AFAIK the connection between the Outlook Add-In and Marketo uses HTTPS. This means that part is as secure as the connection between Outlook and Exchange. However as @Josh well points out, the subsequent connection will not be secure as Marketo is using public SMTP to send to the recipient (just as you would be if you used your Exchange server for the next hop and did not have a point-to-point secured connection with the recipient).
"Securely" is perhaps vague a term, though. What might actually be meant (I don't know what regulations/rules are in play) is a transmission which can be signed to prove the attribution of the content. The contents of a signed email are not necessarily encrypted -- they can be read by someone who happens to intercept the email. However the authorship can always be attributed, using a digital signature that is also attached to the email. The intent is to prohibit any email from being sent from your domain that cannot be proven to have been authored by you. At the server-to-server level, this is what DKIM (which Marketo does support) allows. If a recipient only considers emails that pass DKIM, with a specific DKIM record like gregl._domainkey.example.com to actually be from your domain, then no one can send out a fake proposal on your behalf.
On the flipside you can point them to documents downloadable via SSL. The download will thus be secure in transit. But if you send out an email with an https:// link, how do you stop people from intercepting the plain-text email (if that's what you were trying to combat in the first place), copying the SSL link, and just doing the download themselves? And for that matter, how do you make the final recipient authenticate that an email came from you without taking steps (like DKIM and/or PGP) to ensure that the email itself was not tampered with?
In-depth security is a larger discussion than is suitable for this community, of course, but I worry about people thinking processes are secure when they actually have these big logical gaps.
.png)