Why Aegis AI Builds Its Own Models for Email Security

Ryan Luo · Founder & CTO · Aegis AI

Nov 2026AI Engineering Leadership

01 — The conversation

GuestRyan LuoFounder and CTOAegis AIProfile →

Ryan Luo, Founder and CTO of Aegis AI, explains why his team moved beyond commercial AI APIs to build models tailored to email security. He discusses the difficult balance between catching phishing attacks and avoiding false positives, along with how AI agents are changing engineering work and leadership.

Key ideas

01Commercial language models detected phishing, but false positives made production accuracy a challenge.

02Custom models gave Aegis AI greater control over detection performance, inference costs, and compute.

03Engineers working on detection investigate real threats and learn directly from security analysts.

04AI-assisted investigation reduced some detailed customer reporting work from three or four hours to about 20 minutes.

05AI coding agents make clear requirements, verification, domain understanding, and measurable milestones increasingly important.

Powerful language models can identify sophisticated phishing attacks, but detecting threats is not enough for an enterprise security product. Ryan explains why Aegis AI tested commercial APIs and then built its own models to distinguish suspicious messages from actual threats. Improving precision and recall without disrupting legitimate business communication remains a difficult engineering challenge.

Ryan describes the cost and control advantages of model ownership, including tuning how much compute and intelligence is used for a given attack. His team combines threat-specific context with frequent experimentation, and detection engineers take labeling shifts so they understand the real problems their models must solve.

The conversation also explores junior engineers, AI-assisted coding, and agentic operations. Ryan explains why engineers should question initial AI answers, how well-designed scaffolding can improve automated investigations, and why leaders are increasingly coaching engineers to specify clear, measurable outcomes.