We use Abnormal Security to protect us against phishing.
We implemented Abnormal Security to reduce the number of phishing attacks that reach users, internal customers, and other users in our organization. This automated AI-driven technology replaces the need for multiple resources to review, identify, and block malicious emails.
The ability to quickly spin up a Proof of Concept is one of the easiest things I have ever done. POCs can integrate with our Outlook and Active Directory environment within 15 minutes. This is because they are API-driven. This allows them to easily go back in time and look for past emails that were missed, as well as show us the remediation option for any new emails that come to our organization.
Abnormal Security also allows us to assess the risk of our partners. When partners send us emails, Abnormal Security can identify whether they are potentially high-risk based on data from other customers or on certain trends that it sees in emails coming our way. This allows me to assess both internal and external risks.
Abnormal Security's ability to detect threats in cloud collaboration applications is critical. These applications, such as Slack and Teams, are increasingly being used for communication, and they can be leveraged by attackers to send malicious links and attachments. For example, an external attacker could reach out to us on Teams and send us a link in the same way as they would in an email. This is why it is important to have security solutions in place to protect against these threats.
The biggest benefit of Abnormal Security is the visibility it provides in the full-blown email environment. At my previous company, we were able to reduce our number of phishing-driven events by 70 percent in the first six months of use. As a result, my team was able to move away from dedicated phishing resources and into a more proactive stance, which has allowed our security organization to mature quickly. We realized the benefits of switching from a high-touch to a low-touch solution almost immediately. Every tool needs some maintenance, but Abnormal Security is much more hands-off. It just works, with minimal care and feeding required. The benefits, or ROI, were evident to everyone, up to and including leadership. Abnormal Security not only reduced spam thanks to its graymail feature, but it also allowed us to reduce noise from advertisements and sales engineers, and to provide better cost-oriented feedback because users now receive feedback when they submit phishing emails.
The AI and machine learning functionality improves visibility into broader attacks. With the advancement of AI, threat actors are now leveraging it to create spear-phishing emails that are quicker to put together and send to specific leaders and executives within organizations. AI can handle upwards of 20 languages, so emails now look cleaner. Typically, if an email is written by someone who doesn't speak English as their native language, we'll find grammatical errors. With AI, these errors are fixed. Abnormal Security's AI and ML technologies can see the patterns, adjust their AI models, and adjust much quicker than a person could at this point.
The trained AI model can quickly adjust to new attack patterns and update its models accordingly, providing more visibility and quicker adjustments to new types of attacks. Typically, threat actors will change their approach once they see that we have stopped them. They will change the look of their attacks. And while I trust my analysts to figure out and catch the new ones, I would rather trust an AI model that can adjust much quicker on the fly than a human analyst. So I think Abnormal Security provides a good balance between machine learning and human judgment. Their tools are always being updated with customer feedback and input to ensure that they are as effective as possible.
Abnormal Security has helped us reduce the time we spend on email incidents. In my current organization, we are just implementing it, but in my previous organization, Abnormal Security significantly reduced the time we spent on email incidents. When we turned it on, my team was asking me what they should be doing now. This is a good problem to have in my world because I had plenty of stuff for them to do. It has also allowed them to grow, learn, and develop as security leaders. My team used to spend hours each day on email incidents and it turned to 15 to 30 minutes a day after we implemented Abnormal Security.
Abnormal Security helped to reduce the cost of redundant secure email gateway solutions by 50 percent. Abnormal Security integrates well with Microsoft and works very well with the Microsoft email protection tool, as well as others like Mimecast. It reduces the need for an additional SEG or Proofpoint-like solution. The cost is user-based, and I think it's been affordable at both organizations for the value it brings.
It helps reduce the cost of account takeover detection tools, especially for fraud.
Initial auto-remediation allows us to auto-remediate before the email lands in the end user's inbox for a split second. At that point, they identify if it's malicious or not. The auto-remediation feature is as important as the ability to report a phishing email to an abusive mailbox. If something does land in our inbox, and we think it's phishing, we can report it through the phishing button. The solution assesses to see if it's benign spam or legitimately phishing email.
Abnormal Security needs to continue to grow in all directions, partnering with other key players such as CrowdStrike, an EDR solution. I think it is key to continue to partner with these tech leaders and bring all of that telemetry into a single pane of glass.
I have been using Abnormal Security for two years.
We have not had any stability issues with Abnormal Security.
Abnormal Security is scalable and adjusts to our environment.
I am greatly satisfied with the technical support.
Positive
I previously used Proofpoint Email Protection and Armorblox. I switched to Abnormal Security because the proof of concept was easy to set up and the evidence of its effectiveness was clear. I also trusted the recommendations of my peers in the industry who had used Abnormal Security and put it into production. The POC showed us what Abnormal Security could catch that my current tool was missing, which was huge. We also did an apples-to-apples comparison of Abnormal Security to other solutions and asked our peers about their experiences. All of the feedback was positive.
Abnormal Security can be deployed quickly, providing rapid visibility into the environment. We can use AI models to identify patterns and adapt quickly to new types of phishing emails. Our abuse-mailbox allows us to be customer-focused, and we also provide insights to our partners on a daily and weekly basis.
The only con I see with Abnormal Security is the lack of customization.
Deployment is seamless. It took less than 30 minutes to get on a call with Abnormal Security to ensure that we had the right people with the right access on our side, and then to grant Abnormal Security access to integrate their API. From there, the Abnormal Security tool imported almost everything, and setting up users is easy. As an administrator of the solution, I can add more users to it and tweak the console and system to our liking, to a certain extent.
Abnormal Security provides an onboarding engineer, whom they call a success manager, to work with us during implementation.
The license is based on the user count, so the number of users that have an email address in the organization. Compared to other solutions the price is fair.
I would rate Abnormal Security nine out of ten.
We have 1,000 users.
The maintenance required is minimal.
With its ability to utilize technology, AI, and other tools, Abnormal Security has caught up to or even surpassed its competitors that have been around for longer.
I recommend conducting a proof of concept of Abnormal Security, which is very easy for customers to do and is likely to provide them with more insights.
