---
title: "Stopping business email compromise with AI-driven email security: How VIPRE protects modern enterprises on AWS"
description: "Business email compromise (BEC) uses social engineering and impersonation rather than malicious links, bypassing traditional secure email gateways that are blind to internal traffic and lateral movement. VIPRE developed Integrated Email Security (IES), a cloud-native solution on AWS that integrates directly with Microsoft 365 via APIs, eliminating the need for MX record changes. The solution uses multiple machine learning layers, including semantic similarity models, contextual language models, and dynamic behavioral analysis of links and attachments, running on AWS services such as Amazon ECS with NVIDIA GPUs. In production, VIPRE IES processes over half a million messages daily with P95 latency between 1.4 and 78 seconds depending on sandbox analysis, detecting approximately 1% of messages as BEC attempts. Deployment can be completed in minutes rather than days, providing immediate visibility into internal risks that traditional gateways miss."
---

# Stopping business email compromise with AI-driven email security: How VIPRE protects modern enterprises on AWS

[AWS](https://yomu.fyi/company/aws) · Pedram Jahangiri · Oct 13, 2026

**Type:** Problem & solution

## Summary

Business email compromise (BEC) uses social engineering and impersonation rather than malicious links, bypassing traditional secure email gateways that are blind to internal traffic and lateral movement. VIPRE developed Integrated Email Security (IES), a cloud-native solution on AWS that integrates directly with Microsoft 365 via APIs, eliminating the need for MX record changes. The solution uses multiple machine learning layers, including semantic similarity models, contextual language models, and dynamic behavioral analysis of links and attachments, running on AWS services such as Amazon ECS with NVIDIA GPUs. In production, VIPRE IES processes over half a million messages daily with P95 latency between 1.4 and 78 seconds depending on sandbox analysis, detecting approximately 1% of messages as BEC attempts. Deployment can be completed in minutes rather than days, providing immediate visibility into internal risks that traditional gateways miss.

## Context

Modern enterprises face business email compromise (BEC) attacks that use social engineering and impersonation rather than malicious links or attachments. Traditional Secure Email Gateways (SEGs) relying on MX record redirection are blind to internal traffic, lateral movement, and thread hijacks, creating security gaps. Nearly half of spam emails are BEC scams targeting CEOs, HR, and IT departments. VIPRE developed Integrated Email Security (IES) on AWS to address these gaps with AI-driven detection and native Microsoft 365 integration.

## Approach / What changed

VIPRE IES uses a cloud-native, event-driven architecture on AWS with multi-layer AI/ML detection: semantic similarity models, contextual language models, intent analysis, and dynamic behavioral analysis of links and attachments. It integrates directly with Microsoft 365 via APIs, avoiding MX record changes, and processes emails through data ingestion (Amazon SQS, S3, ECS), an AI detection pipeline with custom BERT models on NVIDIA GPUs, response management (Amazon MSK, ECS), and a search/analytics layer (Amazon RDS, OpenSearch Service, MSK).

## Takeaways

- Nearly half of all spam emails are BEC scams, and traditional SEGs are blind to internal traffic, lateral movement, and thread hijacks because they rely on MX record redirection.
- VIPRE IES uses multiple ML layers—including semantic similarity models, contextual language models, and dynamic behavioral analysis—running on AWS with NVIDIA GPUs to detect BEC attempts.
- In a sample 24-hour period scanning 517,726 messages, VIPRE IES detected 5,508 BEC attempts (about 1% of all scanned messages) with P95 latency of 1.4–15 seconds without sandboxing.

## FAQ

### How does VIPRE IES deploy without MX record changes?

VIPRE IES integrates directly with Microsoft 365 through secure APIs—no MX record changes are needed. This allows rapid, low-friction deployment that can be completed in minutes rather than days, without disrupting existing email flow.

### What scale and latency does VIPRE IES achieve?

VIPRE IES processes over half a million messages per day in production. In a sample 24-hour period scanning 517,726 messages, it detected 5,508 BEC attempts (about 1% of all scanned messages). P95 latency ranges from 1.4–15 seconds without sandboxing, and 39–78 seconds with full sandbox analysis.

**Tags:** [AI](https://yomu.fyi/topic/ai), [AWS](https://yomu.fyi/topic/aws), [Email Security](https://yomu.fyi/topic/email-security), [Microsoft 365](https://yomu.fyi/topic/microsoft-365)

- Source: [AWS](https://aws.amazon.com/blogs/architecture/stopping-business-email-compromise-with-ai-driven-email-security-how-vipre-protects-modern-enterprises-on-aws)
- Source URL: https://aws.amazon.com/blogs/architecture/stopping-business-email-compromise-with-ai-driven-email-security-how-vipre-protects-modern-enterprises-on-aws
- Ingested by Yomu: 2026-10-13T15:00:15.070Z

[Read original post](https://aws.amazon.com/blogs/architecture/stopping-business-email-compromise-with-ai-driven-email-security-how-vipre-protects-modern-enterprises-on-aws)