Skip to content
Franz Korbjuhn
Call +49 40 88192642 Send an email [email protected] Chat in Teams [email protected]
IT security· ·9 min read

Email security with Hornetsecurity – and when Business Premium fits better

Why I usually add Hornetsecurity for email protection when clients use Business Standard, how the switch works, and when I recommend Business Premium instead.

Emails pass through a filter gate with a shield into the office, suspicious messages with warning signs, one with a crown posing as the boss, end up in a quarantine box, and a copy of every email goes to the archive

For email security, I usually add Hornetsecurity for clients on Microsoft 365 Business Standard. Business Standard already filters spam and malware, but the advanced protection of Defender for Office 365 only comes with Business Premium. Hornetsecurity closes that gap without a major rework of the tenant. Based on my work with 14 clients, I describe when that fits and when I recommend Business Premium instead.

What Microsoft 365 already brings for email security

No mailbox in Microsoft 365 is unprotected. Every licence with Exchange Online includes Exchange Online Protection. It filters spam and malware and detects spoofed senders through SPF, DKIM and DMARC. Microsoft itself describes this as protection against broad, known attacks.

The difference is Defender for Office 365 Plan 1, which Business Premium includes and Business Standard does not. It checks links when someone clicks them (Safe Links), opens attachments in an isolated environment first (Safe Attachments) and detects impersonation. That means emails whose sender looks deceptively like a real person or domain. According to Microsoft, the baseline protection explicitly does not include this. What else Business Premium brings, I describe in the article on unused security features in Business Premium.

Archiving is similar. Business Standard has an archive mailbox of 50 GB, while in Business Premium it grows up to 1.5 TB. In neither case is this a separate archiving system.

Why I add Hornetsecurity to Business Standard

First, for context: I have been a Hornetsecurity partner since April 2024, and Hornetsecurity now runs at 14 of my clients. As a reseller, I supply and manage software and cloud licences from various vendors for my clients, Microsoft included. So my recommendation does not depend on the product, but on what the client already has.

Most of these clients work with Business Standard. Moving to Business Premium would be possible, but it takes a fair amount of configuration in the tenant, meaning the company’s Microsoft 365 environment: policies, device management, access rules. Hornetsecurity, on the other hand, is quick to set up and works from the moment of the switch. Even so, I generally prefer a solution from a single vendor. Business Premium brings far more than email protection and an archive, and if you need those features anyway, you are better off there.

What decided it for me was the intuitive interface, an established and stable product and good support. As a partner, I manage all clients through single sign-on in one console. I mostly use 365 Total Protection Plan 3, which Hornetsecurity calls “Enterprise Backup”:

Filter

Spam and malware protection, email encryption, signatures and disclaimers.

Advanced protection

Advanced Threat Protection against targeted attacks and a continuity service that keeps emails accessible even if the mail server fails.

Archive

All incoming and outgoing emails are archived automatically and cannot be changed until the retention period ends.

Backup

Several backups a day of mailboxes, Teams chats, OneDrive and SharePoint, stored independently of Microsoft.

Almost all of my clients use the backup as well. What each plan includes is shown in Hornetsecurity’s data sheets (in German): 365 Total Protection, all plans (PDF), 365 Total Backup (PDF) and Security Awareness Service (PDF).

What the filter catches: mostly the fake boss

For my clients, the phishing emails that most often end up in quarantine pose as internal messages. A typical one is the supposed boss asking an employee to take care of something quickly, for example buying gift cards. The German Federal Office for Information Security (BSI) describes this scam as CEO fraud: criminals pose as senior management and get employees to transfer money, supposedly on management’s behalf.

Such emails often contain neither an attachment nor a link that a virus scanner could flag. They are recognised by the forged or imitated sender. No filter catches everything. The BSI and the German police therefore advise checking unusual instructions by calling the supposed sender back. That belongs in every briefing.

How the switch to Hornetsecurity works

If the mailboxes come from another provider, I first set up a migration job. It synchronises the mailboxes every few minutes, so the old and new environments stay in step. Only once all employees have been briefed do I switch the MX records. These DNS records define which server accepts the emails for a domain. Afterwards they point to Hornetsecurity, which checks the emails and passes them on. Depending on the amount of data, this takes one to several days.

After that, employees receive a quarantine report at fixed intervals. In their own control panel they see the archive and quarantine and can release emails with an acceptable risk to themselves. Clearly dangerous emails stay blocked.

There is one weakness: shared mailboxes are cumbersome. For them I have to create a separate storage location at Hornetsecurity, route the backups of the mailboxes concerned there, and then use permissions to define who may access which mailbox. It works, but it takes more effort than I would like.

Without Microsoft or Google: Hornet.email

Some clients want neither Microsoft nor Google and only need email, protection and an archive. For them, Hornet.email is a good product: mailboxes with calendar and address book, hosted at Hornetsecurity with built-in spam and malware protection. It costs less than Microsoft 365 but offers less. These are not Exchange mailboxes of the kind many people know from Outlook.

That is how the specialist medical practice from my case study solved it. Its mailboxes used to sit with a web host. In 2025, several German hosting providers moved their mailboxes to Microsoft 365, mandatorily and for a monthly fee per mailbox. The host creates a separate tenant for each customer. You can create an administrator there, but only with restricted rights, and the domain can only be extended with the host’s own products. Anyone who wants to use further Microsoft services soon hits that limit, and changing provider means a migration. For the practice, that was the reason to switch.

Before the contract was cancelled, I backed up all mailboxes in Mail Archiver, a self-hosted open-source solution. It is lean, free of charge, runs reliably and is enough for the practice. Today the practice uses Hornet.email in the Enterprise edition, which includes an archive. So an archive does not have to be on-premises; Microsoft offers one too. What else the IT security guideline requires of practices is covered in the article on IT for medical practices.

If you are planning from scratch today, I first recommend Business Premium, which includes extensive security features alongside Exchange Online. Nonprofits get it on their own terms, see Microsoft 365 for nonprofits. As an alternative or in addition, Hornetsecurity covers email security, archiving and backup in one place. You can find more about my approach under IT security and Microsoft 365.

Frequently asked questions

Does Microsoft 365 Business Standard have no spam protection?

It does. Business Standard includes Exchange Online Protection with filters against spam, malware and spoofed senders. What it lacks is Defender for Office 365 with Safe Links, Safe Attachments and impersonation protection. Business Premium includes that.

Do I need Hornetsecurity if I have Business Premium?

For email protection, usually not, as long as Defender for Office 365 is set up. As a pure backup, Hornetsecurity is too expensive; its focus is email security. For backup with Business Premium, I would rather recommend AvePoint Cloud Backup, bundled with AvePoint Policies and Insights. That adds a powerful tool for SharePoint, and the tenant can be monitored for weaknesses and possible data leaks.

Does an email archive have to be on-premises?

No. Hornetsecurity archives in the cloud, and Microsoft offers archive mailboxes depending on the licence. An on-premises archive such as Mail Archiver makes sense if you want to back up mailboxes before cancelling a contract or keep the data in-house.

Sources

Tags
More articles
All articles→
Floor plan of a practice with reception, treatment room, office, server room and a waiting area with Wi-Fi, all connected through a central firewall, with backups passing through a second stage into a data centre
IT security

IT for medical practices: network, backup and the KBV guideline

What the KBV's IT security guideline requires of practices, where the TI service provider's job ends, and how I set up the practice network and backup.

Read→
Servers and computers marked with red padlocks, next to a separate data vault from which the data flows back along a line
IT security

Ransomware attack: how a company with 60 employees was working again after 48 hours

Every computer and file share encrypted, but not the backups. How an offline backup brought a company back without paying a ransom, in which order the systems returned and what changed afterwards.

Read→
A central office building linked by secured connections to a factory, a warehouse and smaller businesses, one of them highlighted
IT security

NIS2: does it apply to my small business?

NIS2 has applied in Germany since December 2025, usually from 50 employees. Small businesses are still often affected, as suppliers or service providers to customers in scope.

Read→