Operating inside one of Israel’s most elite cyber units, Shay Shwartz and Oran Moyal worked on the offensive side of cyber operations, pushing systems to their limits, finding the cracks, and exploiting them before anyone else could. “We’d go three, sometimes four days straight,” Shay recalls. “High pressure, no margin for error.” What they were building in those moments went beyond technical skill. It was a test of endurance, judgment, and, most importantly, partnership.

Years earlier, the two had met as teenagers in Magshimim, a prestigious cyber program in Israel. A successful Capture the Flag competition sparked a friendship that would carry through years of collaboration, from sharing knowledge as students to eventually working side by side in high-stakes military operations. Those years did more than sharpen their abilities. They built a deep level of trust, the kind forged under pressure, where you learn how someone thinks, reacts, and solves problems when the stakes are high. That would ultimately become the foundation for Ocean.

The Problem They Couldn’t Ignore

After their military service, Shay and Oran moved into roles across the security ecosystem, including Microsoft, Axis Security (acquired by HPE Aruba Networking), and Bitsight (following its acquisition of VisibleRisk), where they built enterprise security solutions at scale. 

Over years on the offensive side of security, they developed a deep understanding of how attacks actually unfold in practice. Email was consistently at the center. It remained the primary entry point, the channel where trust is exploited and where small signals carry outsized impact.

At the same time, a major shift was underway. Advances in AI were opening up a fundamentally new way to approach the problem. For the first time, systems could begin to understand communication through context and intent, not just patterns.

That shift was happening on both sides. The same technology that could help defenders understand email was also making attackers significantly more effective. AI was lowering the barrier to highly targeted, convincing phishing, giving even low-resourced actors the ability to operate with a level of precision that previously required nation-state capabilities.

Email had been the number one attack vector for years. Now, it was becoming even more dangerous.

That combination made the opportunity clear. The problem was massive, the timing was right, and the technology had finally caught up. Shay and Oran had the domain expertise from years of offensive work, and they knew exactly what it would take to build a new kind of email security platform. One that could understand email at the same level as a security analyst.

Ocean was built from that insight.

A Different Bet

The idea for Ocean began with a simple but ambitious question: What would email security look like if it truly understood each message and its intent?

At the time, that was a risky premise to build a company around. Large language models (LLMs) were still early and inconsistent, and most of the industry remained focused on traditional machine learning approaches built on rules, retraining cycles, and historical patterns.

Ocean made a deliberate bet: email security shouldn’t just detect anomalies and patterns, it should understand context. While the market doubled down on rules, ML retraining cycles, and pattern analysis, Ocean built on LLMs from day one.

“All the existing solutions were built on models that need constant retraining, rules, and tuning,” Shay explains. “They don’t actually understand the message.” Ocean’s approach centers on understanding email the same way humans do, interpreting language, context, and intent. This depth allows the platform to surface risks that traditional systems miss and adapt quickly as attacks evolve—before they hit.

The First “Wow” Moment

That conviction began to pay off when Ocean deployed its first AI agent into production within real email environments. It was instantly achieving results comparable to legacy email security platforms that had been in the market for years.

For the founders, this was a turning point. “That’s when we realized this isn’t incremental,” Oran says. “This is a significantly different way of solving the problem.” What stood out even more was the trajectory. The system was continuously improving, uncovering new insights and identifying threats that had previously gone unnoticed.

Customers began to see a level of visibility into their email environment that they had not experienced before. The platform was not just catching known threats; it was revealing entirely new categories of risk.

Then Came the Second

A second breakthrough followed, expanding what the platform could do at scale. Ocean’s agents began learning from each other and creating feedback loops that operate directly within the email security workflow.

“One agent would identify something, another would validate or correct it, and suddenly you are closing the loop without a human,” Oran explains.

This created a system where detection, investigation, and validation could happen continuously and autonomously across large volumes of email communications. As a result, Ocean can respond to threats at the same pace they emerge, staying ahead of attackers who are constantly adapting their tactics.

Why Now

For Shay and Oran, the decision to come out of stealth reflects a clear moment of readiness. The underlying technology has matured, the platform has been proven in production, and Ocean has accumulated extensive real-world experience operating in live email environments.

After more than a year and a half running proprietary AI agents and processing billions of emails, the company has built a compounding advantage. While much of the market is only beginning to explore AI-driven approaches to email security, Ocean has already been iterating, learning, and refining its system in enterprise customer environments.

Building More Than a Product

Ocean is building both an email security platform and a team designed to approach the problem from multiple angles. The company brings together AI researchers, social engineering specialists, fraud detection experts, and engineers who have built large-scale infrastructure for some of the world’s biggest organizations.

Many of these individuals have worked together before, creating a strong foundation of trust from day one. At the same time, the founders intentionally built a team with diverse perspectives. “Not everyone thinks the same, and that’s intentional,” they say. “We want the debates. That’s how you get to the best decisions.”

This focus on people extends beyond team composition. “People are the core and heart of the company,” they both emphasize. “We spend a lot of time making sure this is a place where people can grow.” That mindset carries into the product itself, where understanding human behavior is central to how Ocean approaches email security.

Why “Ocean”

The name Ocean reflects how the founders see the email security landscape.

“About 80 percent of the ocean is still undiscovered,” Shay says. That is where the unknown lives, where the most important signals are hidden beneath the surface. It is also where modern email threats exist — subtle, contextual, and often invisible to traditional systems.

Most email security tools operate at the surface level, focusing on patterns, rules, and anomalies. Ocean is built to go deeper into every message. By leveraging AI to understand intent and enrich context, it uncovers layers of meaning within emails that were previously out of reach.

The name is a reflection of that approach. Email security is not about scanning what is visible. It is about exploring what is not, and bringing clarity to the vast, uncharted space where real risk exists.

Getting Close to the Problem

As the company evolved, one strategic decision became clear. To build a world-class email security platform, they needed to be close to the organizations they serve. For Shay, that meant relocating to the United States.

Being on the ground enables Ocean to have real conversations with security teams, understanding their pain points, experiencing their frustrations, and observing their day-to-day operations. Feeding those insights directly back to the product team from the early days reverses the typical model: instead of technology outpacing adoption, adoption outpaces technology. The platform evolves in real environments, shaped by real needs, with a full feedback loop made possible by early adopters and believers who let us into their SOCs to tackle the hardest problem they've been trying to solve for their entire careers.

What Comes Next

Ocean was built on a simple but hard-earned insight. Attackers have long understood how to exploit human communication through email.

For years, Shay and Oran operated within that reality, learning how attacks move through inboxes, how trust is manipulated, and where systems fall short. Now, they are applying that knowledge to build a platform that understands email at the same level.

By bringing context, intent, and human understanding into email security, Ocean is closing a gap that has persisted for far too long. 

For the first time, defenders can adapt and operate at the same depth as attackers.