Two vendors run 91% of the secure email gateway market for US public companies - CipherCue

analysis<br>Two vendors run 91% of the secure email gateway market for US public companies

9 June 2026 &middot; 11 min read<br>&middot; By Chris McCabe

I resolved the public MX records for 2,584 SEC EDGAR-linked entities in CipherCue's database and matched each MX hostname against a vendor rule dictionary. The Microsoft 365 share was unsurprising. The gateway market was not.

Among the 1,877 entities with an identified MX vendor, the secure email gateway category (the layer that sits in front of a mailbox provider) is dominated by two companies. Of the 888 non-mailbox MX matches in the data, Proofpoint and Mimecast account for 812 of them, or 91.4% . If you narrow further to the three largest pure secure email gateway vendors (Proofpoint, Mimecast, Cisco), the figure is 92.4%.

91.4% of secure-email-gateway MX matches across SEC-linked companies are Proofpoint or Mimecast (812 of 888 non-mailbox MX matches; 92.4% if narrowed to the three largest pure gateway vendors)

Microsoft is the biggest single vendor at the MX layer (43.6% of identified entities), which is what you would expect. The interesting finding is what the data shows about the choice not to depend on your mailbox vendor for filtering. In the SEC-linked cohort, that choice resolves to one of two companies more than nine times out of ten.

How the matching works

The matching is intentionally simple: suffix rules over MX hostnames. For example, *.mail.protection.outlook.com maps to Microsoft 365 and *.pphosted.com maps to Proofpoint. This avoids guessing from opaque signals, but it also means the counts are conservative: anything hidden behind a gateway or not in the rule dictionary is not attributed.

The cohort is 2,584 SEC EDGAR entities in CipherCue's database with a CIK and an associated apex domain. Of those, 1,877 (72.6%) have at least one MX hostname matching a vendor in the dictionary. The remaining 707 either returned no resolvable MX records, had MX records pointing to vendors not in the dictionary, or have not been resolved in the current observation window (2026-05-03 to 2026-06-09).

The matcher considers every MX hostname returned for the apex, not only the lowest-priority record. So when a domain lists more than one vendor on its MX, each is counted. 21 entities (1.1% of the identified set) match more than one vendor, which is why share columns sum to slightly over 100%. The deduplicated entity-level top-three share is 86.2%.

The full vendor distribution

818

Microsoft

43.6%

mailbox

523

Proofpoint

27.9%

gateway

289

Mimecast

15.4%

gateway

149

Google

7.9%

mailbox

67

Cisco

3.6%

gateway

44

Barracuda

2.3%

security

Others

0.5%

security

Mailbox platforms Proofpoint & Mimecast Other email security

Vendor<br>Category<br>Entities<br>Share of identified<br>Cumulative

Microsoft<br>Mailbox platform<br>818<br>43.6%<br>43.6%

Proofpoint<br>Gateway<br>523<br>27.9%<br>71.4%

Mimecast<br>Gateway<br>289<br>15.4%<br>86.8%

Google<br>Mailbox platform<br>149<br>7.9%<br>94.8%

Cisco<br>Gateway<br>67<br>3.6%<br>98.3%

Barracuda<br>Email security<br>44<br>2.3%<br>100.7%

Fortinet<br>Email security<br>0.2%<br>100.9%

Sophos<br>Email security<br>0.2%<br>101.0%

Trellix<br>Email security<br>0.2%<br>101.2%

Isolating the gateway market

The headline Microsoft share doesn't tell you much. Microsoft 365 has been the default mailbox platform for large US organisations for years, and a dominant mailbox vendor isn't a surprising finding. What's more interesting is what the data shows when you remove the mailbox platforms entirely and look only at the layer designed to sit in front of them.

Two of the top six vendors are mailbox platforms: Microsoft 365 and Google Workspace. The other four are email-security or gateway vendors: Proofpoint, Mimecast, Cisco, and Barracuda. Below the top six, the residual long tail (Fortinet, Sophos, Trellix) totals nine entities across the whole cohort.

If you take all non-mailbox MX matches as the denominator (Proofpoint 523, Mimecast 289, Cisco 67, Barracuda 44, plus Fortinet, Sophos, and Trellix at 3 each, totalling 932) then Proofpoint and Mimecast account for 812, or 87.1% . If you exclude Barracuda (which is closer to a mailbox-included email security product than a pure gateway) and the long-tail Others, the denominator narrows to 879, and the combined Proofpoint + Mimecast share rises to 92.4% .

Denominator definition<br>Vendors included<br>Total matches<br>Proofpoint + Mimecast<br>Share

All non-mailbox MX matches<br>Proofpoint, Mimecast, Cisco, Barracuda, Others<br>932<br>812<br>87.1%

Non-mailbox excluding Barracuda<br>Proofpoint, Mimecast, Cisco, Others<br>888<br>812<br>91.4%

Three largest pure gateway vendors<br>Proofpoint, Mimecast, Cisco<br>879<br>812<br>92.4%

The duopoly framing holds regardless of where you draw the category boundary. The buyer who chooses an MX-visible secure email gateway in this cohort is making a choice between two products around nine times out of ten.

The gateway market looks different from the rest of the internet

The same...