Artificial intelligence email security startup StrongestLayer Inc. today launched two products aimed at email that can move money or manipulate an AI assistant.

The first product, Intent Workflows, can hold payment, payroll and executive account requests for verification before anyone acts on them. Alongside it comes AI Instruction Intercept, which stops hidden instructions in a message before an assistant such as Microsoft Corp.’s Microsoft 365 Copilot reads them

Intent Workflows targets attacks that carry no malware or suspicious link. In vendor email compromise, a criminal takes over a real supplier’s mailbox and sends new bank details inside an existing thread.

StrongestLayer went through 32,052 attacks that got past existing defenses at 45 organizations in the second quarter. Only 3.6% were payment or bank-change requests. Under a loss model built on the Factor Analysis of Information Risk framework, that small slice accounted for more than 98% of the estimated financial exposure. Sender authentication checks were little help, since 94% of those messages passed them.

Traditional email security asks whether a message looks bad, according to Alan LeFort, StrongestLayer’s co-founder and chief executive. “The costliest attacks are built to look fine,” he said. His company looks at what a message is trying to make happen, which for a wire transfer means “verifying the action instead of betting on a verdict.”

StrongestLayer’s detection still screens every message. Intent Workflows adds a hold for the smaller set of requests that can’t be reversed, with each customer deciding whether those requests wait for verification or go to the security team or a process owner.

Customers can also let a request through with a policy banner, which appears only on tracked requests and spells out the company’s own rule, such as “Bank change: call the number on file.” Payments in scope are held whatever the verdict, so a hijacked vendor account can’t get one through by sounding legitimate.

The software compares each payment request with the payee’s history, and customers pick the threshold, whether that is every payment or only those over $5,000. If nothing has changed, the payment owner confirms in one click, in Microsoft Teams or by email. Any change, or a new vendor, means a call to a phone number already on file, and the email isn’t released until the outcome is logged.

Payroll changes are verified the same way, and executive password, multifactor authentication and account recovery resets go to the identity or security team first, even when the request comes in through the help desk.

Eric Sanchez, chief information security officer at law firm Orrick, Herrington & Sutcliffe LLP, said asking every employee to stay vigilant on every email “has never worked.” Orrick is a StrongestLayer customer and design partner. Under the new setup, every payment that can’t be undone gets “a deliberate check by a named owner,” Sanchez said.

The release also takes on a newer problem. Researchers at Aim Security Ltd. found the EchoLeak flaw in Microsoft 365 Copilot last year, and one crafted email was all it took to get the assistant leaking data.

AI Instruction Intercept reads each message first. A reasoning model checks it for hidden instructions against the customer’s own business context, and only after that does the email reach Copilot, Google LLC’s Gemini or a security classifier. Suspect messages are quarantined by default with an explanation of what each instruction was after.

Email is the one route to an AI assistant that “any outsider can use,” said Joshua Bass, StrongestLayer’s co-founder and chief product officer. He argues the inbox is the first place to stop prompt injection, since all an attacker needs is an address.

Both products are available now for Microsoft 365 and Google Workspace and run alongside a company’s existing email security.

Image: StrongestLayer