When the Experts Choose: Why GuidePoint Security Trusts Virtru for Email Security

The Result

• A Vetted, No-Regrets Choice: Virtru cleared GuidePoint's full vendor gauntlet — architecture review, third-party risk management, and the extra scrutiny of a product it stakes its own name on. "It delivers on that. It is easy to implement."
• Security That Meets Users Where They Work: Virtru for Gmail prompts the sender in the moment and gives recipients a frictionless way to open protected messages — no new passwords or portals. "Better ease of use equals overall better security posture."
• A Layered Defense, Inbound and Outbound: Virtru's outbound protection integrates directly with GuidePoint's existing tooling (including Abnormal AI for inbound email security). "That segregation of duties allows me to take advantage of multiple products — a layered security defense model."

GuidePoint Security is solely focused on cybersecurity, helping organizations solve their most complex security challenges, align security with business objectives, minimize risk, and ensure compliance. A core part of that work is helping clients navigate the cybersecurity landscape and vet, select, and integrate the best-fit technologies for their environments … which means GuidePoint's own standards for the tools it trusts are exacting. That puts data at the absolute center of everything the firm does, and raises the bar for how GuidePoint protects its own.

"We take data protection very seriously at GuidePoint," says Tyler Neemann, Vice President of IT. "We have a lot of requirements from a security perspective from our audits, a lot of requirements that come from our customers, and then we have the brand reputation that we have to maintain." As Neemann puts it, the firm's credibility rests on a simple principle: "Trust us in our actions, not just in our words."

When a company that advises others on security for a living chooses an email security partner, the choice says something. GuidePoint chose Virtru.

"Users Are Irresponsible": Securing Email, the Biggest Exfiltration Point

Neemann is refreshingly honest about where the real exposure lives.

"Your biggest data exfiltration point, and infiltration point, is email," he says. "At the end of the day, users are irresponsible. Myself included. We're doing a hundred thousand things a day. Does every person apply the correct level of scrutiny to every message that's going in and outside of the organization? That's just not reality."

No one, he points out, is manually inspecting message headers before hitting send.

"Am I looking that DKIM passed and DMARC was okay, and that it came from a reputable IP address? I'm not doing that. And no user would be expected to."

It’s an unrealistic expectation.

"It's important to have products that seamlessly blend into the natural user work stream, so they have to think less about ‘Is it bad what I'm doing?’ and more about what I'm doing, but we can't sacrifice those protections in that pursuit of higher efficiency."

The Happy Middle Ground: Virtru Gateway + Virtru for Gmail

The traditional model, Neemann notes, protects at the gateway and hands recipients a login portal. "There's nothing wrong with it. But you have to question, is there a better way?"

For GuidePoint, the better way was to bring the decision to the user in the moment, a middle ground between an invisible server-side safety net and asking every employee to own every call.

"Let's proactively tell them, ‘Hey, you're sending something that's matching some criteria we're defining as sensitive,’" he says. "'Mr. User, let's give you the prompt: Do you want to encrypt this?' ' Well, yes I do. Thank you, Virtru, for telling me.' And the message goes off on its merry way."

That combination (Virtru Gateway watching for sensitive data automatically, and Virtru for Gmail) putting the choice in front of the sender — is exactly the layered, human-plus-automated model GuidePoint wanted. And the controls don't end at send. "It's not just about the initial transaction," Neemann says. "We want the ability to revoke it, we want to do something different than what we did initially. Those are all the things we were looking at — and those are the boxes that Virtru ticks."

No Passwords, No Portals: A Frictionless Recipient Experience

Ask any IT leader about encryption portals, and you'll hear the same story.

"We already have a bazillion passwords that we're trying to remember," Neemann says. "From a help desk perspective, we're getting the requests that come in when these people can't access information because they don't remember their password, their reset goes wrong, they don't read it, the portal's not loading. There's a million things that happen."

Virtru removes the hurdle entirely. The sender's experience lives inside Gmail; the recipient's experience is built to just work. No new account, no password to reset, and no portal to wrestle with. For a firm whose recipients are its own customers, that seamlessness protects more than data. It protects the relationship.

"The Math Makes It Easy": Rolling Out Email Encryption Domain-Wide

Security tools, Neemann observes, were "notoriously terrible to use" for years, with UX treated as an afterthought. That's no longer acceptable in a threat landscape where "our attack vectors are greater in number than we've ever been."

His fix is simple, and it’s one many IT leaders like him have been advocating for years: Make the tool something people can use without a CS degree.

"We'll call it dummy-proof. I'm going to give you a plain-text interaction point that you don't need a degree to understand. You're doing something, do you want to continue doing said thing?"

Even a user who blindly clicks encrypt anyway improves the organization's posture, he argues, "because the engagement increases." Weigh that against the effort of the old workflow, and the decision writes itself. "The math makes it easy. Higher interaction, higher engagement, better ease of use equals overall better security posture. So it's not a question of how do we roll this out, it's a question of how do we get this out as fast as possible."

GuidePoint piloted first — "trust but verify" — then went domain-wide. "Once that's been checked and everybody's happy with the way it's working, you lift the curtain and let it roll."

The clearest sign of success was what didn't happen: new employees needed no special onboarding. "The new users that are coming on board, they don't need that," Neemann says. For everyone else, it was less a hard cutover than a gentle nudge: "We're kind of retraining user behavior, but doing so with a product that enables them to consume that at an expeditious rate — versus us trying to change muscle memory, which is always difficult."

GuidePoint's professional services teams (sending confidential information in and out all day) became the natural power users, alongside HR and finance. "Email is just the de facto standard for a lot of people that we work with," Neemann says. "That's how they want to do it."

A Layered Defense with Abnormal AI: Inbound and Outbound, Without Compromise

GuidePoint pairs Virtru's outbound protection with Abnormal on the inbound side — and Neemann is emphatic that the two coexist without either being watered down. Too often, he says, layering "bleeding-edge" tools forces you to "degrade controls in order to make everything work in a harmonious fashion," which means "the product isn't doing everything it was designed to do."

Virtru avoided that trap. "I can continue to do the things at the traditional SEG, get rid of the really, really bad stuff, and then I've got the enhanced controls from a product like Abnormal applying the AI security layers on ingress," he explains.

"And then from an egress perspective, Virtru's going to come in and say, okay, now all your inbound mail's been protected — now you're going to send data outbound, so we're going to make sure the data encapsulated in this transmission is also protected.

Because of that segregation of duties, it allows Neeman and his team to take advantage of multiple products to have a layered security defense model that other platforms wouldn't allow.

Watch: Beyond the SEG: Building Superior Email Security with Abnormal & Virtru

The Expert's Recommendation: Email Security That Actually Deploys

Neemann sits in a rare seat. He vets vendors not only for GuidePoint's own use, but also as products the firm will stand behind in front of customers. So his pitch for Virtru carries extra weight.

"All these products are going to come in and say they're going to do all of this," he says. "The question is: can I get it in place expeditiously? Can I get the adoption of the general population? And does it actually deliver on the things it says it's going to do? If you cannot implement a thing, you wasted time and money and energy and user currency and trust."

Virtru, he says, clears the bar. "It says it's going to do a thing. It delivers on that. It is easy to implement. It's not an overly complex process where you've got to flip this trigger and degrade this control and reroute this around in a giant circle. It's just going to blend into your natural transmission workflow, and your users are going to be able to use it without having a PhD in email security."

As for the partnership itself: "The company's been great to work with. I think the partnership's been fruitful, and I've genuinely enjoyed getting to know everybody on the Virtru team."

Respecting the Data, Earning the Trust

For GuidePoint, protecting information is the foundation of the firm's credibility.

"Now more than ever, data security is our most important consideration day to day," Neemann says. In a moment when AI and LLMs are erasing the old boundaries around data and "the emphasis on data protection is probably at the highest it's ever been," GuidePoint wanted a partner that protects the mission without getting in its way.

That's the throughline of Virtru's approach. Respect the Data, because respecting data means respecting the people who create and depend on it. GuidePoint's endorsement is the kind that's hard to earn: not from a company that had to be sold, but from one whose entire business is knowing the difference between security that works and security that merely claims to.

"Trust us in our actions, not just in our words," Neemann says. By that standard, the choice speaks for itself.

Ready to see why the experts choose Virtru? Book a demo →