Abnormal AI

What is Abnormal AI?

Abnormal AI is an enterprise behavioral security platform. It connects communication and identity activity, learns patterns associated with employees and vendors, and uses deviations to help security teams identify threats and respond.

Email and identity protection share a behavioral engine and investigation context. AI Governance adds an inventory of approved and shadow AI tools, their users and access, spending, and compliance evidence. Access to newer AI security products depends on each product's release stage.

What can Abnormal AI do?

Behavioral detection

Attune analyzes identity, behavior, and content together to identify suspicious changes rather than relying only on known signatures.

Email investigation and response

Review suspicious messages with signal explanations, search connected mail environments, and apply supported remediation and quarantine controls.

Identity context

Correlate sign-in, device, mail, and related activity when assessing possible account compromise or risky access.

AI Governance

Discover AI tools through connected email, identity, and OAuth signals, then review ownership, permissions, cost, and approval evidence.

Use Cases

“Investigate email fraud”

Assess suspected impersonation, phishing, or vendor fraud with the surrounding communication and identity context.

“Review compromised accounts”

Connect suspicious access with account behavior and evaluate the response actions supported in that environment.

“Manage AI adoption”

Identify unsanctioned tools and bring access, spending, and policy evidence into a recorded approval process.

Frequently Asked Questions

Are all AI security products generally available?

AI Governance is generally available. AI Cloud Security offers priority purchasing and production access to selected customers. AI Agent Security, AI Employee Guardrails, and AI Security Workbench are in the Design Partner evaluation stage; their general availability is upcoming.

How is the platform purchased?

Work with sales to select the products and subscription scope. Fees and term length are specified in the customer order. Standard Cloud Terms provide for renewal unless non-renewal notice is given at least 30 days before the term ends; negotiated terms may differ.

Does email deployment require MX changes?

The email deployment is API-based and is described as requiring no MX changes. Connected systems, permissions, and enabled products determine the available controls.

What data does it process?

The service processes message content, attachments, user information, and activity records under the customer agreement. Standard Cloud Terms allow customer-specific model training and de-identified shared detection learnings. They prohibit using Customer Data to train third-party LLMs or models federated across the customer base.

Do anomaly verdicts prove an attack?

Anomaly determinations indicate a possibility or likelihood of risk. Your organization remains responsible for the actions it takes, including its automatic-remediation configuration. Review the evidence and set response controls for your environment.

Are there regional licensing restrictions?

Standard Cloud Terms prohibit exporting or transferring the service to China or sanctions targets. Eligibility and use are subject to applicable export laws and the customer agreement.

Abnormal AI Alternatives

Nightfall

nightfall.ai

Data loss prevention for security teams governing data across AI, endpoints, SaaS, and email.

Pomerium

www.pomerium.com

Pomerium is a zero-trust, identity-aware proxy that provides clientless access to web applications and critical workloads without a VPN. It helps security, development, and operations teams authenticate, authorize, and audit requests across human, machine, and agentic identities.