chat
expand_more

Introducing CrowdStrike + Abnormal: New Partnership Delivers Joint AI-Based Threat Detection and Response

The new bi-directional integration between Abnormal and CrowdStrike’s solutions helps security teams correlate meaningful events across identity, endpoint, and email solutions, and respond quickly to incidents in progress.
March 29, 2023

Email and endpoint devices are two of the biggest attack entry points contributing to cybercrime loss. Attackers are continuously evolving their tactics to compromise these two entry points, launching sophisticated socially-engineered email attacks and account takeovers that are often so convincing they evade traditional email security detection approaches.

Socially-engineered business email compromise attacks have accounted for over $43B in exposed losses since 2016 and continue to grow, with $2.7 billion in actual losses last year alone.

Rapid detection and response are critical, but security teams too often deal with a sprawl of point solutions that aren’t well integrated. This forces them to either spend precious time and resources on manually sifting through and understanding large volumes of security data or to find ways to integrate the systems themselves.

To solve this problem, we’re excited to announce that Abnormal and CrowdStrike are entering into a strategic partnership to deliver a turnkey solution that gives joint customers more comprehensive protection against both email and endpoint attacks.

The initial bi-directional integration between Abnormal’s Email Account Takeover Protection and CrowdStrike’s Identity Threat Protection products helps security teams correlate meaningful events across identity, endpoint, and email solutions, and respond quickly to incidents in progress. It’s the first step we’re taking on our shared mission to provide customers with better protection while reducing security spend and increasing operational productivity—and it’s available now.

To learn more about the strategic partnership, watch this video with Abnormal CEO Evan Reiser and CrowdStrike President Mike Sentonas.

Why the CrowdStrike + Abnormal Integration is Unique

In speaking with security teams while we were developing this integration, we heard that many technology integrations fall short of their full potential. In most cases, they share a large amount of data without providing the context and correlation that would help security analysts separate signal from noise. With this in mind, we wanted to be sure that our integration with CrowdStrike did not fall into this familiar trap.

The Abnormal platform is built to ingest signals from diverse sources to have the most comprehensive understanding of the behavior of every identity in an organization. The enriched context allows our platform to precisely detect anomalies and block attacks. And when it comes to endpoint telemetry and correlating this data against user behavior, CrowdStrike is unmatched. It made sense technologically—and for the benefit of our customers—to combine CrowdStrike's high-fidelity signals into the Abnormal platform to better protect against email threats and vice versa.

Both CrowdStrike and Abnormal are leveraging the power of machine learning to flag anomaly detections based on normal behavioral patterns. This is a fundamentally different approach than traditional email security integrations that focus on sharing data about known indicators of compromise (IoCs), which often evade detection because they’re constantly changing as cybercriminals evolve their tactics. Because Abnormal can detect attacks without these known bad signals, this technology integration will enable customers to swiftly discover and remediate compromised email accounts and endpoints, even as threat actors continue to become more sophisticated in their techniques.

Now when CrowdStrike detects a risk, it creates an account takeover case within the Abnormal platform. Security analysts can then quickly remediate the email account by logging users out, terminating the session, or forcing a password reset.

Crowd Strike Abnormal Integration Example 1

In the other direction, when Abnormal detects that an email account has been compromised, it automatically sends a signal to CrowdStrike’s Identity Protection platform. The account will then be added to a Watched Users list, which can be configured to allow analysts to contain hosts or force reauthentication on an endpoint device.

Crowd Strike Abnormal Integration Example 2

To see how it works, watch the product demo.

What Customers are Saying

The market need for such a solution like this is evidenced by the insights of industry experts. In the recent Market Guide for Email Security, Gartner recommends security leaders “prioritize the integration of email events into a broader XDR platform” for better protection”

We’re fortunate to have shared customers who helped us build this technology integration to best suit their teams’ needs. Here’s what they had to say about the potential ahead for Abnormal and CrowdStrike.

"Comfort Systems USA builds, supports and maintains our customers’ most critical building systems. I'm excited to see Abnormal and CrowdStrike working together to protect our employees against the types of attacks traditional solutions often fail to detect. With the ability to correlate user behavior events across endpoints, email, and authentication sources, our security team can quickly uncover account takeover attacks and take preventative measures."
Christopher Chambers, Vice President of Information Security, Comfort Systems USA
“The enhanced, integrated offerings from CrowdStrike and Abnormal further strengthen our security infrastructure and quickly orchestrate responses. These solutions provide enhanced protection for our organization as well as significant time savings and process efficiencies.”
Drew Robertson, Chief Information Security Officer, Finance of America Companies

What’s Next for CrowdStrike and Abnormal

This initial integration is the first step in a long-term partnership. As a new member of the CrowdXDR Alliance, we’ll be working to bring an XDR integration to market in the months ahead.

To learn more and request a demo of the current integration, visit the CrowdStrike partnership page here.

Request an Integration
Introducing CrowdStrike + Abnormal: New Partnership Delivers Joint AI-Based Threat Detection and Response

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B Proofpoint Customer Story F500 Insurance Provider
A Fortune 500 insurance provider blocked 6,454 missed attacks and saved 341 SOC hours per month by adding Abnormal to address gaps left by Proofpoint.
Read More
B Malicious AI Platforms Blog
What happened to WormGPT? Discover how AI tools like WormGPT changed cybercrime, why they vanished, and what cybercriminals are using now.
Read More
B MKT748 Open Graph Images for Cyber Savvy 7
Explore insights from Brian Markham, CISO at EAB, as he discusses cybersecurity challenges, building trust in education, adapting to AI threats, and his goals for the future. Learn how he and his team are working to make education smarter while prioritizing data security.
Read More
B Manufacturing Industry Attack Trends Blog
New data shows a surge in advanced email attacks on manufacturing organizations. Explore our research on this alarming trend.
Read More
B Dropbox Open Enrollment Attack Blog
Discover how Dropbox was exploited in a sophisticated phishing attack that leveraged AiTM tactics to steal credentials during the open enrollment period.
Read More
B AISOC
Discover how AI is transforming security operation centers by reducing noise, enhancing clarity, and empowering analysts with enriched data for faster threat detection and response.
Read More