Skip to content
Franz Korbjuhn
Call +49 40 88192642 Send an email [email protected] Chat in Teams [email protected]
IT security· ·updated ·9 min read

Hornetsecurity for Microsoft 365: when additional email security makes sense

Why I usually add Hornetsecurity for email protection when clients use Business Standard, how the switch works, and when I recommend Business Premium instead.

Emails pass through a filter gate with a shield into the office, suspicious messages with warning signs, one with a crown posing as the boss, end up in a quarantine box, and a copy of every email goes to the archive

I have been a Hornetsecurity partner since April 2024 and now use the service with 14 clients, mostly alongside Microsoft 365 Business Standard. Whether additional email security makes sense for your business depends on the protection you already have, your licences and how operation and support are organised. That determines whether I recommend Hornetsecurity, Business Premium or both.

What Microsoft 365 already brings for email security

No mailbox in Microsoft 365 is unprotected. Every licence with Exchange Online includes Exchange Online Protection. It filters spam and malware and detects spoofed senders through SPF, DKIM and DMARC. Microsoft itself describes this as protection against broad, known attacks.

The difference is Defender for Office 365 Plan 1. Business Premium includes it, and it can be added to Business Standard as a separate licence. It checks links when someone clicks them (Safe Links), opens attachments in an isolated environment first (Safe Attachments) and detects impersonation. That means emails whose sender looks deceptively like a real person or domain. According to Microsoft, the baseline protection explicitly does not include this. Microsoft has announced that, from summer 2026, Business Basic and Business Standard also check links at the time of click. Safe Attachments and impersonation protection remain part of Defender for Office 365 (as of October 2026). What else Business Premium brings, I describe in the article on unused security features in Business Premium.

Archiving is similar. Business Standard has an archive mailbox of 50 GB, while in Business Premium it grows up to 1.5 TB. In neither case is this a separate archiving system.

Why I add Hornetsecurity to Business Standard

For context: as a Hornetsecurity partner and reseller, I supply and manage software and cloud licences from various vendors for my clients, Microsoft included. My recommendation is therefore based on what the client already has in place.

Most of these clients work with Business Standard. Moving to Business Premium would be possible, but it takes a fair amount of configuration in the tenant, meaning the company’s Microsoft 365 environment: policies, device management, access rules. Hornetsecurity, on the other hand, is quick to set up and works from the moment of the switch. Even so, I generally prefer a solution from a single vendor. Business Premium brings far more than email protection and an archive, and if you need those features anyway, you are better off there.

What decided it for me was the intuitive interface, an established and stable product and good support. As a partner, I manage all clients through single sign-on in one console. I mostly use 365 Total Protection Plan 3, which Hornetsecurity calls “Enterprise Backup”:

Filter

Spam and malware protection, email encryption, signatures and disclaimers.

Advanced protection

Advanced Threat Protection against targeted attacks and a continuity service that keeps emails accessible even if the mail server fails.

Archive

All incoming and outgoing emails are archived automatically and cannot be changed until the retention period ends.

Backup

Several backups a day of mailboxes, Teams chats, OneDrive and SharePoint, stored independently of Microsoft.

Almost all of my clients use the backup as well. What each plan includes is shown in Hornetsecurity’s data sheets (in German): 365 Total Protection, all plans (PDF), 365 Total Backup (PDF) and Security Awareness Service (PDF).

What the filter catches: mostly the fake boss

For my clients, the phishing emails that most often end up in quarantine pose as internal messages. A typical one is the supposed boss asking an employee to take care of something quickly, for example buying gift cards. The German Federal Office for Information Security (BSI) describes this scam as CEO fraud: criminals pose as senior management and get employees to transfer money, supposedly on management’s behalf.

Such emails often contain neither an attachment nor a link that a virus scanner could flag. They are recognised by the forged or imitated sender. No filter catches everything. The BSI and the German police therefore advise checking unusual instructions by calling the supposed sender back. That belongs in every briefing.

How the switch to Hornetsecurity works

If the mailboxes stay in Microsoft 365, I only switch the mail flow. To do so, I change the MX records. These DNS records define which server accepts the emails for a domain. Afterwards they point to Hornetsecurity, which checks the emails and passes them on to the mailboxes.

If the mailboxes come from another provider, a mailbox migration comes first. I set up a migration job that synchronises the mailboxes every few minutes, so the old and new environments stay in step. I only switch the MX records once all employees have been briefed. Depending on the amount of data, a migration like this takes one to several days.

After that, employees receive a quarantine report at fixed intervals. In their own control panel they see the archive and quarantine and can release emails with an acceptable risk to themselves. Clearly dangerous emails stay blocked.

There is one weakness: shared mailboxes are cumbersome. For them I have to create a separate storage location at Hornetsecurity, route the backups of the mailboxes concerned there, and then use permissions to define who may access which mailbox. It works, but it takes more effort than I would like.

Without Microsoft or Google: Hornet.email

Some clients want neither Microsoft nor Google and only need email, protection and an archive. For them, Hornet.email is a good product: mailboxes with calendar and address book, hosted at Hornetsecurity with built-in spam and malware protection. It costs less than Microsoft 365 but offers less. These are not Exchange mailboxes of the kind many people know from Outlook.

That is how the specialist medical practice from my case study solved it. Its mailboxes used to sit with a web host. In 2025, several German hosting providers moved their mailboxes to Microsoft 365, mandatorily and for a monthly fee per mailbox. The practice’s host gave each customer a separate tenant provided by the host. An administrator could be created there, but only with restricted rights, and the environment could only be extended with the host’s own products. How much freedom you have, and whether such a tenant can be taken over later, depends on the contract and how the tenant was provisioned. For the practice, these restrictions were the reason to switch.

Before the contract was cancelled, I backed up all mailboxes in Mail Archiver, a self-hosted open-source solution. It is lean, free of charge, runs reliably and is enough for the practice. Today the practice uses Hornet.email in the Enterprise edition, which includes an archive. So an archive does not have to be on-premises; Microsoft offers one too. What else the IT security guideline requires of practices is covered in the article on IT for medical practices.

If you are planning from scratch today, I first recommend Business Premium, which includes extensive security features alongside Exchange Online. Nonprofits get it on their own terms, see Microsoft 365 for nonprofits. As an alternative or in addition, Hornetsecurity covers email security, archiving and backup in one place. You can find more about my approach under IT security and Microsoft 365.

Frequently asked questions

Does Microsoft 365 Business Standard have no spam protection?

It does. Business Standard includes Exchange Online Protection with filters against spam, malware and spoofed senders. What it does not include is Defender for Office 365 with Safe Attachments and impersonation protection, which comes with Business Premium or as a separate licence. Microsoft has announced that link checks at the time of click are being added to Business Standard from summer 2026.

Do I need Hornetsecurity if I have Business Premium?

For email protection, usually not, as long as Defender for Office 365 is set up. That leaves backup and archiving, and here the two solutions differ fundamentally. Both back up the tenant. Hornetsecurity also includes email security and a legally compliant email archive. AvePoint Cloud Backup includes neither; bundled with AvePoint Policies and Insights, it adds a tool for SharePoint permissions that lets you monitor the tenant for weaknesses and possible data leaks. If you only need a backup alongside Defender, I tend to use AvePoint. If you also need a compliant archive, Hornetsecurity is the better fit.

Does an email archive have to be on-premises?

No. Hornetsecurity archives in the cloud, and Microsoft offers archive mailboxes depending on the licence. An on-premises archive such as Mail Archiver makes sense if you want to back up mailboxes before cancelling a contract or keep the data in-house.

Sources

Tags
More articles
All articles→
Floor plan of a practice with reception, treatment room, office, server room and a waiting area with Wi-Fi, all connected through a central firewall, with backups passing through a second stage into a data centre
IT security

IT for medical practices: coordinating practice software, network and backup

What the KBV's IT security guideline requires of practices, where the TI service provider's job ends, and how I set up the practice network and backup.

Read article→
Servers and computers marked with red padlocks, next to a separate data vault from which the data flows back along a line
IT security

A ransomware attack in practice: 60 employees back at work within 48 hours

Every computer and file share encrypted, but not the backups. How an offline backup brought a company back without paying a ransom, in which order the systems returned and what changed afterwards.

Read article→
A central office building linked by secured connections to a factory, a warehouse and smaller businesses, one of them highlighted
IT security

NIS2 and small businesses: checking whether it applies, preparing IT measures

NIS2 has applied in Germany since December 2025. Whether a business is in scope depends on sector, size and structure. Small businesses are often affected indirectly, as suppliers or service providers to customers in scope.

Read article→