Book a demo →

Media

AegisAI in the media

Episodes, talks and short explainers on how AI changed email attacks and how AegisAI stops them, from the founders and the engineers who build it.

12 recordings3 press articlesLatest: 5 Nov 2026

On the record

Numbers the founders say on the record, where each comes from, and where to hear it.

~50%

of AI-written phishing gets past existing email filters

A filter that misses half is a coin toss. The layer after the filter has to do the work.

Source

Half of AI phishing reaches the inbox

Hear it

~60%

of people who receive one of these emails click on it

Training cannot carry a 60% click rate. Detection has to catch the email first.

Source

Then 60% of people click

Hear it

20 to 30%

of email attacks now use AI spear phishing, up from under 1% a year earlier

Cy gives the share three ways in three episodes. Each chip plays the moment he says it.

Said on the record

Related reading

S-curve of crime: AI phishing growing 100% YoY
73%

of tracked organizations were reached by one calendar-invite worm

One compromised account sends itself to every contact. The worm spreads mailbox to mailbox.

Source

Q3 2026 State of the AI Attack report

Hear it

Measured on 100M+ emails across 1M+ protected mailboxes, 1 July to 2 September 2026.Read the Q3 report →

Press coverage

Outlets that have covered AegisAI.

Press kit. AegisAI was founded by Cy Khormaee and Ryan Luo, former Google security leads. $49M raised: a $13M seed led by Accel and Foundation Capital and a $36M Series A led by Battery Ventures in July 2026.

Questions these episodes answer

How do calendar invite worms spread?

One email compromises an account, then the attack sends itself to every contact in it: investors to portfolio companies, companies to customers and vendors. It spreads across work and personal accounts alike.

Source: Trust hijacking episode, 10:00 ↗

Why do compliant companies still get breached?

Compliance is the baseline, not the finish line. MGM, Capital One and British Airways were all compliant when they were breached, and slow compliance processes can stop teams adopting the defenses they need.

Source: Trust hijacking episode, 30:09 ↗

Can security awareness training stop AI phishing?

Not on its own. Annual training cannot keep pace with attacks at machine scale, so better detection, in layers from email to endpoint, has to carry the load.

Source: Trust hijacking episode, 12:38 ↗

What is trust hijacking?

Attackers compromise whoever they can reach at scale, then use those trusted accounts (a friend, a vendor, a family member) to reach their real target. Your security is only as strong as your least secured contact.

Source: Trust hijacking episode, 5:55 ↗

Is MFA enough to stop phishing?

No. Relays, man-in-the-middle attacks and stolen device codes get around MFA. The answer is defense in depth that does not leave the decision to the person reading the email.

Source: Trust hijacking episode, 7:10 ↗

How do you catch phishing sent from a trusted company?

In one case SPF, DKIM and DMARC all passed. AI agents caught it by noticing the email did not match how the real sender's emails are built, then opening its links in a sandbox.

Source: Trust hijacking episode, 25:25 ↗

  1. 01Connect
  2. 02Investigate
  3. 03Protect
  4. 04Extend

Every email, investigated.