Inside Ocean's One Billion Monthly Investigations with Tavily

Meet Ocean: Preventing enterprise email attacks

Ocean is the first agentic email security platform built to protect against AI-powered attacks. Ocean’s AI agents investigate every incoming email in the same way a skilled security operations center (SOC) analyst would, protecting hundreds of thousands of mailboxes each month. Today, Ocean supports enterprise security teams by processing over one billion emails a month.

Bar Tzemach, Security Researcher at Ocean, is part of the team building the AI agents that detect sophisticated phishing attacks traditional email security systems miss, including business email compromise, vendor impersonation, and AI-written spear phishing. One of the core questions these agents are built to answer is: Is this sender who they claim to be?

The challenge: Sophisticated impersonation and social engineering

Because today’s most sophisticated phishing attacks are highly contextual and can come from senders with a clean reputation, Ocean’s agents have to understand the context behind an incoming email. To do this, Tzemach’s team needed a reliable, scalable way for Ocean agents to build a sender profile and check claims in the email in real time. This included verifying people, companies, domains, and business context, which could only be found on the open web.

The team was looking for an effective way for their agents to research and bring back relevant, source-backed information that could be used to analyze a potential attack.

Why Tavily: Search built for agents

Tavily stood out because it was built with AI agents in mind, was easy to integrate, and delivered the search quality and context we needed to strengthen our investigations. Bar Tzemach, Security Researcher, Ocean

It only took a matter of weeks for Tzemach to move from first test to full production with Tavily as their integrated search tool. Because Tavily plugs straight into Ocean’s agentic ecosystem, the team did not have to build and run their own web research layer, and could instead, focus on what sets them apart: detection logic and agentic intelligence.

With Tavily, Ocean agents can see the context behind every email in real time, and pair that with proprietary threat intelligence and behavioral signals and determine next steps.

The solution: A real-world background check for every email

Ocean keeps human SOC analysts in the loop, and with Tavily helping agents run web-grounded search, investigation time has decreased from minutes to seconds. The flow has helped remove false positives and focus human effort on flagging attempted attacks that pass technical gateways.

Verdicts grounded in real-world evidence with verifiable sources help Ocean build trust with customers and their SOC teams. For one customer, Ocean’s agent used Tavily to research an email address with a slightly altered version of a legitimate domain the customer was in current contact with. The agent looked for: who they were, where they operated, and how they presented themselves online.

The research results came in and the agent flagged it as vendor impersonation, then presented an explanation to the customer's security team. Within seconds, the security team was able to block and remove the threat.

The outcome: One billion investigations per month and growing

Ocean's agents run about one billion deep investigations each month for customers. In September 2026 alone, they flagged about 54,000 malicious emails and caught roughly 900 lookalike or impersonation domains.

In just four months, the number of customers using Ocean's agents grew 1.5x, while the investigation volume nearly doubled. Even with that growth, there was no added effort on the web research side for the humans in the loop due to Tavily’s verifiable and relevant results.

What's next: Bringing Tavily to more agents

After a successful integration in production, the company is now exploring a wider use of Tavily across the agent stack. Some possibilities include: meeting prep for Sales, competitor analysis for Product, and creating materials for Marketing.

Tavily is our agents' eyes on the open web.Bar Tzemach, Security Researcher, Ocean

Providing more of Ocean’s teams with access to Tavily is expected to enable each with the same high-quality, efficient web research that their detection agents already rely on.

Give your agents a clearer view of the web. Talk to our team.