StrongestLayer announces the launch of Intent Workflows, a new feature that can intercept high-risk emails before they cause financial losses, manipulate AI proxies, or put employees at risk.
This technology analyzes an email to determine what action is requested of a person or system, identifies operations that require additional verification, and forwards them to the appropriate personnel or security team before those messages continue to be circulated.
Some of the most destructive email attacks do not contain malware, suspicious links, or other technical indicators that security tools typically look for. A seemingly normal supplier account may send fraudulent payment instructions, an ordinary email may contain hidden commands designed to manipulate AI assistants, and threats targeting employees can also appear quietly in shared inboxes. In these cases, the emails may pass existing security checks, yet they can still have serious consequences for the organization.
Research from StrongestLayer has highlighted this issue. According to its Phishing Genome study for the second quarter of 2026, just 3.6% of attacks were responsible for 98% to 99.7% of the financial losses. Among these attacks, 94% passed the authentication checks of SPF, DKIM, and DMARC, and each of them also passed the organization's secure email gateway.
StrongestLayer CEO and Co-founder Alan LeFort stated: "Traditional email security is based on identifying malicious messages, but some of the most costly attacks appear to be completely legitimate. Real attackers may send fraudulent bank instructions from compromised accounts, and emails without malicious attachments can also manipulate AI proxies. We created Intent Workflows to catch these situations before they lead to real consequences and to ensure that the right people verify what happens next."
Intent Workflows has introduced a policy-based approach to handling high-risk communications. The platform analyzes the consequential intentions within incoming emails, including instructions for transferring funds, manipulating AI assistants, or threatening individuals and property. When the system identifies such situations, it will hold the emails in suspense before delivery and forward them to the appropriate personnel or security team for verification.
This new feature targets three types of risks.
- Financial fraud and supplier email intrusion. Intent Workflows tracks historical bank information and account details of suppliers, and identifies any changes that may indicate payment fraud. When there are changes to bank instructions, the system delays transactions via the previously established contact numbers for verification, to prevent attackers from using compromised email accounts to redirect payments.
- AI Prompt manipulation. As employees increasingly rely on Microsoft Copilot, Google Gemini, and other AI assistants to handle emails, attackers can embed instructions to trick these systems into forwarding confidential information, hiding messages, or drafting unauthorized approvals. Intent Workflows will intercept these instructions before the assistants process them and apply policies to neutralize, isolate, or block the emails.
- Physical threats to employees and facilities. Emails that threaten employees, executives, buildings, or other physical assets may evade traditional security detection because they do not contain malicious technical indicators. Intent Workflows will identify these messages and immediately forward them to the corporate security or human resources department for review and handling.
Enterprises can configure how to handle each type of message based on the sender's origin, potential consequences, and established company policies. The range of responses includes automatically allowing verified communications and removing malicious instructions, isolating messages, requiring manual approval, or directly blocking them all.
The platform sends notifications and approval requests via Microsoft Teams or email, enabling finance, security, and other responsible teams to take action within their existing workflows. Daily communications remain unaffected, while high-risk operations require appropriate verification.
Intent Workflows is provided as a feature within the StrongestLayer platform, and there is no need for enterprises to replace their existing email security infrastructure.
About StrongestLayer
StrongestLayer is a AI native email security company founded in 2024. Its reasoning-based platform detects and prevents advanced phishing, man-in-the-middle attacks, and business email intrusions by analyzing the intent and business context of messages, rather than matching them to known patterns. The company is headquartered in San Francisco. For more information, please visit strongestlayer.com.
