The Short Answer
Choose Mimecast if you need email continuity during outages, long-term compliance archiving (up to 10 years), advanced impersonation protection, and phishing simulation training in one platform. Choose Office 365 ATP (now Microsoft Defender for Office 365) if you want email security integrated natively into Office 365, lower cost, and simpler management. For most UK SMEs, Office 365 ATP Plan 1 or Plan 2 is sufficient for basic email security. Choose Mimecast if you have compliance requirements (FCA, legal), need email continuity, or face targeted phishing attacks that ATP is not catching.
Mimecast vs Office 365 ATP at a Glance
| Feature | Mimecast | Office 365 ATP (Defender for O365) | |---------|----------|----------------------------------| | Spam & malware blocking | Excellent (multi-engine) | Good (single engine) | | Phishing protection | Excellent (impersonation) | Good (improving) | | Email continuity | Yes (web portal + mobile) | No | | Long-term archiving | Yes (up to 10 years, tamper-proof) | Limited (In-Place Archive) | | Legal hold & eDiscovery | Comprehensive | Limited | | Phishing simulation training | Included | Separate product (Attack Simulator) | | Cost | £4–£12/user/month | £2–£4/user/month (add-on) | | Management complexity | Medium | Low (integrated in O365) | | Setup time | 1–2 weeks | 1–2 days |
Mimecast Strengths
Mimecast provides four layers of protection that Office 365 ATP does not fully match:
- Email continuity — When Office 365 goes down, Mimecast keeps email flowing. Users can send and receive email through the Mimecast web portal or mobile app. All email is queued and synced when Office 365 comes back. This is a feature ATP simply does not have.
- Long-term compliance archiving — Tamper-proof cloud archive storing every email for up to 10 years. Supports legal hold, eDiscovery, and regulatory compliance (GDPR, FCA, HIPAA). Office 365's In-Place Archive is not tamper-proof and has limited eDiscovery.
- Multi-engine threat detection — Mimecast uses multiple detection engines from different vendors, reducing the chance that a threat slips through. ATP uses Microsoft's single engine.
- Impersonation protection — Detects emails that mimic executives, suppliers, or partners — the primary technique in business email compromise (BEC) attacks. More sophisticated than ATP's anti-phishing policies.
- Phishing simulation training — Included in the Mimecast platform. Sends realistic phishing simulations to users and provides instant training to those who click. ATP requires a separate product (Attack Simulator in Defender for O365 Plan 2).
Office 365 ATP Strengths
Microsoft Defender for Office 365 (formerly ATP) provides strong email security integrated natively into Office 365:
- Native integration — No separate service to manage. Security policies, alerts, and reports are all in the Microsoft 365 security centre alongside your other Microsoft security tools.
- Safe Links — Rewrites URLs in emails and checks them at click time. Blocks malicious links even if they were safe when the email was received.
- Safe Attachments — Detonates attachments in a sandbox before delivery. Detects zero-day malware that signature-based systems miss.
- Anti-phishing policies — Detects spoofing and impersonation. Improving rapidly with each update but still less sophisticated than Mimecast's impersonation protection.
- Lower cost — ATP Plan 1 costs around £2/user/month. Plan 2 (with Attack Simulator and automated investigation) costs around £4/user/month. Mimecast costs £4–£12/user/month.
- Zero additional infrastructure — ATP is built into Office 365. No MX record changes, no separate console, no additional vendor relationship.
What Office 365 ATP Cannot Do
- Email continuity — If Office 365 goes down, your email is down. ATP does not provide a fallback. Mimecast keeps email flowing during outages.
- Tamper-proof archiving — Office 365's In-Place Archive can be modified by administrators. For legal and regulatory compliance, a tamper-proof archive is often required. Mimecast's archive is WORM (write once, read many).
- Multi-engine detection — ATP uses Microsoft's detection engine only. If a threat evades Microsoft's engine, it gets through. Mimecast uses multiple engines, reducing this risk.
- Integrated phishing training — ATP Plan 2 includes Attack Simulator, but it is a separate tool with less functionality than Mimecast's integrated simulation and training.
Cost Comparison for 50 Users
Mimecast Standard:
- £7–£9/user/month = £4,200–£5,400/year
- Includes threat protection, continuity, archiving, and training
- Total: £4,200–£5,400/year
Office 365 ATP Plan 2:
- £4/user/month = £2,400/year
- Does not include continuity or tamper-proof archiving
- Total: £2,400/year (plus separate backup/continuity solution if needed)
ATP is cheaper upfront, but if you need continuity and compliance archiving, you need additional products — which can bring the total cost close to or above Mimecast.
The Verdict
For basic email security, Office 365 ATP is sufficient and cheaper. Choose Mimecast if you need email continuity, compliance archiving, face targeted phishing attacks, or are in a regulated industry (financial services, legal, healthcare). Many businesses use both — ATP for native integration and Mimecast for continuity and archiving.
Frequently Asked Questions
Can I use both Mimecast and Office 365 ATP?
Yes. Many businesses use both — Mimecast sits in front of Office 365, scanning all email before it reaches ATP. This provides multi-layered protection. Mimecast handles continuity, archiving, and advanced threat detection, while ATP provides native integration and safe links/attachments. The combination is more expensive but provides the most comprehensive protection.
Does Office 365 ATP replace Mimecast?
For basic email security, ATP can replace Mimecast. However, ATP does not provide email continuity, tamper-proof archiving, or integrated phishing training. If you need these features, Mimecast is still required. Many businesses that switch from Mimecast to ATP alone later add Mimecast back for continuity and compliance.
How much does Mimecast cost compared to ATP?
Mimecast costs £4–£12/user/month depending on the package. Office 365 ATP costs £2–£4/user/month. Mimecast is 2–3x more expensive but includes continuity, archiving, and training that ATP does not. If you need those features, Mimecast is more cost-effective than buying ATP plus separate continuity and archiving solutions.
Which is better at stopping phishing?
Both are good, but Mimecast's impersonation protection is more sophisticated for targeted attacks (BEC, spear-phishing). ATP's anti-phishing is improving rapidly and is adequate for most generic phishing. If you face targeted attacks impersonating executives or suppliers, Mimecast has the edge.
Do I need email continuity if I have Office 365?
Office 365 has a 99.9% uptime SLA, but outages do happen. In 2023, Microsoft experienced several significant outages affecting UK businesses. If email is critical to your operations, continuity (via Mimecast or another solution) ensures you can still send and receive email during a Microsoft outage. For businesses where email downtime is merely inconvenient, ATP without continuity may be acceptable.
