StrongestLayer AI-Native Email Security

StrongestLayer, Inc. is a San Francisco email security company led by CEO Alan LeFort, with a leadership team that previously worked at Proofpoint, McAfee, Google, Mandiant and FireEye/Trellix. It targets AI-generated phishing and business email compromise that pass authentication checks and evade rule-based secure email gateways.

The product is built on TRACE, a multi-LLM reasoning engine that reads the intent of each message, checks it against the business context and explains every verdict. Three agent types sit on top: Inbox Advisor gives employees a plain-English verdict inside Outlook and Gmail, Threat Triage delivers pre-investigated alerts to SOC teams, and Threat Hunt sweeps the organization by sender, subject, URL or domain. It deploys by API next to gateways such as Proofpoint or Mimecast, or replaces them. Customers include schools, county governments, Cedarville University, Corcept Therapeutics and the law firm Orrick.

• TRACE engine: Uses multiple LLMs to reason about message intent against business context.
• Inbox Advisor: Shows employees a plain-English verdict inside Outlook and Gmail.
• Threat Triage: Sends pre-investigated alerts to the SOC.
• Threat Hunt: Sweeps all mailboxes by sender, subject, URL or domain.
• Flexible deployment: Runs by API beside Proofpoint or Mimecast, or replaces the gateway.
• Privacy controls: Does not use customer emails to train models and purges data within 90 days of exit.

A Vietnamese university or local agency on Google Workspace can add an explanatory verdict to every email for staff. A law or accounting firm can detect AI-written invoice fraud that passes authentication. An enterprise SOC can cut daily phishing investigations with pre-investigated alerts.

At a customer with about 5,000 seats, only 0.4% of alerts were false positives in 2026, daily investigations fell from 33 to 4 and investigation time from 660 to 8 minutes per day. One enterprise caught 347 AI-generated attacks in 10 days that its gateway missed. Explained verdicts help employees and analysts understand why a message is dangerous. API deployment takes about 15 minutes with no MX changes.

AI lets attackers write fluent, personalized phishing in any language, and the company's own data shows 86% of attacks reaching inboxes passed SPF, DKIM and DMARC. Rule- and signature-based gateways struggle with these messages, driving interest in LLM-based detection. Vietnamese organizations on Microsoft 365 and Google Workspace, often with small SOC teams, face the same wave of AI-written lures.

StrongestLayer, Inc. lists San Francisco as its location and has raised 9.3 million USD in seed funding, with the latest round led by Inovia Capital. It holds SOC 2, offers a DPA and BAA on request, uses AWS Bedrock in US regions as its only subprocessor, and publishes quarterly threat research such as the Phishing Genome report.