chat
expand_more

How Does Abnormal Security Address Cloud Email Attacks?

Cybersecurity expert Ed Amoroso explains how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email.
March 10, 2023

This article is the fourth in a five-part series from Ed Amoroso at TAG Cyber. You can read part one here, part two here, and part three here.


Using innovative security platforms to reduce the risk of email threats is no longer optional. Rather, modern email security solutions are a mandatory component of all protection architectures. This is not to say that complementary options such as procedural controls and security awareness are ineffective, but the intensity and velocity of inbound email attacks have increased to the point where sophisticated technology solutions must be engaged.

In this article, we explain how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email. We explain the platform and provide an overview of salient aspects of the offering, including how behavioral AI and API integrations offer unique value for enterprise buyers.

How Does the Abnormal Security Platform Work?

The cybersecurity platform from Abnormal Security leverages artificial intelligence (AI) to detect the presence of fraud or other attacks in enterprise email systems. The platform works by collecting and analyzing data from identities and their email communications for the purpose of making decisions—as with any AI system—which in this case, focuses on whether a threat is present in the communications.

Abnormal analyzes key information including:

  • Sender Identity – This has always been an important consideration in email security, but advanced AI can leverage more data and better algorithms to make determinations about the integrity of the sender.

  • Message Contents – This has also been a critical aspect of email security systems for many years, but as malicious email content has become more complex and contextual, the AI in the Abnormal platform can make better determinations related to security. This is especially true for text-based emails that have no typical indicators of compromise, as is often the case with socially-engineered attacks.

  • Attachments and Links – The attachments and links included in any email must be viewed as potentially dangerous, especially links to websites that could include malware or other threats to the recipient or recipient’s organization. Abnormal takes this a step further by understanding where second-stage links direct and the potential malicious nature of them.

The Abnormal platform uses a web of prediction models—including natural language processing (NLP), natural language understanding (NLU), computer vision, BERT Large Language Model (LLM), and more—to detect suspicious activity through analyses of topic, tone, sentiment, behavior, content, and more. In fact, Abnormal uses over 40,000 signals to identify and remediate malicious messages.

The solution also analyzes and understands the communication behavior of every identity for every customer to develop user-specific profiles. With this information, Abnormal can build a baseline of known-good behavior, which it then leverages to detect attacks by identifying unusual activity that deviates from the known baseline.

How is the Abnormal Security Platform Deployed?

The cloud-based platform can be natively integrated with the cloud email services in use at the enterprise—either Microsoft 365 or Google Workspace. The connection is done via Microsoft or Google APIs. This is different from a traditional SEG approach as it requires no email rerouting (changes to MX records), deploying quickly with no interruption to email flow.

TAG Cyber Abnormal Security Deployment

Abnormal Security deployment to cloud service infrastructure

The Abnormal solution triages, remediates, and builds a repository of email detections available to third-party solutions like SIEM, SOAR, and XDR platforms. This includes the results of analyses performed on user-reported phishing emails through Abuse Mailbox or potentially compromised email accounts identified by Account Takeover Protection.

This interoperability increases the visibility and fidelity of events identified across the security stack, helping security teams better understand potential threats—and reducing response times as well as time spent on the investigation.

Customers can leverage out-of-the-box integrations to platforms, such as Splunk, QRadar, Microsoft Sentinel, Cortex XSOAR, Okta, and many more. The Abnormal platform also offers REST APIs, allowing customers to build custom integrations with any third-party solution.

How Does Abnormal Leverage APIs and AI to Help Your Organization?

Abnormal's API integrations with cloud email platforms grant the solution complete visibility into both external and internal email flow within the organization. This enables a better understanding of internal email patterns and contextual signals, which is crucial for detecting and addressing modern attacks that frequently originate from within the organization.

Combining the insights provided by this API integration with the powerful AI outlined above allows Abnormal to help organizations simplify email security, streamline operations, and prevent email attacks with the highest efficacy.

In the final post in this series, we discuss the future of email security, including important trends to be aware of as you work on securing your cloud email environment.

See for yourself how Abnormal leverages behavioral AI to protect your organization from the full spectrum of email attacks. Schedule a demo today.

Schedule a Demo
How Does Abnormal Security Address Cloud Email Attacks?

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B Proofpoint Customer Story F500 Insurance Provider
A Fortune 500 insurance provider blocked 6,454 missed attacks and saved 341 SOC hours per month by adding Abnormal to address gaps left by Proofpoint.
Read More
B Malicious AI Platforms Blog
What happened to WormGPT? Discover how AI tools like WormGPT changed cybercrime, why they vanished, and what cybercriminals are using now.
Read More
B MKT748 Open Graph Images for Cyber Savvy 7
Explore insights from Brian Markham, CISO at EAB, as he discusses cybersecurity challenges, building trust in education, adapting to AI threats, and his goals for the future. Learn how he and his team are working to make education smarter while prioritizing data security.
Read More
B Manufacturing Industry Attack Trends Blog
New data shows a surge in advanced email attacks on manufacturing organizations. Explore our research on this alarming trend.
Read More
B Dropbox Open Enrollment Attack Blog
Discover how Dropbox was exploited in a sophisticated phishing attack that leveraged AiTM tactics to steal credentials during the open enrollment period.
Read More
B AISOC
Discover how AI is transforming security operation centers by reducing noise, enhancing clarity, and empowering analysts with enriched data for faster threat detection and response.
Read More