Obsidian RidgeManaged Email Security
Managed email security for Microsoft 365 and Google Workspace. We configure the protection your license already includes, turn off the sign-ins that skip MFA, and set up and monitor SPF, DKIM and DMARC for your domain. No mail-flow cutover.
The problem
Business email compromise and funds transfer fraud accounted for 58% of the cyber incidents Coalition observed across more than 100,000 policyholders in 2025. The FBI logged over $3 billion in reported BEC losses last year, averaging around $123,000 per incident. These are not breach headlines from big companies. They are wire transfers and invoice fraud at businesses this size.
Sources: Coalition 2026 Cyber Claims Report · FBI IC3 2025 Internet Crime Report
Most of the protection a small business needs against it is already in the Microsoft 365 or Google Workspace license it pays for. The gap is configuration:
That gap is what this service closes, and it is what a cyber-insurance questionnaire is testing when it asks about link protection and sandboxing for inbound mail.
What we do
We do not sell you another filter. We make the one you already pay for do its job, and we keep it that way.
Microsoft 365 and Google Workspace both ship anti-phishing and impersonation protection. Left at the defaults, it misses the look-alike sender and the fake invoice. We configure it for your tenant, your domains and the people attackers impersonate, and keep it configured as staff and domains change.
Safe Links and Safe Attachments in Microsoft 365, or the Security Sandbox in Google Workspace, switched on and applied to every user where your license includes them. If it does not, we tell you in writing which license adds them before you decide. This is what a cyber-insurance questionnaire's control #15, link protection and sandboxing for inbound mail, asks about.
Mail from outside your organization is tagged, so staff can see at a glance that the “partner” asking for a wire change is not inside the building. Legacy authentication, the old sign-in protocols that skip MFA, is turned off, so a stolen password alone does not open the mailbox.
We publish SPF, DKIM and DMARC for your domain, read the DMARC reports, and move the policy toward enforcement once your legitimate senders are accounted for. Mail forged in your domain's name then gets rejected instead of delivered, including to your own clients.
This is configuration and monitoring. Microsoft or Google still does the filtering, and nobody reads your mail around the clock. If a phish leads to a stolen session, Managed ITDR is the layer that watches for the takeover.
Why it is different
A lot of small businesses on Microsoft 365 already have more email protection than they have configured. Before we quote anything, we check whether your built-in filtering, your DMARC policy, and your identity monitoring are actually turned on and doing the job. If they are, we say so, and you keep your money. That is the whole brand: we tell you when you do not need us.
How onboarding works
A direct call with the person who would do the work. We confirm your mailbox count, which Microsoft 365 or Google Workspace license you have, and what is already turned on. If your setup is already fine, we say so.
Within one business day after the briefing you get a fixed-fee proposal: scope, term, onboarding, and the environments we connect to, in writing before anything is signed. Pricing is quoted per environment, not read off a public list.
We work in your Microsoft 365 or Google Workspace admin console with access you grant. Your mail flow does not change: no new mail server, no MX cutover, no migration. DMARC moves toward enforcement in stages, so legitimate mail is not rejected along the way.
We monitor the DMARC reports and re-check the settings, and we tell you in plain English when something needs a decision: a new sending service, a license change, a setting someone turned off.
Pricing
Managed email security is included in Ridge Plus, at $50 per person per month, and in Ridge Reserve. Outside those tiers it is quoted per environment: you get a fixed-fee proposal after the briefing, with scope and term in writing before anything is signed.
For the managed tiers, see full pricing.
What sits next to it
In each case, we operate it and handle the response.
Where this fits
Managed Email Security configures the protection already built into Microsoft 365 or Google Workspace and sets up SPF, DKIM and DMARC. It pairs with ITDR (the identity layer) and SAT (the human layer) to cover the way most incidents actually start.
Pairs with Managed ITDR, Security Awareness Training, and Managed Detection & Response.
Payment-redirect and vendor-impersonation email is the front door to the office manager's inbox. Email Security moves your DMARC policy to enforcement, so attackers cannot send mail as your own practice domain. It is the cheapest high-impact control many offices have never turned on.
How this works for dentalClosing-wire fraud begins with a convincing email. Impersonation protection, link scanning where the license includes it, and DMARC enforcement cut what reaches a paralegal, and the callback-verification habit SAT teaches handles the rest.
How this works for law firmsRefund-redirect and IRS-impersonation email spikes in tax season. Impersonation protection and external-sender tagging flag look-alike mail, and DMARC stops mail forged in your own domain's name, when preparers are moving fastest and least likely to double-check.
How this works for accountingThe insurance wedge
Carriers ask about email filtering, link protection, and whether DMARC is enforced on your domain. These are concrete, checkable controls — the Readiness Sprint documents which ones you run and closes the gaps before the underwriter asks.
From $1,500, delivered in 7 business days — final quote depends on scope, up to $3,500. Signed evidence pack mapped to your carrier's questionnaire — delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
FAQ
No. Managed email security configures the protection you already have, Defender included, instead of adding a layer on top. For most small teams, Defender configured well plus enforced DMARC is the right answer, and that is the service.
No. We work in your Microsoft 365 or Google Workspace admin console with access you grant. Your mail flow does not change, there is no cutover window, and there is no migration.
No fixed minimum. The work is configuring the protection your Microsoft 365 or Google Workspace license already includes, and the proposal is scoped to your mailbox count.
If a phish leads to an account takeover, that is Managed ITDR's job, on every tier from Ridge Core: it watches for the new inbox rule, the forwarding and the unfamiliar sign-in, and we coordinate the response from there.
Email Security itself is configuration and monitoring. Nobody reviews your mail around the clock.
A rewritten link is not a trust signal: attackers launder phishing links through the security gateways that rewrite them. Safe Links, where your license includes it, checks the destination again at click time, and we make sure it is on for every user.
It is included in Ridge Plus, at $50 per person per month, and in Ridge Reserve. Outside those tiers it is quoted per environment after the briefing, with a fixed fee and the scope in writing. You will have the number before you decide anything.
Related
Next step
See where you stand in about 10 minutes, or talk with us. Both are free and we tell you when your current setup is already fine. 30 minutes, plain language, a person who returns your call within one business day.