Abnormal AI review

Abnormal AI is the specialist pick for the attacks that worry finance and security teams most: business email compromise and vendor fraud that carry no malicious payload and pass every authentication check. Its Attune 1.0 model builds a behavioral baseline for each employee and vendor, then flags messages that depart from it, using signals such as authentication events, calendar activity and internal threads. Malicious messages and calendar invites are removed automatically, and every action shows which signals fired. Analysts get search and respond across Microsoft 365 and Google Workspace, a single quarantine view for Abnormal and Microsoft, custom AI models written in plain language, and custom rules on more than 50 message attributes. Detection 360 turns each reported miss or false positive into a tracked investigation. Because it connects by API, there is no MX change. The trade-off is cost visibility: Abnormal publishes no prices, and its depth is aimed at organizations with a security team rather than a single IT generalist.

Who it is for

Mid-market and enterprise security teams on Microsoft 365 or Google Workspace that need to stop payload-free BEC, vendor fraud and AI-written lures.

Price

See vendor pricing (USD check pending).

US price check pending. See the vendor pricing page.

Key features

• Behavioral AI detection that baselines each employee and vendor with its Attune 1.0 model
• Automatic removal of malicious messages and malicious calendar invites
• Search and respond across Microsoft 365 and Google Workspace from one console
• Custom AI models described in plain language, plus custom rules on 50+ message attributes
• Detection 360 tracks every analyst-submitted miss and false positive

Strengths and weaknesses

• Strength: Built for attacks with no link, file or authentication failure, the core of BEC
• Strength: Reads authentication events, calendar activity and internal threads, not only inbound mail
• Strength: Unified quarantine review for Abnormal and Microsoft in one place
• Weakness: No published price; every deal is a sales quote
• Weakness: Focused on Microsoft 365 and Google Workspace, not on-premises mail servers
• Weakness: More than a small business with a few dozen mailboxes usually needs

Key facts

• Deployment: API connection to Microsoft 365 and Google Workspace
• Detection model: Attune 1.0 per-identity behavioral baselines
• Custom rules: 50+ message attributes
• Pricing: Quote based

Where it ranks

Abnormal AI is No. 2 in our Best Email Security Software verdict.