Enterprise Email Security

Forrester renamed this category in 2025, from Enterprise Email Security to Email, Messaging, And Collaboration Security Solutions, two years after reviving the scorecard from roughly a decade of dormancy. The final edition under the old name is The Forrester Wave: Enterprise Email Security, Q2 2023, and that edition carries the full treatment here.

No newer edition will ever carry the old name.

The scorecard that woke up to a rebuilt market

Forrester let this evaluation sleep for about a decade, and the market rebuilt itself while it slept. Mass migration to cloud email, the rise of cloud-native API-enabled email security, the CAPES category, and a wave of acquisitions all happened in the gap. When the scorecard woke up in 2023, the vendors on the Leader rung were not the vendors who had been there a decade earlier.

Principal analyst Jess Burn announced the revival on June 13, 2023, with a companion Landscape that profiled thirty four players in the broader market.

The final edition under this name: The Forrester Wave: Enterprise Email Security, Q2 2023

The Q2 2023 Wave evaluated fifteen vendors against twenty six criteria, and interviewed thirty seven customer references: Abnormal Security, Barracuda Networks, Broadcom, Check Point, Cisco, Cloudflare, Fortinet, Fortra, Google, Microsoft, Mimecast, Proofpoint, Sophos, Tessian, and Trend Micro.

Four vendors have publicly surfaced Leader placements: Cloudflare, Check Point, Microsoft, and Proofpoint. The remaining eleven placements have not been announced in full, and this article assigns no tiers the public record does not support.

Burn's own summary of the moment: "The emergence of a new email security vendor category (CAPES) and the rush of legacy players to remain competitive means that customers have more choice than ever."

The market that stopped being monogamous

The sharpest statistic in this edition is not a score. Of the thirty seven customer references Forrester interviewed, two ran a single email security vendor. Two.

Email security became a plural decision. The drivers, per the report, were "peace of mind (primarily) and greater total efficacy." Peace of mind first, measurable efficacy second. That ordering is the whole buying psychology of this market, and every buyer question that follows should be read in its light.

Customers blend deliberately: one vendor for outbound protection, encryption, and DLP, another for stronger content analysis. The money at stake explains the caution. The FBI counted 2.4 billion dollars in business email compromise losses in 2021 alone, and cyber insurer Corvus found fraudulent funds transfer claims surpassed ransomware claims for the first time in late 2022, at twenty eight percent of cyber incident claims.

The leaders the acquisitions built

Two of the 2023 Leaders entered the email security market through CAPES acquisitions, and Burn says so outright. The acquisitions did not join the market. The acquisitions became the market.

Cloudflare took a Leader placement in its first appearance, on the back of its Area 1 Security acquisition, tying for the top Strategy score with the highest possible scores in vision, innovation, antimalware and sandboxing, email filtering, and malicious email detection.

Check Point, a Leader for Harmony Email and Collaboration, bought CAPES vendor Avanan in 2021 and was the only vendor offering an in-line CAPES deployment for both Microsoft 365 and Google Workspace, plus protection for Teams, SharePoint, Slack, and Dropbox.

Microsoft rounded out the announced Leaders with maximum scores in incident response, threat intelligence, EDR and XDR integration, and product vision and roadmap, on the strength of Defender for Office 365.

The pattern is the finding. The top of the 2023 scorecard was built by acquirers, not organic incumbents. In a market this dangerous, buying the capability counted as having it.

The frontier the old name could not contain

The report's third finding was a warning shot at its own title. Burn wrote that messaging, file sharing, and SaaS apps extend the attack surface, and the stakes are direct: "one successful phish of a supply chain partner's credentials opens your organization up to data loss, credential theft, fraud, and ransomware attacks."

At evaluation time, few vendors covered Teams, SharePoint, Slack, and Dropbox at depth, though many promised the capability within twenty four months. The old name described the channel. The market had already outgrown the channel.

Every vendor promised collaboration coverage within twenty four months. The next scorecard simply made the promise the name.

The name it took next

Where the market went is documented in the successor evaluation, The Forrester Wave: Email, Messaging, And Collaboration Security Solutions, Q2 2025, which scored ten vendors against twenty seven criteria. The field shrank from fifteen to ten, shedding Fortra, Sophos, Tessian, Broadcom, Cisco, and Fortinet while adding Darktrace.

The placements that surfaced publicly tell the continuation of the story. Proofpoint announced a Leader placement. Cloudflare, a 2023 Leader, announced a Strong Performer placement with maximum scores in nine criteria and a top-three Current Offering position. Mimecast announced a Strong Performer placement, one of only two vendors with the highest possible scores in both Vision and Roadmap.

The successor also recorded how normal layering became: sixty three percent of director-level security leaders now run two or more vendors, up from the thirty five of thirty seven references in 2023. And its AI guidance is pointed: natural language understanding and LLMs detect AI-generated phishing and BEC, but explainability is the condition. Context is key, not black boxes.

What to ask while the old scorecard still reads

Layer or consolidate, and on what evidence? The 2023 reference base layered for peace of mind. Ask each candidate which single gap it closes in your stack, with efficacy data from your own environment, not its marketing deck.

What does the collaboration coverage actually protect today? The 2023 promise became the 2025 title. Ask for live protection of Teams, SharePoint, Slack, and Dropbox in a proof of concept, not a roadmap slide, because the successor scorecard already scores it.

What does the AI explain? The successor's own guidance demands explainability. Ask to see the reasoning behind a caught BEC attempt in your environment, and reject any answer that sounds like a black box.

Forrester does not endorse any vendor named here, and tier placement should not be read as a recommendation to buy.

See also Secure Access Service Edge Solutions, where the most consequential vendor in this evaluation is the one that is not in it: Cisco failed Forrester's entry bar because its SASE products still run through separate management consoles rather than one unified platform.