Series A
$36M led by Battery Ventures, with Accel and Foundation Capital
Account takeover protection · Early access

MFA let them in. Aegis watches what comes next.

Agents read sign-ins and mailbox activity per account, and raise one explained finding when behavior stops matching the owner.

Book a demo> book_demo→↵Early Access·Same Connection as Inbound·No MX Change
Trusted by leading
security teams at:
The problem

MFA passes. The session is stolen.

A phishing proxy keeps the session cookie, so no second factor is asked for. Every step after the login looks legitimate.

31%

of MFA-bypass attacks used token theft, the most common technique.

Verizon 2025 Data Breach Investigations Report

Four ways past MFA

  1. Adversary in the middleA proxy relays real MFA and keeps the session.
  2. MFA fatiguePush prompts until someone approves one.
  3. Help-desk resetsA caller talks IT into moving the MFA.
  4. Hidden inbox rulesThe victim’s own replies quietly disappear.
The product

One account, one explained finding. Here is what your team sees.

Each signal is weak alone. Together, inside 24 minutes, on an account that has never made a rule, they fit a stolen session preparing fraud.

Illustrative example. Names and domains are fictional.
What it catches

Four ways a takeover shows up. Pick one to see it.

Finding · Sign-in14:02
a.chen@northwind.example · 198.51.100.40 · Linux / Chrome

Sign-in with MFA satisfied, from a first-seen device on a hosting provider network.

  • DeviceFirst-seen device for this account
  • TravelFaster than travel allows from the last sign-in
  • HistoryNever signs in from hosting providers
Likely account takeoverNext steps included
Illustrative example. Names and domains are fictional.
Customer proof

Attacks stopped. No extra work for the team.

Mesh Read the Mesh story
“The mark of a great email security system is that we don’t have to manage it. … It’s put a stop to the increasing number of attacks – even those using compromised infrastructure and AI to customize attacks to specific employees.”
Arjun MukherjeeCTO, Mesh
How it works

How Aegis spots a takeover

Behind that one finding, one agent per signal, weighed together per account.

The data

MFA works. The remainder is what matters.

>99%
How much modern MFA reduces identity compromise risk, per Microsoft.
32%
Rise in identity-based attacks in the first half of 2025, per Microsoft.
5 min
From session theft to payment fraud in one campaign Microsoft tracked.
FAQ

What your security team will ask

Doesn’t MFA already stop this?

Most of it. Token theft and adversary-in-the-middle kits get past it, so behavior after the login is the remaining tell.

Which signals does Aegis use?

Impossible travel, new devices, inbox rule changes and suspicious internal sends, weighed together per account.

Does Aegis revoke sessions?

Not today. Every finding comes with recommended steps, and your team acts in Entra ID, Okta or Google Workspace. Automated containment is next.

What does it need?

The same API connection as inbound, plus audit-log access. On Microsoft 365, sign-in reports need Entra ID P1.

Your turn

See it on your own tenant.

Early access runs on the connection you already have, review-only, with no MX change.

Request a demo> request_demo→↵
Same connection as inboundNo MX changeReview-only in early access

See what Aegis finds in your environment.

Connect a tenant, run in monitoring mode, and compare against what your current stack delivered.

Book a demo
→