SpamAssasin does ok only on subset of spam emails.. The problem is that underlying model is not capable to differentiate fake email from your boss (unless it's really simple) VS many other external emails you get.

I guess you would still want that 2nd level of protection for your ORG with sensitive data even if some "please buy X" - spam emails are still getting in.

Ofc Google is also not ideal :)

My experience mirrors yours. Fastmail’s filtering is at least as good as Google’s for my inboxes, but Google and the other big players don’t seem to have spam filtering better than Fastmail’s on balance. Casually controlling for things like inbox age, I still get a bit more spam in my Google inboxes than in my Fastmail inboxes.

Once you’ve warmed up/activated the personal mail filter in Fastmail, it seems to work better than anyone else’s.