chat
expand_more

How Does Abnormal Security Address Cloud Email Attacks?

Cybersecurity expert Ed Amoroso explains how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email.
March 10, 2023

This article is the fourth in a five-part series from Ed Amoroso at TAG Cyber. You can read part one here, part two here, and part three here.


Using innovative security platforms to reduce the risk of email threats is no longer optional. Rather, modern email security solutions are a mandatory component of all protection architectures. This is not to say that complementary options such as procedural controls and security awareness are ineffective, but the intensity and velocity of inbound email attacks have increased to the point where sophisticated technology solutions must be engaged.

In this article, we explain how the Abnormal Security platform detects and blocks the full range of cyber threats to cloud email. We explain the platform and provide an overview of salient aspects of the offering, including how behavioral AI and API integrations offer unique value for enterprise buyers.

How Does the Abnormal Security Platform Work?

The cybersecurity platform from Abnormal Security leverages artificial intelligence (AI) to detect the presence of fraud or other attacks in enterprise email systems. The platform works by collecting and analyzing data from identities and their email communications for the purpose of making decisions—as with any AI system—which in this case, focuses on whether a threat is present in the communications.

Abnormal analyzes key information including:

  • Sender Identity – This has always been an important consideration in email security, but advanced AI can leverage more data and better algorithms to make determinations about the integrity of the sender.

  • Message Contents – This has also been a critical aspect of email security systems for many years, but as malicious email content has become more complex and contextual, the AI in the Abnormal platform can make better determinations related to security. This is especially true for text-based emails that have no typical indicators of compromise, as is often the case with socially-engineered attacks.

  • Attachments and Links – The attachments and links included in any email must be viewed as potentially dangerous, especially links to websites that could include malware or other threats to the recipient or recipient’s organization. Abnormal takes this a step further by understanding where second-stage links direct and the potential malicious nature of them.

The Abnormal platform uses a web of prediction models—including natural language processing (NLP), natural language understanding (NLU), computer vision, BERT Large Language Model (LLM), and more—to detect suspicious activity through analyses of topic, tone, sentiment, behavior, content, and more. In fact, Abnormal uses over 40,000 signals to identify and remediate malicious messages.

The solution also analyzes and understands the communication behavior of every identity for every customer to develop user-specific profiles. With this information, Abnormal can build a baseline of known-good behavior, which it then leverages to detect attacks by identifying unusual activity that deviates from the known baseline.

How is the Abnormal Security Platform Deployed?

The cloud-based platform can be natively integrated with the cloud email services in use at the enterprise—either Microsoft 365 or Google Workspace. The connection is done via Microsoft or Google APIs. This is different from a traditional SEG approach as it requires no email rerouting (changes to MX records), deploying quickly with no interruption to email flow.

TAG Cyber Abnormal Security Deployment

Abnormal Security deployment to cloud service infrastructure

The Abnormal solution triages, remediates, and builds a repository of email detections available to third-party solutions like SIEM, SOAR, and XDR platforms. This includes the results of analyses performed on user-reported phishing emails through Abuse Mailbox or potentially compromised email accounts identified by Account Takeover Protection.

This interoperability increases the visibility and fidelity of events identified across the security stack, helping security teams better understand potential threats—and reducing response times as well as time spent on the investigation.

Customers can leverage out-of-the-box integrations to platforms, such as Splunk, QRadar, Microsoft Sentinel, Cortex XSOAR, Okta, and many more. The Abnormal platform also offers REST APIs, allowing customers to build custom integrations with any third-party solution.

How Does Abnormal Leverage APIs and AI to Help Your Organization?

Abnormal's API integrations with cloud email platforms grant the solution complete visibility into both external and internal email flow within the organization. This enables a better understanding of internal email patterns and contextual signals, which is crucial for detecting and addressing modern attacks that frequently originate from within the organization.

Combining the insights provided by this API integration with the powerful AI outlined above allows Abnormal to help organizations simplify email security, streamline operations, and prevent email attacks with the highest efficacy.

In the final post in this series, we discuss the future of email security, including important trends to be aware of as you work on securing your cloud email environment.

See for yourself how Abnormal leverages behavioral AI to protect your organization from the full spectrum of email attacks. Schedule a demo today.

Schedule a Demo
How Does Abnormal Security Address Cloud Email Attacks?

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B AI Mbx Prompts
Discover how to unlock the full potential of the AI Security Mailbox with custom prompts designed to enhance your generative AI output.
Read More
B Protecting Microsoft Accounts Blog
Microsoft, with its vast user base, is a prime target for cybercriminals. Discover the top 5 attack strategies used to compromise its users and systems.
Read More
B Convergence S3 Announcement Blog
Join us for Season 3 of The Convergence of AI + Cybersecurity as we explore deepfakes, the evolving role of the SOC, and the intricacies of AI-native security.
Read More
B AISM Augmenting Customer Facing Product with AI Blog
Learn how Abnormal Security leverages large language models (LLMs) to enhance security awareness and automate SOC teams’ workflows with AI Security Mailbox.
Read More
B Education Targeted Attacks Blog
Cyberattacks on schools have surged, exposing 650K+ records in the last 60 days. As the school year begins, phishing is a key threat to students, teachers, and staff.
Read More
B Fed RAMP Announcement Blog
Abnormal is pursuing FedRAMP Moderate authorization, which enables us to empower federal agencies with AI-native email security against advanced cyber threats.
Read More