How Does Abnormal Security Address Cloud Email Attacks?

Cybersecurity expert Ed Amoroso explains how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email.
March 10, 2023

This article is the fourth in a five-part series from Ed Amoroso at TAG Cyber. You can read part one here, part two here, and part three here.

Using innovative security platforms to reduce the risk of email threats is no longer optional. Rather, modern email security solutions are a mandatory component of all protection architectures. This is not to say that complementary options such as procedural controls and security awareness are ineffective, but the intensity and velocity of inbound email attacks have increased to the point where sophisticated technology solutions must be engaged.

In this article, we explain how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email. We explain the platform and provide an overview of salient aspects of the offering, including how behavioral AI and API integrations offer unique value for enterprise buyers.

How Does the Abnormal Security Platform Work?

The cybersecurity platform from Abnormal Security leverages artificial intelligence (AI) to detect the presence of fraud or other attacks in enterprise email systems. The platform works by collecting and analyzing data from identities and their email communications for the purpose of making decisions—as with any AI system—which in this case, focuses on whether a threat is present in the communications.

Abnormal analyzes key information including:

  • Sender Identity – This has always been an important consideration in email security, but advanced AI can leverage more data and better algorithms to make determinations about the integrity of the sender.

  • Message Contents – This has also been a critical aspect of email security systems for many years, but as malicious email content has become more complex and contextual, the AI in the Abnormal platform can make better determinations related to security. This is especially true for text-based emails that have no typical indicators of compromise, as is often the case with socially-engineered attacks.

  • Attachments and Links – The attachments and links included in any email must be viewed as potentially dangerous, especially links to websites that could include malware or other threats to the recipient or recipient’s organization. Abnormal takes this a step further by understanding where second-stage links direct and the potential malicious nature of them.

The Abnormal platform uses a web of prediction models—including natural language processing (NLP), natural language understanding (NLU), computer vision, BERT Large Language Model (LLM), and more—to detect suspicious activity through analyses of topic, tone, sentiment, behavior, content, and more. In fact, Abnormal uses over 40,000 signals to identify and remediate malicious messages.

The solution also analyzes and understands the communication behavior of every identity for every customer to develop user-specific profiles. With this information, Abnormal can build a baseline of known-good behavior, which it then leverages to detect attacks by identifying unusual activity that deviates from the known baseline.

How is the Abnormal Security Platform Deployed?

The cloud-based platform can be natively integrated with the cloud email services in use at the enterprise—either Microsoft 365 or Google Workspace. The connection is done via Microsoft or Google APIs. This is different from a traditional SEG approach as it requires no email rerouting (changes to MX records), deploying quickly with no interruption to email flow.

TAG Cyber Abnormal Security Deployment

Abnormal Security deployment to cloud service infrastructure

The Abnormal solution triages, remediates, and builds a repository of email detections available to third-party solutions like SIEM, SOAR, and XDR platforms. This includes the results of analyses performed on user-reported phishing emails through Abuse Mailbox or potentially compromised email accounts identified by Account Takeover Protection.

This interoperability increases the visibility and fidelity of events identified across the security stack, helping security teams better understand potential threats—and reducing response times as well as time spent on the investigation.

Customers can leverage out-of-the-box integrations to platforms, such as Splunk, QRadar, Microsoft Sentinel, Cortex XSOAR, Okta, and many more. The Abnormal platform also offers REST APIs, allowing customers to build custom integrations with any third-party solution.

How Does Abnormal Leverage APIs and AI to Help Your Organization?

Abnormal's API integrations with cloud email platforms grant the solution complete visibility into both external and internal email flow within the organization. This enables a better understanding of internal email patterns and contextual signals, which is crucial for detecting and addressing modern attacks that frequently originate from within the organization.

Combining the insights provided by this API integration with the powerful AI outlined above allows Abnormal to help organizations simplify email security, streamline operations, and prevent email attacks with the highest efficacy.

In the final post in this series, we discuss the future of email security, including important trends to be aware of as you work on securing your cloud email environment.

See for yourself how Abnormal leverages behavioral AI to protect your organization from the full spectrum of email attacks. Schedule a demo today.

Schedule a Demo
How Does Abnormal Security Address Cloud Email Attacks?

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.


See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

Integrates Insights Reporting 09 08 22

Related Posts

B Earn Your CPE Credits with Abnormal
Earn your continuing education credits with ISC2 by viewing cybersecurity content from Abnormal Security.
Read More
B Seg Lessons
Discover key insights gleaned from replacing 100+ SEGs for Abnormal customers.
Read More
B Europe Attack Data Blog
Discover what our research uncovered about the European threat landscape and attack trends for organizations in the region.
Read More
Abnormal aims to provide superior detection of email attacks while also directly and indirectly influencing the security awareness of your employees.
Read More
B 6 3 24 BEC Attacks
Discover how cybercriminals obtain corporate data from brokers like ZoomInfo and Apollo to enable targeted business email compromise (BEC) attacks.
Read More
B Addressing Account Takeovers Blog
Discover how security leaders are protecting their organizations against account takeover with insights from our survey of 300 cybersecurity stakeholders.
Read More