I'm a Cyber Security Engineer at a medium size financial services company. Our motive for using Abnormal Security is to defend our Microsoft 365 tenant against sophisticated phishing and Business Email Compromise (BEC) attacks, as well as vendor impersonation attacks, that our normal Secure Email Gateway (SEG) could not defend against. Our SOC team also uses its automated remediation capabilities to deal with the huge volume of emails that are reported to them with suspicious content.The best thing about Abnormal is the deployment itself is so simple. Since it integrates directly using Microsoft 365 APIs rather than needing intricate MX record modifications, it was up and running in our environment in just a matter of moments. The AI engine's ability to grasp the nuances of communication and To ensure the proper setting for what's considered the norm in employee performance is extremely precise. Commonly discovers highly advanced attacks and forgery of vendor invoices with no visible malicious links or attachments. Prior to Abnormal, at least half of a security analyst's day would be spent manually examining reported email or ramping through their inboxes, one by one. With the platform's auto-remediation, though, nearly all of that is done in the background, and that's a giant timesaver for our small team. It is indeed a high dollar solution to use Abnormal Security versus traditional email security, but for our team, the ROI has been 100% worth it. The per-mailbox pricing model seemed like a bit of an "up front investment" for a medium size user base. This combination of user-provided policy and the overwhelming number of engineering hours our SOC analysts put in taking care of user-reported phishing tickets weekly makes the platform self-funding not just in recovered productivity, but in recovered time. Most important of all, denying one costly vendor scam or bogus wire transfer message eradicates the entire yearly position. Automation and risk reduction are worth a lot for asecurity team faced with heavy workload and members who can't keep up with threats in their inbox all day.

As a SOC analyst, user-initiated phishing reports and account takeover detection take a lot of time to process, and I spend the whole shift looking at them. In my opinion, the most attractive feature of Abnormal AI is the speed of detection of Microsoft 365 account compromise compared to traditional secure email gateways. The software was installed via API for Microsoft 365 or Google Workspace, so it did not require much time and did not affect the mail delivery in any way. The dashboard named Threat Log allows me to get more information about the suspicious email activity, including details of the detected attack vectors, and the specific vendors involved in the incident. The automation of response to detected threats by removing the suspicious email from all the user’s inboxes or downing the compromised account significantly reduces the workload compared to using only PowerShell to remove the emails. Additionally, I find the ability to track all the user-initiated phishing reports and automatically reply to them helpful, as it saves a lot of time on ticketing and closing the incidents that do not require any further action.

Abnormal AI delivers comprehensive threat analysis; in my case, it inspects every email flow that reaches users’ inboxes and helps us prevent potential threats to our business email infrastructure. The Threat Log overview is easy for IT officers to use and understand, and it provides clear triage so we can quickly grasp the tactics and adversaries trying to target our collaborators and infiltrate the organization.