Series A
$36M led by Battery Ventures, with Accel and Foundation Capital
BEC and vendor fraud protection

Real vendor. Real thread. Fake invoice.

AI agents check every payment request against the sender’s history, and stop the business email compromise that authentication lets through.

Book a demo> book_demo→↵5-Minute Install·Proven in 5 Days·No MX Change
Trusted by leading
security teams at:
The problem

Every check passes. The request is the fraud.

A hijacked vendor mailbox signs as itself, so SPF, DKIM and DMARC pass. There is no link or malware to find.

$3.05B

in business email compromise losses reported to the FBI in 2025.

FBI IC3, 2025 Internet Crime Report

Illustrative example. Names and domains are fictional.

How it works

How Aegis catches a fake invoice

Aegis reads the thread the way an analyst would: the sender’s history, the change being asked for, and where the reply actually goes. Every verdict arrives with the evidence, so an analyst can confirm it in seconds.

What it catches

Four ways payment fraud arrives

01

Thread hijacking

A reply inside a real invoice thread, from the vendor’s own account.

02

Look‑alike domains

One word added to a vendor’s domain, registered days before use.

03

Bank‑detail changes

“Our bank has changed,” with a deadline on an open invoice.

04

CEO and payroll fraud

The CEO’s name asking for a wire, or an “employee” changing direct deposit.

Results

Measured in customer environments.

33/33
Vendor-invoice BEC emails Aegis caught in a recurring campaign against Markforged.
90%
Fewer false positives than rule-based filtering, Aegis-measured in customer environments.
22%
More attacks blocked than the incumbent tooling caught.
Customer proof

Stopped, even from compromised accounts.

Mesh
300+phishing and impersonation emails the existing tools had missed, surfaced in the first scan
Zeromissed legitimate business emails reported since deploying Aegis
Zeromanual tuning
Read the Mesh story
“It’s put a stop to the increasing number of attacks, even those using compromised infrastructure and AI to customize attacks to specific employees.”
Arjun MukherjeeCTO, Mesh
FAQ

What your security team will ask

Does Aegis block BEC before delivery?

No. Aegis connects by API and works after delivery. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it.

What if the vendor’s real account is compromised?

Authentication passes, so Aegis does not rely on it. The verdict rests on what this sender has sent you before and on the request itself.

Will it flag legitimate bank changes?

Occasionally. When it does, the evidence is attached so an analyst can clear it in seconds.

Where does the sender history come from?

From your own mail, over the same API connection. Nothing to import or configure.

Can we try it without changing mail flow?

Yes. Run Aegis in monitoring mode on live mail with no MX change, then turn on removal.

Your turn

See your results in five days.

Connect a tenant, run Aegis in monitoring mode, and compare it with what your current stack delivered.

Request a demo> request_demo→↵
About five minutes to connectNo MX changeRuns alongside your current stackMonitoring mode first

See what Aegis finds in your environment.

Connect a tenant, run in monitoring mode, and compare against what your current stack delivered.

Book a demo
→