Mimecast vs Abnormal vs Barracuda: what email security costs per mailbox at 2,000 seats

The renewal is live because the add-ons, not the seat, set the bill

A 2,000-mailbox estate renewing email security this quarter is not choosing between three per-seat prices. It is choosing between three ways of splitting the same protection across line items, and the vendor pages that would carry those prices do not carry them. Mimecast's email security page describes multiple tailored plans without a figure. Abnormal's platform page describes an API deployment in 60 seconds and no MX changes, also without a figure. Barracuda's email protection page describes AI-enhanced defences and automated response, again without a figure.

That absence is the first finding for anyone pricing 2,000 seats. Each vendor publishes a capability list and a deployment model; none publishes a per-mailbox rate on the pages a buyer reaches first. The number that decides the renewal arrives in a quote, and the quote is only comparable if the buyer asks for the same four things from all three: the base email security seat, link and attachment protection at click time, archive retention, and continuity if the primary mail platform goes down.

Mimecast is the one of the three that names the adjacent products explicitly. Its page lists Continuity, DMARC, Security Awareness Training and Archiving as complementary solutions inside a single platform, and separately markets Archive and Sync & Recover in a customer quote. A buyer who prices Mimecast on email security alone and then adds archive and continuity is pricing a different product from the one the page describes.

The mailbox count where the built-in Microsoft 365 protection stops being the cheap answer is not stated on any of the three pages. What the pages do state is the gap each vendor claims to close: Mimecast layers advanced AI-driven threat detection to close gaps built-in features leave behind, Abnormal targets business email compromise and account takeover that slip past legacy gateways, and Barracuda says its protection goes far beyond what is built into Microsoft 365. Ask each vendor for the seat count at which their quote undercuts the add-on licence you would otherwise buy from Microsoft, and ask for it in writing.

What each platform actually does at the point of delivery

Mimecast offers two deployment shapes and the choice changes the architecture, not just the price. The gateway option routes all incoming mail through Mimecast's secure gateway first, intercepting threats in line, and supports advanced mail routing and custom multi-rule policies. The API option layers protection directly into the cloud email platform with no MX record changes and no mail flow disruption. Continuity, which keeps mail flowing if the primary server goes down, is described as built into the gateway path.

Abnormal's architecture is behavioural and API-only. Its Attune model learns each identity's normal work, access and relationships, then flags deviations, and the platform correlates email, identity provider and SaaS signals into one model. Deployment is stated as 60 seconds via API with no MX changes. The company says it has 5,000 customers including 30% of the Fortune 500, and that its model is trained on behaviour rather than signatures.

Barracuda's pitch is continuous re-evaluation after delivery. Its page argues that modern attacks look legitimate at delivery and weaponise later, so point-in-time detection is insufficient, and Barracuda IQ uses multi-model AI across more than 100 global threat feeds to re-evaluate risk after delivery. It connects to Microsoft 365 or Google Workspace with no MX changes and claims agentic clawback that removes threats across all mailboxes in near real time without SOC intervention.

The practical difference at 2,000 seats is where remediation happens. A gateway product can block before delivery but needs the mail flow to pass through it; an API product cannot block the first delivery the same way but can pull a message back from every mailbox after the fact. Mimecast offers both paths, which is why its quote has more line items to compare.

How the shortlist compares

The grid below holds what each vendor page actually states about price model, term and what the buyer gets. Where a cell says unpublished, the page carries no figure and the buyer has to request it. The term column is the weakest of the three: none of the pages states a contract length, so every term in the table is a question to put to the account team rather than a published fact.

Read the price model column as a warning about comparability. Mimecast's page describes multiple tailored plans plus complementary products sold inside one platform, so a like-for-like quote needs each of those products priced separately. Abnormal and Barracuda describe platform subscriptions whose contents are not itemised on the page, which means the buyer has to ask for the module list before the per-mailbox rate means anything.

Where each one breaks at 2,000 seats

Mimecast's breadth is the cost risk. A platform that includes continuity, DMARC, training and archiving can be the cheaper answer for an estate that would otherwise buy four products, and the more expensive answer for one that already has archiving elsewhere. The page does not say which components are bundled into which plan, so the buyer cannot tell from the page whether the quoted seat includes archive or adds it.

Abnormal's limit is scope. The page is explicit that its model learns identity, relationship and communication patterns and catches what rules-based approaches miss, which is a strong claim about business email compromise and account takeover. It is not a claim about gateway mail routing or continuity, and the page does not describe either. An estate that needs mail to keep flowing when the primary platform is down is buying that capability somewhere else.

Barracuda's limit is the same shape in reverse. Its page is built around post-delivery detection and clawback, with the argument that delivery-time protection clears threats that later activate. That argument is strongest for an estate that has already accepted delivery-time filtering from Microsoft and wants a second layer; it is a different purchase from replacing the gateway.

None of the three pages states a mailbox ceiling, a minimum seat count or a volume discount. At 2,000 seats those are the three numbers that move a five-figure annual contract most, and all three have to be asked for.

What it costs, and what to ask for

No per-mailbox price appears on any of the three pages, so the honest statement is that list pricing is quote-only for all three. That is not a reason to stop the comparison; it is a reason to specify the quote. Ask each vendor for a single document that prices 2,000 mailboxes for twelve months with link and attachment protection at click time, archive retention for the same period, and continuity, each as a separate line.

Ask Mimecast specifically which of Continuity, DMARC, Security Awareness Training and Archiving are included in the quoted plan and which are additional, because its page presents them as complementary solutions inside one platform rather than as one SKU. Ask Abnormal and Barracuda for the module list behind their platform subscription, since neither page itemises what the seat buys beyond the headline capabilities.

Ask all three for the renewal uplift clause and the minimum term. The pages are silent on both, and at 2,000 seats a multi-year term with a fixed uplift is usually worth more than a first-year discount. Ask also for the seat count at which their quote beats the Microsoft 365 add-on you would otherwise license, because that is the comparison the renewal actually turns on.

One number does appear across the pages and is worth carrying into the call: Mimecast states it protects more than 42,000 organisations, and Abnormal states 5,000 customers including 30% of the Fortune 500. Barracuda's page carries no customer count. Those are scale claims, not price evidence, but they tell the buyer how much reference material to ask for from each account team.

The decision rule

Choose Mimecast if the estate needs mail to keep flowing when the primary platform is down and would otherwise buy archive, DMARC and training separately, because its page is the only one of the three that describes continuity and archiving as part of the same platform, and price the quote with each of those lines itemised before signing.

Choose Abnormal if the estate already accepts Microsoft 365 filtering at delivery and the losses are business email compromise and account takeover, because its page is built around behavioural detection of identity and communication anomalies rather than gateway routing, and ask what happens to mail flow if the platform is unavailable since the page does not describe continuity.

Choose Barracuda if the concern is messages that pass delivery-time checks and weaponise later, because its page argues for continuous post-delivery re-evaluation and describes clawback across all mailboxes without SOC intervention, and confirm the module list behind the subscription before comparing the per-mailbox rate with the other two. Wait on all three until each has put the four line items and the renewal uplift in writing, because no page here publishes a price that a 2,000-seat decision can be made on.