Abnormal Security

Behavioral AI that stops business email compromise, phishing, and account takeover — the threats your email gateway was never designed to catch.

Abnormal Security Review: The AI Email Security Platform That Detects the Attacks That Have No Signatures to Detect

Traditional email security works by matching incoming messages against known threat signatures — lists of malicious links, known bad domains, and detected malware patterns. Sophisticated attackers know this, and they build attacks specifically designed to pass signature checks. A business email compromise attack from a compromised legitimate vendor account contains no malicious links, no known bad domains, and no malware — it is a legitimate email from a real person asking for a wire transfer to a different bank account. Abnormal Security’s behavioral AI detects this attack not by matching a signature but by recognising that this email — from this sender, to this recipient, with this request, at this time — is anomalous. The AI has built behavioural baselines for every identity in the organisation and knows what normal looks like.

Quick Summary

Abnormal Security is an AI-native email security platform — trusted by over 25% of the Fortune 500 — that uses behavioral AI and its Attune 1.0 foundation model to detect business email compromise, vendor email compromise, phishing, account takeover, and AI-generated threats through API integration with Microsoft 365 and Google Workspace, with no MX change required and 4-click deployment, 14-day calibration, and enterprise custom pricing from approximately $36 to $80 per user per year.

Is it worth using? Yes for mid-market and enterprise organisations on Microsoft 365 or Google Workspace that face sophisticated social engineering attacks, BEC, and vendor fraud that traditional email gateways and Microsoft Defender miss — Abnormal’s behavioral detection is specifically designed for the attack types that signature-based tools cannot catch.
Who should use it? CISOs, security operations teams, and IT security leaders at mid-market and enterprise organisations facing high volumes of BEC, impersonation, credential phishing, and account takeover that bypass existing email security controls.
Who should avoid it? Organisations on on-premises Exchange who cannot move to cloud email — Abnormal requires Microsoft 365 or Google Workspace and does not support on-premises Exchange environments.

Verdict Summary

Best for

Financial services, healthcare, and professional services organisations where BEC attacks requesting wire transfers, invoice changes, and credential theft represent the highest-value threat — Abnormal’s behavioral detection is calibrated specifically for these high-stakes attack patterns
Security teams that have deployed Microsoft Defender and still want a second layer specifically designed for social engineering — 65% of Abnormal customers have replaced their third-party secure email gateway and run Defender plus Abnormal as their email security stack
Organisations that want simple, agentless deployment — API-based integration with Microsoft 365 or Google Workspace means no MX record change, no DNS modification, and no user-visible disruption to the email experience

Not for

Organisations on on-premises Exchange — Abnormal requires cloud email platforms and does not support on-premises deployments
Smaller companies needing budget-friendly transparent email security pricing — IRONSCALES offers transparent per-user pricing for teams where Abnormal’s enterprise contract model is disproportionate
Teams needing URL rewriting, attachment sandboxing, or DLP features that Abnormal does not include in its core detection and response scope

Rating
⭐⭐⭐⭐ 4.4 / 5

What Is Abnormal Security?

Abnormal Security was founded in 2018 by Evan Reiser and Sanjay Jeyakumar — building the platform on a hypothesis that email security had to move from signatures to behavior if it was going to catch the most sophisticated attacks. The company has raised substantial venture capital and grown to be trusted by over 25% of the Fortune 500 — a remarkable adoption rate that reflects the genuine detection gap its behavioral AI fills for organisations that have invested in traditional email security and still experience BEC and account takeover incidents.

In March 2026, Abnormal launched Attune 1.0 — its behavioral AI foundation model that simultaneously analyses identity, behaviour, and content to detect novel AI-generated threats and sophisticated social engineering. 85% of Abnormal’s detections are powered by Attune, which continuously learns from the communication patterns of every identity in the customer’s organisation.

How Abnormal Works

Connect via API in 4 clicks. Abnormal integrates with Microsoft 365 or Google Workspace through API access — no MX record change, no DNS modification, and no rerouting of mail through a gateway. Deployment takes minutes for most organisations.
Build behavioral baselines over 14 days. Abnormal ingests historical email data and builds behavioural profiles for every employee, vendor, and partner relationship in the organisation — establishing what normal communication patterns look like for each identity and each relationship.
Attune 1.0 detects anomalies in real time. The Attune foundation model analyses every incoming message against established behavioural baselines — flagging messages that deviate from normal patterns in writing style, sender behaviour, request type, communication timing, or email metadata, even when the message contains no malicious payload.
AI Security Mailbox handles employee-reported threats. When employees report suspicious emails, Abnormal’s AI Security Mailbox triage feature automatically analyses the submission, determines whether it is a real threat, takes remediation action, and responds to the employee — reducing SOC triage workload for phishing reports.
Account takeover detection monitors sign-in activity. Abnormal monitors Microsoft 365 and Google Workspace sign-in patterns — detecting compromised accounts through anomalous authentication locations, impossible travel, and unusual session behaviour, with real-time session revocation capability.
VendorBase monitors the supply chain. Abnormal’s VendorBase graph tracks vendor communication relationships — detecting when a vendor email account shows signs of compromise or when messages impersonating vendors arrive through lookalike domains.

Key Features

Attune 1.0 behavioral AI foundation model — powers 85% of detections through identity, behavior, and content analysis simultaneously
Inbound email security — BEC, vendor email compromise, phishing, and impersonation detection without signature matching
Account takeover protection — anomalous sign-in detection with real-time session revocation capability
AI Security Mailbox — autonomous triage and response for employee-reported suspicious emails
VendorBase — vendor relationship graph detecting supply chain compromise and lookalike domain attacks
AI-generated threat detection — identifies AI-crafted phishing and social engineering content
Identity threat protection — monitors for identity-based attacks across the Microsoft 365 or Google environment
API integration with Microsoft 365 and Google Workspace — no MX change, 4-click deployment, 14-day calibration
No MX record change or DNS modification required — zero disruption to the existing email flow
Trusted by 25% plus of the Fortune 500
Enterprise custom pricing from approximately $36 to $80 per user per year

Real-World Use Cases

BEC prevention: A CFO at a manufacturing company receives an email appearing to be from the CEO requesting a $85,000 wire transfer to a new vendor account. The email uses the CEO’s display name and a convincing email thread — but Abnormal’s Attune model detects that the writing style deviates from the CEO’s established pattern and the request type is unprecedented in the relationship. The email is automatically moved to quarantine before the CFO sees it.
Vendor email compromise: A finance team is processing a legitimate-looking invoice from a long-term supplier with updated banking details. Abnormal’s VendorBase recognises that the supplier’s email account was accessed from an anomalous location three days prior — flagging the compromised account and preventing the $42,000 payment to the attacker’s account.
SOC phishing triage reduction: A security team was manually reviewing 200 plus employee-reported phishing submissions per week — each requiring 20 to 30 minutes of analyst time. Abnormal’s AI Security Mailbox automatically analyses each submission, confirms or dismisses the threat, takes remediation action, and responds to the reporting employee. SOC analyst time on phishing triage drops by 80%.
Account takeover detection: Abnormal detects that an employee’s Microsoft 365 account is generating unusual email-forwarding rules and accessing large volumes of email at unusual hours — indicators of a compromised account being used for data exfiltration. Session revocation is triggered automatically and the security team is alerted with full context before damage is done.

Pros and Cons

Pros	Cons
Detects BEC and social engineering attacks that contain no malicious payload — the exact attacks that signature-based gateways and Defender miss	Does not include URL rewriting, attachment sandboxing, or DLP — organisations need complementary tools for these capabilities
API deployment with no MX change — zero disruption to email flow and no DNS modification required	Enterprise-only custom pricing with no transparent published tiers — all quotes require a sales engagement
Attune 1.0 specifically designed to detect AI-generated phishing — relevant as sophisticated attackers use AI to craft more convincing attacks	Per-user pricing of $36 to $80/year means significant annual commitment for large organisations
25% plus of the Fortune 500 trust the platform — the most validated enterprise email security tool by adoption scale	No on-premises Exchange support — organisations that cannot move to cloud email cannot use Abnormal
AI Security Mailbox automates phishing report triage — directly reduces SOC analyst workload on the most repetitive security task	Post-delivery processing model means there is a latency window between message arrival and Abnormal’s detection and remediation

Pricing & Plans

Abnormal Security does not publish pricing. All plans are custom-quoted based on mailbox count, modules selected, and contract length. Based on third-party buyer data:

Per-user pricing: approximately $36 to $80 per user per year
Entry-level deployments: $50,000 to $100,000 per year for 500 to 1,000 mailbox organisations
Enterprise deployments: scale with mailbox count and module selection
No free tier — structured trials available through the Abnormal sales process

Contact abnormalsecurity.com for a custom quote. Negotiate at quarter-end for best pricing.

Best Alternatives & Comparisons

Darktrace — Better for network-wide behavioral detection including email, OT, and cloud environments alongside email security
Proofpoint — Better for organisations wanting modular email security with URL rewriting, sandboxing, and DLP in one platform
Microsoft Defender — Better for Microsoft 365 organisations wanting native email security included in the M365 E5 licence at no additional cost
IRONSCALES — Better for mid-market organisations wanting transparent per-user pricing for AI email security without enterprise contract minimums

Frequently Asked Questions (FAQ)

What is Abnormal Security?

Abnormal Security is an AI-native email security platform trusted by 25% plus of the Fortune 500 — using behavioral AI and the Attune 1.0 foundation model to detect BEC, phishing, account takeover, and vendor fraud through API integration with Microsoft 365 and Google Workspace.

How does Abnormal Security deploy?

Abnormal integrates with Microsoft 365 or Google Workspace via API in 4 clicks — no MX record change, no DNS modification, and no disruption to the existing email flow. A 14-day calibration period builds behavioral baselines before full protection is active.

What is Attune 1.0?

Attune 1.0 is Abnormal’s behavioral AI foundation model launched in March 2026 — simultaneously analysing identity, behaviour, and content to detect novel AI-generated threats and sophisticated social engineering. 85% of Abnormal’s detections are powered by Attune.

How much does Abnormal Security cost?

Abnormal pricing is custom-quoted. Per-user pricing typically falls between $36 and $80 per user per year. Entry-level enterprise deployments typically start at $50,000 to $100,000 per year for 500 to 1,000 mailboxes.

Does Abnormal Security work with on-premises Exchange?

No — Abnormal Security requires Microsoft 365 or Google Workspace and does not support on-premises Exchange environments. Organisations that cannot move to cloud email need to evaluate alternative email security platforms.

How does Abnormal compare to Microsoft Defender?

Microsoft Defender is included in M365 E5 and provides strong signature-based email security and some behavioral detection. Abnormal is specifically designed for the social engineering attacks that pass through Defender — BEC, vendor fraud, and account takeover with no malicious payload. 65% of Abnormal customers run Defender plus Abnormal as a layered defence rather than replacing Defender.

Final Recommendation

Abnormal Security is the most effective AI email security platform for the specific and high-stakes threat category that signature-based tools consistently miss — business email compromise, vendor fraud, and account takeover attacks with no malicious payload. The Attune 1.0 behavioral AI, API deployment with no MX change, and Fortune 500 adoption scale create a compelling security layer for any mid-market or enterprise organisation that has experienced BEC incidents despite existing email security investment. For any CISO whose organisation has lost money to a wire transfer fraud or compromised vendor account that passed through the existing email gateway, Abnormal Security addresses the detection gap directly.

Next steps