Abnormal Behavior Platform

Behavioural AI based threat detection - often flags the phishing, BES and impersonation attacjs Minimal tuning and low false positives - it took some time to setup the right sensitivity, but once we done that we are all set Quick deployment and seameless integration into our M365 tenant

The capability to automatically remediate all emails linked to a phishing campaign after one of them is flagged is very valuable. This saves a lot of analyst time investigating and responding to phishing attempts. The Abuse Mailbox feature, wherein users can manually send an email for enhanced scanning, is very helpful for conserving SOC resources as it provides an option for users to check suspicious emails themselves rather than reporting them to SOC. Abnormal and other comparable tools I have direct experience of are insufficiently accurate in detecting malicious and unwanted emails for automated remediation of everything which is flagged to be viable. This makes Abnormal's capability to dynamically insert custom warning banners into emails in which suspicious characteristics are identified a useful middle ground between remediation and no action.

The product is cheaper, faster, and has caught close to $Xm in BEC attacks in the first 2 weeks. BEC was not identified by our old phishing / spam platform.

Limited native reporting & dashboards, limited safe links feature, could catch false positives some times so need to keep monitoring it regularly

The platform provides very few options for customisation. Even basic features like alerting are simply on or off with no option to apply rules based on severity or other characteristics. Reporting legitimate emails which were wrongly flagged requires ana analyst to log into the portal and do it manually, which is not workable at any kind of scale. This is significant as it prevents the underling ML engine from getting feedback on errors. The plugin feature intended to detect user account compromises is very inaccurate and significantly worse than comparable features in others (75% of these alerts received over the last six months were classified as false positives when reviewed by an analyst). When required, engineer support has been very slow (six weeks to make a basic change).

The product offering is still maturing. Solutions such as security training platforms are not fully baked yet, but is in progress and improving monthly.