Writer Goes Beyond Rules to Stop AI-Powered Email Attacks

Overview

The Challenge

Writer was running several layers of email security alongside Gmail’s native filtering, but tuning rules had always been a balancing act. Tighten them, and legitimate customer mail lands in quarantine for someone to release by hand. Loosen them, and real attacks reach the inbox. As AI-generated attacks became more varied, that balance got harder to find. Every tool Writer had used also left the last mile to the team: a verdict arrived and somebody still had to work out what it meant and move the indicators by hand. That caused lag, and drift, as the configuration tuned for last quarter’s attacks quietly stopped matching this quarter’s.

Why AegisAI

A rule can only be written for something someone has already seen, and a tool that scores mail something else has already flagged cannot show what sits at the end of an attack chain. Writer wanted to settle the question with evidence, not vendor claims. AegisAI connects to Google Workspace through a read-only API and analyzes mail already sitting in inboxes, so the evaluation needed no commitment, no change to mail flow and no production risk. Writer ran both systems side by side on the same live traffic for eleven days. Setup was a single Slack message with three items: a super admin, an AegisAI administrator, and a list of addresses to exclude from scanning. No rules written, no thresholds tuned, no MX record changes.

Spotlight: Three Attacks No Rule Could Catch

The attacks reaching Writer were built to give a rule nothing to fire on. Three stand out. Each passed SPF and DKIM, Gmail delivered each as clean, and Sublime Security returned no verdict on any of them. A DocuSign envelope lure came from the genuine DocuSign platform, with a fraudulent remittance PDF leading to a QuickBooks lookalike. A voicemail lure came from a real vendor domain the attacker had compromised, leading to a fake Google Voice page built to harvest Workspace passwords. A SendGrid API alert pointed a developer to a pixel-accurate sign-in clone on a domain first seen that day. The giveaway was never in the headers: each request made no sense in context. AegisAI’s agents reason about who is asking for what, follow links to their final destination, and open attachments to find what is hidden one layer down.

Results

AegisAI delivered a 26% increase in recall over Writer’s existing stack, scored on the same live traffic against a ground-truth labeled set. The malicious emails it found had been delivered, and Writer employees had opened several of them. Writer configured three fields, wrote zero rules, and saw zero user escalations after deployment. On October 1, Writer moved from evaluation to enforcement with one additional permission and no change to production. AegisAI now quarantines what it had previously only labeled, including attacks delivered as calendar invites. Writer’s SIEM and its own agents pull each investigation directly from AegisAI’s MCP server, so nobody copies an indicator out of a console.

Conclusion

Writer builds agents that enterprises trust with their work. AegisAI builds agents that investigate every inbound email the way a senior analyst would. Both are built on the same bet: systems that do the work and show the evidence, instead of detectors that leave the operating to the customer. For Writer, that meant verdicts that arrive already investigated, a detection layer its own agents can call, and IoCs that show what attackers are targeting rather than how much mail was stopped. As Writer CISO Eric Freeman put it: “The work came off my team completely. Our SIEM pulls the whole investigation from their MCP server itself — what the agents checked, where the links went, who was targeted — with nobody in the middle. We don’t triage email alerts here any more.”