Introducing CrowdStrike + Abnormal: New Partnership Delivers Joint AI-Based Threat Detection and Response

Email and endpoint devices are two of the biggest attack entry points contributing to cybercrime loss. Attackers are continuously evolving their tactics to compromise these two entry points, launching sophisticated socially-engineered email attacks and account takeovers that are often so convincing they evade traditional email security detection approaches.

Socially-engineered business email compromise attacks have accounted for over $43B in exposed losses since 2016 and continue to grow, with $2.7 billion in actual losses last year alone.

Rapid detection and response are critical, but security teams too often deal with a sprawl of point solutions that aren’t well integrated. This forces them to either spend precious time and resources on manually sifting through and understanding large volumes of security data or to find ways to integrate the systems themselves.

To solve this problem, we’re excited to announce that Abnormal and CrowdStrike are entering into a strategic partnership to deliver a turnkey solution that gives joint customers more comprehensive protection against both email and endpoint attacks.

The initial bi-directional integration between Abnormal’s Email Account Takeover Protection and CrowdStrike’s Identity Threat Protection products helps security teams correlate meaningful events across identity, endpoint, and email solutions, and respond quickly to incidents in progress. It’s the first step we’re taking on our shared mission to provide customers with better protection while reducing security spend and increasing operational productivity—and it’s available now.

To learn more about the strategic partnership, watch this video with Abnormal CEO Evan Reiser and CrowdStrike President Mike Sentonas.

In speaking with security teams while we were developing this integration, we heard that many technology integrations fall short of their full potential. In most cases, they share a large amount of data without providing the context and correlation that would help security analysts separate signal from noise. With this in mind, we wanted to be sure that our integration with CrowdStrike did not fall into this familiar trap.

The Abnormal platform is built to ingest signals from diverse sources to have the most comprehensive understanding of the behavior of every identity in an organization. The enriched context allows our platform to precisely detect anomalies and block attacks. And when it comes to endpoint telemetry and correlating this data against user behavior, CrowdStrike is unmatched. It made sense technologically—and for the benefit of our customers—to combine CrowdStrike's high-fidelity signals into the Abnormal platform to better protect against email threats and vice versa.

Both CrowdStrike and Abnormal are leveraging the power of machine learning to flag anomaly detections based on normal behavioral patterns. This is a fundamentally different approach than traditional email security integrations that focus on sharing data about known indicators of compromise (IoCs), which often evade detection because they’re constantly changing as cybercriminals evolve their tactics. Because Abnormal can detect attacks without these known bad signals, this technology integration will enable customers to swiftly discover and remediate compromised email accounts and endpoints, even as threat actors continue to become more sophisticated in their techniques.

Now when CrowdStrike detects a risk, it creates an account takeover case within the Abnormal platform. Security analysts can then quickly remediate the email account by logging users out, terminating the session, or forcing a password reset.

In the other direction, when Abnormal detects that an email account has been compromised, it automatically sends a signal to CrowdStrike’s Identity Protection platform. The account will then be added to a Watched Users list, which can be configured to allow analysts to contain hosts or force reauthentication on an endpoint device.

To see how it works, watch the product demo.

The market need for such a solution like this is evidenced by the insights of industry experts. In the recent Market Guide for Email Security, Gartner recommends security leaders “prioritize the integration of email events into a broader XDR platform” for better protection”

We’re fortunate to have shared customers who helped us build this technology integration to best suit their teams’ needs. Here’s what they had to say about the potential ahead for Abnormal and CrowdStrike.

"Comfort Systems USA builds, supports and maintains our customers’ most critical building systems. I'm excited to see Abnormal and CrowdStrike working together to protect our employees against the types of attacks traditional solutions often fail to detect. With the ability to correlate user behavior events across endpoints, email, and authentication sources, our security team can quickly uncover account takeover attacks and take preventative measures."
—Christopher Chambers, Vice President of Information Security, Comfort Systems USA

“The enhanced, integrated offerings from CrowdStrike and Abnormal further strengthen our security infrastructure and quickly orchestrate responses. These solutions provide enhanced protection for our organization as well as significant time savings and process efficiencies.”
—Drew Robertson, Chief Information Security Officer, Finance of America Companies

This initial integration is the first step in a long-term partnership. As a new member of the CrowdXDR Alliance, we’ll be working to bring an XDR integration to market in the months ahead.

To learn more and request a demo of the current integration, visit the CrowdStrike partnership page here.