Cybercriminals are increasingly harnessing artificial intelligence to launch attacks at an unprecedented scale, with email becoming their primary battleground. AI can rapidly gather personal details—like information about colleagues, ongoing projects, and recent travel plans—enabling attackers to instantly compose highly convincing, authentic-looking messages. Last year, former Google security experts Cy Khormaee and Ryan Luo, who previously worked on safe browsing technology and reCAPTCHA, joined forces to launch AegisAI. This startup employs AI agents to neutralize these sophisticated threats, commonly known as spear phishing.

Drawing on a decade of experience in preventing email breaches, the AegisAI co-founders recognized that traditional rule-based systems—which rely on rigid "if-then" logic—are too slow and limited to catch AI-crafted malicious emails. In response, they developed AI agents that analyze each message the way a human would, paying close attention to subtle anomalies that even the most thorough checklist might miss. Less than a year after its debut, AegisAI reports that its technology has been adopted by dozens of clients, including crypto payments company Mash, AI startup LangChain, and Lokker, a Google-owned privacy compliance platform.

This growing demand has helped AegisAI secure a $36 million Series A funding round led by Battery Ventures, with continued support from existing backers Accel and Foundation Capital. The new investment brings the startup's total funding to $49 million. "They've researched you, they understand everything about you, and they're targeting attacks that are perfectly bespoke to you," Khormaee noted.

Khormaee claims that AegisAI's agents can detect threats that traditional email security systems might completely overlook. For example, the startup's AI can identify malicious PDF attachments that appear legitimate at first glance, including those with built-in passwords and CAPTCHAs—tricks often used to bypass standard spam filters. When Dharmesh Thakker, general partner at Battery Ventures, observed a surge in email attacks, he set out to invest in a startup that could counter AI with AI, aiming to replace legacy email security tools with agent-driven defenses. "Defending against that is going to be a number one priority for a lot of companies," he said.

AegisAI is not alone in using AI to analyze the context of every incoming email to detect fraud and impersonation attempts. Lightspeed-backed Ocean is also working to displace established vendors like Proofpoint and Mimecast, as well as newer players like Abnormal Security. However, Thakker believes that because AegisAI is led by experts who helped secure Gmail—the world's most popular email system—the startup has the best chance of becoming the leading new hack-prevention company. While AegisAI is starting with email, the company has its sights set on eventually expanding into other areas of defense, such as data security. "The core idea of building customized, highly advanced agents that can do investigations is going to [determine] who becomes the next dominant security company," Khormaee said.