AegisAI Q3 2026 State of the AI Attack Report
Phishing rose 49% this quarter. Attackers are sending from compromised accounts and delivering through the calendar, and AI writes the lures and pushes one template to thousands of organizations in minutes.
Free report. Q3 2026.
Get the Q3 2026 report
The full findings, the data behind them, intrusion-set case studies and the methodology.
Free · Instant download
100M+
emails analyzed, across 1M+ protected mailboxes
38x
more AI Dragnet attacks sent from hijacked accounts
73%
of tracked organizations hit by one calendar worm
Built by the team behind Google Safe Browsing and reCAPTCHA. Backed by Battery Ventures, Accel and Foundation Capital.
Download our Q3 2026 report
The full findings, the data behind them and how we measured it, from more than 100 million emails.
What the Q3 2026 report covers
Built to run beside the mailbox you already have.
The 90% figure is measured by Aegis in customer environments, compared with rule-based filtering.
Questions about the report
How the data was collected, and what you get.
More than 100 million emails sent to over 1 million mailboxes protected by AegisAI, from July 1 to September 2, 2026. The AegisAI threat research team confirmed every phishing verdict in the report.
Phishing that blasts one AI-written template at as many organizations as possible, often within minutes. Its share of all confirmed phishing grew 11.6x this quarter, from 0.5% to 5.8%.
AegisAI's classifier scores each confirmed message on stylistic signals common in language-model output, plus hard artifacts such as unfilled template placeholders. The methodology section explains how it works and where its limits are.
The executive summary, the two key issues, breakdowns by attack type, intrusion-set case studies and the full methodology.
Fill in the form at the top of this page and the download opens right away. It is free.
Yes. Connect Microsoft 365 or Google Workspace by API, with no MX change, and Aegis runs in monitoring mode next to your current stack. Book a demo to get started.
See these attacks in your own tenant.
Connect a tenant, run in monitoring mode, and compare against what your current stack delivered.
Five-minute connect · monitoring mode · disconnect any time without touching mail routing