AegisAI Lands $36M as AI Spear-Phishing Surges Fivefold and Clears Every Legacy Filter

AegisAI said Wednesday it raised a $36 million Series A led by Battery Ventures to deploy autonomous AI agents inside corporate inboxes, countering a surge of AI-generated spear-phishing attacks that clear every legacy security check and arrive in voices the target trusts.

The attack math has shifted. AI-generated spear-phishing made up 2.8 percent of the phishing AegisAI observed in early 2025. By the end of the year, it reached 13.9 percent, according to a study the company presented at this year's M3AAWG conference, drawn from more than 20,000 malicious emails.

The AI-generated emails reached inboxes at nearly twice the rate of human-written attacks. Almost 73 percent of the ones that got through had cleared email authentication because they came from real accounts that attackers had quietly taken over. The FBI's latest Internet Crime Report recorded a record $20.8 billion in losses. Business email compromise alone accounted for $11.64 billion.

"The most immediate, catastrophic risk to your organization isn't an AI agent hacking your firewall," said Cy Khormaee, co-founder and CEO of AegisAI. "It's an AI model manipulating someone in your organization into handing over the keys."

Khormaee founded the company in 2025 with Ryan Luo. Both spent years inside Google's core security group where they helped build reCAPTCHA, Safe Browsing, and Web Risk. Their AI agents inspect each message the way a human analyst would, reading intent and identity rather than matching patterns. The company claims it cuts false positives by up to 90 percent against legacy tools.

"A decade of building security for the world's largest email system does not hurt," said Dharmesh Thakker, general partner at Battery Ventures, who led the round. Existing backers Accel and Foundation Capital also participated. The financing brings AegisAI's total capital to $49 million.

The startup is not alone. Lightspeed-backed Ocean raised $28 million in May to tackle the same problem, while incumbents like Proofpoint, Mimecast, and Abnormal Security face pressure to retrofit AI detection into rule-based architectures.

AegisAI has signed dozens of customers across fintech and technology, including crypto payments company Mesh, AI developer platform LangChain, and privacy compliance firm Lokker. The company also introduced Vanguard, a threat-hunting agent that follows suspicious links and attachments onto the open web and returns a threat report within minutes.

The broader question is whether AI-native email security becomes a standalone category or gets absorbed by the Microsoft and Google ecosystems where the inboxes already live. AegisAI's bet is that the speed of AI-generated attack evolution outruns the development cycles of platform-native tools.

Source