Exclusive: Google’s former ‘click fraud czar’ emerges from stealth with an on-device AI shield against AI-powered phishing, deepfakes, and other scams

Reken, founded by former Shape Security creator Shuman Ghosemajumder, is emerging from stealth with an on-device AI security platform (Reken Private Core) and its first product Northstar for phishing-and-fraud defense. The company raised $10M seed funding and is launching via an early-access program for corporations, government agencies, and universities, after testing in Fortune 500 environments. With FBI-reported cybercrime losses of $20.9B in 2025 (+26% YoY) and growing AI-related fraud complaints, the new product targets the “trust collapse” problem using local (non-cloud) AI to reduce breach and latency risks.

Analysis

This is less about a new cyber startup and more about where the security moat migrates: from cloud inference to the endpoint. That shift favors platform owners with device control and distribution leverage—most notably AAPL and GOOGL—because they can bundle trust features at near-zero incremental acquisition cost, while cloud-first security vendors face higher inference spend and a harder privacy story.

The second-order effect is a trust registry, not just phishing detection. If verifiable sender identity becomes an OS-level primitive, the winner captures the identity graph and can cross-sell into payments, messaging, and enterprise workflows; that is structurally supportive for Apple/Google ecosystems, but it also increases antitrust and privacy scrutiny if they gate trust behind closed platforms. AMZN and bank/issuer ecosystems are indirect beneficiaries only if they become recognized trusted senders, reducing fraud friction and support costs.

Near term, this is mostly a pilot-and-proof problem, not a fundamental earnings driver. The market should care only if on-device models show low false positives on commodity laptops and enterprise adoption within 1-3 months; otherwise the story stays aspirational. The thesis is falsified if latency, battery drain, or detection quality force a reversion to cloud scanning, or if native Apple/Google releases arrive first and commoditize the category before startups can build network effects.

Key Decisions for Investors

• Add AAPL on weakness as a 6-12 month optionality long tied to OS-level trust features; use a modest starter size. Thesis fails if Apple does not ship on-device phishing/identity tooling by the next major product cycle or if enterprise pilots show poor false-positive rates.
• Add GOOGL as a companion long; Android, Workspace, and Chrome are the natural surfaces for embedded sender verification. Prefer call spreads into the next 2 earnings cycles if you want convexity; cut if management signals no productization by Google I/O / next quarter.
• Do not chase pure-play AI fraud/security startups yet; wait for named enterprise references and measurable endpoint performance. If you need expression, use a relative-value basket: long AAPL/GOOGL versus a broad cybersecurity ETF only if platform-native trust features start showing up in product roadmaps.
• Set a watch item on AMZN and RY as 'trusted sender' beneficiaries: if they become default-verifiable brands in consumer messaging, fraud losses and chargeback friction should fall, but that is a 6-18 month adoption story, not a near-term trade.