What makes Ocean different from existing email security vendors?

Ocean uses a custom language model to understand sender intent and organizational context in real time, whereas established players like Proofpoint and Mimecast focus on signature-based detection of conventional phishing.

Why is LLM-powered phishing considered a new threat class?

Large language models automate the reconnaissance and message crafting that previously required manual effort, reducing the barrier to launching targeted spear-phishing campaigns at scale.

Who is backing Ocean?

Lightspeed Venture Partners led the round, with participation from Picture Capital and Cerca Partners. Angel investors include Assaf Rappaport (Wiz CEO) and co-founders of Armis (acquired by ServiceNow for $7.75 billion).

Ocean Lands $28M to Deploy AI-Native Email Defense Against LLM-Powered Phishing

Ocean Emerges With $28M to Combat LLM-Driven Inbox Threats

Ocean, a startup applying intelligent automation to email threat detection, has raised $28 million across investor syndicates including Lightspeed Venture Partners, Picture Capital, and Cerca Partners. Founder Shay Shwartz and co-founder Oran Moyal launched the company to address a fundamental shift in how attackers craft phishing campaigns: the commoditization of targeted message generation through large language models.

According to TechCrunch, the capital infusion reflects growing concern that conventional email security—built to detect phishing templates and known attack signatures—does not account for adversaries using LLMs to automate reconnaissance and personalization at scale. Shwartz, who spent roughly a decade in Israel’s defense and intelligence apparatus before joining Axis (later acquired by HPE), observed that what once required specialist skill and weeks of manual labor can now be orchestrated in minutes through API calls to foundation models.

The Shift From Manual to Automated Phishing

The threat model has evolved. In earlier eras, spear-phishing demanded that attackers manually research targets, craft pretexts, and send individualized messages—activities that limited the volume attackers could sustain. Shwartz told TechCrunch that LLMs invert this constraint: “I can instruct LLM to go and understand exactly who you are, harvest large amount of public information, and create those phishing attacks very targeted against you.” This transformation renders rule-based and behavioral detectors increasingly insufficient.

Ocean’s response is a proprietary small language model optimized for inbox analysis. Rather than matching against signature databases, the system contextualizes each message against organizational communication patterns and sender identity signals. The startup processes billions of emails monthly for clients including Kayak, Kingston Technology, and Headspace.

Investor Confidence and Market Timing

The backing from Assaf Rappaport (CEO of Wiz), along with Yevgeny Dibrov and Nadir Izrael (co-founders of Armis, acquired by ServiceNow for $7.75 billion in 2024), underscores confidence that email remains a critical vulnerability surface as attack tooling becomes more commoditized. Established players like Proofpoint and Mimecast dominate legacy detection; newer entrants like Abnormal Security have built traction on behavioral analytics. Ocean’s positioning—agentic AI applied to context-aware inference—targets a gap between signature-matching and human review.

Why This Matters

The $28 million raise signals that investors view LLM-powered phishing as a distinct threat requiring purpose-built defenses rather than incremental hardening of existing tools. Organizations deploying custom threat models tailored to their communication graphs may shift vendor selection away from generalist email gateways toward specialized AI-native platforms. If Ocean’s proprietary model demonstrably reduces phishing-derived breaches in customer environments, the success could accelerate adoption of agentic email systems across enterprise security stacks—and attract further capital to the category.