Abnormal Increases Compromised Account Detection Accuracy by 10%

October 29, 2021

One of our key objectives at Abnormal is to provide the highest precision detection to block all never-before-seen attacks. We stop a wide range of threats, encompassing everything from social engineering attacks and business email compromise to everyday spam, and we do it without requiring customers to create countless rules, as is the case with traditional secure email gateways.

But perhaps the best protection we can provide is against compromised accounts, which allow threat actors into an organization. Once an account is compromised, either through credential phishing, brute force attacks, or something else, a cybercriminal has full access to all the data in the account, which can be used for nefarious purposes, including sending additional attacks on coworkers and customers. Because this is key to protecting our customers, we’re constantly working to improve our detection engine.

Greater Compromised Account Detection Accuracy

While our detection capabilities have always been best-in-class, attackers are always changing their tactics. In order to constantly improve our product and stay ahead of them, we needed to gain a deeper understanding of cases involving false negatives or false positives.

This was achieved by identifying trends in cases, which we did by grouping similar behaviors and observations together. This allowed us to prioritize our efforts and address the trends with the highest potential impact. The end result is that the Abnormal engineering team improved the account takeover recall accuracy by 10%.

Account takeover overview 10

This means when you receive an account takeover alert, you have the utmost confidence to know it is legitimate and action should be taken.

Benefits of Account Takeover Protection

With Account Takeover Protection, customers can:

  1. Receive an alert via email, third-party SIEM and SOAR providers, or within the product’s Cases tab when an account takeover incident has occurred.

  2. Provide an explainable attack analysis of the incident. Abnormal gathers and organizes all evidence that led to the incident, along with summarized conclusions to equip security teams to take immediate action and provide context to the wider organization.

  3. Automatically remediate compromised accounts by signing users out of all active sessions, immediately disabling the account, and performing a password reset. This can optionally be configured to be performed manually through the product UI.

The combined impact of reducing the noise from incorrectly flagged email messages by 20% and saves customers tremendous time by reducing alert noise. This helps IT security teams minimize exposure to threats lurking within mailboxes that could lead to account takeovers, malware infections, intellectual property losses, compliance issues, or even lawsuits over data breaches.

Abnormal is committed to rapidly innovating to improve its detection capabilities, and built-in automation and processes that help security teams stay ahead of attackers. We’re excited to bring these innovations, specifically those related to its detection improvements, to the forefront.

Want to learn more about account takeover protection? Request a demo today to learn how Abnormal can immediately detect and remediate all compromised accounts.

Related Posts

B 12 03 22 SIEM
Learn about Abnormal’s enhanced SIEM export schema, which provides centralized visibility into email threats
Read More
Blog phishing cover
The phishing email is one of the oldest and most successful types of cyberattacks. Attackers have long used phishing as a common attack vector to steal sensitive information or credentials from their victims. While most phishing emails are relatively simple to spot, the number of successful attacks has grown in recent years.
Read More
Blog brand cover
For those of you who have visited the Abnormal website over the last month, you’ve seen something different—a redesigned brand focused on precision. It’s new and innovative, and different from any other cybersecurity company, because it was created with one thing in mind: our customers.
Read More
B 11 22 21 AAA
At Abnormal, our customers have always been our biggest priority. Customer obsession is one of our five company values, and we live this every single day as we provide the best email security protection available for the hundreds of companies who entrust us to protect their mailboxes.
Read More
Blog microsoft abnormal cover
Before we jump into modern threats, I think it’s important to set the stage ​​since email has been around. Since email existed, threat actors targeted email users with malicious messages, general spam, and different ways to take advantage of the platform. Then of course, more dangerous attacks started to come up… things like malware and other viruses.
Read More
Blog black friday scam cover
While cybersecurity awareness is a year-round venture, it is especially important to be mindful during certain times of the year. With Thanksgiving here in the United States on Thursday, our thoughts will likely be on our family and friends and everything we have to be thankful for this holiday season.
Read More
Blog automation workflows cover
Our newest platform capabilities help customers streamline critical security workflows, like triaging phishing mailbox submissions or triggering tickets to investigate account takeovers, through automated playbooks. Doing so can decrease mean time to respond (MTTR) to incidents, further reducing any potential risk to the organization and eliminating manual workflows to save time and increase the efficiency of IT and security teams.
Read More
Blog tsa scam cover
On November 9, 2021, we identified an unusual phishing email that claimed to be from “Immigration Visa and Travel,” inviting the recipient to renew their membership in the TSA PreCheck program. The email wasn’t sent from a .gov domain, but the average consumer might not immediately reject it as a scam, particularly because it had the term “immigrationvisaforms” in the domain. The email instructed the user to renew their membership at another quasi-legitimate-looking website.
Read More
Blog pyspark cover
At Abnormal Security, we use a data science-based approach to keep our customers safe from the most advanced email attacks. This requires processing huge amounts of data to train machine learning models, build datasets, and otherwise model the typical behavior of the organizations we’re protecting.
Read More
Blog tiktok attack cover
As major social media platforms have expanded the ability of creators to monetize their content in the last few years, they and their users have increasingly found themselves the targets of malicious activity. TikTok is now no exception.
Read More
Blog ransomware guide cover
While various state agencies and the private sector keep track of ransomware attacks and related tactics worldwide, malicious actors change and evolve their ransomware strategies all the time. We’ve put together a comprehensive guide that will define ransomware, how to detect it, and what steps to take if you’ve fallen victim to a ransomware virus attack.
Read More
Blog detection efficacy cover
One of the key objectives of the Abnormal platform is to provide the highest precision detection to block all never-before-seen attacks. This ranges from socially-engineered attacks to account takeovers to everyday spam, and the platform does it without customers needing to create countless rules like with traditional secure email gateways.
Read More