To choose an AI email security platform, test it on your own mail against seven criteria, starting with what it finds in mail the built-in filter, on by default in Microsoft 365, already delivered¹. AegisAI, for example, connects through the Microsoft 365 or Google Workspace API with an OAuth grant the admin controls and can revoke¹⁷. The criteria below are a test you run on your own mail.

What you can do by the end

Start from what the built-in filter already catches

Every AI email security platform sits on top of a filter you already have. In Microsoft 365, the built-in protection against email threats is on by default for every cloud mailbox. It also pulls delivered threats back out of mailboxes with zero-hour auto purge (ZAP)³.

So the trial measure is the threats the built-in layer delivered and did not pull back.

Question to ask a vendor: in our trial, which confirmed threats did you find in mail the built-in filter had already delivered, and how was each one confirmed?

How does AI email protection differ from a legacy secure email gateway?

A legacy secure email gateway sits in the mail path, while API-based AI email protection reads mail inside the mailbox platform after delivery. A gateway receives mail through an MX record change, so every message passes through it first. An API platform connects through an app the admin approves, so routing stays as it is.

The connection model decides what happens in an outage. When a gateway stops, inbound mail waits for it. When an API platform stops, mail keeps arriving while detection waits. The guide on replacing a secure email gateway without a cutover weekend covers running both side by side.

Question to ask a vendor: does deployment need an MX change, and what happens to inbound mail if your service is down?

Check what the model reads in each message

A model can only judge what it reads, so ask for the full list of inputs. The hard cases carry no link or attachment at all. IC3 says chat generators can quickly create official-sounding emails that mimic a company's CEO, and businesses reported losses over $30 million to BEC scams involving AI in 2025¹¹. Total BEC losses reached $3,046,598,558 in 2025.

A text-only payment request has nothing to detonate. The model has to read the request itself and the sender's history. Authentication results add one more input. NIST SP 800-177 Rev. 1 names SPF, DKIM and DMARC as the mechanisms for authenticating a sending domain¹⁵. A message can pass all three and still impersonate a supplier, so those results are one input among several.

Question to ask a vendor: list every input your model reads for one message, and show how it handled a payment-change request with no link or attachment.

Ask what the platform may do without a person

Autonomy is a setting, and you should know where it sits before the trial starts. Microsoft's automated investigation and response (AIR) queues remediation actions for SecOps personnel to approve⁴. For malicious similarity clusters of URLs or files, AIR approves its own pending actions. Approving or rejecting those actions needs a role group with the Search and Purge role.

Hold any AI platform to the same map. Write down which actions run on their own, which wait for a person, and which role approves them.

Question to ask a vendor: which actions run without approval, which wait for an analyst, and who can change that line?

Require a plain-language reason for every verdict

A verdict without a reason cannot be checked, so require one for every message the platform moves or flags. The NIST AI Risk Management Framework lists explainable and interpretable among the characteristics of trustworthy AI¹³. NIST says explainability helps the people who operate or oversee an AI system understand its outputs. The explainer on how AI-powered email security works covers the models behind those verdicts.

Question to ask a vendor: for one blocked message and one allowed message from our trial, what reason did the model give, and which signals did it use?

Check how an admin overrides a wrong verdict

The override path matters as much as the verdict. In Microsoft 365, admins use the Submissions page to report legitimate messages that were blocked and suspicious messages that were allowed¹². An AI platform needs the same two directions. Release a good message, convict a bad one, and see the change recorded.

Question to ask a vendor: how does an admin reverse a verdict, how fast does the reversal reach every copy, and where is it logged?

Limit the access the platform needs, and know how to revoke it

Grant the least access the trial needs, and confirm the revoke path before you grant anything. Microsoft calls tenant-wide admin consent a sensitive operation, because it can give an app's publisher access to significant portions of your data, such as full access to all mailboxes⁷. In Google Workspace, Revoke access removes all access for an admin-installed Marketplace app, and access cannot be revoked for specific scopes⁸.

Keep the read grant and the removal grant apart where the platform allows it. Then the tool can be watched before it can delete anything.

Question to ask a vendor: which permissions does the app request, which of them can move or delete mail, and how do we revoke each one?

How do the four email security solution approaches compare?

Compare approaches on the criteria above, never on a brochure. The table shows how each approach meets each criterion. Confirm every cell in your own trial.

Score each AI email security platform on this checklist

Score each platform yes or no on these questions, using evidence from your own trial.

What makes an email security platform AI-native?

An email security platform is AI-native when a model reads each message and decides on it without a fixed rule written for that attack. Three tests make the label checkable. First, the model reads the request and the sender's history, not only links and files. Second, the vendor can say which actions the model takes on its own and which wait for approval, the same map Microsoft publishes for AIR. Third, each verdict carries a reason, which is what NIST asks of explainable AI.

Ask for the three answers in writing, and check each one in the trial.

How do you tell real AI innovation in email security from marketing?

Real innovation shows up as numbers on your own mail; marketing shows up as numbers without a denominator. Attackers already use AI: IC3 received more than 22,000 complaints reporting AI-related information in 2025¹⁰. A product label does not show whether a platform catches those messages. Three numbers from your trial do.

The page on how to evaluate detection accuracy and the false negative rate sets out the arithmetic behind those denominators.

How do you test an AI email security platform on your own mail before buying?

Run it in monitoring mode on your own tenant, so it records verdicts and moves nothing, then compare its findings with what the built-in filter delivered. Grant read access first and hold the write grant until the findings review, because tenant-wide consent is a sensitive operation. Run the trial long enough to see a payment-change request and a phishing campaign. Then check each finding by hand. The guide on how to structure a read-only email security proof of concept lays out the steps.

How AegisAI handles this

AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, and nothing in the mail flow changes¹⁹. It runs one agent per inbox and four specialists per message, and gives one explainable verdict¹⁶. It follows every link, opens every file and decodes QR codes to the end, before anyone sees the email. Every verdict comes with its reason in plain language, so your team can check it and share it. In monitoring mode it records verdicts without acting.

How to measure it in 30 days

Track three numbers from the first day of the trial.

Questions people ask

Sources