Abnormal AI Innovation: How Abnormal Uses AI in the ML Lifecycle

In cybersecurity, attackers are always evolving their tactics. This means our defenses, especially our Machine Learning (ML) systems, need to adapt quickly. At Abnormal, building and updating these ML-driven defenses for email and identity attacks is a core part of what we do. Traditional ML development cycles involve many manual, time-consuming steps, slowing our response to new threats.

To overcome this, we're integrating Generative AI into our workflow. Using AI-powered tools like Cursor (an AI-first code editor) combined with our internal Model Context Protocol (MCP) server, we accelerate the journey from idea to deployed feature. This AI assistance automates routine coding and integration, freeing engineers to concentrate on the sophisticated design and logic vital for effective detections.

We have previously shared how we set up our MCP servers to accelerate developer velocity. This post explores this AI-augmented approach in a real-world scenario: developing a new model feature and then building a detector that uses it, all while minimizing manual boilerplate coding. Let’s take a look at how these AI tools help us boost development speed while maintaining our rigorous engineering quality and security standards.

Before diving into our AI-augmented approach, it's worth considering the complexities of the traditional path to developing new threat detectors—a process that used to take several hours of an engineer’s time:

1. Feature Conception & Design: Identifying a need for a new signal based on recent attack patterns.

2. Schema & Data Model Changes: Updating data schemas (e.g., Thrift, Protobuf), defining enums, and ensuring correct serialization/deserialization.

3. Extractor Implementation: Writing the core logic to extract the new feature.

4. Configuration & Registration: Ensuring the feature is registered, configured, and integrated into data pipelines.

5. Unit & Integration Testing: Writing comprehensive tests.

6. Detector Design: Conceptualizing how the new feature aids a new detection rule or model.

7. Detector Implementation: Coding the detector logic.

8. Detector ID Management & Registration: Adding and tracking new detector IDs.

9. Detector Testing & Validation: Writing robust tests for the new detector.

Each of these steps, especially in a large and mature codebase like Abnormal's, can involve touching numerous files and remembering intricate system details. This is where the manual effort can become a bottleneck, leading to longer development cycles and increased cognitive load on engineers.

We’ve been experimenting with the use of AI to help accelerate this process, but Large Language Models embedded in Cursor don't inherently understand our unique engineering context or specific workflows for shipping features and threat detectors. They're only as effective as the context we explicitly provide, which becomes particularly challenging within a complex codebase like ours.

A workaround we have adopted at Abnormal is the usage of Cursor Rules. These documentation assets function as engineering blueprints—structured rules defined in Markdown (.md) files within our monorepo, specifying exactly how Cursor should interpret tasks and automate actions. We have described how we set and scale these in a previous blog. Our codebase now contains localized markdown rule files describing common workflows. These rules direct Cursor's actions within our codebase, while our MCP server provides essential external context and integration capabilities, giving Cursor a comprehensive understanding for the task. Our Cursor instance can now generate a nearly complete, review-ready Pull Request (PR) starting from a simple prompt.

Let’s examine a scenario: an engineer identifies a new way to detect risky behavior—certain VPN connection types might indicate malicious activity. To leverage this insight, they propose adding a new attribute, "VPN type," classifying VPN connections into distinct categories (e.g., internal network, public VPN, data center) for use as a detection signal.

Instead of going through all the file edits manually, the engineer can one-shot generate all the boilerplate code in Cursor. Below is an example of everything that an engineer needs to provide for this to work.

The Cursor AI Agent executes this request by fetching the requirements from the Jira ticket, adding new code diffs to implement the new feature, and triggering a new PR on GitHub. The extensive, often error-prone, boilerplate and cross-system integration tasks are completed by the AI Agent following our engineering guidelines.

The engineer's primary focus then shifts to:

• Architecting the system and establishing engineering standards within the markdown rules.

• Implementing the core intellectual property, like the nuanced logic for the feature itself.

• Thoroughly reviewing all AI-generated code for accuracy and best practices.

• Finalizing and augmenting test cases.

Let’s see how this works behind the scenes.

There are two ways in which we can make Cursor more effective internally: by providing it with richer process context and enabling it to take actions outside the code editor.

This workflow is made possible by well-written Cursor rules markdown files which act as engineering blueprints laying out an action plan.

For optimal results, we've observed that precise yet concise Markdown instructions—clearly documenting essential context and explicitly stating key assumptions—significantly reduce Cursor’s tendency to make incorrect inferences. When Cursor consistently errs or requires overly verbose prompts, we've found it effective to revisit our Markdown to clarify assumptions or fill in missing context. Regular testing of rules in fresh Cursor sessions helps in yielding reliable outcomes.

Below is a simplified excerpt of a rules file illustrating the structured, condition-action format Cursor expects.

While well-structured Markdown rules provide Cursor with a clear action plan for code modifications, it's our Model Context Protocol (MCP) server that truly empowers these AI-driven workflows by connecting Cursor to specific, real-time data from our internal tools and enabling interaction with external systems. As we've discussed previously, LLMs are powerful, but they don't inherently understand Abnormal's unique environment. MCP, as set up by Abnormal, acts as a secure bridge, allowing Cursor to query and interact with our internal tools and data sources, making the AI assistance far more potent and accurate.

When a user prompt or instruction in the Markdown files dictates an action, Cursor can leverage an MCP "tool" to get the necessary information or perform a specific task within our environment. This is crucial because it means the AI isn't guessing; it's working with live, accurate data.

Here’s how MCP enhances our "VPN type" attribute example:

1. Dynamic Task Context via Jira Integration:
   The engineer’s prompt includes the Jira ID "ATO-1234." Through an MCP tool (e.g., jira_get_ticket), Cursor queries our MCP server. MCP then securely fetches the ticket's summary, description, and requirements directly from our Jira instance. This live data is seamlessly integrated into Cursor's context, ensuring the AI operates with the precise, up-to-date objectives of the task without manual intervention.

2. Automated, Controlled GitHub PR Creation:
   Once Cursor has generated the necessary code changes based on the Markdown rules, the workflow doesn't stop in the editor. An MCP tool (e.g., git_create_pr) is invoked. Cursor passes the relevant details (branch name, title, commit messages) to MCP. Our MCP server then handles the authenticated interaction with GitHub to create the branch, commit the AI-generated code, and open a PR. This automates a critical step in our development pipeline, ensuring consistency and adherence to our contribution processes.

By exposing these specific, controlled interactions with external systems like Jira and GitHub via MCP, we significantly enhance Cursor's capabilities. The Jira and GitHub interactions shown are just a glimpse, as our internal MCP toolkit is considerably broader. For example, we leverage it to search and create Jira tickets, not just read them, and to retrieve specific GitHub data like comments and GitHub Actions logs, complementing MCP’s role in automating PR.

This allows our AI-assisted workflows to extend beyond mere code generation and integrate deeply with our operational tools, making the entire development process more streamlined.

This AI-driven workflow meaningfully improves how we build by enabling:

• Faster Turnaround: Critical signals, like a new detection feature, move from concept to testable PR in minutes instead of hours, speeding up our response to new threats.

• More Reliable Code: Cursor Rules enforce established patterns, resulting in fewer "forgot to update config file" or "updated the wrong enum" style bugs. Having the rules written down forces standardization.

• Engineers on High-Impact Work: Instead of repetitive setup for a new data extractor, engineers focus on refining its logic or designing the next big detection, not mechanical work.

• Breaking Down Knowledge Silos: An engineer less familiar with our data ingestion pipeline can confidently initiate changes using Cursor Rules, as AI handles the system-specific wiring.

• Quicker Onboarding: New hires leverage blueprints to contribute more quickly, learning by reviewing AI-generated code rather than getting lost in system intricacies.

• Blueprints as Living Documentation: Unlike static wikis, the files written through this process remain up-to-date and directly actionable.

At Abnormal, we believe the future of ML and software development is intrinsically linked with AI assistance. By thoughtfully integrating tools like Cursor with our secure MCP, we're not just speeding up development; we're enhancing work quality and improving our engineers' daily experience. This approach allows us to maintain the highest engineering standards and security while rapidly adapting to the evolving threat landscape.

We're continually exploring new ways to deepen AI integration into more facets of our development lifecycle, always aiming to build more effective, intelligent, and resilient security solutions.

If you're an engineer who's excited about combining ML system design with practical AI assistance, we'd love to talk. At Abnormal, AI doesn't just power our security solutions—it reshapes how we build them.

See Abnormal’s AI capabilities in action by scheduling a demo today.