What do users say about Abnormal AI?

I find Abnormal AI fairly frictionless. It doesn’t require me to go through a lot of extra steps or slow me down, and I feel like it provides the protection we need while keeping things easy for the user. It keeps my inbox clean and makes it easy to find a message if it was incorrectly flagged. I like that it uses AI to look at what’s normal and abnormal instead of just following rules. I also find it simpler and easier to use, and it integrates well with Microsoft Outlook and Azure. Review collected by and hosted on G2.com.

I still find quite a few legitimate emails in my promotions folder, so I think Abnormal AI could do a better job of recognizing good emails. I believe it is supposed to learn when I move something back into my inbox. Setup wasn’t too bad, but we ran into some problems and didn’t get immediate support from the team. We had to wait, so the rollout wasn’t as smooth as it could have been. Review collected by and hosted on G2.com.

Abnormal AI delivers comprehensive threat analysis; in my case, it inspects every email flow that reaches users’ inboxes and helps us prevent potential threats to our business email infrastructure. The Threat Log overview is easy for IT officers to use and understand, and it provides clear triage so we can quickly grasp the tactics and adversaries trying to target our collaborators and infiltrate the organization. Review collected by and hosted on G2.com.

At the moment, we don’t have any complaints about it. Review collected by and hosted on G2.com.

I appreciate the fact that it sorts your emails based on your preferences. This feature keeps my inbox cleaned up while allowing me to look at less pertinent emails easily and on my own time. Review collected by and hosted on G2.com.

It can be a distraction when it sorts emails into folders. For a split second, all emails show up in my main inbox before disappearing to their sorted folders. It takes some getting used to, and even at that it can be annoying. Review collected by and hosted on G2.com.

I'm a Cyber Security Engineer at a medium size financial services company. Our motive for using Abnormal Security is to defend our Microsoft 365 tenant against sophisticated phishing and Business Email Compromise (BEC) attacks, as well as vendor impersonation attacks, that our normal Secure Email Gateway (SEG) could not defend against. Our SOC team also uses its automated remediation capabilities to deal with the huge volume of emails that are reported to them with suspicious content.The best thing about Abnormal is the deployment itself is so simple. Since it integrates directly using Microsoft 365 APIs rather than needing intricate MX record modifications, it was up and running in our environment in just a matter of moments. The AI engine's ability to grasp the nuances of communication and To ensure the proper setting for what's considered the norm in employee performance is extremely precise. Commonly discovers highly advanced attacks and forgery of vendor invoices with no visible malicious links or attachments. Prior to Abnormal, at least half of a security analyst's day would be spent manually examining reported email or ramping through their inboxes, one by one. With the platform's auto-remediation, though, nearly all of that is done in the background, and that's a giant timesaver for our small team. It is indeed a high dollar solution to use Abnormal Security versus traditional email security, but for our team, the ROI has been 100% worth it. The per-mailbox pricing model seemed like a bit of an "up front investment" for a medium size user base. This combination of user-provided policy and the overwhelming number of engineering hours our SOC analysts put in taking care of user-reported phishing tickets weekly makes the platform self-funding not just in recovered productivity, but in recovered time. Most important of all, denying one costly vendor scam or bogus wire transfer message eradicates the entire yearly position. Automation and risk reduction are worth a lot for asecurity team faced with heavy workload and members who can't keep up with threats in their inbox all day. Review collected by and hosted on G2.com.

Abnormal works through the API (asynchronously, not within the mail flow itself as a traditional gateway would be) so scanning processes are not synchronous. This implies a malicious e-mail will appear in a user's inbox for a few seconds in between the AI system analyzing it and retriving it. There's a very fine margin for error if someone is focused on their inbox and presses the keys really rapidly. Also, there are instances when the system is a bit too strong in money related emails; it may mistake for example a genuine invoice or a message from a collaborator for ‘graymail' and perhaps even ‘potential threat'. Succumbing to these false positives takes some time as it isn't always readily possible to just whitelist a trusted domain without a bit of a hoop-jumping exercise. Review collected by and hosted on G2.com.

As a SOC analyst, user-initiated phishing reports and account takeover detection take a lot of time to process, and I spend the whole shift looking at them. In my opinion, the most attractive feature of Abnormal AI is the speed of detection of Microsoft 365 account compromise compared to traditional secure email gateways. The software was installed via API for Microsoft 365 or Google Workspace, so it did not require much time and did not affect the mail delivery in any way. The dashboard named Threat Log allows me to get more information about the suspicious email activity, including details of the detected attack vectors, and the specific vendors involved in the incident. The automation of response to detected threats by removing the suspicious email from all the user’s inboxes or downing the compromised account significantly reduces the workload compared to using only PowerShell to remove the emails. Additionally, I find the ability to track all the user-initiated phishing reports and automatically reply to them helpful, as it saves a lot of time on ticketing and closing the incidents that do not require any further action. Review collected by and hosted on G2.com.

While I find the detection engine to be very accurate, the user interface may cause some frustration when dealing with multi-step queries. For example, when I am trying to sift through a ton of information in the threat logs, my selected filters do not carry over when I open up an alert and have to navigate back. This causes me to have to re-filter what I am looking at and slows down the overall process of incident response. Review collected by and hosted on G2.com.

Abnormal Alerted us to sophisticated phishing emails, business email compromise, and account takeover attempts. Instead of relying on rules to detect email threats, its behavioral AI analyzes how people and systems communicate and behave to uncover suspicious emails. We also had better visibility into why an email was flagged, which was valuable during our security investigation and response efforts. Review collected by and hosted on G2.com.

Performs well once configured. The Abnormal platform works well for securing enterprise email, however it takes time to learn how it detects threats and properly tune it to meet your organization's needs. Your security team may require a learning curve when integrating with your incident response processes. Review collected by and hosted on G2.com.

I like that Abnormal AI is intuitive and user-friendly for operators, offering efficiency and good value for corporations. It efficiently protects incoming and outgoing mail and helps us respond to potential attacks in time; since we started using it, we haven't had any attacks materialize in the company. I also value the training campaigns to better train users and that 365 helps us manage cases when doubts arise. I am happy with the product and the improvements they are making. The initial setup was very quick, and the pre-sales commercial team was very friendly. Review collected by and hosted on G2.com.

Perhaps the training courses could be adapted to the language of the place where the service is contracted. I also think they could improve the artificial intelligence videos and the language of the training emails. Review collected by and hosted on G2.com.

It easily integrates with Office 365, is very good at identifying threats, spam, phishing scams, and other threats, Review collected by and hosted on G2.com.

I wish there was the ability to implement custom graymail categories for smart filtering. Currently there only exists "Promotional", however it would be nice to add additional categories if we wanted, ie social media, etc. Review collected by and hosted on G2.com.

I like the ease of use of Abnormal AI and how it provides alerts when it monitors and finds something unusual in our environment. I also appreciate that it is not information intensive; we only need to provide minimal information initially, and it quickly learns and adapts to our environment. The initial setup was almost too easy, and I was pleased that nothing went wrong during the process. Review collected by and hosted on G2.com.

I find setting up the UI a bit cumbersome and it takes effort to get the dashboards to show the information I need. Review collected by and hosted on G2.com.

I like that Abnormal AI allows smaller teams to manage threats with a more hands-off approach, saving time tuning models and reviewing phishing reports. The AI security mailbox is quite good, as we can direct reports there without our internal SOC intervention, saving us invaluable time. Integrating with KnowBe4's PAB and directing reports to the AI security mailbox allows users to report potentially malicious or spam emails for another analysis. I also appreciate the integrations with Rapid7 and Entra, which help detect account takeovers and take automated actions. The upcoming integration with Cyera will likely be invaluable. The initial setup of Abnormal AI was extremely easy. Review collected by and hosted on G2.com.

We've found that some quite basic attacks get past Abnormal AI, including BEC and VIP impersonation, which didn't happen before with Darktrace. The model improvements from the D360 team need to be more considered and holistic, as similar attacks continue to get through. Review collected by and hosted on G2.com.