What's New

Weekly Detection Enhancements - Week of October 2

• Enhanced detection of lateral phishing from compromised senders, strengthening protection for internal-to-internal messages

AI Detection Engineer acts as an extension of your SOC: when a report in Detection 360 or AI Security Mailbox is confirmed a misjudgment, AIDEN investigates it the way an analyst would, builds a sophisticated, customer-specific detector, tests it against your own traffic, and deploys it once it clears Abnormal's efficacy bar, no rule-writing required. 

With this release:

• See AIDEN’s fast, visible response to confirmed misjudgments reported via Detection 360 and AI Security Mailbox in one unified dashboard

• Get faster turnaround from report to live fix, as AIDEN investigates, builds, tests, and deploys automatically

• Track every deployed detector with full traceability to every message caught and  false positive suppressed

AI Detection Engineer turns reports into faster, fully traceable responses, no rule-writing, no waiting. It's live today for all US and EU commercial customers, no configuration required.

AI Phishing Coach's new Executive Report turns your training program results into a leadership-ready PDF in one click. The branded report covers program performance, where risk concentrates, and which employees to coach or recognize, with AI-generated analysis alongside key charts.

With this release:

• Share results with leadership using Export Executive Report on the Executive Dashboard or the Reports page

• Apply any date range or filters to show a broad or targeted view

• Find past and new reports in Recent Reports on the Reports page

The Executive PDF Report turns program data into a story leaders can act on, with no screenshots and no manual prep. It's live today for all AI Phishing Coach customers.

Security and risk teams often need vendor data outside the platform, for compliance audits, board reporting, or cross-referencing with other systems. Supply Chain now supports one-click CSV export, giving teams instant, flexible access to their full vendor dataset for analysis wherever they need it.

• Navigate to Behavioral Intelligence > Supply Chain and click Export to CSV

• Receive your download automatically, including a Tenant column for multi-tenant environments

• Simplify audits, compliance reporting, and vendor risk analysis

Weekly Detection Enhancements - Week of September 25

• Added internal-account compromise detections to catch targeted attacks disguised as routine coworker email

• Improved precision of subject-matching detection, reducing false positives without sacrificing threat coverage

Identity Threat Protection admins can now filter the Adaptive Identity Reset enrollment roster by department, job title, VIP status, and admin status, sort by name or title, and search across the complete directory.

This makes enrollment easier to manage at scale, helping admins quickly find the users they need without manually working through large rosters.

AI Phishing Coach admins can now assign Video Training to specific AD / Entra ID groups, Google Groups, or departments instead of manually selecting and maintaining recipients. As employees join or leave a targeted group or department, they are automatically added to or removed from the training assignment.

This gives admins more control over who receives training while making targeted programs easier to manage at scale. Training stays aligned with changing teams and organizational structures without requiring admins to continually update recipient lists.

Weekly Detection Enhancements - Week of September 18

• Strengthened detection of internal account takeover, using sender-behavior signals to catch hijacked accounts blasting phishing links to unfamiliar domains

• Enhanced detection of file-share phishing from unknown senders that abuse SharePoint

Infiltration Prevention admins can now download a PDF report for an individual flagged applicant. The report summarizes what prompted the review, the applicant’s identity and standing, and the supporting evidence in clear language.

This gives security teams a simple way to share relevant findings with people or HR teams without requiring them to access the Abnormal Portal.

Infiltration Prevention admins can now filter flagged candidates by one or more flag reasons, such as Submission via VPN or Known Threat Indicator. The new Filter By control works alongside existing filters, and CSV exports reflect the filtered results.

This makes it easier to investigate groups of candidates associated with the same underlying signal without reviewing the flagged candidate list row by row.

The AI Governance browser extension can now detect ChatGPT conversations from personal, free, and logged-out accounts and distinguish personal usage from enterprise usage. Captured conversations are also analyzed for sensitive-data exposure.

This closes an important visibility gap by helping teams understand AI usage that enterprise provider APIs alone cannot see.

AI Governance Chat Insights can now read and analyze text and images within files attached to ChatGPT and Claude conversations. Previously, AI Governance could identify that a file was attached but could not inspect its contents.

This extends visibility beyond chat text, helping teams identify sensitive information employees may be sharing with AI tools through uploaded files.

AI Governance can now send events to existing SIEM or SOAR destinations when new AI tools are discovered, governance statuses change, or risk incidents are updated. It can also provide block and unblock instructions for customer-managed enforcement workflows.

This helps teams operationalize AI Governance without requiring analysts to continuously monitor another security console.

Weekly Detection Enhancements - Week of September 11

• Enhanced detection of credential-phishing lures disguised as fake voicemail and media-player attachments

• Added detections for HR-themed phishing sent from compromised internal accounts at educational institutions

• Added detections for password-spray attacks that succeed on dormant, unmonitored shared mailboxes

AI Phishing Coach admins can configure allowed simulation types and employee impersonation at the Group schedule level, making it possible to tailor attack mixes for different AD groups and departments instead of being tied solely to a Global schedule. (i.e. Finance only receives Credential phishing while HR receives BEC and VEC).

This gives admins more granular control over which attack types different employee groups receive. As different threats often target different parts of the organization disproportionately, programs must reflect that reality.

Admins can switch to a new thumbnail-based Grid view in the Attack Library to visually scan attacks and enable or disable them without opening each attack individually. Every simulation (either automatically created by AI Phishing Coach or built via Attack Creator) displays at once right in the Attack Library without extra clicks, saving time and extra steps when curating custom campaigns.

Weekly Detection Enhancements - Week of September 4

• Enhanced detection of BEC and wire-fraud campaigns with new machine-learning models and feature extraction logic.

• Expanded phishing and investment-fraud detection to catch attacks using rare domain extensions.

• Deployed a dedicated machine-learning model to catch QR-code phishing in messages and attachments.

Infiltration Prevention admins can now apply a review decision across an entire cluster of related applicants instead of reviewing each person individually. Admins can also hide clusters they have already handled while keeping them accessible for future reference.

This reduces repetitive investigation work and makes it easier to manage coordinated groups of suspicious applicants at scale.

Control Center gives security teams two ways to apply organization-specific control alongside Abnormal’s behavioral AI. Describe patterns in natural language with Custom AI Models, or define precise conditions across more than 50 message attributes with Custom Rules. Test both against your own email before launch, then use Passive Mode to validate results before moving to Active Mode.

Custom AI Models are now generally available to all Abnormal customers at no additional cost. Custom Rules are available in Early Access.

Learn more about Control Center

AI Phishing Coach now gives security teams more control without sacrificing the automation that saves hours or the personalization that catalyzes behavior change. Create custom simulations, campaigns, and training videos in minutes with generative AI, or let Precision Training do the work for you, calibrating simulation type, frequency, and difficulty to each employee’s phishing risk score and past interactions. Plus, with new QR-code simulations and in-thread follow-ups, teams have even more ways to deliver realistic simulations and training content to build better security habits.