tools
Abnormal Inbound Email Security
AI-based inbound email security that detects BEC, phishing, vendor fraud, and account takeover using behavioral analysis.
Abnormal Inbound Email Security builds behavioral baselines for employees and vendors, then detects email attacks that may lack malicious payloads, known signatures, or authentication failures. It supports investigation, remediation, quarantine review, and custom detection controls.
Security operations teams use it with Microsoft 365 and Google Workspace. Deployment uses an API without MX changes. Abnormal does not publish public pricing; customers must request a demo, and some related products or capabilities may be separate add-ons.
Features
- Behavioral baselines for employees and vendors
- Detection of BEC, phishing, vendor fraud, and account takeover
- Search and remediation across Microsoft 365 and Google Workspace
- Detection 360 for investigating submitted misses and false positives
- Custom AI Models created from natural-language descriptions
- Custom Rules covering more than 50 message attributes
- Quarantine review and release from one console
- API deployment without MX changes
Use cases
- Detect business email compromise that bypasses native email controls
- Investigate and remediate suspicious messages across cloud mailboxes
- Review and release quarantined messages from one console
- Create organization-specific detections without writing code
- Reduce manual SOC triage for phishing and vendor-fraud attacks
Pros
Cons
Latest updates
- Custom Rules Replace Safelist and Blocklist with More Granular Control
Combine 50+ message attributes with AND/OR logic and exclusions; test rules against historical messages and real mail before enforcing.
- This Week in Detection
Strengthened detection of malicious links; improved detection of brand impersonation messages; expanded coverage for compromised-sender attacks.
- Right Message, Wrong Person: When Legitimate Emails Become Data Breaches
Uses behavioral AI to catch recipient mistakes before confidential information reaches the wrong person.
- This Week in Detection
Improved detection of malicious links by factoring URL verdicts into message scoring; launched a visual detection model for brand-impersonation attacks hidden in email…
- Weekly Detection Enhancements - Week of October 16
Improved graymail classification of promotional messages disguised as replies, distinguishing them from genuine conversations
Capabilities
- Connects your apps — “One console, one behavioral engine, and native API integrations across Microsoft 365, Google Workspace, Okta, CrowdStrike, plus your SIEM and SOAR.” source
Security
- SOC 2 — “We maintain a SOC 2 certification as a result of this regular audit activity and can share the most recent SOC 2 report with our customers on request and under a non-disclosure agreement.” source
- ISO 27001 — “A-LIGN Security and Compliance, Inc. certifies that Abnormal AI, Inc. operates an Information Security Management System (ISMS) that conforms to the requirements of ISO/IEC 27001:2022.” source
- ISO 42001 — “A-LIGN Security and Compliance, Inc. certifies that Abnormal AI, Inc. operates an Artificial Intelligence Management System (AIMS) that conforms to the requirements of ISO/IEC 42001:2023.” source
- GDPR — “such as the General Data Protection Regulation (GDPR) in the European Union (EU), European Economic Area (EEA), and the United Kingdom (UK)” source
Pricing
- Prices checked
- 2026-10-25