Every working American knows the feeling. You open your inbox on a Monday morning and somewhere between the invoices and the meeting invites sits an email that looks almost right. The logo is close. The tone is polite. The request is urgent. Somewhere across the country, a finance manager stares at one of these for ten seconds too long, clicks, and wires money to a stranger. This is how most corporate breaches in America still start: not with a hacker in a hoodie, but with a very convincing email.
AegisAI wants to change that math. The startup announced Proteus on October 8, a foundation model with exactly one job: read every inbound email the way a human security analyst would, and stop the phishing before it reaches anyone’s inbox. Not a chatbot bolted onto a spam filter. A specialist, trained from the ground up for one domain.
The benchmark, with the caveat up front
Here are the numbers, and here is the honest framing they deserve: these are the company’s own numbers, from its launch announcement, not independent verification. AegisAI ran Proteus against 3,020 human-verified phishing attacks drawn from one week of real production traffic. Proteus caught more than 99% of them. An unnamed leading closed-source general-purpose model caught 81%. A widely used open-weight model caught 80%. The company says Proteus missed roughly 30 times fewer attacks, and delivered verdicts up to 7.2 times faster at the median – 26 times faster on the slowest 5% of cases.
Take the caveat seriously. Every vendor’s benchmark flatters the vendor. But the gap itself is the interesting part, and it matches a pattern showing up across American industry right now: specialist models beating bigger generalist models on narrow, high-stakes jobs. A foundation model that only knows email security but knows it deeply can out-investigate a giant model that only knows it a little.
Built by people who defended Gmail
AegisAI was founded in 2025 by CEO Cy Khormaee and Ryan Luo, both former Google security leads who worked on reCAPTCHA, Safe Browsing, and Web Risk. That is not a decorative resume line. These are two of the people who stood between the internet’s worst actors and hundreds of millions of American inboxes for years. Attackers tested every trick on Google first, which means Khormaee and Luo have already seen the next generation of phishing before most companies have seen the last one.
Investors agreed. The company has raised $49 million total: a $13 million seed round in September 2025 co-led by Accel and Foundation Capital, and a $36 million Series A this July led by Battery Ventures. The launch brought a cloud-native service with API endpoints for corporate security stacks and a partnership program for managed security providers.
Why this matters beyond Silicon Valley
The MSSP partnership program is the detail that matters most to Main Street. Most American companies are not Google. They are regional banks, manufacturers, hospital systems, school districts – organizations that cannot hire a team of security analysts but receive the same phishing as everyone else. A model like Proteus, delivered through a managed provider’s existing service, puts analyst-grade email defense within reach of businesses that were never going to build it themselves.
That is a genuinely national story. Phishing does not care about company size. The ransomware wave of the last few years was built on email as the entry point, and the entry point keeps getting more convincing as AI makes the lures cheap, personalized, and grammatically perfect. The old defenses – blocklists, keyword filters, link checkers – were built for an era when the scammers could not write.
There is also a satisfying symmetry here. The same technology that made phishing scalable is now being aimed back at the phishers. AI versus AI, with the defenders finally holding tools as good as the attackers’ tools.
What to do with this
If you run a business
If your company still leans on legacy email filters, ask your security team when they last evaluated an AI-native defense. The phishing landing in your employees’ inboxes this year was very likely written by AI. Your filters should be at least as smart as the attacks.
If you run a security team
Proteus ships as an API-friendly cloud service with an MSSP program, so a pilot does not require ripping out your existing stack. And take the company’s 99% with the grain of salt its own framing invites: run a proof-of-concept on your own traffic before you believe anyone’s benchmark.
If you just have an inbox
Keep doing the basics. Slow down on anything urgent-looking. Check the sender address, not just the display name. But take some comfort in the trend: the defenders are finally catching up, and the best defenders are specialists. Nobody will ever write a headline about the phishing attack that never landed. That quiet is the whole point.
Be First to Comment