Abnormal

Abnormal Security applies behavioral AI to the email security problem, protecting organizations from business email compromise (BEC), spear phishing, vendor email fraud, and account takeover attacks that easily evade traditional secure email gateways (SEGs) and rule-based filters. The platform's core insight is that modern email attacks succeed not because they contain malicious links or attachments, but because they impersonate trusted individuals with convincing social engineering—patterns that only behavioral analysis can reliably detect. Abnormal builds identity graphs for every person an employee communicates with, modeling communication patterns, language style, typical request types, and relationship context. When an email arrives that deviates from established patterns—even if it appears to come from a trusted sender—the AI flags it for review or remediates it automatically. This approach catches vendor impersonation, compromised supplier accounts, and executive fraud scenarios where attackers have researched targets carefully. The account takeover detection module monitors Microsoft 365 and Google Workspace for behavioral signals that indicate credential compromise: unusual login locations, anomalous email forwarding rules, suspicious OAuth application grants, and bulk data access patterns. When takeover is detected, Abnormal can automatically revoke sessions and alert the security team. The platform integrates via API with Microsoft 365 and Google Workspace without requiring MX record changes, minimizing deployment friction. AI-generated attack summaries explain each threat in plain English, helping security teams respond quickly and communicate risk to non-technical stakeholders. Abnormal delivers measurable ROI by reducing time spent on email threat investigation and dramatically cutting the volume of phishing emails reaching end users.

AI Models

Key Features

• Behavioral identity graphs modeling communication patterns per contact
• BEC and vendor email fraud detection without rule signatures
• Account takeover detection across Microsoft 365 and Google Workspace
• Automatic session revocation and OAuth token remediation on compromise
• API-based deployment with no MX record changes required
• AI-generated attack summaries for rapid incident communication
• Employee vulnerability reporting to identify at-risk users
• Retrospective email scanning to surface previously missed threats

Integrations

Pricing

Pros & Cons

Related Cybersecurity Agents