Abnormal Security for Stopping BEC and Social Engineering

In-Depth Review

Abnormal Security launched in 2018 with a focused thesis: the most damaging email attacks do not contain malware, malicious links, or any traditional indicators of compromise. Business email compromise, executive impersonation, and vendor fraud attacks succeed through social engineering alone, and no amount of URL scanning or attachment sandboxing can stop them. Abnormal’s behavioral AI approach was built specifically for this gap.

What Sets Abnormal Security Apart

Abnormal’s behavioral profiling engine is fundamentally different from traditional email security approaches. Rather than analyzing email content for known threat indicators, the platform builds a model of normal communication patterns for every employee and external contact: who they email, when, how they write, what they typically request, and from what devices and locations. When an email deviates from these patterns — a “CEO” urgently requesting a wire transfer from an unusual domain, or a vendor sending an invoice from a slightly different email address — Abnormal flags it as anomalous.

This approach is uniquely effective against payload-less attacks. A text-only email from a spoofed executive domain requesting a payroll change contains no malicious links, no attachments, and no indicators that traditional secure email gateways can detect. Abnormal catches these attacks because the behavioral pattern is anomalous, regardless of the email content.

The API-based deployment model is another significant advantage. By integrating directly with Microsoft 365 and Google Workspace APIs rather than sitting inline as a mail flow proxy, Abnormal deploys in minutes without requiring MX record changes, mail routing modifications, or any disruption to email delivery. This also enables capabilities that inline gateways cannot provide, such as detecting account takeover by monitoring mailbox rules, sign-in patterns, and internal email behavior.

Limitations to Understand

Abnormal is deliberately narrow in scope. It is an email security tool, not an endpoint protection, network detection, or SIEM platform. Organizations should view it as a specialized layer that sits above their existing email security stack (Microsoft Defender, Google Security, or third-party SEG), not as a replacement for broader security infrastructure.

The behavioral model requires a learning period of 14-30 days to establish baselines. During this period, detection accuracy is lower, and organizations may see both false positives and missed detections. The model also performs best in environments with consistent email communication patterns — highly seasonal businesses or organizations with frequent personnel changes may experience more variable detection quality.

The Bottom Line

Abnormal Security is the best-in-class solution for the specific problem of socially engineered email attacks. If BEC, executive impersonation, and vendor fraud are material risks for your organization — and for any company that moves money via email, they are — Abnormal provides detection capabilities that no other tool category can match. Deploy it as a layer above your existing email security, not as a replacement.