StrongestLayer Launches Intent Workflows to Stop Email Threats That Traditional Security Tools Miss

New release intercepts high-risk messages before they trigger fraudulent payments, manipulate AI agents, or put employees at risk

CHICAGO, Nov. 5, 2026 /PRNewswire/ -- StrongestLayer today announced the launch of Intent Workflows, a new capability that intercepts high-risk email messages before they can cause financial loss, manipulate AI agents, or put employees at risk. The technology analyzes what an email is asking someone or something to do, identifies actions that require additional verification, and routes those messages to the appropriate person or security team before they proceed.

Some of the most damaging email attacks contain no malware, suspicious links, or other technical indicators that security tools typically look for. A legitimate vendor account can send fraudulent payment instructions, an ordinary email can contain hidden instructions designed to manipulate an AI assistant, and a threat against an employee can sit unnoticed in a shared inbox. In each case, the message can pass existing security checks while creating serious consequences for the organization.

StrongestLayer's research illustrates the problem. According to its Q2 2026 Phishing Genome research, just 3.6% of attacks accounted for 98% to 99.7% of financial losses. Of those attacks, 94% had passed SPF, DKIM, and DMARC authentication checks, and every one had cleared the organization's secure email gateway.

"Traditional email security is built around identifying malicious messages, but some of the most expensive attacks look completely legitimate," said Alan LeFort, CEO and Co-founder, StrongestLayer. "A real vendor can send fraudulent banking instructions from a compromised account, and an email with no malicious attachment can manipulate an AI agent. We built Intent Workflows to catch these situations before they turn into real-world consequences and make sure the right person verifies what happens next."

Intent Workflows introduces a policy-driven approach to handling high-risk communications. The platform analyzes inbound email for consequential intent, including instructions to move money, manipulate AI assistants, or threaten people and property. When it identifies one of these situations, it holds the message before delivery and routes it to the appropriate person or security team for validation.

The new capability addresses three categories of risk.

• Financial fraud and vendor email compromise. Intent Workflows tracks vendors' historical banking and account details and identifies changes that could indicate payment fraud. When banking instructions change, it holds the transaction for verification through a previously established contact number, preventing attackers from using compromised email accounts to redirect payments.
• AI prompt manipulation. As employees increasingly rely on AI assistants such as Microsoft Copilot and Google Gemini to process email, attackers can embed instructions that cause these systems to forward confidential information, hide messages, or draft unauthorized approvals. Intent Workflows intercepts these instructions before the assistant processes them and applies policies to neutralize, quarantine, or block the message.
• Physical threats to employees and facilities. Emails threatening employees, executives, buildings, or other physical assets can escape traditional security detection because they contain no malicious technical indicators. Intent Workflows identifies these messages and immediately routes them to corporate security or HR for review and action.

Organizations can configure how Intent Workflows handles each category of message based on the sender's provenance, the potential consequences, and established company policies. Responses range from automatically allowing verified communications and removing malicious instructions to quarantining messages, requiring human approval, or blocking them entirely.

The platform delivers notifications and approval requests through Microsoft Teams or email, allowing finance, security, and other responsible teams to act within their existing workflows. Routine communications continue without interruption, while high-risk actions require appropriate validation.

Intent Workflows is available as a capability within the StrongestLayer platform and does not require organizations to replace their existing email security infrastructure.

About StrongestLayer

StrongestLayer is the AI-native email security company founded in 2024. Its reasoning-based platform detects and stops advanced phishing, adversary-in-the-middle attacks, and business email compromise by analyzing the intent and business context of a message rather than matching it against known patterns. The company is based in San Francisco. Learn more at strongestlayer.com.

SOURCE StrongestLayer