A London-founded cybersecurity startup founded by former Google security executives has raised $36m (£28m) to tackle the growing threat of AI-powered spear phishing attacks. AegisAI, launched last year by Cy Khormaee and Ryan Luo, uses artificial intelligence agents to analyse incoming emails and detect subtle signs of manipulation that conventional rule-based filters often miss.
The Series A round was led by Battery Ventures, with existing backers Accel and Foundation Capital also participating. The investment brings AegisAI's total funding to $49m, reflecting strong investor appetite for next-generation email security as hackers increasingly weaponise generative AI to craft personalised, credible phishing messages at scale.
Spear phishing attacks have become significantly more dangerous with AI, which can rapidly scrape personal data from social media, corporate directories and public sources. Attackers can then instantly generate emails that reference a recipient's colleagues, ongoing projects or recent travel plans, making them far harder to spot. Khormaee told TechCrunch that AI-powered attacks now bypass existing controls more than half the time — almost double the success rate of earlier methods.
AegisAI's agents examine each email as a human would, looking for anomalies in tone, timing and context that even the most comprehensive checklist could not catch. The technology can also identify malicious PDF attachments that appear legitimate, including those with built-in passwords and CAPTCHAs designed to fool standard spam filters. The startup already counts crypto payments firm Mash, AI company LangChain and Google-owned privacy platform Lokker among its customers.
For UK businesses, the implications are significant. The Information Commissioner's Office (ICO) has warned that AI-driven cyber threats are evolving faster than regulatory frameworks can adapt. While the EU AI Act imposes strict requirements on high-risk AI systems, including those used in cybersecurity, UK companies face a more fragmented landscape. Experts say the rise of agentic AI defences could reshape the email security market, currently dominated by legacy providers such as Proofpoint and Mimecast. Dharmesh Thakker, general partner at Battery Ventures, noted that defending against AI-powered email attacks is becoming a 'number one priority' for organisations of all sizes.
Looking ahead, AegisAI plans to expand beyond email into broader data security, building custom AI agents capable of investigating threats across multiple channels. For UK consumers and businesses, this signals a shift towards proactive, AI-driven defence — but also raises questions about privacy and the concentration of security expertise in a handful of well-funded startups.