chat
expand_more

How Does Abnormal Security Address Cloud Email Attacks?

Cybersecurity expert Ed Amoroso explains how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email.
March 10, 2023

This article is the fourth in a five-part series from Ed Amoroso at TAG Cyber. You can read part one here, part two here, and part three here.


Using innovative security platforms to reduce the risk of email threats is no longer optional. Rather, modern email security solutions are a mandatory component of all protection architectures. This is not to say that complementary options such as procedural controls and security awareness are ineffective, but the intensity and velocity of inbound email attacks have increased to the point where sophisticated technology solutions must be engaged.

In this article, we explain how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email. We explain the platform and provide an overview of salient aspects of the offering, including how behavioral AI and API integrations offer unique value for enterprise buyers.

How Does the Abnormal Security Platform Work?

The cybersecurity platform from Abnormal Security leverages artificial intelligence (AI) to detect the presence of fraud or other attacks in enterprise email systems. The platform works by collecting and analyzing data from identities and their email communications for the purpose of making decisions—as with any AI system—which in this case, focuses on whether a threat is present in the communications.

Abnormal analyzes key information including:

  • Sender Identity – This has always been an important consideration in email security, but advanced AI can leverage more data and better algorithms to make determinations about the integrity of the sender.

  • Message Contents – This has also been a critical aspect of email security systems for many years, but as malicious email content has become more complex and contextual, the AI in the Abnormal platform can make better determinations related to security. This is especially true for text-based emails that have no typical indicators of compromise, as is often the case with socially-engineered attacks.

  • Attachments and Links – The attachments and links included in any email must be viewed as potentially dangerous, especially links to websites that could include malware or other threats to the recipient or recipient’s organization. Abnormal takes this a step further by understanding where second-stage links direct and the potential malicious nature of them.

The Abnormal platform uses a web of prediction models—including natural language processing (NLP), natural language understanding (NLU), computer vision, BERT Large Language Model (LLM), and more—to detect suspicious activity through analyses of topic, tone, sentiment, behavior, content, and more. In fact, Abnormal uses over 40,000 signals to identify and remediate malicious messages.

The solution also analyzes and understands the communication behavior of every identity for every customer to develop user-specific profiles. With this information, Abnormal can build a baseline of known-good behavior, which it then leverages to detect attacks by identifying unusual activity that deviates from the known baseline.

How is the Abnormal Security Platform Deployed?

The cloud-based platform can be natively integrated with the cloud email services in use at the enterprise—either Microsoft 365 or Google Workspace. The connection is done via Microsoft or Google APIs. This is different from a traditional SEG approach as it requires no email rerouting (changes to MX records), deploying quickly with no interruption to email flow.

TAG Cyber Abnormal Security Deployment

Abnormal Security deployment to cloud service infrastructure

The Abnormal solution triages, remediates, and builds a repository of email detections available to third-party solutions like SIEM, SOAR, and XDR platforms. This includes the results of analyses performed on user-reported phishing emails through Abuse Mailbox or potentially compromised email accounts identified by Account Takeover Protection.

This interoperability increases the visibility and fidelity of events identified across the security stack, helping security teams better understand potential threats—and reducing response times as well as time spent on the investigation.

Customers can leverage out-of-the-box integrations to platforms, such as Splunk, QRadar, Microsoft Sentinel, Cortex XSOAR, Okta, and many more. The Abnormal platform also offers REST APIs, allowing customers to build custom integrations with any third-party solution.

How Does Abnormal Leverage APIs and AI to Help Your Organization?

Abnormal's API integrations with cloud email platforms grant the solution complete visibility into both external and internal email flow within the organization. This enables a better understanding of internal email patterns and contextual signals, which is crucial for detecting and addressing modern attacks that frequently originate from within the organization.

Combining the insights provided by this API integration with the powerful AI outlined above allows Abnormal to help organizations simplify email security, streamline operations, and prevent email attacks with the highest efficacy.

In the final post in this series, we discuss the future of email security, including important trends to be aware of as you work on securing your cloud email environment.

See for yourself how Abnormal leverages behavioral AI to protect your organization from the full spectrum of email attacks. Schedule a demo today.

Schedule a Demo
How Does Abnormal Security Address Cloud Email Attacks?

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

 
Integrates Insights Reporting 09 08 22

Related Posts

B 1500x1500 MKT468a Open Graph Images for Phishing Subjects Blog
Discover the most engaging phishing email subjects, according to Abnormal data, and how to protect your organization from these scams.
Read More
B Threat Report BEC VEC Blog
Our H1 2024 Email Threat Report revealed significant year-over-year increases in both business email compromise and vendor email compromise. Learn more.
Read More
B 2 7 24 Product Update
Abnormal product enhancements improve detection efficacy, reporting on QR code attacks, productivity, and protection from account takeover.
Read More
B 1500x1500 Quishing Stats Blog 02 05 24
Today we released our H1 2024 Email Threat Report, which examines the threat landscape and dives into the latest evolution in phishing: QR code attacks.
Read More
B 1 30 23 Microsoft ATO
A recent nation-state actor attack by the Russian-backed threat group Midnight Blizzard infiltrated Microsoft. Discover how Abnormal can protect you from account takeovers in real time.
Read More
B Look alike Domain Tactics
Learn 6 common look-alike domain tactics, some of the ways attackers use look-alike domains, and steps you can take to reduce your risk.
Read More