Email security AI that judges intent
No links, no attachments, flawless sentences. The most dangerous emails give you nothing to block them on. MAIL PRISM AI reads between the lines — the intent behind the words — and judges.
- Our own language model, built without open weights for security (354M → 1.5B)
- CPU* inference without a GPU — email stays inside the gateway
- Every block comes with a reason your staff can read
Attack emails are now written by AI
The days of catching them by their clumsy wording are over. In December 2025, 56% of reported phishing was written by AI.
- AI can rewrite the words endlesslyStyle, vocabulary, length, language — once blocked, the next email arrives in different words.
- Facts left in the headers can't be rewrittenYour history with this sender · the sending path · the reply-to address
So can a defending AI simply stop the attacking AI?
Source: Hoxhunt (Mar 2026) — share of reported phishing written by AI: under 5% for most of 2025, 56% in December
Even a defending AI seesaws — the better it reads
These two emails say the same thing. The more precisely an AI reads the meaning, the more it treats them alike.
When the words are the same, no amount of good reading tells them apart. That is why AI has had no proven track record in operational email security.
The job is reading between the lines — not just the words or the context. Context is how the text flows; what's between the lines is the intent behind it. Far smaller in size, but the job is judgment.
Emails that passed every check — and how we judge them
Reputation, authentication and antivirus all let these through. They passed because there was nothing to block them on — not because the existing checks were wrong.
- From
- Minsoo Kim <minsoo.kim@partner-trade.com>
- Subject
- RE: Payment date for the September delivery
Hello. I've confirmed what you sent.
Could you check the scheduled payment date for us?
Also, our bank account has changed — please use the one below.
Existing checks
- SPF · DKIM · DMARCPass
- URL reputationNo links
- Antivirus · sandboxNo attachments
- Volume · reputation listsClean
- Grammar · keywordsNormal
- From
- CEO Jungho Kim <ceo.kim.jh@outlook.com>
- Subject
- (Urgent) Can't take calls right now
I'm out at a meeting and can't take calls.
There's a payment that has to go out today,
Reply and let me know if you can handle it now.
Existing checks
- SPF · DKIM · DMARCPass
- URL reputationNo links
- Antivirus · sandboxNo attachments
- Volume · reputation listsClean
- Grammar · keywordsNormal
- From
- Mail Administrator <notice@mailbox-service-alert.com>
- Subject
- [Notice] Mailbox full — incoming mail will stop
Your mailbox has exceeded its limit and new mail will stop soon.
Check your usage and extend it below.
https://mailbox-service-alert.com/renew
Existing checks
- SPF · DKIM · DMARCPass
- URL reputationClean
- Antivirus · sandboxNo attachments
- Volume · reputation listsClean
- Grammar · keywordsNormal
- From
- Junyoung Park <jy.park@kr-supply-partners.com>
- Subject
- RE: Following up on what you mentioned
Following up on our last conversation.
I've put together a list of products that match your specs.
Sign by the end of this month and get 18% off.
Reply and I'll send you a quote.
Existing checks
- SPF · DKIM · DMARCPass
- URL reputationNo links
- Antivirus · sandboxNo attachments
- Volume · reputation listsClean
- Grammar · keywordsNormal
For emails there was nothing to block on, it leaves the reason for blocking in a sentence your staff can read and agree with.
Open-weight models are good AI — just not for a gateway
Not because the models are wrong. Being public is a strength everywhere else, and a weakness in the seat of a security judge.
Nothing to take away
Attackers can't download the same judge and test which emails get through. All they can do is send emails — and every attempt is logged at the gateway.
It only outputs judgments
It does not execute instructions written in the email body. Text written by an attacker cannot make the AI do anything.
Built from pre-training
Not a shrunk or fine-tuned public model. We can name what it was trained on, and we fix and redeploy it ourselves on a short cycle.
With Systematic SFT, we taught it to read between the lines
A system for teaching an SLM expert-grade judgment — trained on a single GPU, judging on CPUs without a GPU.
- You see the reason for a block, in a sentenceRisk criteria are written as sentences, not categories. The model learns to judge, sentence by sentence, whether an email matches.
- Same words, judged by their hidden intentIt reads your history with the sender, the sending path and the reply-to address together, and is taught to judge the intent behind identical words.
- Legitimate business email keeps flowingWhen we choose a model, not blocking legitimate email comes before catching a few more threats.
- Rebuilt on a short cycleIt's method, not resources — so we can quickly rebuild a new model that reflects the field.
The judgment large models gain from scale doesn't come for free below 2B. We created it in a 354M language model — by method.
Measured performance
We measure on real email, and state how we measured
We don't publish a lone number. We say which emails it was measured on.
- Measured onInternal evaluation set — 1,757 legitimate emails · 1,232 threat emails · 82 judgment criteria
- Legitimate emailsDeliberately hard ones — emails whose wording resembles threats, and emails that were once blocked in real operation
AUC
0.972
Pick one legitimate email and one threat email at random: the probability that the legitimate one is judged less risky1 is perfect; 0.5 is a coin toss
We don't quote accuracy. Measure on threat emails alone, and a model that blocks everything scores 100% accuracy. AUC can only be measured with legitimate emails included, so wrongly blocking legitimate email pulls the number down immediately.
So, which of the emails reaching your company today could it stop?
It fills the gap existing email security left open
| The existing problem | MAIL PRISM AI |
|---|---|
| Fraud emails with no links or attachments pass existing checks untouched | Judges what's between the lines — catches a bank-account change request with no prior history |
| Link scanners can't open phishing pages hidden behind a CAPTCHA | Reads what the email asks for, not what lies beyond the link |
| AI-written text isn't caught by grammar or keyword filters | Judges by facts left in the headers and the hidden intent, not by the wording |
| An AI that only reads the words blocks real supplier email too | Protects legitimate email first — AUC 0.972, measured with legitimate email included |
| Behavior-analysis AI must send your email to the vendor's cloud | Inside the gateway, on CPUs without a GPU — even in air-gapped networks |
| Why it was blocked is left only as a score | The reason is recorded as the judgment-criterion sentence |
One gateway, in front of the mail server you already run
Nothing to install on user PCs, phones or the mail server. It keeps your existing equipment in place and judges together with its results.
- DeploymentOn-site installation, PRISM Cloud, dedicated PRISM Cloud
- EnvironmentsStandard mail environments, Microsoft 365 · Google Workspace, air-gapped networks
- With existing equipmentJudges together with your current email security equipment's results; supports All-Active redundancy
Frequently asked before adoption
Do we have to replace our current email security equipment?
No. It takes the results of your existing equipment and judges together with them. Nothing has to be removed.
Do we need a separate GPU server?
No. Judgment runs without a GPU, on CPUs with Intel AMX.
Does our email leave the company to be judged?
Judgment finishes inside the gateway. Nothing is sent to an external API or GPU server.
Who decides what gets blocked?
For each judgment criterion, the administrator chooses pass, block, approve or notify.
How much does it cost?
It depends on your headcount and current infrastructure. Leave us your email and we will send you a quote.
* CPUs with Intel AMX (Advanced Matrix Extensions)
Emails there's nothing to block on — judged inside your gateway, with the reason on record.
We'll send materials and a deployment plan that fit your mail environment.