AWS Architecture Blog

Stopping business email compromise with AI-driven email security: How VIPRE protects modern enterprises on AWS

If your organization has experienced sophisticated email impersonation attempts that bypass traditional security tools, you need advanced protection against business email compromise (BEC). This post shows you how VIPRE uses AI in its email security solution, deployed on AWS for enterprise customers. The solution identifies and stops these incidents before they reach end users, and it integrates directly with existing Microsoft 365 environments.

In this post, you will discover:

  • How AI-powered detection identifies and blocks BEC attempts.
  • Why cloud-native architecture on AWS provides stronger protection.
  • Steps to implement VIPRE IES without disrupting your email flow.

Email security challenges facing modern enterprises

BEC presents significant security challenges for your organization as you rely on email for critical business communications:

  • Sophisticated impersonation: Unlike traditional phishing that relies on fraudulent links or attachments, BEC incidents use social engineering and convincing impersonations to manipulate human behavior. According to data gathered by VIPRE Security Group, almost half of spam email messages (49 percent) are BEC scams, where criminals pretend to be someone important in a company. They usually target CEOs, HR staff, and IT departments.
  • Legacy protection gaps: Traditional Secure Email Gateways (SEGs) that rely on mail exchange (MX) record redirection are often blind to internal traffic, lateral movement, or thread hijacks. This creates security gaps that sophisticated actors can exploit.
  • Cloud collaboration issues: As you move toward zero trust architectures and cloud-native collaboration, email remains a weak link that can be exploited through various vectors.

VIPRE needed to develop a solution that could protect against these advanced incidents while integrating with modern cloud email environments such as Microsoft 365.

Solution overview

To address the challenges of sophisticated email risks, VIPRE developed Integrated Email Security (IES), a cloud-native solution built entirely on AWS. This solution uses AI-powered detection and native Microsoft 365 integration to protect against advanced BEC incidents.

The solution consists of two primary components:

  • Machine learning (ML) detection engine: VIPRE IES uses multiple ML layers that analyze the entire email structure to identify and stop sophisticated incidents. These layers include semantic similarity models that detect subtle impersonations, contextual language models that detect manipulation tactics, intent and topic analysis, and advanced dynamic behavioral analysis of embedded links and attachments.
  • Cloud-native architecture: Built on AWS services, VIPRE IES processes over half a million messages per day in production and is designed to scale to millions, with low latency and high reliability. The serverless architecture scales rapidly to meet demand fluctuations while maintaining security and performance.

This automated approach provides protection against BEC incidents without requiring MX record changes, making deployment straightforward and non-disruptive. Key features of the solution include:

  • Native integration: VIPRE IES integrates directly with Microsoft 365 through secure APIs, providing rapid, low-friction deployment.
  • Real-time analysis: Messages are analyzed in real time for impersonation attempts, unusual patterns, and deceptive content, with suspicious messages appropriately quarantined or flagged.
  • Detection capabilities: The solution looks beyond traditional indicators to catch subtle signs of manipulation, including urgency triggers, financial requests, and digital signature mismatches.
  • Unified management: A centralized dashboard provides visibility into risks, supports quarantine management, and delivers insights into incident patterns and trends.

VIPRE IES uses specific machine learning models on AWS infrastructure to identify BEC attempts while minimizing administrative overhead.

Architecture and implementation

The following diagram illustrates the solution architecture.

VIPRE IES architecture on AWS spanning data ingestion, AI and ML detection, response management, and search and analytics layers

Figure 1: VIPRE IES architecture on AWS

VIPRE IES uses a distributed, event-driven architecture specifically designed to identify and stop business email compromise and AI-generated phishing attempts. The system combines AI and ML technologies in a cost-effective manner to analyze and neutralize email-based risks. The architecture consists of four key layers:

Data ingestion

Processing millions of email messages reliably presents significant challenges, especially with unpredictable traffic spikes. VIPRE’s ingest mechanism uses AWS services to tackle this with a highly resilient system that maintains performance and availability regardless of volume.

  • Every incoming email stream is treated as a discrete job. The raw payload is immediately committed to Amazon S3 as an object. Amazon S3 delivers 99.999999999 percent (11 9s) durability, providing a reliable foundation for email payload storage.
  • The actual processing job (a lightweight reference pointing to the Amazon S3 object) is then queued in Amazon SQS, a fully managed message queuing service. This decoupling supports reliable message handling, buffers traffic spikes, and decouples ingestion from downstream processing.
  • Stateless microservices orchestrated by Amazon ECS with AWS Fargate for serverless container management, pull Amazon SQS jobs, fetch the Amazon S3 payload, and initiate the detection pipeline.

AI and ML detection with layered intelligence

After ingesting email data, the solution performs analysis using a multi-stage workflow where multiple engines are executed in parallel and phases are coordinated using fan-in and fan-out patterns. Based on how engines operate there are roughly four kinds of analysis done:

  1. Static analysis:
    • Engines in this category look at the email as passive data.
    • Definitions, rules, signatures, heuristics and classifiers are updated using hot reload.
  2. Behavioral analysis:
    • Various artifacts extracted from the email body (links, attachments) are opened in a controlled environment (also known as a sandbox) where the execution is monitored and passed through ML classifiers and other engines to identify unexpected behavior.
    • ML classifiers are versioned and shipped along with sandbox Docker images.
    • Heuristics and rule updates are done using Amazon S3 and Amazon S3 events.
  3. Semantic analysis:
    • Email text is passed through a pipeline for text understanding which uses multiple bi-directional transformer models to perform natural language processing (NLP) tasks such as named entity recognition and coreference, intent summarization, zero-shot classification, and semantic similarity matching.
    • The models used are strongly versioned, deployed in Docker images stored in Amazon Elastic Container Registry (Amazon ECR), using PyTorch and scheduled to execute on NVIDIA GPUs.
    • Heuristics and classified embedding datasets can be updated separately through packages stored in Apache Parquet format in Amazon S3, with Amazon Managed Workflows for Apache Airflow (Amazon MWAA) orchestrating data pipeline workflows.
  4. Apply contextual intelligence:
    • Global (customer independent) and local (customer dependent) data feeds are correlated and injected during analysis for context enrichment and detection.
      • Global: artifacts extracted from the email are checked against the latest emergent risks and IoCs, and verified against reputation and classification feeds.
      • Local: sender reputation, trust lists, roles, and similar signals are injected into the analysis context.
    • Intelligence collected by the system (discovered risks, regardless of the source) is fed back into the security data lake from where it’s available for rapid identification of emerging risks. Amazon CloudWatch provides centralized monitoring and governance across the entire detection pipeline.

Response management and remediation

This layer serves as the platform’s control plane, translating detection verdicts into automated actions based on customizable VIPRE IES Action Rule Definitions. Administrators can define specific match expressions against the aggregated threat model to trigger precise remediation workflows.

In inline mode, the service acts as a final gateway so that high-severity risks, such as confirmed malware or severe BEC, are quarantined and prevented from landing in the end-user’s mailbox. This immediate intervention keeps a risk’s dwell time minimal, neutralizing the concern instantly.

The service provides granular workflows for managing quarantined messages. These include:

  • Administrator release: Admins maintain full visibility, with the ability to review audit logs, engine scores, and raw payloads to safely release false positives.
  • End-user self-release: For lower-risk categories (for example, bulk mail), users receive a secure metadata digest so they can self-release items directly from a portal. This reduces administrative overhead while ensuring all user actions remain fully audited for review.

Post-delivery remediation (clawback)

Beyond inline blocking, the system uses native API integrations with mail providers to execute programmatic clawbacks. This allows the service to instantly retract malicious messages from user inboxes post-delivery, neutralizing “time-bomb” threats and preventing lateral movement.

By balancing immediate inline enforcement with flexible release workflows, the response and remediation service maximizes protection without disrupting legitimate business communication.

Search and analytics

This layer closes the loop, transforming the continuous stream of security telemetry into actionable, real-time intelligence for security operators.

  • Every state change and verdict across the entire system is published as an event to the Amazon MSK cluster. Amazon MSK provides the highly durable, ordered, and scalable event stream necessary to handle massive data velocity.
  • Events are consumed, contextually enriched with metadata (for example, user, group profile), and committed to Amazon Relational Database Service (Amazon RDS), which provides automated backups and high availability, to serve as the long-term, auditable system of record.
  • The system delivers instant search results by using change data capture (CDC) to stream updates from Amazon RDS in real time. This low-latency pipeline populates Amazon OpenSearch Service for sub-second analytical queries across security telemetry.
  • The search and analytics service exposes a powerful API that powers VIPRE’s dashboards and interactive reports. These perform sub-second, complex analytical queries that give security teams real-time visibility into their security posture and risk. Queries and results are strictly scoped by the client’s tenant ID, enforcing multi-tenant isolation and providing data separation assurance while supporting rapid incident response.

Real-world protection: how VIPRE IES stops advanced BEC incidents

VIPRE IES’s AI-powered detection successfully identifies and blocks sophisticated BEC and other evasive incidents that traditional email security would miss. Here’s how it works in real-world scenarios:

  • The “urgent wire transfer” incident: An employee in the accounting or finance department receives an email seemingly from their CEO or CFO. The email has a sense of urgency, stating a critical business deal requires an immediate wire transfer to a new vendor. VIPRE IES’s intent-aware AI classifies the email as a financial request, detects urgency triggers in language patterns, and identifies user impersonation along with other risk indicators to automatically quarantine the message.
  • The “confidential or legal matter” incident: An employee receives an email from what appears to be a senior leader or the legal department, with a subject line such as “Confidential Legal Matter – Attorney-Client Privilege.” The email asks the employee to provide sensitive information. VIPRE IES’s semantic analysis engine flags the use of emotionally charged, high-pressure language to create a false sense of urgency and secrecy.
  • The “thread hijacking” incident: When supply chain partners’ email accounts are compromised and actors insert fraudulent payment instructions into legitimate email threads, VIPRE’s conversation thread scoring and domain analysis immediately identify these sophisticated incidents, protecting against scenarios using fake message threads.
  • The “QR code (quishing)” scenario: A QR code incident (quishing) involves an actor embedding an image of a QR code into an email, often with a sense of urgency such as a “security update” or “password expiration,” to trick the recipient into scanning the code with their mobile device, which then directs them to a phishing site. VIPRE IES addresses this evasion by using multiple layers of advanced analysis including using image analysis to decode the URL and then perform real-time behavioral analysis of the URL in an isolated cloud sandbox.

These use cases demonstrate how VIPRE IES provides protection against the full spectrum of modern BEC incidents by applying multiple AI and ML detection layers to analyze message context, sender behavior, and communication patterns.

Results and impact

When you implement VIPRE IES, the combination of its advanced detection capabilities and its native AWS architecture provides a force-multiplier effect across three critical areas:

1. Neutralizing sophisticated BEC email

By using the elasticity of AWS compute to run deep AI and ML semantic analysis at scale, VIPRE IES successfully blocks sophisticated BEC incidents that bypass traditional security tools. This significantly reduces an organization’s exposure to financial fraud and wire transfer scams by identifying malicious intent in real time.

These capabilities are proven in production. In a sample 24-hour period across VIPRE’s Europe (EU) and North America (NA) production environments, VIPRE IES scanned 517,726 messages (376,847 in EU and 140,879 in NA) and detected 5,508 BEC attempts (3,853 in EU and 1,655 in NA). BEC attempts accounted for approximately 1 percent of all scanned messages. Each of those detections represents a potential fraud attempt identified by the system. This depth of analysis also operates at speed. P95 message-processing latency (hourly average) ranges from 1.4 to 15 seconds with dynamic sandboxing disabled, and from 39 to 78 seconds with full sandbox analysis enabled. This maintains real-time protection without disrupting legitimate mail flow.

2. Operational efficiency and reduced alert fatigue

The precision of the IES detection model, supported by the high-throughput processing of Amazon SQS, Amazon MSK, and Amazon ECS, means that security teams can focus on investigating genuine risks rather than managing false positives. This minimizes alert fatigue and supports a more proactive defense posture.

3. Accelerated time-to-protection

Because the platform is built on a cloud-native, API-driven framework, deployment is remarkably fast. Without the need for MX record changes, the solution can be deployed in minutes rather than days, accelerating protection while maintaining existing email infrastructure. This agility also provides immediate visibility into internal risks that traditional gateways often miss.

Beyond the immediate technical mitigation of BEC and zero-day threats, the platform’s native integration supports stringent enterprise compliance through robust encryption, granular role-based access control (RBAC), and comprehensive audit logging. These security improvements help rebuild trust in email communications across all levels of your organization, from end users to executive leadership.

Conclusion

Modern email threats outpace conventional security tools, creating dangerous blind spots in your defenses. Built on AWS services and using advanced AI and ML capabilities, VIPRE IES provides a cloud-native solution that protects against sophisticated BEC incidents. By offloading the “heavy lifting” of infrastructure to the global reach and elasticity of the AWS Cloud, VIPRE IES delivers a security fabric that is as resilient as it is precise.

VIPRE Security and AWS worked together to create a targeted solution that addresses specific email security challenges with precision and scalability. By removing the need for MX record changes and integrating directly with Microsoft 365, VIPRE IES offers a deployment path that accelerates time-to-value.

To get started with improving your email security:

  1. Review your current email security posture to identify gaps in BEC protection.
  2. Explore VIPRE IES in the AWS Marketplace to understand deployment options.
  3. Connect with AWS and VIPRE teams to discuss your specific security requirements.

Learn more about AWS security best practices and cloud-native email protection:

Learn more

VIPRE Security Group

VIPRE Security Group is a leading provider of internet security solutions that protect businesses and home users from cyber risks. For more than 25 years, VIPRE has provided one of the world’s largest intelligence clouds, delivering exceptional protection against today’s most aggressive online risks. The award-winning portfolio includes next-generation antivirus endpoint cloud and EDR solutions, MDR, pen-testing, advanced email security products, data loss awareness, intelligence for real-time malware analysis, and security awareness and compliance training.

About the authors

Pedram Jahangiri

Pedram Jahangiri

Pedram is a Senior Enterprise Solutions Architect at AWS, helping customers design and scale AI/ML, generative AI, and agentic systems. He brings 20 years of experience translating business priorities into enterprise technology solutions across industries. He holds a PhD in Electrical and Computer Engineering.

Anup Patwardhan

Anup Patwardhan

Anup is a Senior Customer Solutions Manager at AWS, helping enterprise customers adopt technology to achieve their business goals. He brings more than 20 years of experience in solutions architecture, consulting, engineering, and operations, including security and machine learning. He holds degrees in Computer Science and Mathematics.

Melvin Antony

Melvin Antony

Melvin is Vice President of Engineering at VIPRE Security Group, leading its cybersecurity product engineering. His expertise spans stream processing, anomaly detection, and distributed systems. An inventor on 11 issued US patents and a Black Hat USA speaker, he holds a master's degree in Computer Science from the University of Central Florida.

Oliver Paterson

Oliver Paterson

Oliver is Director of Product Management at VIPRE Security Group. He helps customers and partners understand evolving cyber threats and address gaps in their security infrastructure. He brings more than 12 years of experience across sales, presales engineering, product marketing, and product management, supporting businesses of all sizes worldwide.

Paul Apostolescu

Paul Apostolescu

Paul is Chief Technology Officer at VIPRE Security Group, leading technology strategy and innovation. With over 20 years in cybersecurity, his expertise spans kernel-level security and enterprise threat detection. He holds several malware detection patents, has presented at Black Hat, and earned a BS in Mathematics and Computer Science from the University of Bucharest.

Usman Choudhary

Usman Choudhary

Usman is Chief Product Officer and General Manager at VIPRE Security Group, Ziff Davis's cybersecurity division. He serves as an executive advisor to Cyber Future Foundation and focuses on cyber resilience and human-centric security. He brings more than 30 years of experience, including work with the US Navy, NetIQ, Novell, and Citi.