Shay Shwartz has an intimate understanding of email phishing attacks. During his teenage years, he earned money as a hacker, but after being caught at age 16, he realized he could redirect his cyber skills toward prevention instead of offense. He then spent roughly a decade in elite cybersecurity roles, leading critical projects for Israel’s top defense and intelligence units—including work tied to the Iron Dome project—before joining Axis, a startup later acquired by HPE. Throughout this time, he was eager to launch his own company, and two years ago, he finally did. His startup, Ocean, an agentic email security platform designed to combat AI-powered threats, has just emerged from stealth mode with $28 million in total funding. The investment round was led by Lightspeed Venture Partners, with participation from Picture Capital and Cerca Partners. High-profile angel investors also joined, including Wiz co-founder and CEO Assaf Rappaport, as well as Yevgeny Dibrov and Nadir Izrael, co-founders of Armis—which recently sold to ServiceNow for $7.75 billion.

While established vendors like Proofpoint and Mimecast, along with newer players such as Abnormal Security, help detect standard phishing attacks, Shwartz (pictured right next to co-founder and CTO Oran Moyal) argues that AI demands a different defensive strategy. In the past, only highly sophisticated hackers could execute spear-phishing due to the extensive time, research, and manual effort required for targeted attacks. “I can instruct an LLM to go and understand exactly who you are, harvest a large amount of public information, and create those phishing attacks very targeted against you,” Shwartz explained.

Ocean claims its AI can thoroughly analyze the context of every incoming email to detect fraud and impersonation attempts. The startup is already reviewing billions of emails each month for customers including Kayak, Kingston Technology, and Headspace. Shwartz said Ocean built a small language model tailored to quickly analyze emails, understand the sender’s intent, and evaluate it against the user’s specific organizational context. “This is like having a guard in every door,” Shwartz said. “This is how we make the inbox a safe place with high hygiene.”