Abnormal Behavior Platform

What I like the most about Abnormal is its ability to detect highly sophisticated email threats by modelling user behavior. The AI-driven approach is extremely effective at identifying subtle anomalies - such as vendor fraud impersonation attempts, or unusual sender relationships, for example, domains modified to look similar to real ones- that traditional solutions often miss. I also value the clean, intuitive interface and the clear explanations behind each detection, which make investigations much faster and easier for analysts. The deployment with Microsoft 365 is really intuitive, simple and quick.

The capability to automatically remediate all emails linked to a phishing campaign after one of them is flagged is very valuable. This saves a lot of analyst time investigating and responding to phishing attempts. The Abuse Mailbox feature, wherein users can manually send an email for enhanced scanning, is very helpful for conserving SOC resources as it provides an option for users to check suspicious emails themselves rather than reporting them to SOC. Abnormal and other comparable tools I have direct experience of are insufficiently accurate in detecting malicious and unwanted emails for automated remediation of everything which is flagged to be viable. This makes Abnormal's capability to dynamically insert custom warning banners into emails in which suspicious characteristics are identified a useful middle ground between remediation and no action.

Behavioural AI based threat detection - often flags the phishing, BES and impersonation attacjs Minimal tuning and low false positives - it took some time to setup the right sensitivity, but once we done that we are all set Quick deployment and seameless integration into our M365 tenant

What i like least about the product is mainly related to cost. Abnormal is a premium solution, and the pricing can be challenging for some organizations, even though the value it delivers is clear. Additionally, during the initial learning phase, the platform may generate alerts or blocks that require manual review until the behavioral model fully estabilizes. Beyond that, the overall expereince has been extremely positive.

The platform provides very few options for customisation. Even basic features like alerting are simply on or off with no option to apply rules based on severity or other characteristics. Reporting legitimate emails which were wrongly flagged requires ana analyst to log into the portal and do it manually, which is not workable at any kind of scale. This is significant as it prevents the underling ML engine from getting feedback on errors. The plugin feature intended to detect user account compromises is very inaccurate and significantly worse than comparable features in others (75% of these alerts received over the last six months were classified as false positives when reviewed by an analyst). When required, engineer support has been very slow (six weeks to make a basic change).

Limited native reporting & dashboards, limited safe links feature, could catch false positives some times so need to keep monitoring it regularly