Mimecast Data Leak Prevention

Mimecast Data Leak Prevention is a cloud service for governing sensitive information sent through email. It is best suited to organizations that need centrally managed email controls for risk and compliance work. Its range of policy actions is useful, but its email focus makes it a poor fit for teams seeking endpoint or cloud-app DLP.

Overview

Mimecast provides a web console for applying granular DLP policies to users and groups. Its cloud-gateway deployment supports Microsoft 365, Google Workspace, and on-premises or hybrid email. That breadth makes it relevant to organizations with mixed email environments, while its lack of endpoint controls, cloud-app controls, and data discovery limits protection beyond the mail channel.

Key features

Policies can scan headers, subject lines, body text, HTML, attachments, and inappropriate images. Administrators can use keywords, dictionaries, file hashes, and pattern matching to identify sensitive material. This offers several ways to define rules for different groups, though the results depend on administrators setting policies that match the organization’s information and handling requirements.

When a policy triggers, administrators can block a message, hold it for review, copy it to a group, deliver it securely, or add content such as a disclaimer. Secure Messaging lets external recipients receive sensitive information through a portal, while policy-based TLS encryption protects email in transit. These options give teams alternatives to simply blocking legitimate business correspondence.

The service can remove hidden Microsoft Word metadata, including comments and tracked changes, which helps avoid sending document history with an attachment. Mimecast describes integration with Microsoft Exchange and Office 365. Its policies can support PCI-DSS, HIPAA, and GLBA compliance work, but that is not a substitute for an organization’s broader compliance program.

Risk scoring, insider-risk workflows, incident workflows, case management, outbound filtering, and data exfiltration detection are also included among its capabilities. The product supports legal hold, eDiscovery, journal capture, search and export, and user and administrator quarantine access. It also includes phishing detection, malware scanning and sandboxing, and attachment scanning. Search and export are supported, though specific export formats are not documented.

Pricing

Mimecast’s DLP pricing is custom; no numeric price or billing term is given for this product. There is no free plan. The Advanced plan has custom pricing and adds data protection, but the supplied plan description does not define its scope further, so buyers should confirm what that means for their requirements.

Professional is billed as “Contact for pricing” and includes one SaaS/cloud exfiltration detector with 30 days of historical activity. Enterprise has custom pricing and includes one detector with 90 days of historical activity, making it the stronger fit when longer activity history matters. Gov has custom options and one detector with 30 days of historical activity. These detector and history terms should be weighed against the organization’s monitoring needs; none of these plans has a published numeric price.

Platforms

Mimecast is cloud-deployed and web-based. Supported mail environments include Microsoft 365, Google Workspace, and on-premises and hybrid email. Its email controls are the relevant platform strength; there are no endpoint controls, cloud-app controls, data discovery, or removable-media controls.

Who it's for

This is a sensible choice for organizations that want centrally managed controls over email leakage, especially where secure delivery, message review, or metadata removal are important. It is less suitable for organizations that need to discover data across repositories or enforce controls on endpoints and cloud apps.

Mimecast says customers can use its knowledge base, community, or support-case process. Its Trust Center lists ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2 Type 2, HIPAA, and other certifications or attestations—relevant considerations for organizations assessing vendor security and compliance posture.

Pros and cons

• Pros: Multiple policy actions, including secure delivery and review, let teams handle sensitive messages without relying only on blocking.
• Pros: Scanning covers message text, attachments, and images, with several detection methods and granular user or group policies.
• Pros: Word metadata removal addresses hidden document history that could otherwise accompany an attachment.
• Cons: Email is the focus; no endpoint controls, cloud-app controls, data discovery, or removable-media controls are included.
• Cons: Custom pricing and no free plan make cost comparison difficult before a sales discussion.
• Cons: The Advanced plan description says it adds data protection but does not define the included scope.

Alternatives

Choose Cyberhaven Insider Risk Management if its API, extension, Linux, macOS, Windows, and web platform coverage better fits your environment. Proofpoint Email DLP and Encryption is another paid email DLP option, with Android, iOS, web, and Windows platforms.

DTEX Insider Risk Management is a paid alternative across Linux, macOS, web, and Windows; its plan requires a demo and has no stated price. NetClean ProActive is a paid option for API, web, and Windows. Teramind Insider Risk Management is a paid alternative with a free trial and API, Linux, macOS, self-hosted, web, and Windows platforms; its Enterprise plan includes tailored deployment assistance, custom reporting and behavior-rule configuration, and premium support and SLA.

Behavox Falcon is a paid API and web alternative with commercial options discussed with sales. CurrentWare Data Loss Prevention has a free trial and an AccessPatrol standalone plan at $12 a month, billed annually, for USB/device control plus DLP; on-prem pricing requires contacting Sales. Safetica Insider Risk Management has a free trial and a Standard plan at $72 a year, priced annually per user, starting at $72, with five reports, five admin accounts, and 12 months of data retention.

For broader category comparisons, see Insider Risk Management Software, Email Anti-Spam Software, Email Security Gateways, Cybersecurity Training Platforms, Phishing Simulation Software, and Email Archiving Software.

Verdict

Mimecast Data Leak Prevention is a strong fit for organizations that want centralized email scanning with flexible policy responses, secure delivery, and metadata removal. Choose it when email is the channel you need to govern; look elsewhere if you need endpoint, cloud-app, or repository-wide data controls, or want a published price before engaging sales.