Coremail Pitches AI-Native Email Security at LEAP 2026

Coremail showed an AI-native email system and a phishing gateway at LEAP 2026 in Riyadh, which ran from Aug. 31 to Sept. 3. On Sept. 8 the Guangzhou vendor said the Riyadh stand followed a Hong Kong LEAP East booth in July, and that both stops were aimed at buyers in government, finance and energy.

The products are not new this month. They have been on a spring-to-autumn circuit that started in Singapore in April. Riyadh was the room where those Gulf buyers actually walk the halls.

Hall 3, Booth G184

Coremail took Hall 3, booth G184 at the Riyadh Exhibition and Convention Centre in Malham, north of the capital. LEAP, now in its fifth edition and themed “Into New Worlds,” is co-organised by Saudi Arabia’s Ministry of Communications and Information Technology, the Saudi Federation for Cybersecurity, Programming and Drones, and Tahaluf.

Tahaluf, the organiser, said the four-day show closed with 1,323 speakers and more than 1,500 exhibitors. It also counted 1,397 investors from 1,027 firms across 72 countries, representing $18.3 trillion in assets under management.

LEAP 2026 AT A GLANCE

• Speakers: Tahaluf put the final speaker count at 1,323.
• Exhibitors: More than 1,500 exhibitors took stands across the Malham halls.
• Investors: 1,397 investors from 1,027 firms in 72 countries were on site.
• Capital in the room: Those firms represented $18.3 trillion in assets under management.

That is a large, noisy floor for a specialist mail vendor. Coremail is not Microsoft or Google. It is a 27-year-old Chinese email house, founded in 1999, trying to be found by the ministries, banks and energy groups that already buy other kit at LEAP.

The Gulf listing is not brand new either. On June 2, 2021, Huawei Cloud’s Middle East account said Coremail On-cloud was available on Huawei Cloud in the region as a SaaS mail host. The 2026 booth is a return with an AI story, not a first look at the map.

Five Stops Before Riyadh

The Sept. 8 statement named only the two LEAP events. The 2026 calendar is longer. Coremail put the same AI mail stack in front of Asian and Gulf audiences from April 9 through Sept. 3, and the Riyadh stand was the fifth stop, not the first.

COREMAIL’S 2026 ASIA-TO-GULF STOPS

GITEX Asia at Marina Bay Sands drew technology firms from more than 110 countries, Coremail said in April. Tahaluf said the first LEAP East in Hong Kong drew 25,000 attendees, and Hong Kong is now locked in as that show’s Asian host for three years. The Riyadh week is where that Asia-Gulf corridor ends on the calendar.

Leihua Chen, Coremail’s CEO, has been selling the unglamorous half of that pitch, the part about mail that actually arrives. “Email remains the backbone of international business,” Chen said, pointing to more than 50 smart relay nodes that reroute mail when a path clogs or fails.

What the AI-Native Mail System Does

The product Coremail keeps putting on these stands is its AI-native secure email system, launched on April 30 at the Digital China Summit. A large language model sits as the cognitive engine. A set of agents sits as the execution layer. Mail is treated as a place where work gets done, not only as a store of messages.

Coremail describes a Perceive-Think-Act loop on a CLI-driven design, with enterprise data as the working core. The system speaks Model Context Protocol so third-party tools can plug in inside a sandbox. The interface uses a three-pane layout with floating prompts.

SIX JOBS THE AGENTS ARE BUILT TO RUN

• Mail classification: Agents sort inbound mail and surface what should be handled first.
• Scheduling: Meeting times are pulled from threads and put on calendars without a separate app hop.
• Approvals: Routine sign-off chains run through the inbox instead of a side portal.
• Workplace tasks: Agents move work across mail and connected business tools in one flow.
• Mail analytics: Volume, delay and risk patterns are summarised for operators.
• System operations: Admin work on the mail platform itself is handed to agents under set limits.

That list is the productivity half of the booth. The security half is why a Gulf CISO would stop walking.

CACTER Is Built for AI-Written Phish

Beside the mail system, Coremail demonstrated the CACTER secure email gateway, the company’s security brand. The LEAP unit runs on Coremail’s Nerves 2.0 neural-net platform and uses anti-phishing agents. It combines semantic analysis with multimodal detection, and it is pitched at AI-generated phishing, impersonation, bad links and high-risk attachments.

Coremail puts anti-spam accuracy at 99.8% and the false-positive rate below 0.02%. Those figures are the company’s own. The gateway is offered as hardware, software or cloud, and Coremail says it sits in front of Coremail, Exchange, Microsoft 365, Gmail and IBM Domino. A later control can recall a bad message that already reached an inbox, using threat data from Coremail’s security centre.

The AI-written phish problem is no longer theoretical. Researchers at IMC 2025, working through 481,558 malicious messages, conservatively put LLM-written share at 51% of spam emails and 14.4% of business email compromise mail as of April 2025. A gateway that still hunts for broken English is hunting for a clue attackers can now erase.

Saudi Inboxes Already Face That Wave

That is the opening in Riyadh. Kaspersky said phishing attempts in Saudi Arabia rose 22.5% in the second quarter of 2025 from the first quarter, and that it blocked more than 142 million phishing-link clicks worldwide in that quarter. Olga Altukhova, a Kaspersky security expert, said attackers are going after biometrics and signatures, not only passwords, and are hiding behind tools such as Google Translate and CAPTCHA.

Proofpoint’s 2025 read of top GCC banks found DMARC records had slipped from 96% in 2024 to 77%, with the strict “reject” setting down from 71% to 60%. That leaves 23% of those banks with no DMARC record at all. In the UAE, Proofpoint said 85% of organisations were hit by business email compromise, up from 66%, with attack volume up 29%. Among Saudi CISOs, 84% now name human error as their biggest cyber risk, up from 48% in 2023.

THE PHISHING LOAD IN THE GULF

• Saudi phishing: Kaspersky recorded a 22.5% rise in attempts in the second quarter of 2025 from the first quarter.
• Bank identity: Proofpoint found DMARC on top GCC banks down from 96% to 77% year on year.
• Human risk: 84% of Saudi CISOs name human error as their top cyber risk, up from 48% in 2023.
• Global clutter: Kaspersky counted 554 million phishing-link blocks in 2025, and said 44.99% of worldwide email was spam.

A vendor that already sells to government, finance and energy, and that now wraps an anti-phish agent around the gateway, is talking to people who have that queue on their desk. Whether the 99.8% claim survives a Gulf bank’s own test is a separate, later question.

Government, Banks and Energy Are Known Ground

Coremail is not a startup hunting a first reference. The firm is Guangdong Yingshi Computer Technology, headquartered in Guangzhou, with branches in Beijing, Shanghai, Shenzhen, Wuhan, Chengdu, Xi’an, Nanjing, Hangzhou, Hong Kong and Bangkok. Its own company pages say it built the first Chinese-language email system and later ran ten-million-user platforms for NetEase and 263.net.

It now claims more than 20,000 enterprise customers and more than 1 billion end users on the Chinese mainland. Named accounts on its company profile include Tsinghua University, Peking University, Fudan University, China UnionPay, ICBC Asia, China Minsheng Bank, China MSA, Hong Kong’s Leisure and Cultural Services Department, the Addis Ababa City Roads Authority, Kweichow Moutai, COSCO, BMW, Hisense, Red Bull, NetEase and Yonyou. The mix already includes a Hong Kong government department, an Ethiopian city authority and global brands, which is the overseas proof it can put on a Riyadh table.

At home, Coremail has spent the last decade on China’s local-stack mail programmes, swapping out Exchange and Domino where policy requires a domestic system. The Gulf pitch rhymes with that work. Sovereign mail, on-prem options, and a gateway that can sit in front of whatever is already there are the same three slides, rewritten for Arabic-script phish and Vision 2030 buyers.

Every Agent Still Runs Inside a Fence

The part of the pitch that will get the hardest questions is not the spam rate. It is the agents. A system that can classify, schedule, approve and operate is a system that must be allowed to read, and sometimes to send. Coremail’s answer is a ReAct loop with a dual-layer, user-level sandbox and least-privilege access, so each agent works inside a box IT can still shut.

AI is reshaping enterprise productivity, and email is evolving from a communication tool into an intelligent collaboration hub. Coremail will continue advancing AI-native innovation to help enterprises build more secure and efficient digital workplaces.

Marvin Wu, Vice President, Coremail

Handing agents the right to perceive, think and act across an enterprise mailbox still asks a security chief to trust a model with the leaky channel the organisation already has. That permission design, not the booth lighting, is what a bank or a ministry will test after LEAP. A sandbox is a claim until someone tries to break it.

The Sept. 8 statement names no new Gulf customer. Coremail pointed anyone who stopped at G184 to coremail.ai.