AegisAI launches Proteus, an email security model that investigates every message

Investigating instead of matching patterns

AegisAI says traditional email security relies on historical attack signatures, rules and behavioral baselines. Proteus instead checks who sent a message, where its links lead and what it is asking for. According to the company, no prior behavior or pattern matching is required, which lets it catch novel attacks.

The model verifies the claims a phishing email depends on, using signals outside the attacker's control. AegisAI lists a link's true destination, the correspondence history between sender and recipient, routing and header data, and how the sending infrastructure has behaved elsewhere.

AegisAI argues that human analysts have long confirmed attacks this way, but manual investigation does not scale beyond a few messages a day. As a result, most security stacks score everything on similarity and investigate only flagged messages, often after delivery. The company says Proteus closes that gap by investigating every message as it arrives.

Proteus does not read an email as raw text. It processes each one as a structured object combining message content, headers, sender and recipient history, sanitized link and attachment data, and threat intelligence, with a custom tokenizer built around it. According to AegisAI, this cuts token costs and improves accuracy.

The threat: machine-written attacks

AegisAI says generative AI has removed the economics that once forced attackers to reuse campaigns. "What was once the purview of nation states is now freely available to the cybercriminal community at large," said Cy Khormaee, Founder and CEO of AegisAI.

The company says AI-generated spear phishing rose from under 1% to more than a fifth of the phishing it tracked over 2025, and at the current pace will make up most attacks by 2028. It also cites a controlled study in which fully automated, AI-written spear phishing achieved a 54% click-through rate, matching messages written by human experts and more than four times the 12% rate for generic phishing.

As an example, AegisAI described a customer incident in which attackers used a malicious OAuth grant to take over a Google Workspace account and send bid invitations to the customer's suppliers. Because the messages came from the compromised account, all passed SPF, DKIM and DMARC checks. AegisAI says it flagged the first message 89 minutes before the account-takeover alert went off.

The company also cautions against relying on general-purpose frontier models for email defense. It says they are built to follow the instructions in front of them, a tendency phishing emails are designed to exploit, and that attackers can test publicly available models repeatedly and in private.

Benchmark results and limits

The evaluation used 3,020 human-verified phishing attacks from a single week of AegisAI's production traffic, none of which appeared in Proteus's training data. All three models scored the same set under the same conditions, and any result other than a phishing verdict, including a spam label, counted as a miss.

• The leading closed-source model missed 565 attacks and the open-weight model missed 604, around 30 times as many as Proteus, according to AegisAI.
• Proteus was 7.2 times faster than the closed-source model at the median and 26 times faster on the slowest 5% of verdicts.
• In an ablation test, the same model supplied with evidence at inference identified 8.4% more phishing than without it.
• AegisAI says 82% of scored messages fall in a usable confidence band, with an expected calibration error of 0.037 before any post-hoc fitting.

The company credits the speed to a model built for a three-way decision, a single inference pass without sampling, and self-hosted infrastructure. Speed matters because email security runs inline, holding each message until a verdict is reached.

AegisAI acknowledges several limits. The benchmark counts only missed detections, and the company says it will publish false-positive data once Proteus has more time in production. The general-purpose models received only the message and a plain classification instruction, which reflects out-of-the-box use rather than their optimized ceiling. The sample also covers one week of traffic from AegisAI's own customers.

Continuous updates and what comes next

AegisAI says Proteus is retrained on an ongoing basis. Each new version must pass adversarial testing across nine attack families, then run side by side with the current version on live traffic, and it replaces the current version only if it does better.

The company places the release within a wider industry debate. It notes that OpenAI has warned of a "defender's window," a limited period when defenders have the same AI capabilities as attackers, and that Anthropic offers vetted security teams tiered access through its Cyber Verification Program. In AegisAI's view, a capable general-purpose model is a starting point for defense, not a defense on its own.

Proteus is the first in a planned family of AegisAI Lab models, along with investigation tools built around them. For security teams, the claims are so far the company's own and rest on its internal benchmark, so false-positive data from production will be the missing piece. AegisAI's stated goal is for every email that reaches an employee to be judged on the evidence behind it, not on how closely it resembles past attacks.