Abnormal Behavior Platform

What I like the most about Abnormal is its ability to detect highly sophisticated email threats by modelling user behavior. The AI-driven approach is extremely effective at identifying subtle anomalies - such as vendor fraud impersonation attempts, or unusual sender relationships, for example, domains modified to look similar to real ones- that traditional solutions often miss. I also value the clean, intuitive interface and the clear explanations behind each detection, which make investigations much faster and easier for analysts. The deployment with Microsoft 365 is really intuitive, simple and quick.

I would like to point out that the Account Takeover feature was the one we used the most. Adding user behavior baseline with anomaly detection was also an important add on. They are quick when it comes to addressing new attack patterns like calendar invite driven attacks. Advanced RBAC model allowing feature and tenant permission management.

Overview and Dashboards are very helpful and straightforward, with relevant information and the latest threats that are being blocked and/or analysed.

What i like least about the product is mainly related to cost. Abnormal is a premium solution, and the pricing can be challenging for some organizations, even though the value it delivers is clear. Additionally, during the initial learning phase, the platform may generate alerts or blocks that require manual review until the behavioral model fully estabilizes. Beyond that, the overall expereince has been extremely positive.

There are a few features that support larger teams reviewing the Threat queue - no way to mark items as already reviewed. No self-service for tenant onboarding to learning mode instead of active. No support for Sovereign/Government tenants - no way to restrict access to EU/US residents only (you would need to split your account into two or more instances to address this).

The limitation is that the e-mails are analyzed after they arrive in a users mailbox. As the AI analyzes the e-mails and the activity that a user conducts, it limits the remediation as we have had cases where users received the malicious email and clicked on the links or opened the attachments before it was remediated.