AI-Powered Spear Phishing Is Getting Harder to Spot
The short answer
A security startup founded by former Google executives raised $36 million to combat AI-generated phishing attacks that are becoming convincing enough to fool employees who would catch traditional scams. Spear phishing is one of the most common entry points for small business fraud and data breaches, and AI-generated attacks are harder for existing email filters to catch because they do not rely on the telltale patterns those filters look for.
- cybersecurity
- phishing
- email security
- fraud prevention
- small business
What happened
AegisAI, founded by former Google security executives, closed a $36 million funding round to build AI agents that detect spear phishing messages by analyzing them the way a careful human reader would — identifying subtle anomalies that rule-based filters miss. TechCrunch reports the system evaluates each message individually rather than checking it against a fixed checklist.
The investment reflects how quickly AI has lowered the cost of targeted phishing attacks. Spear phishing — personalized messages crafted to impersonate a trusted vendor, colleague, or executive — historically required significant manual effort per target. AI tools now allow attackers to generate convincing, individualized messages at scale, making small businesses viable targets where they previously weren't cost-effective to attack.
What it means for your business
Spear phishing is one of the most common entry points for small business fraud and data breaches, and AI-generated attacks are harder for existing email filters to catch because they do not rely on the telltale patterns those filters look for. Review your payment verification process: a standing rule requiring a phone call to confirm any wire transfer request or payment redirect — regardless of how legitimate the email looks — is one of the most reliable low-cost defenses available. Train staff to treat urgency and pressure in financial or credential requests as a warning sign, not a reason to act faster. Your email provider's built-in security is a starting point, but it is worth checking whether it has been updated to flag AI-generated content patterns specifically.
Source: TechCrunch