Clarity in complexity: New insights for transparent email security

Microsoft’s second email security benchmarking report updates its ICES-focused methodology to better reflect real-world deployment patterns, addressing journaling and connector-based reinjection that could inflate detections when Defender and an ICES vendor both flagged the same threat. The update also adds Microsoft Defender zero-hour auto purge post-delivery detections alongside ICES vendor actions to show threats remediated after delivery.

Across ICES vendor benchmarking, layering ICES with Defender continues to reduce inbox clutter, with an average improvement of 9.4% across specific vendors, while gains for filtering spam and malicious messages remain modest at 1.65% and 0.5% respectively. When considering malicious messages that reached the inbox, Defender’s post-delivery purge removed 45% on average, while ICES vendors contributed 55% in post-delivery filtering.

The study’s tracking runs over data from June to August 2025, and the analysis is presented in the context of Microsoft Defender for Office 365 and associated benchmarking sites, according to Microsoft Digital Defense Report 2025. This aims to provide security leaders with transparent, real-world insights to plan layered email protection more effectively.