Best Antivirus for Stopping Phishing and Email-Borne Malware at Work

Fix it now

Filter at the mail service first and at the endpoint second, because anything blocked before delivery never reaches a user to be clicked. If you are on Microsoft 365 you already have Exchange Online Protection, and Business Premium includes Defender for Office 365 Plan 1. Turn on what you own before you buy anything else.

1. Establish what your Microsoft subscription includes. Microsoft describes a protection ladder: built-in security for all cloud mailboxes, then Defender for Office 365 Plan 1 for zero-day malware, phishing and business email compromise, then Plan 2 for simulations, hunting and automation.
2. If you are on Microsoft 365 Business Premium you have Plan 1, which carries Safe Attachments in email, Safe Attachments for SharePoint, OneDrive and Teams, Safe Links in email, Office clients and Teams, impersonation protection and real-time detections.
3. Turn on multi-factor authentication for every mailbox, without an exception for directors. It is the single highest-value control here because it defeats most credential phishing outright.
4. Publish SPF, DKIM and DMARC. Microsoft’s documented order is an SPF record using the soft fail rule first, then DKIM, then DMARC with the action for failures and the reporting destination.
5. Choose an endpoint product on its mail handling, not its scanner. ESET Endpoint Security scans POP3, IMAP, POP3S and IMAPS by default regardless of the port and regardless of the email client, without reconfiguring the client.
6. Fix invoice fraud with a rule, not a product: no change of bank details without a call to a number you already held. Business email compromise carries no attachment and no link, so no scanner sees it.

The layer nobody buys is the one that catches the rest: a reporting button and short, frequent training. Measure the reporting rate rather than the click rate, because the useful signal is how quickly somebody tells you.

If the Microsoft entitlement plus multi-factor authentication is the whole answer for you, stop here. Below is what each layer can actually stop, what to ask an endpoint vendor about mail, and where to spend next.

Why it happens

Most malware still arrives by email, and most successful attacks now arrive by email with no malware in them at all. That difference decides where the money should go. An endpoint product with mail scanning is a useful last line, but it is the last line, and expecting it to solve phishing is the most common mistake in small business security buying. The controls that stop credential theft sit further upstream, and several of them cost nothing.

The mail service layer inspects messages before they land: reputation, attachment analysis, link inspection at the moment of the click rather than at delivery, and impersonation detection. Microsoft describes this as a ladder, with built-in security for all cloud mailboxes preventing broad, volume-based, known email attacks; Defender for Office 365 Plan 1 protecting email and collaboration from zero-day malware, phishing and business email compromise; and Plan 2 adding phishing simulations, post-breach investigation, hunting, response and automation. Microsoft names Microsoft 365 Business Premium among the subscriptions that include Plan 1, which is why the first job is an audit rather than a purchase.

The endpoint layer inspects what arrives on the machine: the mail traffic as it is collected, the web request when somebody clicks, and the file when it is saved and run. It is your protection when mail reaches a machine through a channel the service layer does not cover, and it is the layer that catches the payload rather than the message. Then there are two layers that are not products at all – authentication, meaning multi-factor on the mailbox, and process, meaning a rule that no bank details change without a phone call to a known number. Those two stop the attacks with nothing malicious in them, which is the category that costs businesses the most money.

The endpoint layer is still worth choosing carefully, because products differ more here than they do on detection. What separates them is whether mail scanning is a component you can enforce by policy or a browser extension a user can switch off, and whether the same vendor sells the upstream layer you may want later.

Full reference

Four layers, and what each one can actually stop

What to ask about an endpoint product’s email handling

Four questions separate products meaningfully, and the answers are usually in the vendor’s own documentation rather than on the datasheet.

1. Does it scan the mail protocols themselves rather than only the saved attachment? ESET, for example, documents that all communication over POP3 and IMAP is scanned by default regardless of the port, that IMAPS on 585 and 993 and POP3S on 995 are supported, and that this happens regardless of the email client used and without reconfiguring it.
2. Is anti-phishing a policy-enforced component or a browser extension the user can disable? ESET publishes Anti-Phishing protection as a Web and email component that blocks web pages known to distribute phishing content, alongside Web access protection and Web control.
3. Does it also filter mail in the client itself, and can antispam be managed centrally rather than per machine?
4. Does the vendor sell a mail server or cloud mailbox product you could add later without changing endpoint vendor?

That last question is the one worth planning around. ESET publishes ESET Mail Security for on-premises Microsoft Exchange and ESET PROTECT Mail Plus for cloud mailboxes, so the upstream layer can be added as a licence change rather than a fresh procurement exercise, and the two report into a related place. It is not a reason to accept a worse endpoint product, but between two comparable ones it is a genuine tiebreaker.

Getting the domain records right, in Microsoft’s order

Microsoft publishes a sequence rather than a set, and following it avoids the usual outcome where DMARC is published before the legitimate senders pass and somebody’s newsletter stops arriving. Start by publishing an SPF record containing all the email sources you know about, particularly where your corporate traffic originates, using the soft fail enforcement rule. Then set up DKIM to digitally sign messages. Then set up DMARC to validate that the domains in the MAIL FROM and From addresses match, to specify what happens to messages that fail, and to identify the reporting services that will monitor the results.

The reason to do this is not your own inbox. Domain authentication stops other people sending mail that appears to come from you, which protects your customers, your suppliers and your reputation. It costs DNS changes and attention, and it is the cheapest thing on this page.

Where to spend, by situation

• On Microsoft 365 already: enable and configure what you own before buying anything. Confirm which Defender for Office 365 features your subscription includes, turn on Safe Links and Safe Attachments, and switch on multi-factor authentication for every account.
• Running your own Exchange server: a mail server security product is the highest-value addition, because the endpoint cannot filter what the server has already delivered.
• Small business, mixed mail arrangements, no dedicated IT: an endpoint suite with policy-enforced mail and web filtering, plus multi-factor authentication, plus the domain records.
• Repeated invoice fraud attempts: this is a process problem. Fix the payment verification rule first; no product line item will help.
• Users clicking things regularly: add a reporting button and short, frequent training, and measure the reporting rate rather than the click rate.

What an endpoint agent will never do

It will not stop a well-written message asking somebody to log in somewhere. There is no attachment to scan and, if the page is new, nothing yet categorised to block. That is not a criticism of the product category, it is a description of where the control has to live: mail-service filtering, multi-factor authentication so the harvested password is insufficient, and a reporting habit so you find out in minutes rather than weeks. Buy the endpoint layer for what it is genuinely good at – the payload, the saved file, the known-bad destination – and put the phishing budget upstream.

Questions people ask about this