Has anyone tried the Secure Email Gateway add-on? Worth it?

Tried it on a client's deployment. It's fine for basic filtering but overpriced for what you get.

If you're already deep in their ecosystem, maybe. But you're paying a premium for the integration. For the same cost you could run a more capable open source stack (rspamd, clamav, opendkim) on a small VM cluster. More control, and you're not stuck waiting for their support when a false positive cripples your inbound mail flow.

The API for incident response is clunky. Try pulling a specific quarantined message during an urgent investigation. You'll see what I mean. Their detections are decent for common campaigns, but I've seen it miss well-crafted BEC attempts that a human would catch.