Phishing is one of the largest and most difficult challenges for any enterprise security team. It's the great equalizer of security -- we all have to deal with it. We built our own email IDS at Uber with control over features and alerts means we can adjust to evolving threats in real-time. But just as important, we demonstrated that security investments can also drive operational benefits in price, extensibility, and performance. This talk will walk through how building our own email IDS in AWS helped guard against phishing and improve operations.