Former Google security execs raise $36M for AegisAI to fight AI-powered spear phishing with AI agents

Hackers are increasingly using AI to launch attacks at massive scale, with email emerging as the primary vector. AI can quickly aggregate personal information — details about colleagues, active projects, and recent travel itineraries — enabling attackers to craft convincing, personalized messages instantly.

Former Google security executives Cy Khormaee and Ryan Luo, who worked on developing safe browsing technology and reCAPTCHA, teamed up last year to launch AegisAI. With a decade of experience preventing email hacks, they recognized that existing rule-based systems relying on if-then logic are too slow and limited to catch AI-crafted malicious emails.

AegisAI's solution: AI agents that analyze each message the way a human would, paying attention to subtle anomalies that even the most detailed checklist wouldn't catch. Less than a year after launch, the startup says its tech has been adopted by dozens of customers, including crypto payments company Mash, AI startup LangChain, and Google-owned privacy compliance platform Lokker.

That demand has just helped AegisAI raise a $36 million Series A led by Battery Ventures, with participation from existing backers Accel and Foundation Capital. The fresh funding brings the startup's total capital to $49 million.

"AI-powered attacks bypass existing controls more than half the time now, which means they're almost twice as effective as they used to be," Khormaee told TechCrunch. "They've researched you, they understand everything about you, and they're targeting attacks that are perfectly bespoke to you."

Khormaee claims AegisAI's agents can spot threats traditional email security systems may miss entirely, including malicious PDF attachments with built-in passwords and CAPTCHAs designed to fool standard spam filters.

Battery Ventures general partner Dharmesh Thakker, who noticed an increase in email attacks, set out to invest in a startup that could defend against AI with AI. "The bad guys are using email to attack us using AI at a much faster pace than we can keep up with," Thakker said.

AegisAI isn't alone in this space — Lightspeed-backed Ocean is also trying to disrupt established vendors like Proofpoint and Mimecast, along with newer player Abnormal Security. But Thakker believes AegisAI, led by experts who helped secure Gmail, has the best shot at becoming the dominant new defense company.

While starting with email, AegisAI has its sights on eventually expanding to other areas of defense, such as data security.