your domain to an enforced DMARC policy.
How is IRONSCALES licensed?
By plan, from Email Essentials up to Complete Protect, scaled to the number of users, with optional modules such as account takeover protection, encryption and DLP, DMARC and Teams protection. Ask us for a quote.
What is the difference between IRONSCALES Email Protect and Complete Protect?
Email Protect adds advanced spam, URL and attachment scanning and customisable remediation to Email Essentials. Complete Protect takes Email Protect and adds account takeover protection, integrated security awareness training and phishing simulation testing.