Abnormal Security

What is Abnormal Security?

Abnormal AI, formerly Abnormal Security, is a cloud email and identity security platform that uses behavioral analysis to detect phishing, business email compromise and account takeover. It is sold to mid-market and enterprise security teams. The vendor says it activates in minutes with no agents and no MX record changes.

Key features of Abnormal Security

• Inbound email security: detects attacks that rely on novel or subtle techniques using behavioral context.
• Account takeover protection: identity threat protection and security posture management.
• AI Phishing Coach: simulated phishing and training content.
• Email DLP and misdirected email protection: guards against data leaks and wrong-recipient mistakes.
• AI security: AI governance, AI agent security and employee guardrails.
• Attune engine: the vendor's AI engine behind detection.

How Abnormal Security works

Abnormal connects to cloud email and identity systems through APIs, learns normal behavior for users and vendors, and flags messages and sign-ins that deviate. The vendor reports benchmark results of 46x fewer misses and 60x fewer false positives against general-purpose LLMs; these are self-reported and vary by environment.

Who uses Abnormal Security?

The vendor claims more than 5,000 customers including 30% of the Fortune 500, naming CVS Health, PepsiCo, Marriott, Lowe's, Liberty Mutual and Unilever. Target industries include financial services, healthcare, manufacturing, retail, technology, public sector and education.

Abnormal Security pricing

Abnormal does not publish pricing; plans are quoted by the vendor. Offerings include Inbound Email Security and a broader suite. A 30-minute demo is available on request.

Abnormal Security integrations

The vendor names Microsoft Entra, Okta, Ping Identity, Microsoft 365, Google Workspace, AWS, GCP, Azure, Oracle, Anthropic, OpenAI and Microsoft Copilot.

Abnormal Security alternatives

Proofpoint is a long-established email security vendor that typically sits as a gateway and offers broader compliance tooling. Mimecast also provides gateway-based email security with archiving and continuity. IRONSCALES is another API-based option with a focus on phishing simulation and user reporting.