Key Insights
Our latest blog post laid out a strategy for CISOs concerned about securing AI: get visibility, establish governance, control employee use, supervise agents, and detect intrusion in the cloud.
Those steps give you a plan, but executing them takes tools. The strategy is sound, and the market's response to it has been a catalog of point solutions, each with its own idea of what AI security means.
Abnormal has a solution, and it's deliberately narrow. AI security looks like a new problem because the technology is new. Structurally, it's the problem we've been solving since the company started: identify an entity, learn what normal looks like for it, notice when behavior departs from that, and respond faster than a human could.
That capability has been running in production against email attacks for years, across more than 5,000 organizations. With AI, the method stays the same while the number of identities and the range of actions grow.
The Abnormal Behavioral Security Platform extends along exactly those two axes, as one platform with five products: AI Governance, AI Employee Guardrails, AI Agent Security, AI Cloud Security, and the AI Security Workbench. Each maps to a step in the CISO's strategy.
Why an AI-Driven Attack Is Still Detectable
A common objection is that AI attackers are too good to catch. On initial access, that's close to true. A capable adversary masquerades source IPs and mimics local user behavior well enough that entry looks like a normal login, and detection focused on the perimeter will not fire.
What happens next is a different story. In July 2026, roughly 700 AI agents run during an internal benchmark compromised Hugging Face's production infrastructure, moving through four regions and harvesting credentials in about 48 hours. OpenAI and Hugging Face both published detailed accounts, and the Cloud Security Alliance post-mortem covers it in depth. For detection, the pace stands out: hundreds of coordinated agents specializing into roles, across multiple regions, in a matter of days.
No human operator works that way. Post-access, AI behavior is conspicuous precisely because it's efficient: too many actions, too quickly, across too many systems, touching resources no employee has a reason to touch. An identity that enumerates storage buckets it has never accessed, modifies a network security group it has never modified, and reaches a honeypot credential that exists for no operational purpose has produced a signal no rule needed to anticipate.
Abnormal is built around this distinction. Hard rules catch the attacks you predicted. A behavioral model catches behavior that's inappropriate for that identity even when you couldn't have described the attack in advance. You define the intent; the model flags what diverges from it.
One Behavioral Platform, Expanded for AI
Strip the Abnormal Behavioral Security Platform down to its architecture:
Enumerate the identities an organization depends on.
Normalize everything they do into a single activity log: this identity did this thing to this thing.
Build a behavioral model of normal for each identity, specific to that organization rather than an industry average.
Detect deviations from that model.
Respond autonomously.
That's the foundation that stops business email compromise (BEC) and account takeover for our customers today. Securing AI extends that foundation in two ways.
1. More Identities
Abnormal began by modeling human identities from Microsoft 365 data. The identity set now includes service accounts, cloud identities, and AI agents, along with anything else in an environment that can be named and observed: a printer, a conference room, a network security group, a storage bucket. If you can identify it, we can baseline it.
Agents are hard to secure when an organization can't inventory them. An agent borrowing a service account and an API key has no identity of its own, which means there's nothing to baseline and nothing to hold accountable. Give it an identity and the rest of the pipeline works on it unchanged.
2. More Responses
Blocking or deleting a malicious email is a narrow response, appropriate to a narrow surface. Covering AI means a wider set: rotating a credential, updating a network security group, requiring step-up authentication, or intervening inside the AI tool itself at the moment of action. That last option is the least obvious.
Consider an employee using an AI assistant connected to their CRM, who asks it to send a follow-up to a customer list. Rather than blocking the integration, Abnormal can interrupt the action: Did you mean to email all 1,000 customers? Double-check before I do that.
Nothing was blocked, and no one filed a ticket. The action that would have caused the damage didn't go through unreviewed. Enforcement at the point of use changes behavior in a way a firewall rule can't, because the person is still in the loop and still has context.
The AI Security Models
Here's how the products line up against the strategy we proposed in our last blog post.:
- Visibility: AI Governance
- Governance: AI Governance
- Employees: Employee Guardrails
- Agents: AI Agent Security
- Cloud: AI Cloud Security
- Investigation: AI Security Workbench
Steps 1-2: AI Governance
AI Governance maps every AI application in use, including large language models and the SaaS tools that added AI features last quarter. It shows who's using what, what data they're putting into it, and what it's costing, broken out by organizational unit.
It assembles that picture from signals most organizations already generate: identity and single sign-on data for sanctioned tools, email data to catch sign-ups that never went through IT, billing and compliance APIs from the model providers, AI gateways, and browser-level signals for the personal-account usage that bypasses everything else. The spend view tends to get a CFO's attention, and it's often the fastest route to finding tools nobody disclosed.
From there, governance is an overlay on the inventory rather than a separate program. The inventory becomes a use-case registry with named owners, and the regulatory obligations that apply to your environment get mapped onto it, with documentation you can hand to your general counsel. Plain-language policy in, concrete per-environment rules out.
AI Governance is available today, installable from the Abnormal portal with a 30-day proof of value.
Step 3: AI Employee Guardrails
You've given everyone an AI assistant. The question is what happens next: what people type into it, which systems it reaches into on their behalf, and what actions come out the other side. Pulling a full copy of your CRM, generating code that introduces a vulnerability, or filing a hundred malformed tickets in your service desk are all things an assistant will do willingly if asked.
AI Employee Guardrails watches that activity against the identity baseline Abnormal already maintains for each employee, and enforces policy at the point of use rather than at the firewall.
That means step-up authorization inside the tool, blocking a specific action rather than a whole application, and translating plain-language rules such as "no protected health information and no cardholder data into models" into controls that fire.
Step 4: AI Agent Security
The simplest description of this product is the security agent that makes sure all the other agents are behaving.
The failures here are rarely permission violations. A support bot routes customer data through a help portal it was authorized to use. A sales agent gets ambitious and emails a hundred customers, which it had every right to do. Both are technically allowed and both are well outside the intent behind the permission grant. No access control fires, because nothing was violated.
AI Agent Security gives every agent its own identity and behavioral baseline, tracks the service accounts and keys it borrows, and flags activity that's permitted but inappropriate for that agent. Response actions run from flagging to revoking access to rotating credentials.
Longer term, this is heading toward real-time contextual access decisions, which would complement the identity governance and privileged access tooling you already run rather than replace it.
Step 5: AI Cloud Security
AI Cloud Security answers a specific question: if an AI-driven attacker were inside your environment right now, would you know within minutes, and would something respond without waiting for a human?
Part of the approach is honeypots: fake credentials, keys, and resources that no legitimate process has any reason to touch, but that look appealing to something scanning an environment for a way deeper in. They're inexpensive, mechanical to deploy, and produce almost no false positives, because nothing but an intruder ever reaches them.
The rest is behavioral detection applied to cloud identities: control-plane changes, anomalous access patterns, and activity that doesn't fit what that identity has ever done before. Responses run in real time, including rotating a credential or isolating a network segment, because a machine-speed attack won't wait for your on-call rotationThe rest is behavioral detection applied to cloud identities: control-plane changes, anomalous access patterns, and activity that doesn't fit what that identity has ever done before. Responses run in real time, including rotating a credential or isolating a network segment, because a machine-speed attack won't wait for your on-call rotation.
Step 6: AI Security Workbench
A cybersecurity investigation looks a great deal like a cybersecurity attack. Both involve probing infrastructure, enumerating identities, and asking pointed questions about how to reach things. Teams that plan to investigate an incident with a general-purpose model can hit this at the worst possible moment and end up standing up alternative tooling mid-incident.
AI Security Workbench is an investigation environment built for that work, and it arrives already knowing your people, your identities, and your cloud infrastructure, because it sits on the same identity graph and activity log as everything else in the platform.
AI Governance is available now. You can join the waitlist for the other AI security products and be the first to know when they go live.
The Abnormal AI Platform Advantage
Bought individually, each product solves the step it maps to. Bought together, a policy set once in AI Governance propagates outward. Declare that customer financial data doesn't go into models, and that policy applies to the employee using an assistant, the agent acting on their behalf, and the cloud resource holding the data, without being configured three times in three places.
That's the practical argument for a platform over a collection of point solutions. A policy enforced in one place and inherited everywhere stays accurate, while three separately configured controls drift apart within a quarter.
Start With AI Visibility
If you're working through the six steps, the sequence still holds: visibility first. It's unglamorous, it's the step everyone wants to skip, and it makes the other four possible. You can start this week.
Abnormal AI builds a behavioral model for each identity an organization depends on, human and non-human alike, and detects the moment one of them stops behaving normally. That approach protects more than 5,000 organizations, including 30% of the Fortune 500. AI Governance applies the same foundation to every AI application in your environment.
Learn More About Our AI Security Products
