AegisAI, founded by former Google security execs, lands $36M to stop AI-driven spear phishing

Phishing used to be easy to spot. You’d get an email from a supposed prince in a far-off land, riddled with spelling errors and weird formatting, asking for your bank details. It was a numbers game for the attackers, and a common sense test for the rest of us. But those days are officially dead. We are now entering an era where your boss, your spouse, or your vendor can be perfectly spoofed by a machine in seconds.

The Problem of Scale

The traditional security stack is failing because it was built for the old world. Most enterprise filters look for known bad domains, malicious attachments, or blacklisted IP addresses. This is essentially a giant checklist. But generative AI has turned the checklist into a relic. When a bad actor can use a large language model to scrape your LinkedIn profile, study your writing style, and reference a specific project you mentioned in a podcast, the resulting email doesn't look like spam. It looks like work.

This isn’t just a theory. We’re seeing a massive spike in spear phishing that bypasses the standard corporate gateways. This is why AegisAI just pulled in $36 million in funding. The company, started by former security leadership at Google, isn't trying to build a better filter. They are trying to build an artificial brain that reads mail the way a suspicious human does.

The Concept of Behavioral Analysis

When you read an email, you aren't just looking for viruses. You are looking for context. You’re asking yourself if the tone is right, if the request makes sense for this time of day, and if the sense of urgency feels earned. Traditional software can't do that. AegisAI’s approach involves deploying agents that analyze the nuances of communication—the small anomalies that a checklist would miss but a human intuition might catch.

For a founder, this is a fascinating shift. We’ve spent years focusing on the perimeter—locking the doors and windows. But if the attacker can walk through the front door because they look exactly like your lead developer, the locks don't matter. AegisAI is betting that the only way to beat AI-driven social engineering is with AI-driven behavioral defense.

The Founder Perspective

I’ve talked to enough security teams to know that the biggest fear right now isn't a complex server exploit; it's the person in accounting getting a voice memo or a deep-fake email that tells them to change a wire transfer destination. The tech used by attackers is getting cheaper and more accessible every month. If you can generate a thousand personalized attacks for the cost of a few cents, the defense has to be equally automated.

What interests me about the AegisAI team is their background. Coming from Google’s security trenches, they’ve seen how scale works against you. When you have billions of users, you can't rely on manual intervention. They are taking that high-scale mentality and applying it to the hyper-specific nature of spear phishing. It’s a classic case of using the enemy's strength against them.

Why This Matters for Builders

If you are building in the crypto or AI space, you are a target. Period. These industries attract the most aggressive social engineering because the payouts are high and the tech is often misunderstood by the general public. We need to stop thinking about security as a product you buy and start thinking about it as an continuous layer of intelligence.

• Context is the new firewall: Your metadata doesn't tell the whole story. The content of the communication is where the risk lives.
• Human intuition doesn't scale: You can't train every employee to be a forensic linguist. You need tools that do the heavy lifting.
• The cost of failure is rising: One successful spear-phishing attack can drain a treasury or compromise a codebase.

The $36 million round is a clear signal that the venture world sees the current security infrastructure as inadequate for the generative AI era. They aren't investing in another antivirus. They are investing in a way to protect the human element of the business.

Some Healthy Skepticism

As much as I like the concept, we have to be realistic. Security is always an arms race. As soon as tools like AegisAI become standard, attackers will start training their models to specifically bypass behavioral agents. They will find the patterns that trigger the "all clear" and exploit them. No tool is a silver bullet, and builders shouldn't treat it as such.

That said, the transition from static filters to dynamic agents is the right move. We cannot fight a 2026 threat with 2010 logic. The move toward agents that understand intent rather than just syntax is the only way forward.

The Long Game

This isn't just about email. The same logic AegisAI is using will eventually need to be applied to Slack, Telegram, and even voice calls. We are moving toward a Zero Trust model not just for networks, but for communication itself. You should assume that every message you receive might be fake until a trusted agent verifies the context.

For founders, the takeaway is simple: check your assumptions about your current security stack. If you are relying on traditional providers to catch these new types of attacks, you are leaving a massive gap in your defense. Watch how this space evolves, because the battle for the inbox is just the beginning of a much larger shift in how we verify identity online.

The goal is not to stop every attack, but to make attacking so expensive and difficult that the bad actors move on to easier targets.

In the world of AI, the easiest target is always the one relying on yesterday's checklists. AegisAI is aiming to change that math, and $36 million gives them a lot of runway to try.

Read the original at TechCrunch AI →