[
  {
    "criteria": "Deployment model",
    "cloudflare": "SEG+ICES hybrid (Inline MX or API post-delivery or BCC)",
    "proofpoint": "SEG (Inline MX required)",
    "mimecast": "SEG (Inline MX required)",
    "abnormal": "100% API ICES (post-delivery, zero MX)",
    "ms_defender_p2": "Native M365 (EOP + Safe Links/Attachments)",
    "sublime": "API ICES (post-delivery)"
  },
  {
    "criteria": "Anti-BEC / VEC",
    "cloudflare": "Strong (Area 1, pre-attack time, EDF fingerprinting)",
    "proofpoint": "Very strong (Nexus AI, relationship graph, SPF macros)",
    "mimecast": "Good (behavioral detection, impersonation protection)",
    "abnormal": "ML leader (pure behavioral anomaly detection)",
    "ms_defender_p2": "Good (identity protection, Safe Links)",
    "sublime": "Very good (explainable rules, semantic detection)"
  },
  {
    "criteria": "Anti-phishing link",
    "cloudflare": "RBI/NVR (Network Vector Rendering, Inline only)",
    "proofpoint": "Very strong (TAP, URL defense, predictive sandboxing)",
    "mimecast": "Strong (URL rewriting, sandbox)",
    "abnormal": "Anomaly-based (detection via behavioral signals)",
    "ms_defender_p2": "Safe Links (URL rewriting, time-of-click detonation)",
    "sublime": "Explainable rule-based detection"
  },
  {
    "criteria": "Sandbox attachments",
    "cloudflare": "Yes (Forrester 5/5 antimalware)",
    "proofpoint": "Strong (TAP Attachment Defense, predictive sandboxing)",
    "mimecast": "Strong (Targeted Attack Protection)",
    "abnormal": "Limited (behavioral focus, no deep sandbox)",
    "ms_defender_p2": "Safe Attachments (Azure detonation)",
    "sublime": "Yes (integrated sandbox)"
  },
  {
    "criteria": "DLP",
    "cloudflare": "Free DLP Assist M365 for Email Security customers (compose-time)",
    "proofpoint": "Strong (Illusive DLP, outbound content classification)",
    "mimecast": "Strong (outbound DLP, encryption, content policies)",
    "abnormal": "Medium (inbound detection focus, limited DLP)",
    "ms_defender_p2": "Strong (Purview DLP, unified M365 classification)",
    "sublime": "Medium"
  },
  {
    "criteria": "Archiving / Continuity",
    "cloudflare": "No (no equivalent)",
    "proofpoint": "Yes (archiving via Enterprise Archive, optional continuity)",
    "mimecast": "Strong (Cloud Archive 99-year retention, Email Continuity)",
    "abnormal": "No",
    "ms_defender_p2": "Via E3+ (Exchange Online Archiving, compliance center)",
    "sublime": "No"
  },
  {
    "criteria": "BIMI / MTA-STS hosting",
    "cloudflare": "No (community request unanswered since 2022)",
    "proofpoint": "No (Agari for advanced DMARC)",
    "mimecast": "Yes (integrated DMARC Analyzer, BIMI and MTA-STS)",
    "abnormal": "No",
    "ms_defender_p2": "No",
    "sublime": "No"
  },
  {
    "criteria": "Transactional sending",
    "cloudflare": "Yes (Email Service Workers, 3,000/month included in Workers Paid then $0.35/1k)",
    "proofpoint": "No",
    "mimecast": "No",
    "abnormal": "No",
    "ms_defender_p2": "No",
    "sublime": "No"
  },
  {
    "criteria": "Setup complexity",
    "cloudflare": "API-first fast (API mode: 4 OAuth clicks), Inline more complex",
    "proofpoint": "Complex (mandatory MX, policies, Hosted SPF, DKIM 2048)",
    "mimecast": "Complex (mandatory MX, long onboarding, policies)",
    "abnormal": "Very fast (API only, OAuth authorization)",
    "ms_defender_p2": "Native (no MX changes, managed by M365 admin center)",
    "sublime": "Fast (API, automatic flow discovery)"
  },
  {
    "criteria": "Indicative price / user / month",
    "cloudflare": "Quote-based, ~$7 USD+ base (Spendhound 2025 market estimate)",
    "proofpoint": "Essentials $1.80-5 USD / P1-P2 $5-12 USD",
    "mimecast": "M2/M3 $4-8 USD",
    "abnormal": "Premium, not public",
    "ms_defender_p2": "$5 USD (or included in E5)",
    "sublime": "Medium, not public"
  }
]