Definition
Controls that detect phishing, BEC, malware, and account takeover in enterprise mail (Microsoft 365 / Google Workspace) — shifting in 2026 from rule-based SEGs toward LLM/agent analysis of intent and identity.
Key Points
- Incumbents: Proofpoint, Mimecast, Abnormal Security; newcomers: aegisai, Ocean
- API-first integration replaces inline gateway appliances for many startups
- Expansion beyond inbox (e.g., AegisAI Vanguard link/attachment hunting)