The hardest email threats to catch don’t look malicious at first glance.

They come from trusted senders, inside real conversations, with requests that appear legitimate. Nothing about them immediately signals risk, which is exactly why they work.

When these emails are investigated carefully, the answer is usually there. The intent can be uncovered, and the attack can be understood. The issue is that doing this well takes time, experience, and access to multiple layers of context that not every team has at hand.

Security teams have spent years layering tools into the email stack, yet the highest-impact attacks still reach the inbox. The reason comes down to how these systems are built. Traditional tools are designed to recognize patterns such as known indicators, anomalies, and signals that can be matched at scale. The challenge is that modern attacks are built around context, not patterns, which leaves a gap that continues to be exploited.

This is especially visible in vendor compromise, targeted phishing, and AI-generated social engineering. AI has made these attacks easier to generate, more personalized, and far more scalable, reducing the kinds of signals that detection systems rely on.

To address this directly, Ocean built Ray, a central autonomous intelligence engine designed to investigate and understand email threats in context. 

What Investigation Actually Looks Like Today

When a suspicious email reaches a SOC analyst, the investigation follows a familiar path. The analyst starts with the email itself, reviewing headers, content, attachments, and links to identify anything out of the ordinary. From there, the work moves into context. Prior communication history is reviewed, the sender’s behavior is evaluated, and subtle shifts in intent are examined.

Infrastructure and threat intelligence checks follow, validating whether anything behind the email points to compromise or abuse. Only after this full process does the analyst make a decision, take action, and document the findings.

This approach works, but it is manual, time-intensive, and difficult to apply consistently across the volume of email most organizations receive. As a result, only a fraction of emails are ever investigated at this level of depth.

How Ray Understands Email Attacks in Real Time

Ray applies that level of investigation continuously, across every email, as it arrives.

In a vendor compromise scenario, a trusted sender makes a request that looks plausible, but something in the context has shifted. Analysts typically need to reconstruct prior communications to determine whether the request aligns with expected behavior. Ray evaluates how that sender typically communicates, identifies when intent deviates, and surfaces the inconsistency immediately without requiring manual review.

The same approach applies to reported phishing. Security teams have trained users to report anything suspicious, which creates a steady stream of low-signal emails. Ray analyzes each reported message in context, determining whether it represents real risk or normal communication. At the same time, it provides case-specific feedback to the user, turning each report into a training opportunity and improving judgment over time without adding workload to the SOC.

For attacks that do not match any known pattern, the process shifts as well. These cases often require deeper analysis to determine intent, and detection typically happens only after someone investigates and creates a new rule. Ray evaluates behavior and context in real time, allowing it to identify threats without relying on prior examples and reducing the need for reactive rule creation.

Across these scenarios, the dependency on manual investigation is removed. Ray enables these attacks to be understood as they occur.

An AI-Native, Agentic Approach to Investigation

Ocean’s platform is built as an AI-native, agentic system. A swarm of agents works together to carry out different parts of the investigation, including content analysis, communication review, infrastructure checks, and threat intelligence lookups.

Ray acts as the central intelligence layer that coordinates this system. It does not attempt to perform every function itself. Instead, it orchestrates sub-agents, ensuring that each step of the investigation is executed and that the results are combined into a coherent understanding of the email.

The process mirrors what an analyst would do manually, but without the same constraints around time and scale. Each email is evaluated directly, with the system determining whether it makes sense in context rather than waiting for a predefined signal.

In cases where additional internal context is needed, analysts can contribute information that becomes part of the system’s knowledge. Over time, this allows the system to adapt to the organization while continuing to operate autonomously across the vast majority of cases.

What previously required hours or days of work can now happen automatically and at scale across all emails.

What Changes for the Security Team

For the security team, this changes how work is distributed and how decisions are made.

More attacks are identified before they ever require manual investigation, and emails are evaluated with full context rather than partial signals. Analysts don’t have to rely on incomplete indicators or opaque verdicts, which reduces uncertainty around whether something is actually malicious.

Novel attacks also no longer depend on someone identifying a gap and writing the next rule after the fact. Instead of spending time validating low-signal activity, teams gain deeper visibility into real threats and can operate with greater confidence in what reaches the inbox.

At the same time, this approach addresses a long-standing issue in email security: the black box problem.

Many tools provide a verdict without showing how it was reached, forcing analysts to retrace the investigation manually if they want to validate the decision. This slows response time and limits trust in the system’s output.

The industry has made progress in addressing this with explainable AI (xAI), introducing ways to surface contributing factors and provide partial insight into model behavior. But in most cases, that visibility stops short of the investigation itself. Analysts may see why a model produced a score, but not how the full decision was formed across all layers of context.

Ray takes a more complete approach. The full chain of reasoning is exposed, including how the email was analyzed, what context was considered, and how the conclusion was reached. Analysts are not asked to trust a decision; they can see how it was made.

Over time, this changes the relationship between the team and the system. Decisions become clearer, confidence increases, and the need to second-guess outcomes is reduced. The result is fewer missed attacks, more consistent responses, and a level of visibility that allows the team to operate with greater certainty.

What Happens When Every Email Gets Investigated

The ability to identify these attacks has never been the limiting factor. Practitioners have shown, time and again, that with enough time and context, the signal can be found. The challenge has been applying that level of understanding consistently across the full volume of email.

Ray changes that by extending the investigation to every message, rather than reserving it for a small subset of cases.

Once email security operates this way, investigation becomes continuous and proactive, and legacy tools feel inherently incomplete. 

Book a demo to see Ray investigate email threats in a live environment.