Giulian Garruba

The Anti-Phishing Working Group (APWG) — the world's leading coalition of industry, law enforcement, and government organizations combating phishing and cybercrime — tracks which sectors phishing attacks target most. In its 2025 Q4 report, SaaS and webmail platforms, including Google Workspace, tied for the most-targeted sector industry-wide, each accounting for 20.3% of all phishing attacks.

Your organization is deploying AI agents. If it hasn’t started yet, it will soon. IDC projects over 1 billion agents in the enterprise by 2029, 40 times higher than today, making 217 billion actions per day. They will read your email, query your databases, summarize your financial records, and execute workflows across every system your employees touch. The agentic AI security market is responding fast.

When you're evaluating email security tools, you shouldn't have to choose between a fair test and keeping your users safe. Yet somehow, that's become the ask. Here's a pattern we've seen. Organizations run a PoV comparing API-only tools with SEG solutions. Then someone suggests turning off core protections on the SEG (URL rewriting, attachment controls, advanced threat policies) to "level the playing field." That's not leveling anything; it's just removing the field entirely.