Barracuda Networks, Egress, IRONSCALES and Sublime Security

About Egress

Egress, a KnowBe4 company, is a cloud email security provider that says it continuously assesses human risk and dynamically adapts policy controls, defending against advanced phishing attacks and outbound data breaches. Egress says it uses contextual machine learning and neural networks, with integration through a cloud-native API architecture. Egress says KnowBe4's acquisition of Egress created the largest AI-driven cybersecurity platform for managing human risk. KnowBe4 says it entered into a definitive agreement to acquire Egress.

Defend is KnowBe4's inbound email security solution. Defend uses AI and natural language processing to map historical communication patterns and identify anomalies. Defend rewrites links and checks them at time of click, and Defend detects QR codes within email. Active and malicious code is automatically disabled from HTML message bodies and attachments. Sender policy verification lookup and validation are performed on every message for SPF, DKIM and DMARC. Defend filters graymail to a separate folder. Defend uses AI to automate inspection of user-reported phishing emails and remediate attacks across the enterprise.^[7]

Defend performs time-of-click inspection to detect malicious URLs that are weaponized post-delivery. Phishing is one of the most common attack vectors for ransomware. Egress says 90% of ransomware starts with a phish and that Defend uses AI-powered analysis to stop malicious links and payloads.^[8][9]

On the outbound side, security administrators can configure their risk appetite for data exfiltration and deploy KnowBe4 Prevent to block activity, warn users when they are about to contravene policy, or monitor user activity without end-user notification. Prevent uses AI technology to analyze recipients for signals that an address may be a personal account linked to the sender. Prevent analyzes attachments for sensitive content and verifies them against the intended recipients. Administrators can control and report on exfiltration incidents through an approve/reject workflow. Protect is secure, certified end-to-end email encryption, and Workspace is a way to collaborate and share securely. The Security Center is a single portal for risk analysis, reporting and incident triage, investigation and response for the KnowBe4 Cloud Email Security products Defend, Prevent and Protect, including a live threat feed.^[7][10]

Defend integrates into Google Workspace and MS Outlook apps on Windows Desktop, Mac, iOS and Android. Defend operates after a SEG, Google or Microsoft 365 has performed analysis. KnowBe4 Cloud Email Security is integrated into Microsoft 365, including support for Mac and OWA users.^[7][11]

KnowBe4 says attackers increasingly target attorneys and support staff, who have access to valuable client information. KnowBe4 also addresses financial services organizations, with email and human error as the focus. A customer quoted by KnowBe4 selected Defend and Prevent as added security layers in its Microsoft 365 environment.^[12][13]

The KnowBe4 Platform provides attack simulation and training, email and collaboration security, and agent security powered by AIDA (Artificial Intelligence Defense Agents) and a proprietary Risk Score. KnowBe4 says more than 70,000 organizations worldwide trust it. KnowBe4, Inc gives its address as 33 N Garden Ave, Suite 1200, Clearwater, FL 33755. Vista Equity Partners took KnowBe4 private, and KnowBe4 raised $300 million in a round led by KKR.^[7]

KnowBe4 states that all of its products are SSAE18 SOC 2 Type 2 certified and Cyber Essentials certified. KnowBe4 has been audited against the International Organization for Standardization 27001:2022 standard covering information security controls and the 42001:2023 standard covering AI management systems. KnowBe4 maintains compliance with the GDPR. KnowBe4 uses AWS and Azure for data encryption in transit (TLS) and at rest (AES-GCM 256).^[12][14]

About IRONSCALES

IRONSCALES sells email security that protects Microsoft 365 and Google Workspace against business email compromise, account takeover, malware and malicious URLs, credential harvesting, generative AI attacks, QR code and image-based phishing, and deepfake impersonation in Microsoft Teams meetings. IRONSCALES connects to Microsoft 365 or Google Workspace through a native API integration, with no MX record changes, no agents, and no mail flow disruption. IRONSCALES can be added behind an existing secure email gateway, and the gateway can be retired later.^[7]

Adaptive AI builds a behavioral baseline and social graph using NLP and NLU, learning how users normally communicate. Adaptive AI provides real-time reputation, content, and behavioral analysis to detect malicious threats. Adaptive AI works at the mailbox level and sees internal and external traffic. IRONSCALES combines Adaptive AI with human insight from 36,000+ threat hunters across 18,000+ organizations, so an attack confirmed in one organization is blocked for the rest.^[2][7]

Themis is described as an agentic AI virtual SOC that automatically classifies, clusters, and remediates threats detected by machine learning models or user-reported emails. When a threat is detected, Themis takes autonomous action: quarantining, clustering, or escalating based on automation preferences. IRONSCALES automates threat classification, incident clustering, quarantine actions, user notifications, and enrichment with threat intelligence. Admins can configure workflows from alert-only to fully automated remediation and end-user notification. When a user clicks the Report Phishing button, IRONSCALES scans the message, clusters it with similar emails, and evaluates it using Adaptive AI and community insights. The platform integrates with SIEM, SOAR, XDR, and EDR systems to support incident response workflows.^[2][9]

Red Teaming Agent runs the same OSINT reconnaissance attackers run, pulling from social media, press releases, job postings, and vendor relationships. Red Teaming Agent generates attack simulations from what it finds. Phishing SOC Agent delivers L2-level forensics in minutes and runs five analysis tracks in parallel: sender verification, body analysis for social engineering, link inspection through the full redirect chain, attachment detonation across 100+ engines, and relay path tracing. Phishing Simulation Agent gathers OSINT on people, including social media profiles, data breach exposure, and recent job changes, and builds simulations that mirror the tactics targeting the organization.^[6][10]

The platform incorporates Human Risk Management: phishing simulation, security awareness training, and user risk scoring modules that automatically tailor simulations to each employee's specific threat profile. IRONSCALES offers a GPT-powered spear phishing module for VIPs and frequently targeted employees. IRONSCALES experts handle email threat investigation, remediation, and AI tuning on the customer's behalf.^[2][11][12]

Deepfake Protection analyzes voice independently of video, so it catches impersonation even when cameras are off. Protected identity profiles build automatically from normal meeting activity, with no manual uploads and no IT involvement. Outbound email encryption is elective or policy-based, with AES-256 encryption in transit and at rest. Hosted DMARC, SPF, and DKIM come with automated policy enforcement, SPF record flattening, and continuous monitoring with detailed authentication reports. Account takeover protection detects unauthorized access attempts to Microsoft user accounts to prevent data breaches, internal BEC attacks, and ransomware.^[10][12]

IRONSCALES was founded in 2014 by alumni of the Israel Defense Forces' Intelligence Technology unit. IRONSCALES is headquartered in Atlanta, Georgia, and Tel Aviv, Israel. Series B funding of $8 million was led by Jump Capital, bringing total financing to $16 million since 2015. Series C funding of $64 million was led by PSG, bringing total financing to $80 million since 2015. Organizations worldwide are served both directly and through a network of more than 3,500 managed service provider (MSP) partners. For schools, the AI trains on actual attacks that target K-12 and higher education environments.^{[2][3][5][6][7][10][12][14][15][16]}

About Sublime Security

Sublime Security sells email security software that offers AI-powered protection against modern email threats. Sublime says legacy security solutions cannot keep up with AI-powered attacks. Sublime says a centralized detection model gives every customer the same blind spots and that updates take weeks or months. Sublime says its platform deploys a team of specialized AI agents that autonomously stop targeted attacks.^[2][5]

Sublime names two agents. ASA, the Autonomous Security Analyst, triages, investigates and resolves user-reported emails in seconds. Sublime says ASA clears the queue and provides transparent verdicts with investigation logs. ADÉ, the Autonomous Detection Engineer, generates new org-specific detections, backtests them and deploys coverage in hours. ADÉ creates and backtests org-specific coverage, then proposes it for deployment with approval in a click.^[2][10]

Sublime says its distributed detection model adapts coverage to the customer's environment and generates new defenses in hours. Sublime's Distributed Detection Model adapts with every message an organization sends and receives. Detection methods named by Sublime include natural language understanding, computer vision, file explosion and dynamic link analysis. Sublime recursively unpacks files, URLs and images to find hidden payloads, and decodes QR codes, extracts text with OCR and uses computer vision to spot phishing pages. Sublime groups related messages so analysts can investigate once and remediate across all affected mailboxes. Sublime supports threat hunting through historical email data using Sublime's detection language. Sublime can automatically quarantine, delete, or warn users the moment a threat is detected. Sublime finds and remediates malicious calendar invites (ICS phishing).^[2][5][11]

Sublime applies the same detection engine that powers inbound protection to catch sensitive data before it leaves the environment. Sublime says built-in DLP detections cover personal, payment, health and credential data. Sublime says ASA investigates each flagged message and blocks confirmed violations before delivery. Sublime says teams can manage inbound and outbound email protection in one platform, with one detection engine and one console.^[5][6]

Tailored Phishing Simulations and Training is a Sublime add-on that uses attacks detected in the customer's environment to prioritize and create relevant simulations. Sublime lets customers choose a Sublime-curated template, turn a malicious email detected in their environment into a simulation, or generate one from a scenario they describe. When employees click, Sublime delivers immediate, attack-specific training on the email and signals they missed.^[7]

Sublime connects to Microsoft 365 or Google Workspace via API, with no MX record changes. Sublime offers multi-tenant SaaS, single-tenant SaaS, or self-hosted deployment, and self-hosting is available to Enterprise customers. In the Enterprise-only option, Sublime says the software runs in the customer's VPC, and Sublime provides updates but can never access the data. In the other option, Sublime runs the software in its own VPC and operates it like traditional SaaS. Sublime stores and manages detection rules in GitHub, and exposes REST APIs to integrate email security data into existing workflows and tools. Sublime sends enriched telemetry to a SIEM and triggers playbooks in a SOAR. Sublime ingests threat feeds, YARA signatures and indicators of compromise (IOCs). Sublime works alongside Microsoft Defender for Office 365, and works alongside Google Workspace.^{[5][10][11][12][13]}

Sublime offers a plan that is free for individual security practitioners getting started on Sublime Cloud. Sublime sells a plan with the full platform, premium support and advanced controls. Snowflake observed a decrease in false positives and in the time spent managing email security after implementing Sublime. Elastic uses Sublime for email security. Sublime says US Signal strengthens email defense while simplifying operations. Josh spent 10 years in offensive cyber initiatives and red teaming in the private sector, and he started Sublime to build a product that would stop phishing, which was always the fastest way for him to gain access to a network.^{[2][5][6][7][8][11]}