Does Abnormal replace my secure email gateway?

It can. Approximately 75% of Abnormal customers now operate with Abnormal plus Microsoft or Google native security only — no third-party SEG. Abnormal has completed 700+ successful SEG migrations. That said, the platform also works alongside your existing gateway if you prefer a layered approach during transition.

How long does deployment take, and what changes to my mail flow?

Deployment takes minutes. Abnormal connects via API to M365 or Google Workspace — no MX record changes, no transport rule modifications, no mail-flow rerouting. Your existing email infrastructure stays untouched. Most customers see value on day one.

What types of attacks does Cloud Email Security stop?

The suite covers BEC, executive impersonation, vendor email compromise, credential phishing, malware, ransomware, lateral phishing from compromised internal accounts, invoice fraud, and graymail. Abnormal also detects account takeover, M365 misconfigurations, and misdirected emails.

What happens if Abnormal blocks a legitimate email?

It happens — rarely. Detection accuracy across the platform is 99.99% (Honeywell, 188,000 attacks over 90 days). When a false positive does occur, quarantined messages are straightforward to release. The platform is designed to over-protect and give you a simple override rather than let an attack through.

How does Abnormal see attacks that my current tools miss?

Traditional tools look for known-bad indicators: malicious URLs, flagged domains, malware signatures. Modern BEC and social engineering attacks carry none of those. Abnormal takes the opposite approach — it builds a behavioral baseline for every identity and vendor, then detects deviations. That is why it catches payloadless attacks, compromised vendor emails, and internal lateral phishing that gateways structurally cannot see.

Does Abnormal replace my secure email gateway?

It can. Approximately 75% of Abnormal customers now operate with Abnormal plus Microsoft or Google native security only — no third-party SEG. Abnormal has completed 700+ successful SEG migrations. That said, the platform also works alongside your existing gateway if you prefer a layered approach during transition.

How long does deployment take, and what changes to my mail flow?

Deployment takes minutes. Abnormal connects via API to M365 or Google Workspace — no MX record changes, no transport rule modifications, no mail-flow rerouting. Your existing email infrastructure stays untouched. Most customers see value on day one.

What types of attacks does Cloud Email Security stop?

The suite covers BEC, executive impersonation, vendor email compromise, credential phishing, malware, ransomware, lateral phishing from compromised internal accounts, invoice fraud, and graymail. Abnormal also detects account takeover, M365 misconfigurations, and misdirected emails.

What happens if Abnormal blocks a legitimate email?

It happens — rarely. Detection accuracy across the platform is 99.99% (Honeywell, 188,000 attacks over 90 days). When a false positive does occur, quarantined messages are straightforward to release. The platform is designed to over-protect and give you a simple override rather than let an attack through.

How does Abnormal see attacks that my current tools miss?

Traditional tools look for known-bad indicators: malicious URLs, flagged domains, malware signatures. Modern BEC and social engineering attacks carry none of those. Abnormal takes the opposite approach — it builds a behavioral baseline for every identity and vendor, then detects deviations. That is why it catches payloadless attacks, compromised vendor emails, and internal lateral phishing that gateways structurally cannot see.

Email Security

The Modern Email Security Platform for the Era of AI

Build a behavioral model of every person and every vendor connected to your organization: catching the BEC, vendor fraud, account takeover, and AI-generated attacks legacy gateways miss. Detection that tunes itself. Deployed via API in 60 seconds.

Request a Demo

Three-year ROI in avoided BEC losses

Forrester Total Economic Impact™ Study

Advanced attacks stopped in 90 days at one Fortune 500 customer

SOC hours reclaimed annually through automated triage

Forrester Total Economic Impact™ Study

Take A Product Tour

The Challenge

Your Gateway Is Missing Critical Attacks

Wire requests from spoofed executives pass authentication

Attackers register lookalike domains or compromise real accounts to send wire transfer requests that pass every authentication check your gateway runs. Just a convincing email from what appears to be your CFO.

Compromised vendors reply inside real email threads

When a vendor account is compromised, the attacker replies inside an existing email thread with the correct context, tone, and formatting. Your gateway sees a legitimate sender, so it delivers the message straight to your finance team.

Invoice fraud arrives timed to your billing cycles

Attackers study your billing cadence and send invoices from lookalike domains at exactly the right moment. The amounts, formatting, and timing all match expectations, so accounts payable processes them without a second thought.

AI-generated phishing

Generative AI writes flawless, personalized phishing emails that match your tone, context, and language patterns. No typos. No template repetition. Nothing for a signature-based scanner to recognize.

Compromised employees allow an attack from inside your tenant

Once attackers take over an internal account, every email they send passes every authentication check — because it really is your employee's account. Your gateway can't tell the difference between a normal message and a malicious one from the same sender.

Why Abnormal

What Makes Modern Email Security Different

Built for the era of AI — and engineered to do what legacy gateways or rules-based solutions can't.

AI-Native Detection

Behavioral AI that tunes itself to your environment, every day — catching the attacks signatures and rules can't.

Visibility & Control

See every decision. Hunt across your environment. Tune detection your way — built for the modern SOC.

Complete Email Platform

Outbound protection, modern email operations, and deployment for any cloud email environment — in one console.

See What Makes Abnormal Unique

Built for the Modern Security Team

Platform Capabilities That Turn Detection Into Outcomes

Detection 360

The engine that makes Abnormal smarter every day. Submit a missed attack or false positive — Detection 360 investigates, explains the outcome, updates the models, and shows you exactly what changed.

Search & Respond

One workspace for hunting, triaging, and remediating across Microsoft 365 and Google. Search with 30+ filters, pivot natively into Detection 360, and act on findings in seconds.

Custom AI Models

Build custom detection models from email examples and natural language. Zero coding. Zero rule-writing. Test against historical messages, then deploy across your organization or to individual mailboxes.

AI Security Mailbox

Automated triage of user-reported phishing. AI Security Mailbox analyzes the report, applies the same behavioral models, responds to the user, and remediates the threat — without analyst involvement.

Email Productivity

Filter graymail before it hits inboxes. Newsletters, promotions, and bulk messages get sorted automatically — recovering thousands of employee hours per year and decluttering everyone's day.

Messaging Security

Behavioral AI for Slack, Microsoft Teams, and Zoom. Modern social engineering doesn't stop at the inbox — and neither should your protection. Same per-identity detection, every channel attackers reach.

Behavioral AI Built for the Era of GenAI

Attune is the named foundation model behind every Abnormal detection. It builds a per-identity behavioral baseline — then detects attacks by deviation from that baseline, not by matching known threat indicators. Signatures and rules need an example before they can recognize an attack. Attune doesn't. It catches novel campaigns, AI-generated attacks, and zero-payload social engineering that no rule could anticipate.

AI That Tunes AI

Most security platforms ship a model and hand the tuning to your team. Abnormal does the opposite. It combines our behavior AI with detection agents to continuously adapt to your environment — learning from every flagged message and every analyst correction — so detection gets sharper every day. Your team stops maintaining rules and starts focusing on the work only humans can do.

Glass Box, Not Black Box

Every Abnormal detection comes with the full reasoning: which signals fired, what the behavioral baseline was, and what cross-environment context strengthened the verdict. Analysts hunt across the environment with 30+ filters, pivot findings into Detection 360, and tune detection their way — using deterministic rules, AI-native models, or both. Two control surfaces. One unified console.

The Modern Email Control Plane

Email security shouldn't stop at the inbox. Abnormal extends behavioral AI to the full email lifecycle — inbound and outbound, security and operations, cloud and hybrid environments. One console on top of Microsoft and Google for unified management, outbound protection against data loss, and a guided path to retire your legacy SEG for good.