AegisAI raises $36 million to fight AI spear phishing

AegisAI, a startup founded by former Google security executives Cy Khormaee and Ryan Luo, has raised $36 million in a Series A round to build automated defenses against AI-driven spear phishing, according to TechCrunch. The round was led by Battery Ventures, with Accel and Foundation Capital participating, bringing the company’s total funding to $49 million. AegisAI says it already has dozens of customers less than a year after launch, including crypto payments company Mash, AI developer toolmaker LangChain, and Google-owned privacy compliance platform Lokker.

The pitch is that email—already the workhorse of corporate impersonation—has become easier to weaponise at scale as attackers use AI to assemble personal context quickly. TechCrunch describes how models can scrape and combine details such as coworkers’ names, active projects, and travel plans, then produce messages that read like internal correspondence. Khormaee told TechCrunch that AI-powered attacks bypass existing controls more than half the time, and that the new wave is “almost twice as effective” because it is highly personalised. That claim, in turn, is an indictment of the dominant tooling: many enterprise email filters still revolve around static rules and known-bad indicators, which are best at catching yesterday’s templates.

AegisAI’s answer is to use “AI agents” that assess each message more like a human reviewer would, looking for small inconsistencies that do not fit a checklist. The company argues that this helps with edge cases that are designed to look clean—messages with plausible narrative detail, or attachments that appear normal at first glance. One example cited by TechCrunch is malicious PDF attachments that include passwords and CAPTCHAs, techniques that can frustrate automated scanning pipelines and push the burden back onto the recipient.

The funding round also signals where buyers think the cost sits. If phishing becomes cheaper to produce and harder to spot, the spend shifts from training employees to buying ever more sophisticated gatekeepers. Battery Ventures’ Dharmesh Thakker told TechCrunch he has noticed an increase in email attacks and expects defending against AI-powered email fraud to become a top priority for many companies. AegisAI is not alone—TechCrunch notes other startups, including Ocean, are chasing similar “context-aware” detection while competing with established vendors such as Proofpoint and Mimecast and newer players like Abnormal Security.

For now, AegisAI is selling an email shield, but it is already talking about expanding into areas like data security. The company’s bet is that as attackers automate the front door, enterprises will pay for automated investigators on the inside.

The round’s headline number is $36 million. The day-to-day battleground is still the same: an inbox where a single convincing message can turn an employee into the weakest link.