Abnormal AI (Abnormal Security)
Procurement partnerAbout
Abnormal AI is a cybersecurity company that builds a behavioral AI platform to protect organizations from email threats, identity attacks, and AI-driven security risks. The platform uses behavioral AI to learn normal patterns of every employee, vendor, and identity, then detects and automatically remediates attacks such as business email compromise, phishing, account takeover, and AI-generated threats. Founded in 2018, the company serves over 5,000 organizations including more than 30% of the Fo...
Details
VenSearch Intelligence
Ideal Customer
- Abnormal AI's primary sweet spot is large enterprises with thousands of employees running Microsoft 365 or Google Workspace, with the platform explicitly designed for organizations of that scale.
- Over 20% of the Fortune 500 use Abnormal, and named customers such as Maersk, Xerox, Mattel, CVS Health, and Marriott reflect a concentration in complex, global enterprises with high volumes of sensitive communications.
Key Differentiators
- Abnormal AI's primary differentiator is its API-based, behavioral AI architecture — it connects to Microsoft 365 or Google Workspace in 60 seconds with no MX record changes, no rules to tune, and no agents to deploy, unlike traditional Secure Email Gateway (SEG) competitors such as Proofpoint and Mimecast.
- Its proprietary Attune foundation model builds behavioral baselines for every identity in an organization and detects deviations without relying on signatures or known threat indicators, making it particularly effective against payload-free attacks, socially engineered BEC, AI-generated lures, and account takeovers that bypass authentication.
Industries Served
- Abnormal AI explicitly targets Financial Services (wire fraud, BEC, vendor compromise targeting treasury and AP teams), Healthcare (securing patient data and stopping out-of-pattern requests targeting clinical and AP staff), Manufacturing, Retail/Hospitality, Technology/IT, Public Sector/Government (FedRAMP-authorized for federal agencies), and Education (protecting campuses, students, and staff).
- Notable named customers span these sectors and include AAA/Auto Club Group, Liberty Mutual, Bristol Myers Squibb, Chipotle, Lowe's, Domino's, and the Florida Department of Veterans' Affairs.
Service Coverage
- Abnormal AI operates globally, serving customers across North America, Europe, and Asia-Pacific.
- The company is headquartered in Las Vegas, Nevada, with additional offices in San Francisco, London (European HQ), Bengaluru (R&D center), New York, and Tokyo.
Partnerships
- Abnormal AI has a deep strategic partnership and investment relationship with CrowdStrike, including a bi-directional integration spanning email, identity, endpoint, and SIEM workflows through the CrowdStrike Falcon platform, and membership in the CrowdXDR Alliance.
- The platform has a strategic alliance with Microsoft (natively integrating with Microsoft 365, Entra ID/Azure AD, and Microsoft Sentinel) and also integrates natively with Google Workspace, Google Chronicle, Okta, Slack, Teams, and 100+ other tools via API.
Company Size & Ownership
- Abnormal AI was founded in 2018 by CEO Evan Reiser and CTO Sanjay Jeyakumar, both formerly of Twitter (via TellApart acquisition).
- As of late 2025/2026, the company has approximately 1,400–1,500 employees, having grown its headcount by 70% in the year ending mid-2025.
Compliance & Certifications
- Abnormal AI holds an extensive set of compliance certifications, including SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 27701 (privacy), ISO/IEC 42001:2023 (AI governance), FedRAMP Moderate Authorization (achieved in just 256 days, sponsored by the Tennessee Valley Authority, authorized April 2025), GovRAMP, TX-RAMP, CSA STAR, GDPR, CCPA, PIPEDA, CJIS attestation, CMMC Certified, Cyber Essentials Plus, DORA, ITAR, NIS2, and VPAT.
- The company is pursuing FedRAMP High and DoD Impact Level 5.
Compiled from public sources by VenSearch · Last researched October 14, 2026
Offerings
18 offeringsAccount Takeover Protection
Account Takeover Protection uses behavioral AI to identify subtle anomalies and precisely detect compromised accounts by correlating email, IdP, and SaaS behavioral signals into one model. When a compromised account is detected, it automatically disables the account, signs the user out of active sessions, and forces a password reset without manual analyst intervention. It catches account takeover scenarios including socially-engineered MFA resets and privilege misuse that bypass authentication controls.
AI Agent Security
AI Agent Security inventories production AI agents deployed within an organization and verifies that each one behaves as intended according to its defined purpose and permissions. It maps non-human identities including AI agents, service accounts, and other non-human identity types through the Identity Trust Graph to detect behavioral deviations. The product helps organizations govern autonomous AI agents as they proliferate across enterprise environments.
AI Cloud Security
AI Cloud Security detects AI-driven attacks against cloud identities and workloads and contains threats within an organization's response policies. It connects AI tools, people, agents, and cloud activity through behavioral context to identify threats targeting cloud infrastructure including virtual machines, databases, and API keys. The product is part of Abnormal's AI Security suite that gives enterprises visibility and governance over AI running in their business.
AI Data Analyst
AI Data Analyst is an AI-powered agent that allows security teams to ask plain-English questions and get security insights instantly across their entire security environment. It enables analysts to uncover tailored insights without needing to write queries or navigate multiple dashboards. The product is listed as a platform-level add-on that complements the broader Abnormal Behavioral Security Platform.
AI Employee Guardrails
AI Employee Guardrails keeps employee AI use on task by protecting sensitive data and enforcing policies based on the individual person, the AI tool being used, and the specific request. It provides controls over how employees interact with AI platforms to prevent data leakage and ensure usage aligns with organizational policies. The product is part of the AI Security suite and leverages behavioral context to distinguish compliant from risky AI interactions.
AI Governance
AI Governance discovers every AI tool, agent, and chat operating in the organization's environment, scores each for risk, and enforces policy automatically. It includes a browser extension that can detect ChatGPT conversations from personal, free, and logged-out accounts and analyze file attachments in AI chat sessions for sensitive data exposure. It also supports SIEM/SOAR integration to send events when new AI tools are discovered or governance statuses change, helping teams operationalize AI governance without continuous console monitoring.
AI Phishing Coach
AI Phishing Coach is a security awareness training product that builds personalized phishing simulations from the real attacks Abnormal stops, tailoring scenarios to each employee's role, behavior signals, and language. It uses dynamic risk analysis to automatically calibrate simulation frequency, difficulty, and follow-up coaching based on individual employee interactions, and provides AI-generated video training in 30+ languages. The product tracks phishing risk scores with trends and global benchmarks and generates executive-ready PDF reports on program performance.
AI Security Mailbox
AI Security Mailbox is an AI co-worker for email security operations that autonomously triages user-reported emails, classifying each as malicious, spam, safe, or a security training exercise without manual first-line review. When a reported message is malicious, it automatically finds and removes all related campaign emails across the tenant, and sends personalized, policy-aligned responses to the employee reporter. It integrates with existing phishing report buttons, abuse mailboxes, and SIEM/SOAR tools to bring all reports into one normalized SOC-ready queue.
AI Security Workbench
AI Security Workbench enables security teams to run AI-powered investigations across petabytes of behavioral events stored in the Abnormal platform. It allows analysts to query and investigate threats at scale across identity, email, and cloud behavioral data. The workbench supports deeper threat hunting and incident response workflows beyond what is available in the standard console views.
Attune
Attune is Abnormal's proprietary behavioral AI foundation model that learns what is normal for every identity in an organization and detects attacks by identifying meaningful deviations from that baseline, without relying on signatures or known threat indicators. It is trained on billions of derived behavioral signals from production data and powers all Abnormal detections across email, identity, and AI security products. Attune 1.0 is described as discovering more unique attacks compared to prior model generations and driving the vast majority of all malicious attack detections on the platform.
Behavioral Security Platform
The Abnormal Behavioral Security Platform is a unified security platform that integrates email security, identity security, and AI security into a single console powered by the Attune behavioral AI engine and the Identity Trust Graph. It connects to over 100 native API integrations across Microsoft 365, Google Workspace, Okta, CrowdStrike, Azure, GCP, and SIEM/SOAR tools to ingest thousands of behavioral signals without requiring MX changes or agents. The platform enables automated detection, investigation, and remediation of sophisticated attacks at machine speed across all protected surfaces.
Email DLP Rules
Email DLP Rules provides outbound email data loss prevention by allowing security teams to define and enforce custom email policies while an AI Triage Agent reviews matches in context, releasing benign messages and quarantining genuine violations. It uses behavioral context to reduce analyst management overhead and false positives compared to traditional keyword-matching DLP tools. This capability is part of the broader Email Security platform and is managed through the same unified console.
Email Productivity
Email Productivity uses behavioral AI to learn each employee's email preferences and automatically move low-priority promotional graymail out of the inbox into a dedicated folder, reducing total inbox volume without quarantine portals or manual policy management. It learns from each user's email behavior to continuously refine personal safe and block lists, improving accuracy over time. An Email Productivity dashboard tracks hours saved, remediation coverage, and user impact so teams can quantify and report productivity gains.
Identity Threat Protection
Identity Threat Protection correlates email, identity provider, and SaaS signals into a unified behavioral model to catch identity threats that pass authentication and stop them before they escalate into breaches. It supports adaptive identity reset enrollment, allowing admins to filter and manage enrollment rosters by department, job title, VIP status, and admin status at scale. The product detects threats including compromised accounts blasting phishing links, lateral movement, and insider risk scenarios.
Inbound Email Security
Inbound Email Security is powered by Attune 1.0 and builds a behavioral baseline for every employee and vendor to detect and automatically remediate advanced email threats including BEC, AI-generated lures, and payload-free attacks before they reach the inbox. It deploys via API in 60 seconds with no MX changes required and provides behavioral AI detection, attack remediation, calendar invite remediation, and campaign-level threat removal. The product also includes a Threat Log, Detection 360 feedback loop, custom AI models, and custom rules for organization-specific policies.
Infiltration Prevention
Infiltration Prevention detects synthetic personas and infiltration campaigns by spotting fraudulent identities in applicant tracking systems before access is provisioned to the organization. Admins can filter flagged candidates by flag reasons such as Submission via VPN or Known Threat Indicator, and download per-applicant PDF reports summarizing the evidence for sharing with HR or people teams. It closes the identity risk gap that begins before an attacker ever gains access to systems.
Misdirected Email Prevention
Misdirected Email Prevention uses behavioral AI to detect outbound emails headed to the wrong recipient by analyzing recipient context, communication history, content signals, and metadata without requiring static rules or policy tuning. When a likely misdirected email is detected, it holds the message in quarantine and immediately notifies the sender with an explanation and options to release or cancel, resolving most cases without SOC involvement. It deploys via SMTP relay alongside existing Abnormal deployments for Microsoft 365 with no MX changes and includes an Outbound Log for audit and compliance.
Posture Management
Posture Management, also referred to as Security Posture Management, identifies risky misconfigurations across cloud email platforms by checking configurations against benchmarks such as the CIS Microsoft 365 Foundations Benchmark. It prioritizes identity misconfigurations based on real attack risk, helping security teams address the gaps attackers are most likely to exploit. The product provides visibility into configuration gaps across applications, people, and tenants within a single console.
Considering Abnormal AI (Abnormal Security)?
Our team will work with you to determine if Abnormal AI (Abnormal Security) is the right fit for your organization. From research and assessment through procurement negotiation and ongoing vendor management — we handle the entire process at no cost to you.