Abnormal Increases Compromised Account Detection Accuracy by 10%

October 29, 2021

One of our key objectives at Abnormal is to provide the highest precision detection to block all never-before-seen attacks. We stop a wide range of threats, encompassing everything from social engineering attacks and business email compromise to everyday spam, and we do it without requiring customers to create countless rules, as is the case with traditional secure email gateways.

But perhaps the best protection we can provide is against compromised accounts, which allow threat actors into an organization. Once an account is compromised, either through credential phishing, brute force attacks, or something else, a cybercriminal has full access to all the data in the account, which can be used for nefarious purposes, including sending additional attacks on coworkers and customers. Because this is key to protecting our customers, we’re constantly working to improve our detection engine.

Greater Compromised Account Detection Accuracy

While our detection capabilities have always been best-in-class, attackers are always changing their tactics. In order to constantly improve our product and stay ahead of them, we needed to gain a deeper understanding of cases involving false negatives or false positives.

This was achieved by identifying trends in cases, which we did by grouping similar behaviors and observations together. This allowed us to prioritize our efforts and address the trends with the highest potential impact. The end result is that the Abnormal engineering team improved the account takeover recall accuracy by 10%.

Account takeover overview 10

This means when you receive an account takeover alert, you have the utmost confidence to know it is legitimate and action should be taken.

Benefits of Account Takeover Protection

With Account Takeover Protection, customers can:

  1. Receive an alert via email, third-party SIEM and SOAR providers, or within the product’s Cases tab when an account takeover incident has occurred.

  2. Provide an explainable attack analysis of the incident. Abnormal gathers and organizes all evidence that led to the incident, along with summarized conclusions to equip security teams to take immediate action and provide context to the wider organization.

  3. Automatically remediate compromised accounts by signing users out of all active sessions, immediately disabling the account, and performing a password reset. This can optionally be configured to be performed manually through the product UI.

The combined impact of reducing the noise from incorrectly flagged email messages by 20% and saves customers tremendous time by reducing alert noise. This helps IT security teams minimize exposure to threats lurking within mailboxes that could lead to account takeovers, malware infections, intellectual property losses, compliance issues, or even lawsuits over data breaches.

Abnormal is committed to rapidly innovating to improve its detection capabilities, and built-in automation and processes that help security teams stay ahead of attackers. We’re excited to bring these innovations, specifically those related to its detection improvements, to the forefront.

Want to learn more about account takeover protection? Request a demo today to learn how Abnormal can immediately detect and remediate all compromised accounts.
Image

Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

0
Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 10 3 22 Cobalt Terrapin Blog
Threat group Cobalt Terrapin uses sophisticated impersonation techniques with multiple steps to commit invoice fraud.
Read More
B 09 29 22 CISO Cybersecurity Awareness Month
October is here, which means Cybersecurity Awareness Month is officially in full swing! These five tips can help security leaders take full advantage of the month.
Read More
B Email Security Challenges Blog 09 26 22
Understanding common email security challenges caused by your legacy technology will help you determine the best solution to improve your security posture.
Read More
B 5 Crucial Tips
Retailers are a popular target for threat actors due to their wealth of customer data and availability of funds. Here are 5 cybersecurity tips to help retailers reduce their risk of attack.
Read More
B 3 Essential Elements
Legacy approaches to managing unwanted mail are neither practical nor scalable. Learn the 3 essential elements of modern, effective graymail management.
Read More
B Back to School
Discover how threat group Chiffon Herring leverages impersonation and spoofed email addresses to divert paychecks to mule accounts.
Read More
B 09 06 22 Rearchitecting a System Blog
We recently shared a look at how the Abnormal engineering team overhauled our Unwanted Mail service architecture to accommodate our rapid growth. Today, we’re diving into how the team migrated traffic to the new architecture—with zero downtime.
Read More
B Industry Leading CIS Os
Stay up to date on the latest cybersecurity trends, industry news, and best practices by following these 12 innovative and influential thought leaders on social media.
Read More
B Podcast Engineering 11 08 24 22
In episode 11 of Abnormal Engineering Stories, David Hagar, Director of Engineering and Abnormal Head of UK Engineering, continues his conversation with Zehan Wang, co-founder of Magic Pony.
Read More