Abnormal Security Reviews

We use Abnormal Security for our email protection in addition to Microsoft 365. Previously, we relied on another provider for many years to scan emails for malicious content, viruses, and spam. However, with the increasing sophistication of email attacks, our old provider simply couldn't keep up. Their system involved rerouting our emails to them for scanning before delivery to Microsoft 365. This approach proved ineffective, particularly for attacks like CEO impersonation emails or simple text messages requesting personal information. These attacks didn't contain any traditional malicious attachments.

Abnormal Security serves several key functions for us. Primarily, it excels at detecting malicious content. Additionally, it effectively isolates spam, preventing it from cluttering our inboxes. For legitimate but unwanted emails, such as newsletters, it creates a dedicated "Promotions" folder, keeping our inboxes organized. These are the main reasons we appreciate Abnormal Security.

Abnormal Security Portal Provides Comprehensive Email Security Management. We have access to a web portal provided by Abnormal Security. This portal grants us complete visibility into how Abnormal Security analyzes our incoming email. We can see everything it catches, how it classifies the emails as malicious, legitimate, etc., and the reasoning behind the classification. The portal is well-organized with dedicated sections for different threat types. We can easily identify account takeover attempts, vendor fraud attempts, and other threats. A particularly valuable feature is the search and respond functionality. In the past, we've encountered situations where employees accidentally sent out sensitive information or messages that shouldn't have been distributed. The portal allows us to quickly locate these emails and remove them from everyone's inbox, including deleted items. This ensures the emails vanish completely and never reach the intended recipients. Furthermore, the portal empowers us to manage our email security preferences. We can whitelist trusted senders and create custom blocklists for unwanted emails, providing a high level of control over our email environment.

While Abnormal Security has been effective in detecting a wide range of email threats, some emails have slipped through. To address this, we've educated our users. If they suspect spam, phishing, or an unusual email, they can report it directly through the "Report" button in Outlook which forwards to Abnormal, or by forwarding it to the "phishing" email address. This triggers a deeper analysis by Abnormal to identify any missed threats. According to our year-long data, users have submitted over 1,500 emails from 121 employees. Abnormal identified 4 percent as malicious and 9 percent as spam, with the remaining 87 percent deemed safe. These statistics indicate that Abnormal doesn't catch everything. However, by fostering a user base that remains vigilant and reports suspicious emails, we can leverage Abnormal's deep analysis to further enhance our email security.

During the pilot period, Abnormal Security's benefits became clear. We encountered an ongoing account takeover that we were initially unaware of. However, as Abnormal Security ran, it helped us organize and identify threats effectively. Feedback from the field has been very positive compared to our previous vendor. With our previous vendor, we received four daily emails notifying users about quarantined emails. These notifications cluttered inboxes and created confusion. There were instances where legitimate malware was quarantined, but the user received a message like "This email was quarantined for you. Do you want to investigate or recover it?" Unaware of the potential threat, some users might release the email, believing it to be a false positive. This could lead to compromising their credentials or infecting their computer. Abnormal Security takes a different approach. They automatically hide suspicious emails, preventing them from reaching user inboxes. This eliminates confusion and protects users from inadvertently engaging with malicious content.

We encounter AI in various ways. For example, it can be involved in filtering emails. For example, if I am receiving an email in my inbox that I prefer not to see there every day. I might move it to my promotions folder. Conversely, an email might land in promotions that I want to see in my inbox, perhaps because it's considered graymail. In that case, I can move it back to my inbox. The AI can learn from my actions and apply those preferences in the future. AI also plays a crucial role in defending against certain cyberattacks. Traditional methods might not be sufficient to catch these threats. AI can analyze incoming emails for a multitude of factors, performing a kind of predictive analysis on potential threats. These factors might include a sense of urgency in the email's tone, an email supposedly from the CEO but with an unrecognized sender address, or a domain that's a month old. Humans might not readily pick up on such red flags, but AI can effectively identify them.

My colleagues tell me that since we implemented this change, the number of attacks has decreased. I can confirm this by checking the dashboard, which shows the current attack volume. Even more importantly, by filtering out greymail into a promotions folder, everyone saves time by not having to sort through irrelevant emails in their inboxes.

There have been fewer IT tickets lately concerning suspicious activity. People used to report things like clicking on something malicious or questioning if an email was spam. Now, if something seems abnormal, it's sent directly to the Abnormal activity queue. Previously, we'd receive frequent reports about things like fake CEO emails or phishing attempts, but those types of tickets are becoming rare in our help desk.

Previously, we used a much more affordable email security solution. While Abnormal Security costs more, it outperforms or at least matches the capabilities of its competitors. We trialed Barracuda, but their pricing was prohibitive. Even if they lowered their prices now, I wouldn't consider them. Mimecast and Proofpoint, the other options we explored, were priced similarly. However, Abnormal's setup is significantly easier to use. While the initial configuration involves integrating it with our Microsoft 365 environment, Abnormal's day-to-day operation, configuration, and fine-tuning are much simpler compared to the other products.

Our main goal is to use Abnormal Security as an additional shield against the increasingly advanced email threats targeting our organization. During our implementation, we've discovered additional benefits. Firstly, it dramatically reduces the time needed for investigations, giving our IT team more efficient access to search and discovery tools than our current system provides. Secondly, it empowers both our threat-hunting and incident response teams, especially frontline responders. This allows them to access crucial data points directly, without always needing to wait for escalations.

The biggest challenge we faced was sophisticated business email compromise attacks. These targeted our customers or vendors, with attackers gaining access to their legitimate email systems and impersonating users to send emails to our enterprise. Our existing security tools were ineffective at detecting this traffic, as it originated from legitimate mail servers and mailboxes of people we regularly communicate with. Traditional security analysis didn't have enough telemetry to detect the anomalies. We needed a solution to differentiate between genuine interactions with our customers and vendors and those disguised as them by attackers who had hijacked their mailboxes. This was the primary use case for Abnormal Security, and it's proven highly effective in addressing this challenge.

I'm impressed with their API architecture. One of the main reasons is its invisibility to threat actors trying to launch attacks. Unlike our traditional email security tools in the SEG, which attackers can easily detect before they even start emailing us, the API remains hidden until they've already begun their attack. This gives us valuable early visibility via the API, allowing us to easily pipe that data to other tools and stop advanced attacks more effectively. The improved visibility into our email infrastructure also benefits our IT teams. Using the API integration, they can now remediate issues in minutes, whereas before it could take hours. Previously, identifying an inbound cyber attack meant bouncing between several tools: one to identify the attack, another to track affected emails, and yet another to quarantine them. Abnormal's APIs streamline this process. With a single search, an IT technician can identify users who received the emails, track who clicked on them, see where the emails are located, and even delete them from everyone's inbox directly. This has drastically reduced our investigation and response time for phishing and BEC attacks, from hours to mere minutes.

Compared to many other vendors we considered, Abnormal Security stands out in its ability to detect the full spectrum of email threats. While our existing Secure Email Gateway handles traditional threats like spam and malware quite well, it often misses more sophisticated attacks. The SEG relies on static indicators like email flags, suspicious file hashes, or mass recipient lists. We can easily identify and filter out emails matching these criteria, but they do little to stop targeted attacks. Here's where Abnormal Security shines. Their anomaly detection engine excels at recognizing one-off attacks, including those where a threat actor infiltrates a vendor's mailbox and manipulates payment instructions or redirects transactions. Abnormal identifies these anomalies using behavioral analysis, effectively catching threats that traditional static methods typically miss.

The two main benefits Abnormal Security offers us are its ease of use and its powerful search capabilities. These features empower our internal teams to get more involved in the response process, helping us track down threats efficiently. Additionally, Abnormal's ability to stop advanced attacks significantly reduces our security team's workload. Security teams are consistently stretched thin, so minimizing wasted effort chasing false alarms is crucial. By keeping harmful emails out of user inboxes, Abnormal allows us to focus on other priorities. In summary, our primary gains from Abnormal are its effectiveness in blocking attacks and its ability to empower our internal teams, ultimately strengthening our overall security posture.

Abnormal Security's AI and machine learning capabilities significantly expand the range of email attacks they can block. This is crucial to optimizing their product's performance for us. Specifically, their ability to leverage AI indicators and extensive email telemetry is critical for stopping advanced threats, like compromised mailboxes sending disguised emails. Traditional methods often fall short in such scenarios. Our primary concern is identifying emails sent by a threat actor posing as a legitimate mailbox owner. AI-powered anomaly detection proves virtually indispensable in discerning the true sender's identity. Abnormal Security has identified and prevented several such sophisticated attacks in our own experience. One remarkable example involved a vendor's seemingly legitimate email flagged as suspicious by Abnormal. Initially dismissed as a false positive by our first responders, a deeper analysis of the email's telemetry revealed subtle anomalies. The email's sudden shift to a professional tone, unlike the typically casual communication with this vendor, was one such anomaly. As it turned out, Abnormal's suspicions were correct – the vendor's account had been compromised. This instance highlights the unparalleled effectiveness of AI in detecting sophisticated email threats. By focusing on abnormalities in email behavior, AI can uncover hidden dangers that might otherwise elude traditional security measures.

The deployment of AI has significantly reduced the number of internal attacks we encounter, and it has even extended its benefits beyond our perimeter. We've proactively alerted several customers and vendors about potential compromises before they even realized their systems were under attack. This proactive approach has been well-received, with many recipients expressing their appreciation for our timely intervention. Within our organization, AI has dramatically streamlined our security operations by automating the analysis of sophisticated attacks, freeing up valuable time and resources for our security teams.

Abnormal Security has dramatically reduced the time our team spends resolving email incidents. What used to consume hours or even days, depending on the attack and response complexity is now handled within minutes, often by less experienced team members. This has significantly improved our efficiency and freed up valuable time for other security tasks.

Although no product can eliminate attacks, we've been pleasantly surprised by the effectiveness of Abnormal Security. Initially, when we approached them with our use case and problem, we'd have been happy with a much lower catch rate. Stopping even a significant number of attacks would have been a success. But the actual results have been incredibly impressive. While some attacks still slip through, the features in Abnormal allow us to feed those cases back into their system. This feedback fuels the AI's learning process, helping it avoid repeating the same mistakes. Interestingly, the attacks that remain undetected are often difficult to define even for human analysts. They involve subtle cues that would be challenging for any AI to spot in the specific contexts we've encountered. One example involved a new customer with whom we had exchanged only a handful of emails. While this customer's account became compromised, the attacker wasn't the usual contact person. Since the AI had only profiled the communication style of the usual contact, the malicious email appeared normal compared to that limited baseline. In such cases, where the AI lacks sufficient data, even exceptional systems can be caught off guard. While no product is perfect, we're highly impressed by Abnormal's speed and efficiency in catching attacks. They've dramatically reduced the workload on our help desk compared to the past, with the results being clear and measurable.

Compared to our old solutions, Abnormal Security's incident response is like night and day. With our previous SEG, identifying and remediating a suspicious email was a cumbersome process. We'd flag the email, then jump through hoops to figure out who received it and if anyone clicked on it. With different modules and separate views, it was a mess. Once we confirmed the threat, another system hunt began, pulling emails from user inboxes. It was slow, fragmented, and frustrating. Abnormal is a breath of fresh air. If we spot a threat alert on the dashboard, we simply click on it to see all recipients, where the email sits, and who interacted with it. And then, the holy grail – a single button. Click 'Remediate', and those emails vanish from user inboxes, instantly neutralized. Just a button click from issue detection to resolution in seconds. All from one screen. That's the transformative power of Abnormal Security. Something our old solutions couldn't dream of.

We have a separate Proofpoint email gateway, so Abnormal is what we consider to be defense in depth. It catches malicious emails that our primary email gateway misses, so we're depending on Abnormal to detect them for us. It also gives us trickier stuff, like zero-day threats. 

We also use Abnormal for our abuse mailbox. Our users have a "report phishing" button in Outlook. If they get any suspicious email that they think is malicious or spammy, they can click that button and report it to Abnormal. The Abnormal abuse mailbox automatically analyzes it and responds to the user as to whether it is safe spam or malicious. If it is safe, it sends a copy of the email back to the user so they don't have to look for it in their deleted items. 

We have close to 24,000 users. Not all of those are users because a large percentage of those work mainly in Salesforce, but many mailboxes. It's also three different Microsoft tenants because we acquired or merged with other companies throughout the years. 

Abnormal helps increase the level of our email security. I would be uncomfortable if we did not have that second layer of defense. I think it's super important. Having Abnormal helps me sleep better at night by keeping an eye on the emails that Proofpoint logs in. 

The solution's AI/ML features broaden the types of email attacks it can stop by learning employee behaviors. I recently got numbers from the Proofpoint and Abnormal sides, and the fact that Abnormal was still catching so many specific types of attacks that Proofpoint missed is kind of crazy. It says that Abnormal detected almost 7,000 attacks in the past 30 days. That's a huge number of emails. 

Abnormal Security has reduced the time my team spends on those email incidents. I work on the admin side, so I'm not involved in running down the incidents on the SOC side, but we would need more people if we didn't have Abnormal automatically remediating so many of these attacks. 

I didn't even realize it was stopping this many attacks. You let it go and do its thing. That's a lot of emails, and it takes a lot of time for a person to hunt down this volume of attacks. Even if it took only half an hour per attack, that's more than a full-time employee could deal with. If we didn't have Abnormal doing this, it would take at least two FTEs. 

The solution helps reduce the costs of account takeover detection tools. We have it integrated with CrowdStrike, and Abnormal sends alerts back and forth. The integration with CrowdStrike helps us better monitor the environment and produces more alerts for the SOC to investigate. 

We use Abnormal Security for our email security.

Abnormal Security's visibility into internal spam attacks, thanks to its API-based architecture, has been exceptional. It's incredibly fast, with no delays, unlike other solutions that can introduce lag times of up to ten minutes. For executives, this is unacceptable. Having direct API integration is a game-changer. It provides clear visibility into messages and is remarkably user-friendly. There's no need for days of training on the admin dashboard; it's intuitive and straightforward. Clicking here and there is all it takes to search for emails. The interface displays delivery details, current location, and the processing outcome, indicating whether the email was deemed spam and moved to junk or considered legitimate.

Abnormal Security's full-spectrum email attack detection has proven effective in protecting us against various threats, including credential phishing, invoice fraud, extortion attempts, and name impersonation. On rare occasions where emails slip through the cracks, reporting them leads to swift remediation within two hours, accompanied by training updates to prevent similar occurrences. I haven't encountered similar emails after submitting reports.

It is important that threats can be detected in cloud collaboration applications such as Slack Teams and Zoom. Anything that will help protect our organization is valuable.

The Proof of Concept for Abnormal Security demonstrated its effectiveness by catching threats that Mimecast missed.

Its AI and machine learning expand the range of email attacks it can stop, while also reducing false positives. We had significant issues with our previous provider, Mimecast, experiencing numerous false positives reported by various teams. When I suggested that the system should be smarter, the response was usually dismissive. Thankfully, I don't encounter this issue with Abnormal Security. The biggest example I can give involves impersonation attacks. With Mimecast, any new employee creating an account on Thursday and then receiving emails from our recruiting team on the same day would trigger an impersonation alert, despite the recruiting team having prior interactions with that person. Abnormal Security, however, recognizes that the new account was recently created, the older account has a history of sending emails, and there was prior communication between the two accounts, accurately concluding that this is not an impersonation attempt. While we could potentially collect flight data to further solidify this, Abnormal Security's intelligence allows it to understand that such activity from a new employee is legitimate. We haven't experienced any false positives or false negatives with Abnormal Security.

The AI and machine learning capabilities have helped reduce the number of attacks that get through.

We have another solution that we placed in front of Abnormal Security for added security and we found that Abnormal Security is catching emails that were phishing extortion invoice fraud that the other solution didn't recognize as a threat.

Abnormal Security has reduced the amount of time our team spends on email incidents by a minimum of four to five hours per week.

It helped reduce the cost of redundant security email gateway solutions.

Previously, our solution lacked warnings about potential security issues. Abnormal Security, however, has identified a couple of instances where it flagged suspicious activity. For example, it might alert us that someone's account seems compromised and suggest taking action. If we don't intervene, Abnormal Security will automatically handle the situation. Importantly, these alerts provide valuable insights we never had before, such as identifying VPN usage. This increased visibility significantly enhances our security posture.

We use Abnormal Security to protect us against phishing.

We implemented Abnormal Security to reduce the number of phishing attacks that reach users, internal customers, and other users in our organization. This automated AI-driven technology replaces the need for multiple resources to review, identify, and block malicious emails.

The ability to quickly spin up a Proof of Concept is one of the easiest things I have ever done. POCs can integrate with our Outlook and Active Directory environment within 15 minutes. This is because they are API-driven. This allows them to easily go back in time and look for past emails that were missed, as well as show us the remediation option for any new emails that come to our organization.

Abnormal Security also allows us to assess the risk of our partners. When partners send us emails, Abnormal Security can identify whether they are potentially high-risk based on data from other customers or on certain trends that it sees in emails coming our way. This allows me to assess both internal and external risks.

Abnormal Security's ability to detect threats in cloud collaboration applications is critical. These applications, such as Slack and Teams, are increasingly being used for communication, and they can be leveraged by attackers to send malicious links and attachments. For example, an external attacker could reach out to us on Teams and send us a link in the same way as they would in an email. This is why it is important to have security solutions in place to protect against these threats.

The biggest benefit of Abnormal Security is the visibility it provides in the full-blown email environment. At my previous company, we were able to reduce our number of phishing-driven events by 70 percent in the first six months of use. As a result, my team was able to move away from dedicated phishing resources and into a more proactive stance, which has allowed our security organization to mature quickly. We realized the benefits of switching from a high-touch to a low-touch solution almost immediately. Every tool needs some maintenance, but Abnormal Security is much more hands-off. It just works, with minimal care and feeding required. The benefits, or ROI, were evident to everyone, up to and including leadership. Abnormal Security not only reduced spam thanks to its graymail feature, but it also allowed us to reduce noise from advertisements and sales engineers, and to provide better cost-oriented feedback because users now receive feedback when they submit phishing emails.

The AI and machine learning functionality improves visibility into broader attacks. With the advancement of AI, threat actors are now leveraging it to create spear-phishing emails that are quicker to put together and send to specific leaders and executives within organizations. AI can handle upwards of 20 languages, so emails now look cleaner. Typically, if an email is written by someone who doesn't speak English as their native language, we'll find grammatical errors. With AI, these errors are fixed. Abnormal Security's AI and ML technologies can see the patterns, adjust their AI models, and adjust much quicker than a person could at this point. 

The trained AI model can quickly adjust to new attack patterns and update its models accordingly, providing more visibility and quicker adjustments to new types of attacks. Typically, threat actors will change their approach once they see that we have stopped them. They will change the look of their attacks. And while I trust my analysts to figure out and catch the new ones, I would rather trust an AI model that can adjust much quicker on the fly than a human analyst. So I think Abnormal Security provides a good balance between machine learning and human judgment. Their tools are always being updated with customer feedback and input to ensure that they are as effective as possible.

Abnormal Security has helped us reduce the time we spend on email incidents. In my current organization, we are just implementing it, but in my previous organization, Abnormal Security significantly reduced the time we spent on email incidents. When we turned it on, my team was asking me what they should be doing now. This is a good problem to have in my world because I had plenty of stuff for them to do. It has also allowed them to grow, learn, and develop as security leaders. My team used to spend hours each day on email incidents and it turned to 15 to 30 minutes a day after we implemented Abnormal Security.

Abnormal Security helped to reduce the cost of redundant secure email gateway solutions by 50 percent. Abnormal Security integrates well with Microsoft and works very well with the Microsoft email protection tool, as well as others like Mimecast. It reduces the need for an additional SEG or Proofpoint-like solution. The cost is user-based, and I think it's been affordable at both organizations for the value it brings.

It helps reduce the cost of account takeover detection tools, especially for fraud.

At a high level, we leverage Abnormal Security for all spam filtering, but it is more than that. It is not your basic old spam filtering. They are finding things or phishing attempts that are very targeted, such as spear phishing emails that come through the pipeline and may look innocent or innocuous to most email security tools. Abnormal Security is able to spot them and essentially, mitigate and remediate them so that the users do not accidentally fall for something they should not.

Abnormal Security provides visibility into internal spam attacks due to its API-based architecture. At a high level, they have a bunch of dashboards and things like that that let you view who are the most targeted people and who are they auto-remediating. That is one of the key features. They reach into the box and pull these sorts of emails out before people start responding to them. All the information about who is being attacked and what sort of attacks are occurring is there in dashboards.

Abnormal Security can detect the full spectrum of email attacks. Because they have this AI-based model, they seem to be able to find things that other spam filters using just the basic algorithms cannot find. Abnormal Security is then able to auto-remediate that. It can pull that stuff right out of the box.

It learns from what employees are doing and what is standard procedure versus not, so the intent is to broaden the types of email attacks it can stop. Its AI and ML capabilities have helped big time to reduce the number of attacks that get through. We have a small team. Without it, they would have to actively work through various types of spear phishing or phishing that get through to our employees. That has been greatly reduced, so the team can work on higher-value tasks. Because of all the auto-remediation, people are more productive, and we can work on more proactive things. In the past, it took anywhere from 40 to 80 hours a week working on these sorts of things. It has gone to less than a day or eight hours of a work week.

Abnormal Security has reduced the amount of time our team spends on email incidents.

Abnormal Security will help to reduce the costs of redundant Secure Email Gateway solutions. All of our contracts have not expired yet. 

We use Abnormal Security for blocking spam and email threats in a medium-sized manufacturing environment.

Abnormal Security is valuable because it features an automated scoring tool that doesn't require much intervention from our team. It enhances threat detection capabilities by making the process automated and is easy to scale to our entire environment. 

Additionally, it protects us from being business email compromised, which is invaluable for maintaining our security.

The primary need for the product, what drove us to that product, was a need for greater email security. We had been experiencing a series of executive impersonation attacks that our current email gateway was not able to pick up. People were pretending to be an executive at our organization and trying to get people to buy gift cards or send them the codes or complete an action or something along those lines for them. We did a proof of concept with Abnormal, and it did a really good job of preventing those attacks from happening.

With Abnormal, I've gotten my weekends back. In my case, I was getting paid every weekend to do email remediation, and I was having to pull in on-call administrators. We were doing search and destroy and forward attacks. That was every single weekend basically that we were dealing with some type of attack. Usually, the attack was an executive impersonation that required us to move quickly. Once I put Abnormal in and we got it into Active Protection, it was almost like magic. Those attacks just went away.

The net result for the business is that we get to focus on more proactive things. We stopped firefighting, and we started doing things that helped us holistically improve our security posture. The automation really, really helped us focus on more important work.

The time to value was immediate. We put it into a passive mode for a month or so as part of a proof of concept. We liked what we saw. When we turned it into active mode, it was immediate.