Series A
$36M led by Battery Ventures, with Accel and Foundation Capital
Inbound email security

Every message is new. Judge it that way.

AI agents investigate every inbound email for what it is trying to do, and remove the ones that fail from every mailbox they reached.

Book a demo> book_demo→↵5-Minute Install·Proven in 5 Days·No MX Change
Trusted by leading
security teams at:
The problem

Gateways match the past. Attacks now arrive new.

AI writes every lure fresh, from authenticated or compromised senders. Signatures and reputation have nothing to match.

3 in 10

confirmed phishing emails cleared native Gmail and Microsoft filters in Q3 2026.

AegisAI Q3 2026 Phishing Trends Report

Illustrative example. Names and domains are fictional.

What Aegis stops

Stop the attacks filters miss. Before anyone acts on them.

Aegis investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached.

Illustrative example. Names and domains are fictional.
What it catches

One investigation for every kind of attack. Pick one to see it.

Case · Accounts payable09:14
From: Dana Hale, CFO <d.hale.office@gmail.com>

Can you update the bank details for Calder Freight before today's run? Don't loop in AP, I'll explain later.

  • SenderUses the CFO's name from a personal address
  • RequestChange of bank details, under time pressure
  • HistoryThe CFO has never asked for this by email
Vendor payment fraudRemoved
Illustrative example. Names and domains are fictional.Learn about fraud protection →
Customer proof

Fewer attacks get through. Teams get their time back.

Mesh
300+phishing and impersonation emails the existing tools had missed, surfaced in the first scan
Zeromissed legitimate business emails reported since deploying Aegis
Zeromanual tuning
Read the Mesh story
“Aegis is the first solution that truly changes the game. They came into Mesh and stopped attackers in their tracks.”
Bam AziziCEO, Mesh
How it works

How Aegis investigates an email

Every verdict comes with its reason in plain language, so your team can check it and share it.

Results

Measured in customer environments.

90%
Fewer false positives than rule-based filtering, Aegis-measured in customer environments.
22%
More attacks blocked than the incumbent tooling caught.
1.9s
Median time from arrival to verdict. Removal follows within seconds.
Deployment

Nothing in your mail flow changes.

Out of the mail path.

Reads mail through the Microsoft 365 or Google Workspace API after delivery. No change to mail routing (MX records).

Starts read-only.

Runs in monitoring mode first. Removal needs write access your admin grants and can revoke.

If Aegis is down.

Mail keeps flowing. Detection pauses until the service returns.

Alongside what you run.

Works with your gateway or Defender. Archiving and your identity provider stay where they are.

For your security team
  • Removed everywhere.One bad email is pulled from every inbox it reached, forwards included.
  • Alerts that explain themselves.A summary, the warning signs found and a recommended next step.
  • No rules to tune.Nothing to write or maintain as attacks change.
FAQ

What your security team will ask

Where does Aegis sit in mail flow?

Out of band. It reads mail through the Microsoft 365 or Google Workspace API after delivery. No MX change, no gateway.

What happens if Aegis has an outage?

Mail keeps flowing. Detection pauses until the service returns.

How fast is removal?

The median verdict takes 1.9 seconds, and a convicted message is removed from every mailbox it reached within seconds.

Does it replace our gateway or Defender?

It runs alongside either, and many teams use it to retire a gateway.

Your turn

See your results in five days.

Connect a tenant, run Aegis in monitoring mode, and compare it with what your current stack delivered.

Request a demo> request_demo→↵
About five minutes to connectNo MX changeRuns alongside your current stackMonitoring mode first

See what Aegis finds in your environment.

Connect a tenant, run in monitoring mode, and compare against what your current stack delivered.

Book a demo
→