Introducing CrowdStrike + Abnormal: New Partnership Delivers Joint AI-Based Threat Detection and Response

The new bi-directional integration between Abnormal and CrowdStrike’s solutions helps security teams correlate meaningful events across identity, endpoint, and email solutions, and respond quickly to incidents in progress.
March 29, 2023

Email and endpoint devices are two of the biggest attack entry points contributing to cybercrime loss. Attackers are continuously evolving their tactics to compromise these two entry points, launching sophisticated socially-engineered email attacks and account takeovers that are often so convincing they evade traditional email security detection approaches.

Socially-engineered business email compromise attacks have accounted for over $43B in exposed losses since 2016 and continue to grow, with $2.7 billion in actual losses last year alone.

Rapid detection and response are critical, but security teams too often deal with a sprawl of point solutions that aren’t well integrated. This forces them to either spend precious time and resources on manually sifting through and understanding large volumes of security data or to find ways to integrate the systems themselves.

To solve this problem, we’re excited to announce that Abnormal and CrowdStrike are entering into a strategic partnership to deliver a turnkey solution that gives joint customers more comprehensive protection against both email and endpoint attacks.

The initial bi-directional integration between Abnormal’s Email Account Takeover Protection and CrowdStrike’s Identity Threat Protection products helps security teams correlate meaningful events across identity, endpoint, and email solutions, and respond quickly to incidents in progress. It’s the first step we’re taking on our shared mission to provide customers with better protection while reducing security spend and increasing operational productivity—and it’s available now.

To learn more about the strategic partnership, watch this video with Abnormal CEO Evan Reiser and CrowdStrike President Mike Sentonas.

Why the CrowdStrike + Abnormal Integration is Unique

In speaking with security teams while we were developing this integration, we heard that many technology integrations fall short of their full potential. In most cases, they share a large amount of data without providing the context and correlation that would help security analysts separate signal from noise. With this in mind, we wanted to be sure that our integration with CrowdStrike did not fall into this familiar trap.

The Abnormal platform is built to ingest signals from diverse sources to have the most comprehensive understanding of the behavior of every identity in an organization. The enriched context allows our platform to precisely detect anomalies and block attacks. And when it comes to endpoint telemetry and correlating this data against user behavior, CrowdStrike is unmatched. It made sense technologically—and for the benefit of our customers—to combine CrowdStrike's high-fidelity signals into the Abnormal platform to better protect against email threats and vice versa.

Both CrowdStrike and Abnormal are leveraging the power of machine learning to flag anomaly detections based on normal behavioral patterns. This is a fundamentally different approach than traditional email security integrations that focus on sharing data about known indicators of compromise (IoCs), which often evade detection because they’re constantly changing as cybercriminals evolve their tactics. Because Abnormal can detect attacks without these known bad signals, this technology integration will enable customers to swiftly discover and remediate compromised email accounts and endpoints, even as threat actors continue to become more sophisticated in their techniques.

Now when CrowdStrike detects a risk, it creates an account takeover case within the Abnormal platform. Security analysts can then quickly remediate the email account by logging users out, terminating the session, or forcing a password reset.

Crowd Strike Abnormal Integration Example 1

In the other direction, when Abnormal detects that an email account has been compromised, it automatically sends a signal to CrowdStrike’s Identity Protection platform. The account will then be added to a Watched Users list, which can be configured to allow analysts to contain hosts or force reauthentication on an endpoint device.

Crowd Strike Abnormal Integration Example 2

To see how it works, watch the product demo.

What Customers are Saying

The market need for such a solution like this is evidenced by the insights of industry experts. In the recent Market Guide for Email Security, Gartner recommends security leaders “prioritize the integration of email events into a broader XDR platform” for better protection”

We’re fortunate to have shared customers who helped us build this technology integration to best suit their teams’ needs. Here’s what they had to say about the potential ahead for Abnormal and CrowdStrike.

"Comfort Systems USA builds, supports and maintains our customers’ most critical building systems. I'm excited to see Abnormal and CrowdStrike working together to protect our employees against the types of attacks traditional solutions often fail to detect. With the ability to correlate user behavior events across endpoints, email, and authentication sources, our security team can quickly uncover account takeover attacks and take preventative measures."
Christopher Chambers, Vice President of Information Security, Comfort Systems USA
“The enhanced, integrated offerings from CrowdStrike and Abnormal further strengthen our security infrastructure and quickly orchestrate responses. These solutions provide enhanced protection for our organization as well as significant time savings and process efficiencies.”
Drew Robertson, Chief Information Security Officer, Finance of America Companies

What’s Next for CrowdStrike and Abnormal

This initial integration is the first step in a long-term partnership. As a new member of the CrowdXDR Alliance, we’ll be working to bring an XDR integration to market in the months ahead.

To learn more and request a demo of the current integration, visit the CrowdStrike partnership page here.

Request an Integration
Introducing CrowdStrike + Abnormal: New Partnership Delivers Joint AI-Based Threat Detection and Response

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.


See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

Integrates Insights Reporting 09 08 22

Related Posts

B travelscams
Cybercriminals exploit stolen financial data to offer consumers heavily discounted travel deals. Learn how these email scams work and tips to avoid falling victim to them this summer travel season.
Read More
B Earn Your CPE Credits with Abnormal
Earn your continuing education credits with ISC2 by viewing cybersecurity content from Abnormal Security.
Read More
B Seg Lessons
Discover key insights gleaned from replacing 100+ SEGs for Abnormal customers.
Read More
B Europe Attack Data Blog
Discover what our research uncovered about the European threat landscape and attack trends for organizations in the region.
Read More
Abnormal aims to provide superior detection of email attacks while also directly and indirectly influencing the security awareness of your employees.
Read More
B 6 3 24 BEC Attacks
Discover how cybercriminals obtain corporate data from brokers like ZoomInfo and Apollo to enable targeted business email compromise (BEC) attacks.
Read More