In short: Avanan vs Mimecast comes down to architecture and scope. Avanan, now Check Point Email Security, connects to Microsoft 365 or Google Workspace by API and inspects mail after the native filter. Mimecast is best known for its MX-based gateway and now also offers API-based deployment, alongside archiving, DMARC and awareness training products.
The short answer
Harmony Email and Collaboration, originally Avanan, was built from the start as an API-based layer inside the Microsoft 365 or Google Workspace tenant. Mimecast is best known as a cloud email gateway that you point your MX records at, and now offers an API-based deployment option alongside it.
Both now cover phishing, malware and impersonation, and both offer add-ons for archiving, DMARC and security awareness training. The differences are in how each is deployed, how far protection extends into collaboration apps, and how the wider product range is packaged. Product names change, so we check both vendors' current line-ups when we advise.
Deployment: API inside the tenant vs gateway in front
Harmony Email and Collaboration connects by API, with no MX change. Microsoft's or Google's own filter runs first, then Check Point inspects each message, including internal mail between your users, before it reaches the inbox. Check Point describes enforcement from monitor mode through to inline prevention, so you can trial it without touching mail flow.
Mimecast offers two deployment options on its current site:
- MX-based: mail is routed through Mimecast's gateway before it reaches your mail service, giving perimeter protection in line
- API-based: protection connected directly to the cloud email platform, with no MX change
Mimecast states support for Microsoft 365, Google Workspace and on-premises email. An on-premises or hybrid mail server is one situation where a gateway still has a clear advantage, because an API-based product needs a cloud mailbox platform to connect to.
Feature comparison
| Harmony Email and Collaboration (Avanan) | Mimecast | |
|---|---|---|
| Deployment | API, after the native filter, no MX change | MX-based gateway or API-based |
| Mail platforms | Microsoft 365 and Google Workspace | Microsoft 365, Google Workspace and on-premises email |
| Internal mail inspection | Yes | Depends on deployment and configuration; check with Mimecast |
| Collaboration apps | Teams, SharePoint, OneDrive, Google Drive, Slack, Box, Dropbox, ShareFile (Email & Collaboration coverage) | Collaboration Threat Protection for Teams, SharePoint and OneDrive; Aware Governance & Compliance Suite for platforms such as Slack, Teams and Zoom |
| Attachment sanitisation (CDR) | Yes, in both tiers | Check current Mimecast packaging |
| DLP and encryption | DLP in the Complete Protect tier, with encryption as a policy action | Incydr Data Protection for insider risk; check current packaging for email DLP and encryption |
| Archiving | Archiving add-on, up to 10 years | Mimecast Email Archive |
| DMARC | DMARC Management add-on | DMARC Analyzer |
| Awareness training | Security Awareness Training add-on with AI phishing simulations | Engage Security Awareness |
| Analyst-led response to user reports | Incident Response as a Service add-on | Managed Threat Response |
| Wider platform | Check Point Portal with endpoint, mobile, browser, SASE and network security | Mimecast's email security and human risk platform |
Check Point details are from its Email Security plans page; Mimecast details from mimecast.com product pages. We have not included detection-rate or performance claims from either vendor.
Archiving, DMARC and awareness training
For many UK organisations, the deciding factor is not threat protection but everything around it.
- Archiving. Mimecast sells Email Archive as a named product in its range. Check Point's Archiving add-on stores email for up to 10 years with search, filtering and bulk export. If you have strict retention or e-discovery needs, compare the retention options, search and legal hold features of each against your policy.
- DMARC. Both offer tools to move your domains to an enforced DMARC policy. Check Point's is DMARC Management; Mimecast's is DMARC Analyzer.
- Awareness training. Check Point's Security Awareness Training uses real threats seen in your tenant to generate phishing simulations; Mimecast offers Engage Security Awareness. For an independent view, see our guide to security awareness training software.
Switching between them
Moving from a gateway to Harmony Email and Collaboration is usually straightforward because the two can run side by side:
- Connect Harmony Email to your Microsoft 365 or Google Workspace tenant in monitor mode while the gateway stays in place
- Compare what each catches over a few weeks, using your own mail
- Export or migrate any archive you need to keep, and confirm retention obligations
- Switch Harmony Email to inline prevention, then point MX records back at Microsoft or Google
- Remove gateway connectors and rules, and update SPF and DMARC records to match the new mail path
Moving the other way, from Avanan to Mimecast's MX-based gateway, means a mail-flow change and DNS updates, so plan a cut-over window.
Verdict: who suits which
Harmony Email and Collaboration tends to suit organisations that are fully on Microsoft 365 or Google Workspace, want protection with no change to mail flow, use several collaboration and file-sharing apps, or already run other Check Point products and want them in one console.
Mimecast tends to suit organisations that still run on-premises or hybrid mail, want a gateway in front of their mail service, or put archiving at the centre of their email strategy.
Forever Systems supplies and supports Check Point Email Security, and we will tell you honestly if a gateway approach fits you better. The fairest test is a side-by-side trial on your own mail. Contact us to arrange one, and see our email security guide for the wider picture.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the main difference between Avanan and Mimecast?
Avanan, now Check Point Email Security, connects to Microsoft 365 or Google Workspace by API and inspects mail after the native filter, with no MX change. Mimecast began as an MX-based gateway in front of your mail service and now also offers an API-based option.
Does Mimecast require an MX record change?
Its MX-based deployment does, because mail is routed through Mimecast's gateway first. Mimecast also offers an API-based deployment that does not need an MX change.
Does Avanan include email archiving like Mimecast?
Archiving is available as an add-on to Check Point Email Security, storing email for up to 10 years with search and bulk export. It is not included in the base plans.
Can I move from Mimecast to Avanan without downtime?
Usually, yes. Harmony Email can run in monitor mode alongside the gateway, then switch to inline prevention before MX records are pointed back at Microsoft or Google. Plan archive migration and DNS changes carefully.