Spam protection and filtering
Anti-spam and anti-malware filtering that catches bulk and known-bad mail before delivery.
Email security for Microsoft 365 and Google Workspace
Email security is the set of controls that keeps phishing, malware, impersonation and data leaks out of your organisation's mailboxes. Arke Technologies, in Johannesburg, configures, monitors and manages email security for Microsoft 365 and Google Workspace across South Africa: filtering, sender authentication, encryption and staff training, with a monthly report.
Email threats: how phishing attacks work
Email security, short for electronic mail security, matters because email threats reach every employee, every day. A phishing attack is a message that impersonates someone you trust, such as a bank, a supplier, SARS, a colleague or Microsoft, to steal credentials, money or data. Phishing in cyber security terms is social engineering at scale, with email as the vehicle. The email phishing attack types we defend against:
- Credential phishing. A fake sign-in page; a Microsoft phishing email asking you to "re-validate your mailbox" is the classic example.
- Spear phishing. Phishing and spear phishing attacks differ in aim: spear phishing targets a named person with researched detail, often a finance officer, a bursar or an executive.
- Business email compromise. An attacker takes over or imitates a supplier's mailbox and sends changed banking details on a genuine-looking invoice. Money paid to a fraudulent account is hard to recover.
- Phishing malware. Attachments and links that install ransomware or password stealers. Spam and phishing overlap: much malware still arrives looking like ordinary spam.
- Consent phishing. A malicious phishing application asks the user to grant it access to their mailbox, bypassing the password entirely.
- QR-code phishing. A code that sends the user's phone to a fake sign-in page, outside the network's protection.
The layers of email protection we put in place
No single product stops every email threat, so good email protection is layered:
Phishing protection for links and attachments
Links checked at the moment of click; attachments opened in a sandbox first.
Sender authentication
SPF, DKIM and DMARC on every domain you own. Secure email addresses start here: without DMARC at enforcement, receiving servers have no instruction to reject mail forged in your finance team's name.
Impersonation and anomaly detection
Rules and machine learning that flag abnormal behaviour: a lookalike domain, a first-time sender using a director's name, a mailbox that suddenly forwards mail to outside addresses.
Encryption
TLS for mail in transit, and message encryption or S/MIME for sensitive content.
Data loss prevention
Policies that stop ID numbers, bank details and health information leaving by email unprotected.
People and response
Training, simulated phishing and a one-click report button for suspicious mail.
Secure email and encrypted email, in plain terms
Four mechanisms sit behind the phrase "secure email":
- TLS. Transport encryption protects mail between servers, but only opportunistically unless enforced. An email TLS check shows whether your domain enforces it; MTA-STS makes it mandatory for inbound mail.
- S/MIME. Secure/Multipurpose Internet Mail Extensions uses certificates to sign and encrypt messages, giving end-to-end encryption for email between parties who both hold certificates. It suits regular exchanges with a known counterpart.
- Encryption in Outlook. Microsoft Purview Message Encryption lets users encrypt email in Outlook, or send a confidential email in Outlook with "Do Not Forward", to any recipient, inside Microsoft 365 or not: usually the simplest way to send secure email in Outlook.
- Gmail options. Confidential email in Gmail sets an expiry and blocks forwarding, copying and printing, but it is not end-to-end encryption. To encrypt a Gmail email itself, use hosted S/MIME or, where you need to hold the keys, client-side encryption; both are available only in some Workspace editions.
Secure encrypted email works only if people use it, so we set sensitivity labels and automatic mail encryption for the obvious cases, such as ID numbers and medical records.
Email security best practices
Our email security check tests these best practices:
- Multi-factor authentication on every mailbox, with phishing-resistant methods for administrators.
- Legacy authentication switched off.
- SPF, DKIM and DMARC published, with DMARC moved in stages from monitoring to quarantine and reject.
- External senders tagged, and lookalike domains flagged.
- Automatic forwarding to external addresses blocked by default.
- Mailbox audit logging on and retained.
- Encryption and data loss prevention rules for personal information.
- A report button for every user, with reported mail triaged under your SLA.
- Changes to a supplier's banking details confirmed by phone on a number you already hold, never by reply.
- Regular phishing simulations, reported to management.
Spam protection on Android phones and iPhones comes from the same filtering at the mail service. The phone still needs device management, so a lost device is not an open mailbox.
Governance, POPIA and procurement
- POPIA. Mailboxes hold the personal information of staff, clients, patients and learners. Section 19 requires reasonable safeguards and section 22 requires notification of a compromise; our controls and incident records support both. See POPIA compliance.
- Retention. Retention policies and holds keep mail for as long as the law or your policy requires, and no longer.
- Escalation. A suspected mailbox compromise goes to your named contacts under the severity matrix in your SLA.
- Public sector and schools. Departments, municipalities and schools hold personal information and handle public money, so their mailboxes are targets. Reporting maps to King IV Principle 12 and the PFMA or MFMA; see cybersecurity for government and cybersecurity and POPIA for schools.
- Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request). Company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete SBD forms when a bid requires them. Projects are bought on a purchase order or tender; ongoing management under an SLA.
- Continuity. Every setting lives in your own tenant and is documented. You own your data, credentials and documentation, and changing provider needs no mail migration.
What email security costs
Email security has two cost lines. The first is licensing: the protection in your Microsoft 365 or Google Workspace edition, any upgrade such as Defender for Office 365, and any third-party service you add. We supply Microsoft 365 and Google Workspace licences monthly or annually, and our Microsoft 365 pricing guide sets out what each plan includes. The second is the work: a hardening project, quoted after the email security check, and ongoing management priced per user per month within a managed-service SLA.
For context, published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026). The largest cost driver is usually the gap between the licences you hold and the protection you need.
Last reviewed: September 2026.
