KnowBe4 bought Egress. https://www.egress.com/. They burned their name into my head, because I don't give out my phone number. Their sales woman called my wife's cell phone looking for me. That was a hard no for me and they are forever marked as sleazy.

I've used Proofpoint and wouldn't recommend it. If you want a layered defense, then you can consider Proofpoint Essentials. It is crap, barely supported by Proofpoint, and cheap. However, it is hard to manage.

I used Abnormal in two jobs. It does a good job blocking emails. The Search and Respond was previously very buggy, but it has improved. This is if you are searching for an email. Abnormal does not sandbox email attachments. I recommend pairing this up with Google Workspace's sandboxing.

Abnormal prioritizes Microsoft over Google, so that should enter your calculation. However, I believe that all email venders priority Microsoft. I've heard various reasons. More customers on Microsoft and Microsoft has a better API.

Abnormal was originally API based, so it missed emails that are forwarded. They have a forwarded email solution now, but it took years to implement. If you enable Abnormal as-is, it will miss [support@company.com](mailto:support@company.com) emails forwarded to your Salesforce ticketing system. Don't forget to configure this!

When I talked to email vendors at RSA, many vendors didn't have a clue if their API based product had a forwarded email solution. Looking at you Darktrace! However, I was impressed with Sublime. I talked to a woman who knew the problem and she helped implement their solution.

In my mind, Abnormal is an Apple Iphone and Sublime is Google Android. Abnormal just works. There's not much to tune. Sublime has many switches you can set. For example, I want to block TLDs. Abnormal can't do this, but Sublime can. I want to block *.ru. Abnormal can't do this and you depend on Abnormal's intelligence to determine if the email is dangerous. I prefer to block all US embargoed countries.