Israel’s Ocean gets $20m in Lightspeed-led deal

Ocean, an Israel-based cybersecurity startup that builds AI tools to detect phishing and social engineering in email, has raised US$20 million in a series A funding round.

The round was led by Lightspeed Venture Partners, with participation from Picture Capital, Cerca Partners, and several cybersecurity founders and executives.

The startup was founded in 2024 by Shay Shwartz and Oran Moyal, raised a US$8 million seed round in 2024 led by Picture Capital, and now has about 35 employees.

Ocean said the new funding will go toward AI research, product development, and hiring.

It expands software that connects to Google Workspace and Microsoft 365 to scan emails in real time through APIs.

🔗 Source: Calcalist

🧠 Food for thought

Implications, context, and why it matters.

Ocean joins an email security market shaped by API-first tools

Ocean connects to Microsoft 365 and Google Workspace through APIs, a route already used by Abnormal AI, an email security company 1.
Abnormal sells itself as built for cloud email with a pure API setup and behavior analysis aimed at socially engineered attacks 1.
The API approach now reaches older vendors too. Proofpoint offers API deployment alongside other options 2.
Abnormal’s detections also feed other services. Arctic Wolf, a security operations provider, added them to its Managed Detection and Response (MDR) offering 3. The service uses a third party to monitor and respond to cyber threats for customers 3.

Email security vendors now compete on openness, control, and broader coverage

Ocean’s funding adds to interest in the space, though newer vendors need more than strong AI detection to stand out.
IRONSCALES, an email security company, mixes AI with “human insights” from end users and “35,000+ analysts” in its network 4.
Material Security, another email and cloud security company, stresses “transparent signal and precise remediation actions you control” 5. It also calls its model more extensible than Abnormal AI, which it calls “read-only capabilities” for its APIs 5.
Obsidian Security, a cybersecurity company focused on software-as-a-service app protection, argues email protection on its own falls short 6. It says defenses should center on where identity compromise happens, “the browser” 6.