Email is still the number one way attackers get into an organization. In 2025, the FBI’s Internet Crime Complaint Center (IC3) logged more than $20.8 billion in reported losses, a 26% jump over the prior year, and business email compromise (BEC) alone accounted for roughly $3 billion of that total. For managed service providers (MSPs), those figures are more than an industry headline. When a client gets hit, the MSP is the one who has to explain what happened, clean up the damage, and answer the hard question of why the defenses did not hold.
The challenge in 2026 is that email threats have evolved faster than many of the tools meant to stop them. Attackers now use generative AI to write flawless phishing messages at scale, clone executives’ voices and faces for wire-fraud schemes, and slip past filters built for an earlier era. At the same time, MSPs are being targeted directly as a shortcut to their entire client base.
To protect customers, and themselves, MSPs need a secure email gateway they actually control: one that filters threats before they reach the mailbox, gives full visibility into what was blocked and why, scales cleanly across many clients, and can be branded and billed on the MSP’s own terms. That is exactly what SecurityGateway for Email Servers by MDaemon Technologies is built to do.
Why MSPs Are Prime Targets in 2026
MSPs occupy a uniquely dangerous position. A single provider may hold privileged access to dozens or hundreds of client networks, which turns one successful breach into a doorway to many. Attackers know this, and they plan around it.
Reported cybercrime losses climbed 26% in a single year, and business email compromise alone accounted for $3.05 billion of the 2025 total. (Source: FBI IC3 2025 Internet Crime Report)
The 2021 Kaseya VSA attack remains the textbook example: compromising a single remote management platform let attackers push ransomware to roughly 1,500 downstream businesses through about 60 MSPs. But this is not old news. Through 2025 and into 2026 the pattern has only accelerated. The DragonForce ransomware group breached an MSP through an unpatched remote management tool and used that foothold to reach its customers. In July 2025, technology distributor Ingram Micro was hit by SafePay ransomware. Ransomware crews including Qilin and Akira have continued to single out IT service providers heading into 2026.
The data backs up the anecdotes. In a 2026 survey of 350 MSP and MSSP leaders across the UK and Ireland, CyberSmart found that 75% had been breached at least once in the previous 12 months, 54% two or more times, and 32% three or more times. Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in breaches had doubled to 30%.
The reputational stakes are as real as the technical ones. Clients increasingly hold their provider responsible when something goes wrong. That makes email security not just another service line for MSPs, but a core part of protecting their own business.
What Is a Secure Email Gateway?
A secure email gateway (SEG) is a filtering layer that sits in front of your mail server and inspects every message, inbound and outbound, before it reaches or leaves the mail server. Think of it as a checkpoint: legitimate mail passes through, while spam, phishing, malware, and policy violations are stopped, quarantined, or flagged according to your rules.
A gateway protects against two directions of risk.
Protecting from External Email Threats
Most attacks arrive from outside. A capable gateway screens inbound mail for:
- Spam and phishing, using Bayesian filtering, DNS and URI block lists, greylisting, and anti-spoofing checks.
- Viruses and malware, using multiple scanning engines, plus detection of malicious QR codes (“quishing”) and dangerous Office macros.
- Spoofed and impersonated senders, using SPF, DKIM, DMARC, and ARC to verify that a message really came from where it claims.
- Data leak prevention (DLP) rules that catch sensitive information such as financial data or personal identifiers before it leaves.
- Content and policy enforcement on outbound mail.
- Encryption (TLS, RequireTLS, MTA-STS) so messages stay private in transit.
- Account-level protections such as hijacked-account detection and compromised-password warnings.
- Publish SPF, DKIM, and DMARC records.
- Keep spam complaint rates below 0.3%.
- Offer one-click unsubscribe on bulk mail.
- No real access to logs, so when a client asks why a message was blocked, or why one got through, you cannot give a clear answer.
- Manual license reconciliation every time a client adds or removes users.
- Little or no ability to brand the service as your own.
- Rigid deployment that forces client data into a location or model you would not have chosen.
Protecting from Internal Email Threats
Threats also move outward. A compromised account, a careless employee, or a malicious insider can leak data or send spam that lands your domain on a block list. Outbound and internal filtering adds:
How AI Is Changing Email Threats (and Email Defense)
The 2026 email threat landscape at a glance: email is still the top attack vector, AI now drives most phishing, and three in four MSPs surveyed were breached in the past year
The single biggest shift since this topic was last covered is artificial intelligence, and it cuts both ways.
On the attack side, generative AI has erased nearly every tell that used to give phishing away. The awkward grammar and clumsy formatting are gone. KnowBe4’s 2025 Phishing Threat Report found that 82.6% of analyzed phishing emails showed signs of AI use, a 53.5% increase year over year. Research from Hoxhunt tracked AI-generated phishing climbing sharply through 2025, reaching a majority of detected attacks in a single month by year’s end. And for the first time, the FBI tracked AI as a distinct factor in its 2025 IC3 report, tying it to $893 million in losses.
Deepfakes have raised the stakes further. In one widely reported case, an employee at engineering firm Arup was tricked into wiring roughly $25 million after joining a video call in which every other “participant,” including the CFO, was an AI-generated fake. This is BEC evolved: not just a spoofed email, but a convincing synthetic person.
The defense has to be just as smart. SecurityGateway now includes AI Email Classification, which lets administrators connect an AI model (OpenAI, Google Gemini, a custom endpoint, or a local model that keeps data entirely on-premises) and apply custom prompts to score and act on suspicious messages. For MSPs handling regulated client data, the local-model option matters: content can be analyzed for AI-era threats without sending anything to a third-party cloud.
SecurityGateway version 12 also added Display Name Protection, a multi-layered defense aimed squarely at the impersonation tactic behind most BEC. When an attacker sends mail using a trusted executive’s or vendor’s display name, Display Name Protection catches the mismatch before it reaches the target.
Email Authentication Is Now Mandatory (SPF, DKIM, DMARC, and BIMI)
Email authentication used to be a best practice. As of 2024 and 2025, it is effectively a requirement. Google and Yahoo began enforcing bulk-sender rules in February 2024, and Microsoft followed for Outlook, Hotmail, and Live addresses in May 2025. Collectively, these mailbox providers now expect senders to:
Enforcement has since hardened from “route it to junk” to outright rejection, so non-compliant mail increasingly bounces rather than landing in the spam folder.
For MSPs, this creates two jobs at once: making sure client mail is properly authenticated so it gets delivered, and rejecting inbound mail that fails authentication so spoofed messages never reach users. SecurityGateway handles both. It provides full SPF, DKIM, and DMARC verification and enforcement, and it supports ARC (Authenticated Received Chain) so that legitimate forwarded mail, through mailing lists for example, is not mistakenly rejected. That last detail is where many authentication setups break, and it is a meaningful advantage.
SEG vs. ICES and Zero Trust: Where a Modern Gateway Fits
You may have seen debate about whether the traditional gateway is being replaced by newer API-based tools, sometimes called Integrated Cloud Email Security (ICES), which analyze mail after delivery inside a cloud mailbox. It is a fair question, and the honest answer is more nuanced than “old versus new.”
The real difference is architectural, not a matter of which approach uses AI. Modern gateways, SecurityGateway included, use AI and machine learning too. What a gateway uniquely provides is pre-delivery control: it blocks threats before they ever reach the inbox, enforces policy at the SMTP level, and works in front of any mail platform, whether that is Microsoft 365, Microsoft Exchange, MDaemon, or any other SMTP server. API-only tools are typically tied to one or two cloud providers and act only after a message has already been delivered.
This also fits how security teams now think about email under a zero-trust model: never trust, always verify. Verifying a sender’s authentication, screening for impersonation, requiring encryption, and enforcing strong authentication on accounts all happen most effectively at the gateway, before a message is trusted enough to reach a person. SecurityGateway’s Dynamic Screening, account lockout, SMTP authentication enforcement, and support for WebAuthn passwordless sign-in all reinforce that posture.
For most MSPs, the practical answer is not either/or. A gateway delivers the pre-delivery control and cross-platform flexibility that cloud-native hygiene alone cannot.
Many Third-Party Solutions Aren’t Mitigating Threats
Plenty of MSPs already resell an email security product. The problem is that many of those products were built for a single organization, not for a provider managing many clients at once. That mismatch shows up as daily friction:
None of that is a filtering problem. It is a control problem. And control is exactly what an MSP needs in order to run email security as a profitable, scalable service rather than a support headache.
Why MSPs Choose SecurityGateway™ by MDaemon Technologies
SecurityGateway checks every message through five independent layers, from spam and phishing filtering through authentication, encryption, and access control, so only clean mail reaches the inbox.
SecurityGateway for Email Servers was designed with multi-tenant management in mind, which is why MSPs are switching to it to protect both their clients and their own margins. Here is what that control looks like in practice.
Multi-tenant, role-based administration. SecurityGateway supports three administrator roles: Global Administrators with full control, Domain Administrators who can manage only their assigned domains (and cannot see any other tenant’s settings), and Quarantine Administrators limited to the quarantine queue. You delegate as much or as little as you want, and automatic domain and user creation keeps onboarding nearly hands-free.
White-label branding. Set your own logo and branding on the login page and navigation, either globally across all clients or per individual domain, so each tenant sees a service that looks like yours.
Monthly per-user billing. Instead of large up-front license blocks, MSP and hosted licensing bills monthly per user, so your cost tracks your actual client base. Hosted pricing is marketed starting at $1 or less per user per month, scaling down as user counts grow. (Dedicated and larger MSP contracts are quoted individually.)
Full visibility. Detailed inbound and outbound logs, advanced filtering, quarantine reports, real-time charts, and a dedicated change log that records every configuration change and who made it. When a client asks a question, you have the answer.
Deployment on your terms. Run SecurityGateway on-premises, on your own virtual infrastructure, as a private cloud, on a dedicated virtual private server, or fully hosted by MDaemon Technologies. That flexibility also helps with data sovereignty and compliance obligations (GDPR, HIPAA, PCI DSS, and emerging rules such as the EU AI Act), because you decide where client data lives.
Modern, layered protection. All of this sits on top of the multi-layered filtering already described: AI Classification, Display Name Protection, multi-engine antivirus, QR-code and macro screening, full SPF, DKIM, DMARC, and ARC authentication, encryption, and outbound DLP.
One MDaemon MSP customer, a Canadian provider growing about 50% per year, moved off a third-party gateway that gave them no log access and required manual license reconciliation. After switching to the multi-tenant version of SecurityGateway, they cut administrative time and cost, gained the flexibility and control they had been missing, and reported 100% client approval.
Take Control of the Email Security You Deliver
Email threats are not slowing down, and neither is the pressure on MSPs to keep clients safe. SecurityGateway gives you the control, visibility, and flexibility to meet that pressure on your own terms.
Read the MSP case study to see what one provider achieved, explore SecurityGateway’s SaaS, private cloud, and virtual private server deployment options, or schedule a free demo today.
