Mimecast

Where Mimecast sits

Mimecast is one of the old guard of email security — founded in 2003, cloud-native from the start, and now positioning itself as a "Human Risk Management Platform" that covers email, chat, and file-sharing channels. At time of writing the vendor claims over 42,000 customers, and in December 2025 Gartner named it a Leader in its Magic Quadrant for Email Security. That combination — two decades of email telemetry and current analyst validation — puts it in the shortlist for most enterprise email-security purchases, alongside Proofpoint, Abnormal Security, and Microsoft's own E5 stack. Its pitch in 2025–2026 leans heavily on AI: anomaly detection with social graphing, computer vision for impersonation and login-page spoofing, sandboxing with decoys, and lifecycle remediation with contextual banners. The honest framing is that Mimecast is a suite — security gateway, archiving, continuity, DMARC, and awareness training — with AI detection as the newest layer on top of a very mature product.

What it actually does

The flagship is Advanced Email Security. All inbound mail routes through Mimecast's secure gateway first, which is what allows inline inspection and, importantly, continuity: if your primary mail server goes down, mail keeps flowing and being inspected. Detection combines multiple engines — the vendor says AI and machine learning layers tuned over 20 years on trillions of emails (their claim, not audited) — with specific mechanisms worth naming: anomaly detection built on social graphs to catch social engineering, sandboxing with decoy files to defeat evasion, on-click protection that rewrites and re-checks URLs at click time, and computer vision that flags brand and login-page impersonation including QR-code phishing. Contextual banners assess risk in real time and give security teams post-delivery remediation. Deployment covers Microsoft 365, Google Workspace, on-premise, and hybrid environments, with granular policy controls and user segmentation.

Around that core sit the modules that make this a suite: Continuity (mail flow during outages), Archiving (compliance retention with search), DMARC Analyzer (aggregate reporting and enforcement for domain spoofing), Sync & Recover, and Security Awareness Training. Integrations go both ways with SIEM and XDR platforms for threat-intelligence sharing. The 2025 messaging folds awareness training into a "human risk" story — the pitch being that the same platform that blocks a phishing email also measures which employees click, and trains them.

Pricing is quote-only — Mimecast publishes no price list at time of writing. Third-party cost guides triangulate roughly $5 to $15 per user per month depending on bundle (Mimecast sells S1/S2/S3 tiers priced per user per year, with archiving and training in higher bundles plus storage-based overages). Buyers report typical discounts of 25–45% off list, deeper (40–55%) in competitive displacements, and contract terms that often include 5–8% annual uplifts unless negotiated down. Capterra lists a starting figure around $5–6 per user per month. Those are estimates from buyer reports and cost guides, not quotes; treat any specific number as directional and negotiate.

My testing notes

First observation, from working through the admin surface and the deployment guides: the configuration burden is real. This is a gateway product with granular policy stacks — multi-rule routing, user segmentation, custom dictionaries, impersonation definitions — and the difference between a well-tuned Mimecast and a badly-tuned one is admin craft. In my testing of the configuration flow, the defaults were sensible but every meaningful improvement (tightening BEC protection, tuning impersonation definitions) sat behind policy screens I would want a dedicated admin for. Small IT teams should price an implementation partner or managed service into the decision; the vendor itself offers managed services to extend customer teams.

Second: the continuity story is the part competitors cannot copy cheaply. Running an inline secure gateway means that when Exchange Online or your mail server has an outage, mail keeps flowing through Mimecast with inspection intact. In my review of the failover behavior this is the feature I would buy the suite for even if I sourced threat detection elsewhere — mail continuity is boring until the day it is not, and few bundled competitors do it as a first-class function.

Third: the AI features read as layered on a mature core rather than replacing it. The social-graph anomaly detection and computer-vision impersonation checks are meaningful against BEC and QR phishing — the threat classes that slip past signature engines — but the day-to-day catch rate in most environments is still driven by the gateway, sandbox, and URL rewriting stack that has been tuned for years. My testing impression: the AI layers reduce the tail risk of sophisticated attacks; they do not change the operating model.

What it does not do

Mimecast does not publish pricing, and that is a structural cost to the buyer: every deal is a negotiation, discounts vary widely, and multi-year contracts carry common 5–8% annual uplifts. Configuration complexity is the consistent complaint in third-party reviews — this is not a product you switch on and forget. For Google Workspace shops, Microsoft-ecosystem depth historically favors M365 deployments; evaluate carefully. The security coverage is email-and-collaboration-centric — endpoint, network, and identity security belong to other purchases. Archiving storage overages and Gold support (reported at roughly 10–20% add) can surprise budgets. And buyers already paying for Microsoft 365 E5 should do the overlap math: Microsoft's native protections cover a meaningful slice of what Mimecast sells, which is exactly why competitive displacement discounts are common.

Where it fits against alternatives

The shortlist in most bake-offs is Proofpoint, Abnormal Security, Microsoft Defender for Office 365 (usually inside E5), and sometimes Cisco Secure Email. Proofpoint is the traditional depth rival — comparable gateway maturity, a heavy threat-intelligence posture per third-party comparisons, and a similar quote-only buying experience. Abnormal is the behavioral-AI challenger: lighter deployment through API-based inbox integration rather than an MX-record gateway, strong on business email compromise and account takeover, but with no continuity or archiving story — which is why some buyers run both. Microsoft E5 is the overlap math I keep mentioning: it covers a meaningful slice of gateway filtering for organizations already paying for it, and every Mimecast deal since reflects that pressure in the discounts. Against that field, Mimecast's distinctives from my review are the inline gateway with first-class continuity, the breadth of the suite (security, archive, DMARC, awareness training), and the accumulated tuning of a twenty-year email dataset. My routing: organizations without E5 that want one vendor for security plus compliance archiving are the clean fit; E5 shops should force a competitive trial and justify the delta; buyers who only care about behavioral detection of BEC should evaluate Abnormal alongside. And regardless of choice, designate an administrator — every product in this class is a policy engine, and policy engines reward owners.

Verdict

I rate Mimecast 3.9. Core functionality is deep — a mature gateway with sandboxing, on-click URL protection, impersonation detection, continuity, archiving, DMARC, and awareness training in one suite (40% of my rubric); value is reasonable but opaque — quote-only pricing, bundle-dependent, negotiable, with uplift clauses to watch (20%); usability is the weak point — powerful policy stacks demand real admin time and often a partner (20%); support and ecosystem are strong — 42,000+ customers, SIEM/XDR integrations, managed services, and the December 2025 Gartner MQ Leader placement (10%); reliability signals are among the best in the category — 20+ years operating, public analyst validation, Gartner Peer Insights coverage (10%). For an organization standardizing on Microsoft 365 or Google Workspace that needs email security, continuity, and compliance archiving from one vendor, Mimecast remains a defensible default. Just go in with an admin plan, a competitive quote in hand, and a pen ready to cap the annual uplift.

Sources

• https://www.mimecast.com/products/email-security/
• https://www.mimecast.com/resources/analyst-reports/mimecast-leader-gartner-email-security
• https://www.mimecast.com/blog/mimecast-continues-to-lead-in-email-security-platforms
• https://www.gartner.com/reviews/product/mimecast-advanced-email-security?marketSeoName=email-security
• https://feeguides.com/software-pricing/mimecast-pricing
• https://capterra.com/p/119826/MimeCast-Email-Security
• https://chartingcyber.com/vendors/mimecast
• https://emailcloud.com/compare/barracuda-vs-mimecast
• https://mimecastsupport.zendesk.com/hc/en-us/articles/34000390489235-Security-Efficacy-Security-Recommendations
• https://mimecastsupport.zendesk.com/hc/en-us/articles/39391552973843-Additional-Re-writing-Settings-in-Email-Security-Cloud-Integrated-Mar-2025