AI email security — MAIL PRISM AI
Why email security needs
its own language model
What separates a fraud email with no links and no attachments is not the words but what's between the lines. Built without open weights for security and trained from pre-training up, our language model judges email on CPUs, without a GPU.
The hard problem
Why email is the hardest seat
Because the job is reading between the lines — not just the words or the context. Context is how the text flows; what's between the lines is the intent behind it.
Far smaller in size, but the job is judgment.
Serious problems today
The emails that do the most damage give you nothing to block on
Payment fraud — one email saying the account changed, and the money is gone
95.4%
Of 1,591 foreign-exchange trade frauds against Korean import/export companies, 1,518 used email hacking to steer payment to a fake account. 2021 to H1 2025, total losses of about KRW 133 billion.
Source: Financial Supervisory Service, Korea (Sep 2025)
$3 billion
Business email compromise (BEC) losses reported in the US in one year — 24,768 frauds where a single email led to a wire transfer.
Source: FBI IC3 Internet Crime Report 2025
$163,000
One email, sent after intercepting a Spanish exporter's mail: “our account has moved to a Portuguese bank.” A Korean importer paid to the new account.
Source: Financial Supervisory Service, Korea (Sep 2025)
Emails after money don't even carry a link.
Account takeover — link scanners stop at “verify you are human”
43%
Share of 2025 phishing attacks that abused a CAPTCHA (human check). The same year: MFA bypass 48%, phishing-as-a-service kits 90%.
Source: Barracuda (Jan 2026) · tracked campaigns
11.9 million
Phishing hidden behind CAPTCHAs in March 2026 alone — up 125% in a month, making threats hard for automated scanners to recognize.
Source: Microsoft email threat trends Q1 2026 (Apr 2026)
94–96%
Share of credential phishing among attacks carrying links or attachments. Malware: 4–6%.
Source: Microsoft email threat trends Q2 2026 (Jul 2026)
Even when you can't open what's beyond the link, what the email asks for is inside the email.
By category
Email security AI — what's different?
The seat that judges what's between the lines of incoming email was empty.
| Traditional email security gateway | Cloud AI email security | Open-weight email AI | MAIL PRISM AI | |
|---|---|---|---|---|
| Main job | Blocks malicious links, attachments and spam | Detects anomalous behavior in incoming mail | Summary and search, outbound leak prevention | Judges phishing, impersonation and financial fraud in incoming mail |
| Fraud with no link or attachment | Blocked only if a rule fires | Detected from behavior history | Out of scope | Reads between the lines and judges |
| Reason for a block | Rule or signature name | Risk score, signals | — | The judgment-criterion sentence itself |
| Email sent out | None (inside the gateway) | To the vendor's cloud | To an in-house GPU server | None (inside the gateway) |
| Inference resources | Server | Vendor cloud | GPU server (20B class) | CPU, no GPU |
| Model | — | Undisclosed | Open weights | Our own language model, open weights excluded |
| How performance is stated | Detection rate | Own figures | — | AUC including legitimate email |
* General characteristics by category; individual products may differ.
Why no open weights
Open-weight models are good AI — just not for a gateway
Not because the models are wrong. For summarizing, translating, writing and internal assistance, they are genuinely useful AI that anyone can download, verify and adapt. But at the gateway, the judge is the line of defense. If anyone can download it, so can the attacker.
| Using a public model | MAIL PRISM AI — our own 354M → 1.5B language model | |
|---|---|---|
| Attacker access to the model | Can download the same model and search, without limit, for emails that get through | Nothing to take. All they can do is send emails |
| Cost of evasion attempts | Free · unlimited · leaves no trace | Every attempt is logged at the gateway |
| Instructions in the body | Trained to follow instructions in the input, with bypass techniques published | Doesn't execute instructions in the body; outputs only a judgment |
| When a weakness is published | Every customer using the same model is exposed at once | We fix it ourselves and redeploy on a short cycle |
| Training data | Hard to explain to customers what it was trained on | Built ourselves from pre-training — we can name the sources |
In a security product, this difference isn't about performance. It's about whether an attacker can get hold of the security judge.
Systematic SFT
With Systematic SFT, we taught it to read between the lines
A system for teaching an SLM expert-grade judgment — trained on a single GPU, judging on CPUs without a GPU.
- Turn expert judgment into sentencesRisk criteria are written as sentences, not categories. The model learns to judge, sentence by sentence, whether an email matches.→ You see the reason for a block, in a sentence
- Teach what's between the lines, not the wordsIt reads the sender history, path and reply-to address together, and is taught on a relational basis to judge the intent behind identical words.→ Same words, judged by their hidden intent
- Measure while protecting legitimate email firstWhen we choose a model, not blocking legitimate email comes before catching a few more threats.→ Legitimate business email keeps flowing
↻ Even subtle judgments improve on a short cycle — it's method, not resources, so we can quickly rebuild a new model that reflects the field.
The judgment large models gain from scale doesn't come for free below 2B. We created it in a 354M language model — by method.
Model specifications
MAIL PRISM AI language model specifications
Our own language model, built from pre-training — not a shrunk or fine-tuned public model.
| R5-354M · R1 | R5-354M · R2 in operation | R8-1.5B · May 2027 | |
|---|---|---|---|
| Parameters | 354 million (354M) | 354 million (354M) | 1.5 billion (1.5B) class |
| Pre-training | Our own, no base model | Our own, no base model | Our own, no base model |
| Languages | Korean · English | Korean · English · Japanese | Korean · English · Japanese · Chinese (Simplified · Traditional) · Arabic · Hindi · Russian · Thai · Vietnamese · Indonesian · Malay · German · Spanish (14) |
| Architecture | Transformer decoder · 24 layers · hidden 1,024 · 16 attention heads | Transformer decoder · 24 layers · hidden 1,024 · 16 attention heads | Transformer decoder · 32 layers · hidden 1,792 · 28 attention heads |
| Vocabulary · tokenizer | 50,304 · built for email text | 50,304 · built for email text | 128,000 · 14-language BPE |
| Tokens per email | 1,024 | 5,120 | 5,120 |
| Training stack | RMSNorm · SwiGLU · MTP · BF16 | RMSNorm · RoPE · SwiGLU · MTP · BF16 · FlashAttention | RMSNorm · RoPE · SwiGLU · MTP · BF16 · FlashAttention |
| Judgment training | SFT | Systematic SFT | Systematic SFT |
| Inference | CPU, no GPU (Intel AMX) | CPU, no GPU (Intel AMX) | CPU, no GPU (Intel AMX) |
The architecture proven at 354M, unchanged — only size and training data grow.
Our view
SLMs have entered real use — except for expert-grade judgment
Today's SLMs mostly stay at classification — picking from fixed categories, as on-device models or input-safety checks. Large models can judge, but they need GPUs and the email has to leave. We created expert-grade judgment at this size — with Systematic SFT, in the hardest seat there is: email security.
AI that judges, without being giant
Method creates capability
In large models, scale provides the capability. Below 2B, how you teach decides it. Our technology isn't a new architecture — it's Systematic SFT.
A language model we built
Not an open model we adopted, but one built without a base model. While others built models that converse, we built a model that judges.
We don't fight LLMs
General intelligence belongs to large models; judgment in the field to our own model. Per-email judgment by this model, exception analysis by an LLM agent at the administrator's side.
Scale buys capability; method creates it. Models under 2B are not practice models — we've already proven it in email security.
Email security AI that judges intent — MAIL PRISM AI