Email is still the front door to most businesses. It is also, right now, the easiest place for criminals to walk in.
The reason the problem is getting worse is not that hackers have become more skilled. It is that AI has made skill largely unnecessary. Tools freely available online can scan a target's public profiles, read their company announcements, identify their colleagues, and write a fake email that references all of it. The result sounds like it came from someone who knows you. AI-written phishing emails now achieve click rates of up to 54%, compared to about 12% for old-style generic scams.
The financial damage is not abstract. Business email compromise, which is the category of attack where criminals impersonate a trusted contact to approve a payment or transfer funds, costs organizations an average of $4.67 million per incident according to IBM's 2025 data. The FBI logged $2.77 billion in reported losses from this type of attack in 2024 alone, and those are only the incidents that were reported.
AegisAI, founded in 2024 by Cy Khormaee and Ryan Luo, two engineers who spent roughly a decade at Google building defenses for Gmail, raised $13 million at launch and has now closed a further $36 million Series A led by Battery Ventures. The total raised is $49 million. The company's customers already include crypto payments firm Mash, developer tooling company LangChain, and a Google-owned privacy platform called Lokker.
The core idea is straightforward. Most existing email security systems work like bouncers with a checklist: they look for known bad senders, suspicious links, or unusual file types. AI-crafted emails sail through those filters because they do not match any known pattern. AegisAI's system instead reads each email as a person would, weighing the full context of the message against what is normal for that recipient. The company claims it catches malicious PDF attachments that include built-in passwords and fake verification screens specifically designed to fool automated scanners.
The market AegisAI is entering is crowded but clearly in motion. The email security market sits at around $7 billion and is on a path toward $16 billion by 2032. The established players, Proofpoint and Mimecast, are losing ground: Proofpoint reportedly lost more than 1,300 customers in the past year mainly to AI-native competitor Abnormal Security. AegisAI is targeting the same gap, but with founders who have a specific credential that Abnormal does not: they helped build the defenses for the world's most widely used email system.
One number from the threat side stands out. Researchers predict that by 2027, traditional detection methods will be unable to group AI-generated phishing emails into recognizable campaigns at all, because each email will be different enough to look unique. That is not a distant scenario. It means every business, regardless of size or industry, is heading toward a world where the email in your finance team's inbox genuinely looks like it came from your CEO, your auditor, or your biggest supplier.
AegisAI is a small company with less than a year of operating history. Whether it can hold its ground against well-funded competitors and the big platforms, Microsoft and Google, both of which are building their own AI defenses, is not settled. But the problem it is solving is real, it is getting worse, and the people running it have the relevant track record. If you are responsible for operations, finance, or procurement at any organization that handles money or sensitive data over email, the practical implication is the same regardless of which vendor wins: your current email security setup was probably designed for a world that no longer exists.