Definition

Controls that detect phishing, BEC, malware, and account takeover in enterprise mail (Microsoft 365 / Google Workspace) — shifting in 2026 from rule-based SEGs toward LLM/agent analysis of intent and identity.

Key Points

  • Incumbents: Proofpoint, Mimecast, Abnormal Security; newcomers: aegisai, Ocean
  • API-first integration replaces inline gateway appliances for many startups
  • Expansion beyond inbox (e.g., AegisAI Vanguard link/attachment hunting)

Sources