Abnormal AI
The AI-native behavioural security company — it catches the socially-engineered attacks (BEC, phishing, VEC) that gateways miss, using behavioural AI, and is expanding beyond email to identity & AI governance. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Five intel pages. One behavioural model.
The complete Abnormal AI platform — every linked card is a full intel page, from the email-security flagship to the 2026 behavioral platform.
Inbound Email Security
Catch what gateways miss.
Behavioural AI stops the BEC, credential phishing and account takeover gateways miss; via API, no MX change, live in minutes.
Account Takeover Protection
Catch the breached account.
Detects already-compromised internal accounts from unusual logins, mail-rule changes and lateral movement, then auto-remediates.
AI Security Agents
AI co-workers for your SOC.
Autonomous SOC agents: AI Security Mailbox triages reported mail 24/7 (Forrester cited ~5,000 hours saved a year) and a Phishing Coach.
Email Productivity & Posture
Cleaner, safer, better-configured.
Three capabilities on the same behavioural model: graymail removal, email posture management and misdirected-email prevention.
Behavioral Platform
Beyond email — one model.
Launched Aug 3, 2026: the behavioural model beyond email, with Identity Threat Protection, AI Governance and Infiltration Prevention.
Attune engine
Platform & engineAbnormal’s one behavioural AI engine: it models identity, behaviour and relationships to spot attacks, and powers every product.
From Abnormal Security to Abnormal AI
Platform & engineThe 2025 rebrand: an AI-native platform reaching past email into AI security agents and identity protection, newer parts still evolving.
Abnormal AI sells across 2 of the products TechBag carries in security. The Security guide shows how the category splits and which part is yours. →
Why “behavioural AI, catch what gateways miss” is the whole story
Signature-based gateways miss the payload-less social engineering that causes the biggest losses. Abnormal bet on behavioural AI that models normal and flags the anomalies gateways can’t catch — API-integrated in minutes and layered on top of Microsoft and Google native security.
Behavioural AI (Attune)
Attune models the normal behaviour of every identity and relationship and flags anomalies, catching the BEC and impersonation that signature tools miss: Abnormal’s moat.
API-Native (ICES)
API integration with Microsoft 365 / Google Workspace: live in minutes, no MX change, analysing mail post-delivery. It augments native security or replaces the gateway.
Catch What Others Miss
Abnormal catches the BEC, phishing, account takeover and VEC that gateways and native defences let through, with high efficacy and low false positives.
Autonomous AI & the Platform
Autonomous AI security agents automate SOC triage and remediation; the 2026 platform extends the same behavioural model to identity threat, AI governance and infiltration.
Fast-Growing & India-Rooted
~$200M ARR at 100% YoY and a $5.1B 2024 valuation, with its largest R&D office outside SF in Bengaluru. It’s quote-priced and billed in INR/GST through TechBag.
Start with Inbound Email Security (catch what your gateway misses) — then add Account Takeover Protection, AI Security Agents, Email Productivity & Posture, and the 2026 Behavioral Platform. One behavioural model.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
AI-native behavioural
Attune — not signatures
Catch what gateways miss
BEC, VEC, phishing
API — minutes, no MX
Layer on M365/Google
AI Security Agents
~5,000 SOC hrs/yr saved
2018 · San Francisco
CEO Evan Reiser
~$200M ARR (100% YoY)
$5.1B valuation (2024)
3,000+ customers
~1 in 5 Fortune 500
Bengaluru
Largest office outside SF
The company in six figures
See the platform, hear the pitch
An Abnormal Approach to Email Security
The behavioural approach, explained.
Inbound Email Security — Product Demo
The flagship, walked through.
Where Abnormal AI sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Abnormal AI Across Its Platform
Each dot is an Abnormal angle: competitive position vs category momentum.
The flagship — behavioural AI ICES.
The Behavioural-Detection × Deploy-Speed Map
Behavioural detection & deploy speed vs the field — where Abnormal catches what gateways miss.
AI-native behavioural; catches what gateways miss.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Abnormal AI?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What’s your priority?
2. Which sentence sounds most like you?
3. What does success look like?
What is Abnormal Inbound Email Security?
AI-native behavioural email security that catches the BEC gateways miss, deployed in minutes via API.
Read →Behavioural AI vs signatures
Why modelling normal behaviour (Attune) catches payload-less attacks that signature-based gateways can’t.
Read →Catch the account takeover
How behavioural anomalies (odd logins, mail rules, lateral movement) reveal an already-compromised account.
Read →Autonomous AI security agents
AI Security Mailbox and Phishing Coach — autonomous agents that triage, remediate and coach, saving SOC hours.
Read →Beyond email (2026)
One behavioural model extended to identity threat, AI governance and infiltration prevention.
Read →Abnormal vs Proofpoint vs Microsoft
The honest matrix — behavioural layer (Abnormal) vs broad platform (Proofpoint) vs bundled native (Microsoft).
Read →The acronym decoder
Every term on these pages, in one place- Abnormal AI
- An AI-native behavioural security company; founded 2018, renamed from Abnormal Security in 2025.
- Behavioural AI (Attune)
- Abnormal’s engine: it models normal behaviour for each identity and relationship and flags attack anomalies.
- ICES
- Integrated Cloud Email Security: sits behind M365/Google mail via API, no MX change, post-delivery.
- BEC
- Business Email Compromise: payload-less fraud (fake invoices, CEO fraud) that signature tools miss.
- VEC
- Vendor Email Compromise: attacks through a compromised or impersonated vendor thread.
- Account Takeover (ATO)
- When an attacker takes over an internal account; Abnormal spots odd logins, mail rules and lateral movement.
- AI Security Mailbox
- An autonomous agent that triages user-reported emails 24/7, remediates campaigns and replies to reporters.
- Posture Management
- Continuous detection of risky email/M365 misconfigurations and drift; part of Email Productivity & Posture.
- Identity Threat Protection
- A 2026 capability: catch compromise in post-authentication sessions and suspicious help-desk reset requests.
- AI Governance
- A 2026 capability to discover, score and govern sanctioned and shadow AI tools and agents.
- The augment-or-replace model
- Abnormal augments Microsoft/Google native security, or replaces a legacy secure email gateway (SEG).
- The India layer
- Abnormal’s largest R&D office outside SF is in Bengaluru; TechBag supplies scoping and INR/GST.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Scope (& augment vs replace)
Your mail platform (M365/Google) and current security set the question TechBag scopes: augment native security or replace a legacy gateway?
Connect via API (minutes)
Connect Abnormal to Microsoft 365 or Google Workspace via API, with no MX change, and let Attune learn your organisation’s normal behaviour.
Catch what native misses
Abnormal flags the BEC, phishing, ATO and VEC your native or gateway security missed and auto-remediates post-delivery. Close the gap.
Automate & extend
Turn on AI Security Agents (autonomous SOC triage, ~5,000 hours saved/yr), then add Email Productivity & Posture and the 2026 behavioural platform.
Compare honestly
Need DLP, compliance or awareness training? Proofpoint. On M365 E5? Defender is bundled. Deep detection engineering? Sublime.
Buy through the channel
Abnormal is quote-priced (per mailbox, USD) — TechBag adds scoping, INR/GST invoicing, DPDPA-residency help and local support.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Inbound Email Security | Per mailbox — by quote | Behavioural detection (BEC/phishing/VEC); API deploy | Catch what gateways miss |
| Account Takeover Protection | Per mailbox / add-on — by quote | Behavioural ATO detection + remediation | Post-compromise defence |
| AI Security Agents | By quote / platform | AI Security Mailbox, Phishing Coach, Data Analyst | Autonomous SOC automation |
| Email Productivity & Posture | Add-on — by quote | Graymail, posture management, misdirected email | Hygiene, config & accidental-leak |
| Behavioral Platform (2026) | By quote (new) | Identity threat, AI governance, infiltration | Beyond-email behavioural security |
Per mailbox, quote-priced (in USD) — TechBag scopes the mailboxes, advises augment-vs-replace, compares vs Proofpoint/Microsoft, and handles INR/GST.
Five pitfalls that cost buyers quarters
Expecting a full platform (it’s email-first)
Abnormal leads at behavioural email detection but lacks Proofpoint’s DLP, archiving and awareness-training depth. If you need those, run Abnormal as a layer beside a broader platform.
Thinking it replaces your whole mail stack
Abnormal is an ICES that layers on Microsoft 365 / Google Workspace by API. It can replace a legacy gateway, but you keep your mail platform and the native security underneath it.
Overlooking explainability/customisability trade-offs
Abnormal’s global model needs little tuning, but SOC teams wanting transparent, tunable rules may find less customisability than detection-engineering rivals such as Sublime Security.
Treating the AI agents as fully proven
The agents lead most peers, but agentic AI is new and the ~5,000 SOC hours saved/year figure is a vendor/analyst claim, so validate the savings in your environment and keep oversight.
Missing the India R&D story (and residency question)
Abnormal’s largest R&D office outside San Francisco is in Bengaluru, a real credibility point. For regulated deployments, still confirm DPDPA data-residency with the vendor.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: autonomous AI in the SOC and AI governance compound fastest — exactly where Abnormal (AI Security Agents, the 2026 platform) is placed.
AI-native / behavioural email security (ICES)
The shift in email security is from signature-based gateways to AI-native, behavioural, API-based ICES.
What it means for you
Abnormal pioneered behavioural ICES: Attune catches the BEC signature tools miss.
Autonomous AI in the SOC
AI is moving from assisting analysts to acting on its own: triaging, remediating and coaching at scale.
What it means for you
Abnormal’s agents automate first-line SOC work; Forrester cited ~5,000 hours saved/year.
Behavioural security beyond email
Behavioural detection is spreading from email to identity, AI usage and insider threats.
What it means for you
Abnormal’s 2026 platform extends its behavioural model to identity and AI governance.
Layering on Microsoft/Google (augment native)
Organisations increasingly layer behavioural security onto native Microsoft 365 / Google security via API.
What it means for you
Abnormal layers onto native security via API, deploying in minutes with no MX change.
AI governance / shadow AI
As employees adopt AI tools everywhere, organisations must discover and govern sanctioned and shadow AI.
What it means for you
Abnormal’s 2026 AI Governance discovers, scores and governs your AI tools and agents.
AI email security & India
Indian enterprises, mostly on M365/Google, face rising BEC/VEC and value vendors with real India engineering.
What it means for you
Abnormal stops the BEC/VEC hitting India; its largest non-SF R&D office is in Bengaluru.
Questions buyers ask about Abnormal AI
Ready to shortlist Abnormal AI?
Open any of the five intel pages for the deep dive, or let a TechBag advisor build the case with you — mailbox scoping, augment-vs-replace advice, honest Proofpoint/Microsoft comparison, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.