Email Security vs. Defender vs. ITDR: Why MSPs Shouldn't Choose Just One

These days, Microsoft 365 identities are a top target for attackers. They know that once they gain control of a trusted identity, they can easily move through the environment, access sensitive data, impersonate users, and launch additional attacks.

And thanks to generative AI, email is now one of the easiest ways to target user accounts and steal credentials, sessions, and tokens at scale. That’s because traditional security controls that rely on familiar phishing patterns can’t keep up with the volume of variations AI makes possible.

At this point, the industry has accepted that it’s not a matter of if an attack will succeed, but when. MSPs can’t just focus on preventing business email compromise. They also have to account for what happens after a malicious message gets through.

That’s one of the reasons you’re seeing a surge of Identity Threat Detection and Response (ITDR) solutions hitting the market, including newcomers like Petra Security and longtime fan favorites like Blackpoint Cyber or SentinelOne. ITDR tools monitor identity activity for signs of compromise and help contain threats before an attacker can do more damage.

With Defender for Office 365 and ITDR in your stack, it’s easy to assume your clients don’t need additional email security protection.

And that’s music to attackers’ ears.

The Email Security Gap ITDR and Defender Can’t Fill

To be fair, when it comes to email security and protecting user identities, Defender and ITDR each play important roles.

Defender looks for phishing, malware, and malicious links. It can also support post-delivery investigation and remediation, depending on the client’s licensing.

ITDR watches the identity layer for signals that accounts, credentials, or sessions have been compromised. It then helps contain the threat before the attacker can move further through the environment, for example removing the compromised emails from a user’s inbox.

Together, that looks like complete coverage. But neither tool continuously monitors each email for changes that could turn a safe message into a threat.

Emails aren’t frozen in time. New intelligence can emerge, links can become malicious, trusted senders can become compromised.

For example, say an attacker gains control of a vendor’s Microsoft 365 account. They contact your client’s users from that legitimate account, but start making unusual requests, like sending updated invoices with new wire instructions or asking for sensitive information you’ve shared prior—or worse, shouldn’t need to share at all!

Defender may see a legitimate Microsoft 365 user. ITDR may eventually detect that the vendor’s account has been compromised. But with the average user clicking a malicious link 26 seconds after it reaches their inbox, MSPs can’t afford to wait for ITDR to do its job.

How Email Security, like Shield, Fills the Gap

Between the M365 mailbox and ITDR sits another important player: your email security tool.

Having an independent dedicated email security platform gives MSPs another set of detection methods, policies, and threat intelligence. It’s also often easier to use than M365 and Defender alone.

Shield is Mailprotector’s zero trust email security product for Microsoft 365. It doesn’t replace Defender or ITDR. It closes the gap between prevention and identity response.

In the compromised-vendor example above, Shield goes beyond just validating whether the message comes from a legitimate Microsoft 365 account. It also evaluates whether the communication is trusted, wanted, and consistent with the established email relationship between sender and recipient.

If a new request for payment or sensitive information seems off, for example, it comes from a different country, Shield can keep the message out of the primary inbox or present it with additional context via the Heads Up Display so the user doesn’t default to paying the “updated invoice.” And depending on the customized security levels you set – it likely won’t make it to the inbox at all!

Shield makes this possible by combining a pre-delivery gateway with patented mailbox-level API integration. The gateway evaluates messages before Microsoft 365 accepts them. The API continuously tracks and acts on messages inside the mailbox, while user trust and silence decisions help Shield understand what each unique recipient actually expects from a sender.

Because both parts share context, Shield doesn’t treat each decision as a separate event. What it learns at the gateway, inside the mailbox, and from user behavior informs what happens next.

Do You Really Need Another Security Tool Touching Email?

Microsoft Defender and ITDR both play important roles in the fight against identity compromise. Defender helps protect the Microsoft environment. ITDR helps identify suspicious identity activity and contain the threat.

But they weren’t designed to monitor the contents of the email itself, how the message’s risk level changes over time, or how users interact with each sender. Not to mention they also can’t always stop threats before they even land in the inbox.

In today’s world of AI-driven attacks, those are gaps you can’t afford to leave exposed. Gone are the days of phishing emails riddled with grammar errors or obvious tells. This is why a multi-layered security approach is crucial for modern MSPs.

The strongest security stack isn’t about choosing between email, identity, and Microsoft security. It’s about making sure there’s no gap between them.

Want to explore email security topics on a deeper level? Check out HELO, world, the Mailprotector engineering blog, for technical deep dives and a look behind our products.

Technical deep dives at The Mailprotector Engineering Blog Read the blog mailprotector.engineering