u/Same-Designer-5499

Long short, we spent a few months running two SEGs in sequence, one of which we already had and one that came with an acquisition. Redundant yes, but double the distance covered.

Then an email came in impersonating the vendor payment details with just a believable note about changed bank details from a supplier we deal with every week. Two products, same miss. That was the moment it clicked that gateways are still built to scan payloads.

If you've eliminated the SEG and gone native plus something behavioral, what fell over?

Small nonprofit, all but eight of us. we dont have an IT person, but we outsource the little we can.
last month, a grant payment was nearly wired to the wrong account when an email almost identical to our program partners, on the same thread we'd been on for weeks came in, with just a small line mentioning they'd changed their bank details. our finance girl only stopped because she decided to call said partner's phone about it and thats when she learned our partners had been hacked and the bank change detail was a lie!
its pretty jarring because theres no system to catch such an occurrence between our ESP and bank account. so is atrted looking for tools myself but every one i found seems to only cater to big companies with full, working SOC's.
since we're only a small org without all the muscle financially, please recommend something affordable that worked if you have ever been in such a situation. TIA

Not sure if this is the right sub for a budget-ish question but here goes.

We are on M365 E3 and we bolt a legacy SEG in front of it. Renewal came in and it jumped again and I am sitting here trying to justify it to my director when Defender already does a chunk of what the SEG does. The overlap feels huge and I cannot cleanly explain what the SEG catches that Defender doesn't anymore.

A few things I really can't answer:

Is the SEG still pulling its weight against the stuff that actually hurts now, the BEC and vendor impersonation with no link or attachment. Or is that the gap both of them share.

For anyone who dropped their SEG and went M365-native only, did your miss rate go up or did nothing change except the invoice getting smaller.

And if you added a third thing instead, an API layer or whatever people use, what did it catch in production that the other two didn't.

Trying to make a real decision here, not collect vendor demos. Real production experience appreciated.