Mimecast

What Mimecast actually does

Mimecast is a cloud email security gateway. It inspects inbound and outbound email for phishing, malware, impersonation attacks, and data leakage. You point your MX records at Mimecast, and it filters mail before it hits your Microsoft 365 or Google Workspace tenant. The core product includes URL protection (rewriting and scanning links at time of click), attachment sandboxing, and impersonation detection for BEC.

Beyond threat protection, Mimecast offers email archiving with search and e-discovery, email continuity (a fallback mailbox if your primary provider goes down), and data loss prevention policies. The archiving piece is a real differentiator for regulated industries that need long-term retention without managing separate infrastructure.

Mimecast has been adding API-based detection to supplement the gateway model, particularly for internal email threats and account takeover. But the product DNA is still gateway-first. If you want a gateway that also does archiving and continuity, Mimecast covers that well in a single platform.

Who it’s best for

• Mid-market organizations (500-10,000 mailboxes) running Microsoft 365 that want email security and archiving in one product
• Companies in regulated industries that need email retention, e-discovery, and compliance reporting
• IT teams that want email continuity as a safety net during Exchange Online outages
• Organizations evaluating Proofpoint but finding the cost prohibitive
• Teams that prefer a gateway model with MX record routing over API-only approaches

Pricing reality check

Mimecast prices per user, per year. Entry-level email security starts around $3-5 per user per month. Adding archiving, continuity, and awareness training pushes that higher. Expect to land somewhere between $5-10 per user per month for a meaningful bundle, depending on volume and commitment length.

That typically undercuts Proofpoint by 15-30% for comparable functionality. Mimecast is more willing to negotiate on mid-market deals. But do not assume the sticker price is the floor. Push for multi-year discounts and make sure you understand what is included in each tier. The bundling has gotten clearer in recent years, but always get line-item pricing in writing.

Alternatives to consider

• Proofpoint TAP — If your threat model demands the strongest detection engine and you have the budget, Proofpoint still edges out Mimecast on advanced threat detection. The gap is not enormous, but it exists.
• Abnormal Security — If you do not need archiving or continuity and your primary concern is BEC and account takeover, Abnormal’s API-based model is faster to deploy and requires no MX changes.
• Microsoft Defender for Office 365 — Already included in E5 licensing. If you are on E5 and your threat volume is moderate, test Defender before paying for an overlay.
• IRONSCALES — If you want email security combined with phishing simulation and employee reporting, IRONSCALES is lighter and cheaper, though it lacks Mimecast’s archiving depth.

The Charting Cyber take

Mimecast is the practical choice for organizations that need email security, archiving, and continuity bundled together at a reasonable price. It does all three things competently. It will not win detection benchmarks against Proofpoint in every category, but for most mid-market environments, the gap does not justify the price difference.

The question to ask yourself is whether you actually need a gateway. If you are deploying email security for the first time in 2025, the API-based approach (no MX changes, faster deployment, catches internal threats) is worth serious consideration. Mimecast is adding API capabilities, but it is still fundamentally a gateway product. Buy Mimecast if you need archiving and continuity alongside security. If you only need threat detection, newer vendors do it with less operational overhead.