Agent Index by Heritage Services
Submit / Claim
Home / Compare / Email security and phishing-response AI agents

Email security and phishing-response AI agents

Agents that triage reported phishing and remove or classify campaigns, compared on autonomy, deployment and published pricing. Live listings: Abnormal AI Security Mailbox, Microsoft Security Copilot Phishing Triage Agent, KnowBe4 AIDA and Imperum Virtus (Email Phishing agent). This update adds Ironscales, Sublime ASA/ADÉ, Material, Proofpoint Satori, Check Point Harmony Email & Collaboration (formerly Avanan), Hoxhunt Respond, Phished, StrongestLayer TRACE and Adaptive Security. Proofpoint Satori classifies and can trigger customer workflows but does not block or delete itself. Check Point and Sublime government rows are platform-only. Material publishes per-user prices; KnowBe4 SAT Advanced (includes AIDA) publishes per-seat MSRP. This is not a ranking or score.

Columns

Hide columns to focus the table. The full comparison stays in the HTML.

Field Abnormal AI Security Mailbox (Abnormal AI for Government)Microsoft Security Copilot Phishing Triage Agent (Defender)KnowBe4 AIDA (AI Defense Agents)Imperum Virtus AI SOC agents (Triage, Pilot, Email Phishing)Ironscales AI agents (Phishing SOC Agent, Red Teaming Agent and Phishing Simulation Agent)Sublime Security ASA and ADÉ (Autonomous Security Analyst and Autonomous Detection Engineer)Material Security AI agents (user-reported phishing agent and OAuth Remediation Agent)Proofpoint Satori agents (Abuse Mailbox Agent and DLP Triage Agent)Check Point Email Security AI agents (Harmony Email & Collaboration, formerly Avanan)Hoxhunt Respond (automated phishing incident response)Phished AI security agents (Report Triage, Orchestration, Simulation and Real-Time Protection agents)StrongestLayer TRACE agents (Inbox Advisor, Threat Triage and Threat Hunt)Adaptive Security Agentic Email Security and Phish Triage
Vendor Abnormal AIMicrosoftKnowBe4ImperumIronscalesSublime SecurityMaterial SecurityProofpointCheck Point Software TechnologiesHoxhuntPhishedStrongestLayerAdaptive Security (TeamGuard AI Inc.)
HQ United States · North AmericaUnited States · North AmericaUnited States · North AmericaNetherlands · EuropeUnited States · North AmericaUnited States · North AmericaUnited States · North AmericaUnited States · North AmericaIsrael · Middle EastFinland · EuropeBelgium · EuropeUnited States · North AmericaUnited States · North America
Primary category SecuritySecuritySecuritySecuritySecuritySecuritySecuritySecuritySecuritySecuritySecuritySecuritySecurity
Also listed in Security, ComplianceSecuritySecurity, ComplianceSecuritySecuritySecuritySecuritySecuritySecuritySecuritySecuritySecuritySecurity
Summary Autonomous agent for email security operations that triages user-reported emails, removes related malicious campaign messages across the organisation and replies to reporters; included in Abnormal AI for Government, which is FedRAMP and GovRAMP Moderate authorized.Security Copilot agent in Microsoft Defender that autonomously triages user-reported phishing, resolves false positives and explains each verdict.Suite of AI agents for human risk management that automatically generate and deliver personalised phishing simulations, training, remedial and policy-quiz content per user; the FedRAMP Moderate KnowBe4 Platform covers AIDA (except AIDA Deepfakes).Amsterdam-built autonomous SOC platform whose Virtus agents triage every alert through a 7-stage pipeline, return a verdict with confidence and evidence, and hand cases to an investigation agent, with sovereign/on-prem AI options.API-based email security for Microsoft 365 and Google Workspace that runs three AI agents: a Phishing SOC Agent for L2-style forensic investigation of suspicious emails, a Red Teaming Agent that models attacks aimed at your organisation and hardens detection, and a Phishing Simulation Agent. Plans include agentic autonomous remediation.Email security platform whose AI agents triage user-reported and flagged emails end to end (ASA, with passive or active auto-remediation modes) and write backtested detections for new attacks (ADÉ), which default to one-click human approval and can auto-activate when they clear a precision threshold. Runs as SaaS or self-hosted in AWS, including GovCloud.Cloud workspace security for Google Workspace and Microsoft 365 with an AI agent that triages, clusters and remediates user-reported phishing across the organisation, plus an OAuth Remediation Agent that investigates third-party app and AI-agent grants and can revoke tokens on its own. Per-user pricing is published.Agentic AI layer inside Proofpoint's platform. The Satori Abuse Mailbox Agent classifies every user-reported email that needs manual review (phish, malware, spam or clean) and can trigger configured quarantine or tagging workflows. A DLP Triage Agent does the same for data-loss alerts, with guardrails, chat explanations and audit logs.Check Point's API-based, prevention-first email and collaboration security (Harmony Email & Collaboration, formerly Avanan) for Microsoft 365, Gmail, Teams, Slack and file-sharing apps. Check Point says autonomous AI agents investigate threats, correlate activity into campaigns, prioritise incidents and orchestrate remediation. Check Point Infinity Platform for Government (which includes Harmony Email) is FedRAMP Moderate and GovRAMP Authorized at platform level; Check Point Harmony is TX-RAMP Level 2 — none of those registry rows name the AI agents.Finnish human-risk platform whose Respond module automatically investigates every employee-reported email, groups related reports into one campaign incident, suppresses safe and duplicate reports, and removes confirmed malicious messages from all affected inboxes without waiting for an analyst.Belgian human-risk platform with a suite of AI agents that run the phishing training programme (orchestration, simulation, brand, supplier and deepfake simulation agents), triage every reported email with a verdict and a drafted reply, and check clicked links in an isolated environment in real time. New content needs admin approval and every action is logged.AI-native email security for Microsoft 365 and Google Workspace in which a multi-LLM reasoning engine (TRACE) investigates each email's intent against your business context and blocks attacks. Three classes of agents give employees plain-English verdicts in Outlook and Gmail, send pre-investigated, MITRE-mapped cases to the SOC, and hunt and remediate across mailboxes.API-based 'agentic email security' that re-analyses inbound mail after native filtering with ML and LLM reasoning and removes confirmed threats across every inbox automatically (configurable human-in-the-loop thresholds). AI Phish Triage classifies employee-reported emails and acts on them, feeding Adaptive's simulations and awareness training.
What the agent does on its own Triages user-reported mail, removes related campaign messages org-wide, replies to reporters.Classifies user-reported phishing, resolves false positives, leaves true positives open with a rationale.Generates and delivers personalised phishing simulations, training and quizzes per user.Virtus Email Phishing agent plus SOC triage/investigation pipeline with verdicts and evidence.Phishing SOC investigation, Red Teaming detections, simulation agent; plans include agentic autonomous remediation.ASA triages abuse-mailbox and flagged mail; ADÉ writes and backtests detections.User-report agent classifies and remediates org-wide; OAuth agent can revoke tokens.Classifies abuse-mailbox submissions (phish/malware/spam/clean) and DLP alerts; can trigger configured quarantine/tag workflows.Vendor says AI agents investigate, correlate campaigns, prioritise incidents and orchestrate remediation (marketing/webinar; not in the 15 Oct 2026 admin guide).Investigates reported mail, clusters campaigns, suppresses safe/duplicate reports, removes confirmed threats across inboxes.Report Triage returns a verdict and drafted reply; simulations and training run continuously; real-time link verdicts.Per-email TRACE verdicts (Inbox Advisor); Threat Hunt can sweep then remediate.Re-analyses inbound mail after native filtering; removes confirmed threats across inboxes; Phish Triage classifies reported mail.
Human-in-the-loop controls Vendor describes fully automated triage and remediation in the Abnormal Gov suite.True positives stay open for analysts; learns from analyst feedback.Awareness/simulation agents; not an inbound-mail enforcement gateway.Customer-set thresholds; auto-close, escalate or queue for approval; overrides logged.Customisable remediation thresholds on plan cards.Passive mode never changes mail; active mode auto-remediates per verdict; unknown always goes to a human; ADÉ defaults to approval, with optional auto-activation above a precision bar.Uncertain phishing verdicts flagged for review; OAuth agent can require analyst approval for business-critical apps.Agents do not block, delete or change policy; high-risk alerts escalate to humans.Admin guide documents quarantine and reported-phishing workflows; confirm agent HITL in a demo.Vendor calls it automation; removal is reversible; complements Microsoft Defender.New content needs admin approval; Incident Response agent drafts a checklist only; every action is logged.Threat Triage leaves the final call to analysts (“Analysts decide; they don’t dig”).Configurable confidence thresholds for when a human must approve; quarantined mail waits for admin review.
Deployment model API on Microsoft 365 / Google Workspace (Abnormal AI for Government).Inside Microsoft Defender / Security Copilot (Defender for Office 365 Plan 2 + SCUs).KnowBe4 SAT Advanced (human-risk / SAT platform).Imperum autonomous SOC / agentic SecOps platform (sovereign/on-prem AI option).API on Microsoft 365 and Google Workspace; no MX change.Sublime Cloud or self-hosted AWS including GovCloud; Enterprise required for ASA.API on Google Workspace and Microsoft 365.Inside Proofpoint (CLEAR / Threat Protection Workbench); MCP to other tools.API-based inline for Microsoft 365, Gmail and collaboration apps (formerly Avanan).Hoxhunt Respond module; Microsoft 365-oriented; SOAR/SIEM hand-off.Phished human-risk platform; Microsoft 365 / Google Workspace / SIEM / SOAR.API on Microsoft 365 and Google Workspace; ~15-minute deploy; no MX change.API; no MX change.
Works alongside a SEG? API mailbox security; can sit with existing mail flow. Confirm with vendor.Runs in Microsoft’s Defender stack, not as a third-party SEG overlay.Not a SEG replacement; complements email filtering and training.SOC platform, not a mailbox API overlay.Vendor FAQ: yes, can run alongside an existing SEG.Email security platform with detections/response; self-hosted option.Cloud workspace security overlay; not positioned as a replacement MX gateway.Sits in the Proofpoint stack, not as a third-party SEG overlay.Inline API email security (Harmony Email & Collaboration).Complements Microsoft Defender; not a replacement MX gateway.Awareness and reported-mail triage; not a SEG replacement.Vendor: deploy alongside Proofpoint or Mimecast, or replace a gateway.Re-analyses after native filtering; API overlay, not an MX replacement.
Government authorizations (registry) fedramp Abnormal AI for Government · FedRAMP Authorized · FR2425960757 · Moderate · authorized 2025-04-11 (listing); tx-ramp Abnormal AI for Government · Level 2 · TX1890118 (listing); tx-ramp Abnormal AI · Level 2 · TX1227626 · expires 2029-03-25 (listing); govramp Abnormal AI for Government · Authorized · Moderate (listing)—fedramp KnowBe4 Platform · FedRAMP Authorized · FR2201340492 · Moderate · authorized 2023-11-14 (listing); tx-ramp KnowBe4 Platform · Level 2 · TX1009295 (listing)——tx-ramp Sublime Security Platform · Level 2 · TX1903681 · expires 2029-07-05 (platform-only)——fedramp Check Point Infinity Platform for Government · FedRAMP Authorized · FR2511048038 · Moderate · authorized 2025-09-24 (platform-only); govramp Check Point Infinity Platform for Government · Authorized · Moderate (platform-only); tx-ramp Check Point Harmony · Level 2 · TX1598637 · expires 2028-01-27 (platform-only)————
Framework tags (Agent Index) FedRAMP, GovRAMP, TX-RAMP—FedRAMP, TX-RAMP——————————
FedRAMP (Marketplace, listing scope) Abnormal AI for Government · FedRAMP Authorized · FR2425960757 · Moderate · authorized 2025-04-11—KnowBe4 Platform · FedRAMP Authorized · FR2201340492 · Moderate · authorized 2023-11-14——————————
Frameworks (vendor-claimed) FedRAMP, GovRAMP, TX-RAMP—FedRAMP, TX-RAMP——TX-RAMP——FedRAMP, GovRAMP, TX-RAMP————
Capabilities / tasks phishing triage, email security, security operations, alert triage, incident response, remediation, government compliancephishing triage, email security, security operations, alert triage, incident response, threat detectionemail security, policy management, workflow automation, risk assessment, government compliancephishing triage, email security, security operations, alert triage, incident response, case investigationphishing triage, email security, incident response, remediation, threat detectionphishing triage, email security, alert triage, remediation, threat detectionphishing triage, email security, remediation, incident response, cloud securityphishing triage, email security, alert triage, security operationsemail security, phishing triage, threat detection, incident response, remediationphishing triage, email security, incident response, remediationphishing triage, email security, workflow automation, risk assessment, incident responseemail security, phishing triage, alert triage, threat detectionemail security, phishing triage, remediation, threat detection
Pricing (as published) Not publishedNo standalone price. Requires Microsoft Defender for Office 365 Plan 2 plus Security Copilot security compute units (SCUs). Microsoft says Security Copilot agents are also made available to Microsoft 365 E5 customers. Check Microsoft's Security Copilot pricing for SCU rates.Published MSRP on knowbe4.com (May 2026 list, per seat per month, 3-year term): SAT Advanced, which includes AIDA, from $3.75 (25–50 seats) down to $2.79 (501–1,000 seats); 1,001+ seats by quote.Not publishedNot published (plan cards on the pricing page say 'Get Pricing')Not published for Sublime Enterprise (required for ASA). Free Sublime Core tier and free EML Analyzer available.Published: Essentials $4 per user/month and Advanced $6 per user/month (billed annually, plus a fee based on Shared Drive size). Essentials includes the automated agent for user-reported phishing. Advanced adds the agent that investigates, classifies and remediates OAuth grants. ATO Resilience is +$3 per user/month as an add-on or $5 stand-alone. Enterprise is by quote.Not published as list prices. The Abuse Mailbox Agent datasheet describes an action-based model (pay for automated work performed, not users, tokens or seats) without dollar amounts.Not publishedNot published (per-employee quote after a scoping call)Not published (Core, Advanced and higher tiers listed without visible prices; partner pricing available)Not published (custom, per mailbox; 14-day proof of concept)Not published (per-seat quote based on employee count and products)
Pricing model quotequotepublished-tiersquotequotequotepublished-tiersquotequotequotequotequotequote
Primary source https://abnormal.ai/products/ai-security-mailboxhttps://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agenthttps://www.knowbe4.com/products/aidahttps://www.imperum.io/autonomous-soc/virtus-triagehttps://ironscales.com/platform/agentshttps://docs.sublime.security/docs/asa-autonomous-security-analysthttps://material.security/use-cases/automate-user-report-responsehttps://www.proofpoint.com/us/platform/satorihttps://www.checkpoint.com/harmony/email-security/https://hoxhunt.com/product/phishing-email-incident-response-automationhttps://phished.io/ai-security-agents/https://www.strongestlayer.com/platform/threat-triagehttps://www.adaptivesecurity.com/email-security
Last checked 2026-10-182026-10-182026-10-182026-10-182026-10-182026-10-182026-10-182026-10-182026-10-182026-10-182026-10-182026-10-182026-10-18
Official site https://abnormal.ai/products/ai-security-mailboxhttps://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agenthttps://www.knowbe4.com/products/aidahttps://www.imperum.io/autonomous-soc/virtus-triagehttps://ironscales.com/platform/agentshttps://docs.sublime.security/docs/asa-autonomous-security-analysthttps://material.security/use-cases/automate-user-report-responsehttps://www.proofpoint.com/us/platform/satorihttps://www.checkpoint.com/harmony/email-security/https://hoxhunt.com/product/phishing-email-incident-response-automationhttps://phished.io/ai-security-agents/https://www.strongestlayer.com/platform/threat-triagehttps://www.adaptivesecurity.com/email-security

Email-security extra rows (autonomy, human-in-the-loop, deployment, SEG coexistence, government authorizations) are generated from each listing’s vendor pages and registry records. Check Point and Sublime government rows are platform-only. Proofpoint Satori classifies and can trigger customer workflows but does not block or delete itself. This is not a ranking. Dedicated AI SOC listings are on the AI SOC table.

Side-by-side data is generated from the open dataset. “Vendor-claimed” frameworks are as marketed by each vendor and not verified by Agent Index; framework tags indicate relevance, not certification. Request current quotes from each vendor before buying. This page does not rank or score vendors. Sponsored comparisons, if any, will be labelled.

Use-case comparisons

Related