Meet Mo Sun, Engineering Manager
Meet Mo Sun, Engineering Manager on Abnormal's detection team. In four and a half years, she's helped build the systems that protect customers at scale - and learned that her biggest impact now comes from building the people behind them.
June 4, 2026
Four and a half years ago, Mo Sun joined Abnormal because the technology was genuinely different. Most security companies bolt AI on as a feature. Abnormal had built behavioral models as the foundation from day one. For a data scientist who believed you couldn't improve what you couldn't precisely see, that was exactly the kind of problem worth showing up for.
What she walked into matched the impression: hard problems, small teams trusted with decisions that materially changed customer security outcomes, and a culture that expected intellectual honesty over velocity for its own sake. She's been building here ever since, first as an individual contributor, now as an engineering manager on the detection side of the house. Over four years, the scope of the work has grown, and so has she.
Before the System, There Was the Firefighting
Before Mo's team built the misclassification management pipeline, the work was almost entirely reactive. A customer complaint would surface, the team would investigate, ship a fix, and move on to the next ticket. There was no systematic way to know whether the fix held, whether the model had drifted, or whether the same pattern was quietly affecting other customers.
"It wasn't that the process was broken — people were doing real, careful work," Mo said. "But it was manual, it didn't scale, and there was no shared visibility across the team into what was changing and why."
The product was growing faster than the approach could keep up with. The team was constantly firefighting, with customer problems arriving faster than they could sustainably address them.
"The breaking point was recognizing that the old approach — however well-intentioned — was burning people out and leaving us blind to the bigger picture."
The answer was to use AI to systematically cover the repeated cases so the team could focus on the ones that actually required human judgment. The signal that it was working didn't arrive dramatically. It was, as Mo describes it, a gradual exhale. The number of customers with active misclassification issues came down and stayed down. The same customers who had raised concerns came back with positive feedback, not because the team had manually chased down their issue, but because the pipeline had caught it and they felt the difference without anyone white-gloving every case. The ad-hoc work started shrinking. The list of one-off things sitting on people's plates got shorter.
"When people have more room to think instead of just reacting, you've actually changed something," she said.
Zooming Out When It Would Be Easier Not To
A few months ago, Mo's team caught something that could have looked like isolated noise. A handful of customers were seeing anchor image attacks, a technique where attackers embed images to manipulate how email content is perceived and evade detection. The easy read was a few edge cases. The team didn't stop there.
The more they dug in, the more the pattern pointed to something broader: an emerging attack vector that could scale across the customer base if they didn't move quickly. Within a short window, the team was already building new modeling designed to catch not just the specific variant, but the broader class of similar attacks, standing up monitoring across all accounts simultaneously and working in tight alignment with threat intelligence to chase signals and stress-test hypotheses. The response compounded rather than just closed a single gap.
"When you see something wrong for one customer, the first question isn't 'how do we fix this ticket' — it's 'what does this tell us about the system, and how do we make sure it never catches us off guard again.'"
The Instinct She Had to Let Go Of
The transition from IC to manager didn't happen in a single moment. It was a gradual realization that the ceiling on what Mo could accomplish alone was much lower than what the team could accomplish together. "I can fix this myself" stopped being a virtue and started being a bottleneck.
What replaced it was a more deliberate focus on enabling others, making sure people had the context and the runway to tackle problems she never could have solved alone, and measuring her own contribution by how much bigger the team's output was, not how much of it she personally touched.
"Growing others became the way to grow the product," she said. "Once I internalized that, the transition started to feel less like giving something up and more like unlocking a different kind of leverage."
Her best work now looks like setting up the conditions for the team to repeatedly do their best thinking: the right problem clearly framed, the right person on it, with everything they need to move without coming back to her at every step. She's deliberate about context at every meaningful decision point, making sure people understand not just what to do, but why it matters and what tradeoffs they're navigating. Then she makes the work progressively more complex as they grow into it.
"When you align someone's strengths to the right question and give them the scaffolding to succeed, they tend to surprise you."
What AI-Native Actually Means
The difference between AI as a layer and AI as a foundation shows up in how problems get framed from the start. At places where AI is bolted on, the default question is: how do we build this feature, and can AI help? At Abnormal, the default question is: what does the data tell us, what signals truly matter, and how do we design a feedback loop that makes the system smarter over time?
"That inversion changes everything downstream — how we define metrics, how we investigate anomalies, how we decide what to ship next."
On Mo's team, moving from a hypothesis to offline analysis to a shipped experiment in a tight loop is just the normal way work gets done. People are expected to think in terms of signals, model behavior, and measurable impact. For Mo as a manager, AI has also compressed the distance between a question and an answer, freeing her up to stay focused on the parts that require human judgment: framing the right questions, keeping the team on the highest-leverage problems, and staying close to how the work connects to real customer outcomes.
Still in the Middle of It
When Mo looks at the next year, two priorities stand out. The first is making sure the measurement infrastructure the team has built becomes deeply trusted across the organization, so teams can use it to set direction, evaluate new launches, and explore problems they haven't identified yet. The second is growing engineers who instinctively reach for data, design with feedback loops in mind from the start, and see AI not as something that assists the work but as something that shapes how the work is structured in the first place.
She knows she's in a rare moment. The technology is maturing in real time, which means the problems keep evolving and the ceiling on what's possible keeps rising.
"We're right in the middle of one of the most consequential technical shifts of our generation, and we're building something that actually matters," Mo said. "That combination doesn't come around often, and I'm very aware of how fortunate it is to be here for it."
It's the same instinct that brought her here four and a half years ago: before you can improve something, you have to be able to see it precisely. She's still building toward that, for her customers, her team, and whatever comes next.
