由前 Google 安全高管创办的 AegisAI 获 3600 万美元融资，阻击 AI 驱动的鱼叉式网络钓鱼

黑客正日益利用 AI 大规模发动攻击，而电子邮件已成为主要目标。AI 可以迅速汇集个人信息——例如同事信息、正在推进的项目以及近期旅行行程——使不法分子能够即时编写看似真实、极具说服力的邮件。

去年，曾参与开发安全浏览技术和 reCAPTCHA 的前 Google 安全高管 Cy Khormaee 与 Ryan Luo 联手创办了 AegisAI。这家初创公司使用 AI Agent 来消除这类被称为鱼叉式网络钓鱼的威胁。

在拥有十年防范电子邮件黑客攻击的经验后，AegisAI 的两位联合创始人意识到，依赖“如果—那么”逻辑的现有规则型防黑客系统，面对 AI 编写的恶意邮件时既过于迟缓，能力也有限。因此，他们开发了能够像人类一样快速分析每封邮件的 AI Agent，关注即使最详尽的检查清单也可能发现不了的细微异常。

AegisAI 表示，在成立不到一年后，其技术已被数十家客户采用，其中包括加密货币支付公司 Mesh、AI 初创公司 LangChain，以及隐私合规平台 Lokker。这一需求刚刚帮助 AegisAI 完成 3600 万美元 A 轮融资，由 Battery Ventures 领投，现有支持者 Accel 和 Foundation Capital 参投。这笔新融资使该初创公司的累计融资额达到 4900 万美元。

“如今，AI 驱动的攻击有超过一半的时间能够绕过现有控制措施，这意味着它们的有效性几乎是过去的两倍，”Khormaee 对 TechCrunch 表示。“它们研究过你，了解关于你的一切，并且发动完全为你量身定制的攻击。”

Khormaee 称，AegisAI 的 Agent 可以发现传统电子邮件安全系统可能完全遗漏的威胁。例如，该公司的 AI 能够识别初看起来合法的恶意 PDF 附件，包括内置密码和 CAPTCHA 的附件；这些手段通常被用于欺骗标准垃圾邮件过滤器。

当 Battery Ventures 普通合伙人 Dharmesh Thakker 注意到电子邮件攻击有所增加时，他开始寻求投资一家能够用 AI 对抗 AI 的初创公司——其目标是以 Agent 驱动的防御取代传统电子邮件安全工具。

“坏人正以我们难以跟上的速度，利用 AI 通过电子邮件攻击我们，”Thakker 对 TechCrunch 表示。“对此进行防御，将成为许多公司的头号优先事项。”

AegisAI 并不是唯一一家利用 AI 分析每一封入站邮件上下文、以侦测欺诈和冒充企图的初创公司。获得 Lightspeed 支持的 Ocean 也在尝试取代 Proofpoint、Mimecast 等成熟厂商，以及 Abnormal Security 等较新的参与者。

不过，鉴于 AegisAI 由曾帮助保护 Gmail——全球最受欢迎的电子邮件系统——的专家领导，Thakker 认为，这家初创公司最有机会成为领先的新一代黑客攻击防护公司。

尽管 AegisAI 当前从电子邮件安全切入，但该公司计划最终扩展至其他防御领域，例如数据安全。Khormaee 表示：“构建能够开展调查的定制化、高度先进 Agent，这一核心理念将决定谁会成为下一家占据主导地位的安全公司。”

Hackers are increasingly using AI to launch attacks on a massive scale, with email emerging as a primary target. AI can quickly aggregate personal information — such as information about co-workers, active projects, and recent travel itineraries — allowing bad actors to instantly craft convincing messages that look authentic.

Last year, former Google security executives Cy Khormaee and Ryan Luo, who previously worked on developing safe browsing technology and reCAPTCHA, teamed up to launch AegisAI, a startup that uses AI agents to stomp out these threats, known as spear phishing.

With a decade of experience preventing email hacks, the AegisAI co-founders realized that existing rule-based systems for preventing hacks — relying on “if-then” logic — are too slow and limited to catching AI-crafted malicious emails. So they developed AI agents that quickly analyze each message as a human would, paying attention to small anomalies that even the most elaborate checklist wouldn’t catch.

Less than a year after its launch, AegisAI says its tech has been adopted by dozens of customers, including crypto payments company Mesh, AI startup LangChain, and privacy compliance platform Lokker. That demand has just helped AegisAI raise a $36 million Series A led by Battery Ventures, with participation from existing backers Accel and Foundation Capital. The fresh funding brings the startup’s total capital to $49 million.

“AI-powered attacks bypass existing controls more than half the time now, which means they’re almost twice as effective as they used to be,” Khormaee told TechCrunch. “They’ve researched you, they understand everything about you, and they’re targeting attacks that are perfectly bespoke to you.”

Khormaee claims that AegisAI’s agents can spot threats traditional email security systems may miss entirely. For instance, the startup’s AI can catch malicious PDF attachments that look legitimate at first, including ones with built-in passwords and CAPTCHA, which are often used to fool standard spam filters.

When Dharmesh Thakker, general partner at Battery Ventures, noticed an increase in email attacks, he set out to invest in a startup that could defend against AI with AI, one aiming to replace legacy email security tools with agentic-driven defense.

“The bad guys are using email to attack us using AI at a much faster pace than we can keep up with,” Thakker told TechCrunch. “Defending against that is going to be a number one priority for a lot of companies.”

AegisAI isn’t the only startup using AI to analyze the context of every incoming email to detect fraud and impersonation attempts. Lightspeed-backed Ocean is also trying to displace established vendors like Proofpoint and Mimecast, along with newer players like Abnormal Security.

However, given that AegisAI is led by experts who helped secure Gmail, the most popular email system in the world, Thakker believes the startup has the best shot at becoming the leading new hack-prevention company.

While AegisAI is starting with email, the startup has its sights on eventually expanding to other areas of defense, such as data security. “The core idea of building customized, highly advanced agents that can do investigations is going to [determine] who becomes the next dominant security company,” Khormaee said.