AegisAI, led by ex-Google execs, raises $36M to stop AI spear phishing

Hackers are weaponizing artificial intelligence to launch cyberattacks at unprecedented scale, and email has become their primary battlefield. By rapidly harvesting personal data such as colleague names, ongoing projects, and recent travel plans, malicious actors can now generate highly convincing, personalized messages in seconds.

Last year, former Google security executives Cy Khormaee and Ryan Luo , both veterans of safe browsing technology and reCAPTCHA , founded AegisAI, a startup that deploys AI agents to neutralize these advanced threats, known as spear phishing.

Drawing on a decade of experience combating email intrusions, the co-founders recognized that conventional rule-based defenses, which rely on static “if-then” logic, are far too slow and inflexible to catch AI-crafted malicious emails. In response, they engineered AI agents that scrutinize every message the way a human would, flagging subtle anomalies that even the most thorough checklist would overlook.

In less than a year since launch, AegisAI reports that dozens of organizations have adopted its technology, including crypto payments firm Mesh, AI startup LangChain, and privacy compliance platform Lokker. This growing demand fueled a $36 million Series A funding round led by Battery Ventures, with continued support from existing investors Accel and Foundation Capital. The new investment brings AegisAI’s total raised capital to $49 million.

“AI-powered attacks now bypass existing controls more than half the time, making them nearly twice as effective as before,” Khormaee told TechCrunch. “They’ve researched you, they understand everything about you, and they’re launching attacks that are perfectly customized to you.”

Khormaee asserts that AegisAI’s agents can detect threats that traditional email security systems routinely miss. For example, the startup’s AI can identify malicious PDF attachments that appear harmless at first glance, including those armed with embedded passwords and CAPTCHA challenges , tactics commonly used to slip past standard spam filters.

When Dharmesh Thakker, general partner at Battery Ventures, observed a surge in email-based attacks, he sought to back a company that could counter AI with AI, one focused on replacing legacy email security tools with agentic-driven defense.

“The bad guys are using email to attack us with AI at a pace we simply can’t match,” Thakker said. “Defending against that will become a top priority for many companies.”

AegisAI is not alone in this space. Lightspeed-backed Ocean is also working to unseat established vendors like Proofpoint and Mimecast, as well as newer competitors such as Abnormal Security. Still, Thakker believes AegisAI has the strongest chance of becoming the leading new cybersecurity company, given that its leaders helped secure Gmail, the world’s most widely used email platform.

While AegisAI is starting with email protection, the startup plans to eventually expand into other security domains, including data security. “The core idea of building customized, highly advanced agents that can conduct investigations will determine who becomes the next dominant security company,” Khormaee said.