We may earn a commission when you buy through our links. Affiliate disclosure
Coupons and deals
Inspect the request as well as the attachment
Sentaro's Message product evaluates communication using its wording, sender context and relationship history. The intended problem includes a payment change or credential request that has no obvious malicious attachment. Its interface presents a finding with the message path, relevant identity information and a timeline.
For a suspicious supplier payment update, a security reviewer needs to understand who sent it, whether the account has communicated before and which detail changed. The product's role is to assemble signals and take the configured action; a convincing interface example is not proof of detection performance in another organization.
Combine several kinds of message evidence
The published scope includes display-name mismatches, lookalike domains, mail authentication posture, reply-chain context and links or QR-code destinations. These address different parts of an incident. A familiar display name is not equivalent to an authenticated sender, and an existing thread can still contain a suspicious new request.
Use findings to support the established verification process. A payment instruction should still be checked through the organization's approved independent channel. An AI verdict can help prioritize review without becoming the only authority for a consequential financial or account action.
Review software grants at the scope level
The App product inventories connected applications and OAuth permissions, including tools that can read mail, files or contacts. It shows the app, affected users, scopes and activity so that an organization can distinguish a necessary integration from an excessive or abandoned grant.
A free AI tool can hold significant access even when it never appeared in purchasing records. Review the permission actually granted, its business owner and whether the integration still has a purpose. Removing a grant should be coordinated with the owner of a legitimate workflow so that a security action does not silently interrupt required work.
Response controls need an operating plan
Sentaro describes inline labels, quarantine, blocking and revocation controls. The appropriate response depends on the configured policy and the evidence. A suspected message held for review has a different status from a confirmed threat whose access has been revoked.
Define who can release an item, mark a finding safe or change an enforcement rule. During evaluation, include legitimate but unusual messages and approved high-permission applications. False positives and missed threats both matter when judging the effect on the team.
Keep planned protection distinct from live features
The current site marks Message and App live, while Identity and Behavioral are scheduled for general availability in Q4 2026. The planned Identity scope includes exposure and lookalike-domain signals; Behavioral concerns deviations from a user's usual activity.
The present date falling within that quarter does not by itself establish release. Confirm the tenant's actual enabled product and acceptance criteria. A scenario diagram that includes a future vector is a product illustration rather than evidence that every depicted protection is active today.
Connect through the tenant and review data terms
The pricing page describes API connections to Microsoft 365 or Google Workspace alongside existing security tools, without requiring MX-record changes. The provider states that hosting is in Sweden and distinguishes its own analysis engine from third-party model processing.
Review the actual permissions, retention and DPA with the responsible administrator. The homepage explicitly marks SOC 2 and ISO 27001 certification as in progress. Procurement should request current evidence rather than treating a standards badge as proof that an audit is complete or that the organization's obligations are automatically satisfied.
Count protected accounts before comparing prices
Sentaro defines a protected account as a watched mailbox and says aliases or distribution lists are excluded from that count. Pro is priced per protected account, while Sovereign adds a custom arrangement for dedicated tenancy and related requirements.
Compare the enabled protection, deployment scope and written commercial terms for the plan available to the account. Check access requirements and the order total before committing to a deployment.
Sentaro FAQs
Are Identity and Behavioral confirmed live simply because it is Q4?
No. Current pages label their general availability for Q4 2026. Confirm the actual enabled release rather than inferring completion from the calendar.
Does every email alias count as another protected account?
The pricing FAQ defines the unit as a watched mailbox and says shared aliases and distribution lists do not count.
Are SOC 2 and ISO 27001 audits described as complete?
The current homepage marks certification in progress. Request current evidence during procurement.