AegisAI Perspectives · 074
Choose an AI email security platform for advanced threats by testing session-theft phishing, new lures and payment requests that carry no link or file.
CISOs recommend an AI email security platform that reads the page behind each link and judges what each message asks for. BEC losses reached $3,046,598,558 in 20251. AegisAI investigates every email for what it is trying to do15, and the tests below apply to any product you trial.
The seven point comparison for any threat is in how to choose an AI email security platform. This page tests the attacks that pass a Microsoft 365 or Google Workspace filter: AiTM session theft, zero-day lures and payloadless BEC.
A token theft attack happens when attackers compromise and replay a token issued to a user, even if that user satisfied multifactor authentication5. Because the authentication requirements are met, the attacker is granted access by using the stolen token.
Microsoft's playbook says a suspicious link click is a trigger7. The email could be an adversary-in-the-middle (AiTM) phishing kit and the start of an attack. After the theft, look for a new MFA credential or edited forwarding rules. A platform that only checks the sender sees a clean message, so it has to judge the page the link opens. How a session-stealing kit works traces the chain from the email to the stolen Microsoft 365 session.
Ask the vendor: will you send a test email that links to a counterfeit Microsoft 365 sign-in page, and show me the page the platform saw?
In a Microsoft scenario table, a link that was legitimate on delivery and later weaponized was not detected, because it was not malicious on delivery10. URLs are scanned before delivery when Safe Links is on, and the recommended setting holds a message until scanning finishes.
Ask whether the platform scans before the user can open the message, and whether it removes the message from every mailbox when the link changes later.
Ask the vendor: show me a link that was clean at delivery and bad an hour later, and how long removal took.
Safe Links, for example, checks a clicked URL against known malicious URLs, and URLs without a valid reputation are detonated in the background9. The weak point is a phishing site that shows a scanner clean content.
Cloaking is itself evidence: agents look for signs that a site detects analysis or serves decoy content instead of what the email promised22. The same write-up says agents analyze the page for phishing-kit code. For why reputation lists fail on day one, read how zero-day email attacks evade filters.
Ask the vendor: what does the platform conclude when a page shows its scanner different content than it shows a person?
A payment request from a fake executive has nothing to detonate. The IC3 defines BEC as fraud done through compromised accounts or social engineering to move money. It also says chat generators can quickly create official-sounding emails that mimic a company's CEO3. In 2025, businesses reported losses over $30 million to BEC scams involving AI.
The platform must judge what the message asks for and who sends it. Send a payment change request from a lookalike of a real supplier's domain, and read the reasoning. The page on whether an AI model or a rule catches payloadless BEC explains the difference.
Ask the vendor: what evidence does the verdict list for a message with no link or file, and a passing sender check?
Microsoft states that Safe Links does not protect URLs in rich text format (RTF) email messages12. QR codes and archives are the usual next edges, along with links inside PDFs.
Ask the vendor: which link and file types do you skip, and what happens to a message you could not fully read? Then test one of each.
A verdict with no reason gives an analyst nothing to check against the message. Ask for the full evidence record, covering the link chain and the sender history, on one malicious and one clean message from your trial.
Ask the vendor: show me the evidence behind this verdict, in words my analyst can share.
Removal from mailboxes after delivery needs write access through the Microsoft 365 or Google Workspace API. Start read-only, compare verdicts with your analysts' reading, then grant write access and confirm you can revoke it from your admin console.
Ask the vendor: what is read-only in week one, and what changes when I grant write access?
Email a counterfeit sign-in page link and ask what the platform saw.
Change a link's destination after delivery, then time the removal.
Use a lure on a brand new domain and read the evidence.
Serve decoy content to scanners and see what is concluded.
Try a payment change request with no link or file.
Get the list of formats the platform does not follow.
Require a plain language reason on every verdict.
Confirm what runs read-only first, and who can revoke write access.
Measure how fast one conviction removes every copy, forwards included.
| Attack | API-based | Gateway | Built-in platform controls | Managed service |
|---|---|---|---|---|
| Session-theft phishing | Can read the message and the page it points to; ask for the page it saw | Checks mail in transit; ask whether the destination is judged | Suspicious link clicks are an investigation trigger | Depends on the provider's tools |
| Brand new lure | Can judge the behavior of the page and message | Depends on the reputation data available at delivery | URLs without a valid reputation are detonated | Depends on the analyst queue |
| Link changed after delivery | Removal from every mailbox needs write access | Limited once the message is delivered | A weaponized link missed on delivery was not detected | Done by the provider on request |
| No link or file | Can read the request itself | Depends on the product; ask for a test | Depends on the policy; ask for a test | The analyst reads the request |
| Format gaps | Ask for the types it does not follow | Ask for the types it does not follow | RTF messages are not covered | Ask for the types the provider skips |
Illustrative example, figures are fictional. Harbor Row Freight (fictional) has 600 staff on Microsoft 365 and a two person security team. In a trial, the team sends three test emails. The first links to a counterfeit sign-in page, and the platform shows a screenshot of the page and the reason it convicted the message. The second links to a clean page that is changed after 40 minutes, and the platform removes the message from 12 mailboxes within seconds of the change. The third asks the finance lead to update a supplier's bank details with no link or file, and the verdict names the lookalike domain and the sender's first contact. The team keeps write access off until all three verdicts match their own reading.
AegisAI investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached. It catches fake executives and vendors, and payment requests even with no link or file to scan16. It follows every link to the end and opens every file before anyone sees the email, and it decodes QR codes. Its agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it24. Every verdict comes with its reason in plain language, and it runs in monitoring mode first, with removal behind write access your admin grants and can revoke.
Run the trial on your own tenant through the demo page, after reading the inbound email security page. The wider threat classes are in the guide to BEC, AiTM and zero-day phishing.
CISOs recommend a platform that reads the page behind each link and judges what each message asks for. Check it with a counterfeit Microsoft 365 sign-in link, a lure on a new domain and a payment change request with no link, then read the evidence behind each verdict.
Not on its own. A replayed token gives access even after the user satisfied multifactor authentication, so the email filter has to judge the lure and the sign-in page behind it.
A payment request with no link or file gives a scanner nothing to detonate. The IC3 lists BEC losses of $3,046,598,558 for 2025, and chat generators make official-sounding executive emails quickly. The platform has to judge the request itself.
A plain language reason plus the link chain and sender history behind it. A score alone gives the analyst nothing to check in the Microsoft 365 message trace.
No. Start read-only, compare verdicts with your analysts' reading, then grant write access through the Microsoft 365 or Google Workspace API for removal.
