- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Abnormal AI
The AI-native behavioural security company — it catches the socially-engineered attacks (BEC, phishing, VEC) that gateways miss, using behavioural AI, and is expanding beyond email to identity & AI governance. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at no extra cost.
Free, vendor-neutral, 30 minutes
The company, at a glance
Quick answer
Five intel pages. One behavioural model.
The complete Abnormal AI platform — every linked card is a full intel page, from the email-security flagship to the 2026 behavioral platform.
Inbound Email Security
Catch what gateways miss.
The flagship — AI-native, behavioural email security that stops the advanced, socially-engineered attacks (BEC, credential phishing, account takeover, vendor email compromise) that traditional secure email gateways AND Microsoft/Google native defences miss. Its behavioural AI (Attune) learns your normal and flags anomalies; it’s API-integrated (deploys in MINUTES, no MX change), sitting behind native mail — so it augments (or replaces) your gateway without re-routing your mail.
Account Takeover Protection
Catch the breached account.
Detect COMPROMISED internal accounts via behavioural anomalies — unusual logins, out-of-pattern sign-ins, malicious mail-rule changes, lateral movement — so a breached account doesn’t become an internal attack. This is cross-signal behavioural detection of accounts ALREADY compromised (not just blocking inbound), with auto-remediation — powered by the same behavioural model as the flagship. Catch the takeover, and stop it spreading.
AI Security Agents
AI co-workers for your SOC.
Abnormal’s 2025–2026 bet — AUTONOMOUS AI agents that automate SOC tasks: AI Security Mailbox (an AI co-worker that triages user-reported emails 24/7, auto-remediates campaigns org-wide, and closes the loop with reporters via conversational GenAI — Forrester cited ~5,000 analyst hours saved/year); AI Phishing Coach (just-in-time, risk-adaptive training); and an AI Data Analyst. Autonomous agents that eliminate manual SOC work and handle volume humans can’t.
Email Productivity & Posture
Cleaner, safer, better-configured.
Beyond stopping attacks — three capabilities off the same behavioural model: Email Productivity (strip graymail/promotional noise, reclaim inbox time), Posture Management (continuous security posture — catch risky misconfigurations and config drift across your email/M365 platform), and Misdirected Email (prevent accidental data leakage from mis-addressed mail). Cleaner inboxes, hardened configuration, fewer accidental leaks.
Behavioral Platform
Beyond email — one model.
Abnormal’s 2026 expansion (launched Aug 3, 2026) — one behavioural model, extended beyond email: Identity Threat Protection (detect/remediate compromise inside post-authentication sessions; protect the help desk against suspicious reset requests), AI Governance (discover, score and govern the AI tools and agents — sanctioned and shadow — across your org), and Infiltration Prevention (flag fraudulent candidates / suspected nation-state operatives before they gain access). Human-behaviour security, beyond the inbox.
One behavioural model — the Attune engine
Platform & engineEverything Abnormal does runs on ONE behavioural AI engine — Attune — trained on billions of behavioural signals and rooted in the founders’ ad-tech/behavioural-ML background. It models identity, behaviour and relationships to detect the deviations that signal an attack, and the SAME model powers inbound email, account takeover, the AI security agents, posture, and (2026) identity threat, AI governance and infiltration prevention. One model, many applications — the moat that lets Abnormal extend across the human attack surface.
From ‘Abnormal Security’ to ‘Abnormal AI’ — the platform story
Platform & engineThe 2025 rebrand from ‘Abnormal Security’ to ‘Abnormal AI’ signalled two things: an AI-native identity (behavioural AI is the foundation, not a feature) and a platform expansion beyond email. In 2025–2026 Abnormal added autonomous AI security agents (automating SOC work) and, in August 2026, identity threat protection, AI governance and infiltration prevention — becoming a ‘Behavioral Security Platform’ protecting human AND non-human/synthetic identities. (Agentic and identity/AI-governance capabilities are new and evolving — validate for your environment.)
Why “behavioural AI, catch what gateways miss” is the whole story
Signature-based gateways miss the payload-less social engineering that causes the biggest losses. Abnormal bet onbehavioural AI — model normal, flag the anomalies gateways can’t catch— behavioural AI (Attune) that models normal behaviour and flags the anomalies signature gateways can’t catch, API-integrated in minutes, layered on Microsoft/Google native security doubled down on it.
Behavioural AI (Attune)
Instead of signatures, Abnormal models the NORMAL behaviour of every identity and relationship, and flags anomalies — catching the social engineering (BEC, impersonation) that signature-based tools miss. Behaviour beats signatures. Its genuine moat.
API-Native (ICES)
API-integrated with Microsoft 365 / Google Workspace — deploy in minutes, no MX change, no mail re-routing — sitting behind native mail and analysing post-delivery. It layers onto your stack (augment or replace the gateway), frictionlessly.
Catch What Others Miss
The result: Abnormal catches the advanced, behavioural attacks — BEC, phishing, account takeover, VEC — that gateways and native defences let through, with high efficacy and low false positives. Best-in-class behavioural detection.
Autonomous AI & the Platform
Beyond detection: autonomous AI security agents (automating SOC triage and remediation) and, in 2026, a broader behavioural platform (identity threat, AI governance, infiltration prevention) — one model, extended across the human attack surface.
Fast-Growing & India-Rooted — Local via TechBag
A fast-growing modern leader (~$200M ARR, 100% YoY; $5.1B 2024 valuation) with its largest R&D office outside SF in BENGALURU — genuine India relevance. It’s quote-priced; TechBag adds scoping, honest comparison (vs Proofpoint/Microsoft), DPDPA-residency help, INR/GST and support.
Start with Inbound Email Security (catch what your gateway misses) — then add Account Takeover Protection, AI Security Agents, Email Productivity & Posture, and the 2026 Behavioral Platform. One behavioural model.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
AI-native behavioural
Attune — not signatures
Catch what gateways miss
BEC, VEC, phishing
API — minutes, no MX
Layer on M365/Google
AI Security Agents
~5,000 SOC hrs/yr saved
2018 · San Francisco
CEO Evan Reiser
~$200M ARR (100% YoY)
$5.1B valuation (2024)
3,000+ customers
~1 in 5 Fortune 500
Bengaluru
Largest office outside SF
The company in six figures
See the platform, hear the pitch
An Abnormal Approach to Email Security
The behavioural approach, explained.
Inbound Email Security — Product Demo
The flagship, walked through.
Trusted by 600,000+ organisations worldwide
Where Abnormal AI sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Abnormal AI Across Its Platform
Each dot is an Abnormal angle: competitive position vs category momentum.
The flagship — behavioural AI ICES.
The Behavioural-Detection × Deploy-Speed Map
Behavioural detection & deploy speed vs the field — where Abnormal catches what gateways miss.
AI-native behavioural; catches what gateways miss.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Abnormal AI?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What’s your priority?
2. Which sentence sounds most like you?
3. What does success look like?
What is Abnormal Inbound Email Security?
AI-native behavioural email security that catches the BEC and social engineering gateways miss — API-integrated, minutes to deploy.
Read →Behavioural AI vs signatures
Why modelling normal behaviour (Attune) catches payload-less attacks that signature-based gateways can’t.
Read →Catch the account takeover
How behavioural anomalies (odd logins, mail rules, lateral movement) reveal an already-compromised account.
Read →Autonomous AI security agents
AI Security Mailbox and Phishing Coach — autonomous agents that triage, remediate and coach, saving SOC hours.
Read →Beyond email (2026)
One behavioural model extended to identity threat, AI governance and infiltration prevention.
Read →Abnormal vs Proofpoint vs Microsoft
The honest matrix — behavioural layer (Abnormal) vs broad platform (Proofpoint) vs bundled native (Microsoft).
Read →The acronym decoder
Every term on these pages, in one place- Abnormal AI
- An AI-native behavioural security company — protect people from socially-engineered attacks (email, identity, AI usage). Founded 2018; rebranded from Abnormal Security in 2025.
- Behavioural AI (Attune)
- Abnormal’s engine — it models the normal behaviour of every identity and relationship and flags anomalies that signal an attack. The moat.
- ICES
- Integrated Cloud Email Security — API-integrated email security that sits behind native M365/Google mail (no MX change), analysing post-delivery. Abnormal’s model.
- BEC
- Business Email Compromise — payload-less, socially-engineered attacks (fake invoices, CEO fraud) that cause the biggest losses and that signature tools miss. Abnormal’s core catch.
- VEC
- Vendor Email Compromise — attacks via a compromised or impersonated vendor thread. Abnormal catches these by understanding your real vendor relationships.
- Account Takeover (ATO)
- When an attacker gains control of an internal account. Abnormal detects it via behavioural anomalies (odd logins, mail rules, lateral movement).
- AI Security Mailbox
- An autonomous AI agent that triages user-reported emails 24/7, auto-remediates campaigns, and closes the loop with reporters — saving SOC analyst hours.
- Posture Management
- Continuous detection of risky misconfigurations and config drift across your email/M365 platform — part of Email Productivity & Posture.
- Identity Threat Protection
- Abnormal’s 2026 capability — detect/remediate compromise inside post-authentication sessions and protect the help desk against suspicious reset requests.
- AI Governance
- Abnormal’s 2026 capability — discover, score and govern the AI tools and agents (sanctioned and shadow) used across your organisation.
- The augment-or-replace model
- Abnormal layers onto your Microsoft/Google native security to catch what it misses (augment), or can replace a legacy secure email gateway (SEG).
- The India layer
- Abnormal’s largest R&D office outside SF is in Bengaluru; TechBag adds scoping, honest comparison, DPDPA-residency help, INR/GST and support.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Scope (& augment vs replace)
Your mail platform (M365/Google), current email security (native? a gateway?), and needs. TechBag scopes whether Abnormal should AUGMENT your native security or REPLACE a legacy gateway — and compares honestly vs Proofpoint (platform) and Microsoft (bundled).
Connect via API (minutes)
Integrate Abnormal with Microsoft 365 or Google Workspace via API — no MX change, no re-routing — and let Attune learn your organisation’s normal behaviour. Protected in minutes.
Catch what native misses
Abnormal flags the behavioural anomalies — BEC, phishing, ATO, VEC — that your native/gateway security missed, and auto-remediates post-delivery. Add account-takeover protection. Close the gap.
Automate & extend
Turn on AI Security Agents (autonomous SOC triage, ~5,000 hours saved/yr), add Email Productivity & Posture, and — as you mature — the 2026 behavioural platform (identity, AI governance). One model, more coverage.
Compare honestly
Need a broad platform (DLP/compliance/awareness)? Proofpoint (a sibling — TechBag sells it). On M365 E5? Defender is bundled. Deep detection-engineering? Sublime. TechBag advises honestly.
Buy through the channel
Abnormal is quote-priced (per mailbox, USD) — TechBag adds scoping, INR/GST invoicing, DPDPA-residency help and local support.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Inbound Email Security | Per mailbox — by quote | Behavioural detection (BEC/phishing/VEC); API deploy | Catch what gateways miss |
| Account Takeover Protection | Per mailbox / add-on — by quote | Behavioural ATO detection + remediation | Post-compromise defence |
| AI Security Agents | By quote / platform | AI Security Mailbox, Phishing Coach, Data Analyst | Autonomous SOC automation |
| Email Productivity & Posture | Add-on — by quote | Graymail, posture management, misdirected email | Hygiene, config & accidental-leak |
| Behavioral Platform (2026) | By quote (new) | Identity threat, AI governance, infiltration | Beyond-email behavioural security |
Per mailbox, quote-priced (in USD) — TechBag scopes the mailboxes, advises augment-vs-replace, compares vs Proofpoint/Microsoft, and handles INR/GST.
Five pitfalls that cost buyers quarters
Expecting a full platform (it’s email-first)
Abnormal is best-in-class at behavioural email detection — but it’s EMAIL-FIRST and narrower than a full human-risk platform. It doesn’t match Proofpoint’s DLP, compliance/archiving or security-awareness-training depth (Proofpoint is a Wave-C sibling TechBag also sells). If you need those, Abnormal is a LAYER, not the whole answer. Many enterprises run Abnormal FOR the behavioural detection alongside a broader platform. TechBag is candid about the split.
Thinking it replaces your whole mail stack
Abnormal is an ICES that LAYERS ON your Microsoft 365 / Google Workspace native security via API — it AUGMENTS native (catching what it misses) and can replace a legacy secure email gateway, but it does NOT replace your mail platform or your native security underneath. Understand the model: you keep Microsoft/Google, and Abnormal adds the behavioural layer. TechBag scopes augment-vs-replace for your stack.
Overlooking explainability/customisability trade-offs
Abnormal’s strength is a global behavioural model that ‘just works’ — but some advanced SOC teams note it offers LESS rule-level customisability and explainability than detection-engineering-focused rivals (e.g. Sublime Security). If your SOC wants deep, tunable, transparent detection rules, weigh that. For most, Abnormal’s low-tuning, high-efficacy model is a benefit. TechBag matches the approach to your team.
Treating the AI agents as fully proven
Abnormal’s autonomous AI security agents (AI Security Mailbox etc.) are genuinely ahead of most peers — but agentic AI is NEW and evolving, and the headline figures (e.g. ~5,000 SOC hours saved/year) are Abnormal’s/analyst claims that depend on your environment and volume. Deploy them thoughtfully with oversight, and validate the savings for your case. TechBag helps you adopt the agents with the right guardrails.
Missing the India R&D story (and residency question)
Abnormal’s largest R&D office outside San Francisco is in BENGALURU — genuine India relevance and engineering depth, a real credibility point often overlooked. On the flip side, for regulated deployments, data-residency requirements (DPDPA) should be confirmed with the vendor — don’t assume. TechBag surfaces both: the India R&D story, and the residency confirmation, and handles GST.
The evaluation kit
The flagship intel page carries an 8-question vendor checklist and an automation-savings calculator:
Skip the homework entirely
Bring your device counts and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: autonomous AI in the SOC and AI governance compound fastest — exactly where Abnormal (AI Security Agents, the 2026 platform) is placed.
AI-native / behavioural email security (ICES)
The biggest shift in email security is from signature-based gateways to AI-native, behavioural, API-based ICES that catch the social engineering gateways miss.
What it means for you
Abnormal pioneered AI-native behavioural ICES — its Attune engine catches the BEC and social engineering that signature tools miss, deploying in minutes via API.
Autonomous AI in the SOC
AI is moving from assisting analysts to acting autonomously — triaging, remediating and coaching — handling the alert volume humans can’t.
What it means for you
Abnormal’s AI Security Agents (AI Security Mailbox, Phishing Coach) autonomously automate first-line SOC work — Forrester cited ~5,000 analyst hours saved/year.
Behavioural security beyond email
Behavioural detection is expanding from email to identity, AI usage and insider/infiltration threats — wherever human (and synthetic) behaviour can be modelled.
What it means for you
Abnormal’s 2026 platform (identity threat, AI governance, infiltration prevention) extends its one behavioural model across the human attack surface.
Layering on Microsoft/Google (augment native)
Organisations increasingly LAYER modern behavioural security onto their existing Microsoft 365 / Google native security via API — augmenting rather than ripping out.
What it means for you
Abnormal’s API/post-delivery model layers cleanly onto native security (augment or replace the gateway), deploying in minutes with no MX change.
AI governance / shadow AI
As employees adopt AI tools everywhere, organisations need to discover and govern the AI (sanctioned and shadow) used across the business.
What it means for you
Abnormal’s 2026 AI Governance discovers, scores and governs the AI tools and agents across your org — behavioural security for the AI era.
AI email security & India
Indian enterprises (mostly on M365/Google) face rising BEC/VEC and are adopting AI-native email security — and value vendors with real India engineering.
What it means for you
Abnormal layers on M365/Google cleanly, catches the BEC/VEC hitting Indian businesses, and has its largest R&D office outside SF in Bengaluru — with TechBag adding the local layer.
Questions buyers ask about Abnormal AI
Ready to shortlist Abnormal AI?
Open any of the five intel pages for the deep dive, or let a TechBag advisor build the case with you — mailbox scoping, augment-vs-replace advice, honest Proofpoint/Microsoft comparison, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.