Human Behavior AI Protects Hampton Roads Sanitation District Ecosystems

Maintaining healthy waterways is the mission of Virginia’s Hampton Roads Sanitation District (HRSD), a political subdivision of the commonwealth responsible for wastewater treatment across nearly 5,000 square miles around Chesapeake Bay.

HRSD protects public health and the aquatic environment for 20 cities and counties, nearly 2 million residents, the region's multimillion-dollar tourism and oyster farming industries, and the world’s largest naval station, Naval Station Norfolk.

“As a wastewater utility, our primary focus is operational technology security,” said Roger Caslow, CISO. “But IT, particularly email, often serves as the ingress point for attacks.” After a 2020 ransomware attack, the agency upgraded its security tools, adopting Microsoft 365 E5 for email security.

This improved HRSD’s email security posture, but the agency still had to contend with a steady stream of account takeovers and extortion emails that escaped detection by Microsoft’s built-in tools. “Technology can increase security, but the human factor in technology use can lead to compromises that create other problems,” Caslow said.

“Even after fine-tuning M365 to be as aggressive as possible without kicking out every email, advanced attacks got through. Abnormal stops those advanced attacks. It’s like MS Defender is our hockey defense, and Abnormal is a really good goalie.”
—Roger Caslow, CISO, HRSD

Caslow, who at that time operated as a security team of one, found that addressing the missed attacks was consuming 20% of his time and taking up the IT helpdesk’s time, too. He reviewed the available email security options on the market and decided to run proofs of value with Abnormal and another AI-based solution.

“During the POV, Abnormal’s flexibility and visibility were surprising. In addition to stopping those extortion emails with human behavior AI, Abnormal gave us visibility into the amount of graymail and superfluous messages reaching our inboxes. The ability to filter that out lets our email be focused on our business and saves hours for my employees,” he said.

Abnormal’s performance and capabilities made it a clear choice for Caslow. "After Microsoft Defender reviews an email, Abnormal comes in and gets us to the protection finish line, so to speak.” Abnormal’s ease of integration with CrowdStrike to enrich endpoint protection held immediate appeal, too. “As soon as we found out about the integration, we implemented it,” he added.

Freed from spending dozens of hours a month on email threat detection and remediation, Caslow has expanded his team and fine-tuned HRSD's security awareness education. Abnormal’s AI Security Mailbox automates assessment of user reports, takes action as needed, updates users on the outcome, and provides insights for training. "We push some of Abnormal’s findings over to our SANS platform to find the right training resources for follow-on education,” he said.

“Abnormal is continuously adding useful features. More importantly, Abnormal listens to the customer, takes their feedback, and integrates it as soon as possible, which has been quicker than expected, based on my past experiences with technology providers.” —Roger Caslow, CISO, HRSD

With Abnormal, HRSD’s IT and OT systems are better protected from threats that exploit technology and human vulnerabilities. That helps HRSD uphold its mission of keeping the region’s waterways clean and safe. Caslow describes Abnormal as a valuable addition to HRSD’s toolbox. “I would recommend Abnormal to other companies. In my opinion, Abnormal delivers significant value for its price, and our interactions with the Abnormal team have been simple and smooth, from sales all the way through to customer success,” he said.