Homepage

Breadcrumbs

Abnormal AI provides advanced email security to prevent credential phishing, business email compromise, account takeover, and more.

Abnormal AI

Abnormal AI provides advanced cloud email security to prevent credential phishing, business email compromise, account takeover, and more.

What's New? Product Updates

description

security,privacy,email security,cloud email security,phishing protection

keywords

https://images.abnormalsecurity.com/production/images/L_Abnormal-homepage_Opengraph.png?w=1200&h=630&q=82&auto=format&fit=crop&dm=1740090372&s=5d61b4c2e242be3ca70dfe1d54859b11

referrer

robots

twitter:card

twitter:creator

twitter:description

twitter:image

twitter:image:alt

twitter:image:height

twitter:image:width

twitter:site

twitter:title

{"title":{"title":"What's New? Product Updates | Abnormal AI"}}

Learn about recent enhancements, updates, add-ons, and new products in our AI-native email security platform.

What's New

Named a 2025 Gartner® Peer Insights™ Customers’ Choice for Email Security

vs Mimecast

vs Avanan

Secondary CTA

Whether FormComplete is utilized on a form

FormComplete

CTA Display

What text is displayed on the primary CTA (see sheet for details on copy)

Primary CTA Text

Form Columns

chakra-ui-ChakraProvider

BladesDynamicHeroBlade

Button

EntriesCardWhatsNew

Select

BladesDynamicContentSections

Pagination

PagePropsProvider

Overlay

EmbeddedVideo

Divider

SocialShare

FormComponent

EntriesFilteringWhatsNew

Footer

Container

OptionGroup

Option

WhatsNewMainPage

Prose

HeaderSpacing

FormFields

SearchInput

Screen

PrimaryCtaText

FormColumns

CtaDisplay

VsMimecast

SecondaryCta

VsAvanan

Abnormal Solutions

react-awesome-reveal

lottie-react

date-fns

plasmic-nav

react-scroll-parallax-global

plasmic-embed-css

Abnormal Pages

loading-boundary

plasmic-query

plasmic-basic-components

Abnormal Legal

Abnormal Why Abnormal

Abnormal Landing Pages

react-aria

plasmic-rich-components

Abnormal Partners

Abnormal Products

Abnormal Design System

Abnormal Marketing

antd5 hostless

react-slick

As Microsoft 365 environments become more complex, accidental misconfigurations are now a leading cause of cloud email vulnerabilities. The growing number of applications, layered settings, and fragmented ownership create blind spots and accidental openings that threat actors like Midnight Blizzard have exploited in the past.
The new Security Posture Management (SPM) add-on continuously detects misconfigurations across your users, apps, and tenants, giving your security teams the visibility and control they need to stay ahead of attackers. Now Available.

Security Posture Management

Continuously find and fix critical Microsoft 365 misconfigurations across your cloud email environment.

Announcing Security Posture Management for Microsoft 365

Major Release

Customers now have complete control to configure safelists and/or blocklists directly within URL Settings in the Abnormal Portal. 
To add a domain or URL:<ul><li>Navigate to Settings &gt; Message Remediation </li><li>Click on the URL Rewriting tab</li><li>Click ‘Add Entry’ for URL Rewriting Safelist and Blocklist</li></ul>
<img src="https://images.abnormalsecurity.com/production/files/safelist_blocklist-feature.png?w=768&q=82&auto=format&fit=clip&dm=1754322979&s=c480c1d176e27f56157caec23d8b68e1" alt="URL Rewriting Safelist and Blocklist" />

Note: URL Rewriting is not currently available for Gyre or Google Workspace customers.

Inbound Email Security

Customers now have complete control to configure safelists and/or blocklists directly within URL Settings in the Abnormal Portal.

URL Rewriting: Safelisting and Blocklisting Self-Service

Functional Release

We’ve redesigned the Just-in-Time coaching pages in AI Phishing Coach to make them more engaging and easier to understand. The updated experience includes clearer structure, richer visuals, and stronger alignment between the simulation email and the coaching content. It also highlights behavioral insights more prominently to help users understand why the simulation was relevant to their role. This update addresses key customer feedback and is especially impactful for coaching senior employees more effectively.

AI Phishing Coach

The Just-in-Time coaching experience now features a more visual, structured, and personalized design to better engage end users and reinforce trust in training.

Enhanced Just-in-Time Coaching Experience in AI Phishing Coach

Enhancement

Abnormal now continuously analyzes login history using newly identified indicators of compromise (IOCs). When a historical login matches emerging IOCs, Abnormal automatically updates existing ATO case confidence levels and provides enriched threat context to help accelerate investigation.
This update to ATO leverages signals across the Abnormal customer base to strengthen case accuracy over time, which helps security teams detect and respond to threats with greater confidence.
Now Available.

Account Takeover Protection

Boost Account Takeover (ATO) detection confidence based on newly available intelligence about threat indicators.

Automated Threat Hunter for Account Takeover Protection

Enhance reliability and simplify deployment with direct push-based delivery.
Abnormal now offers a push-based integration for Microsoft Sentinel, allowing you to stream security event data directly into your Log Analytics Workspace without relying on polling or custom Function Apps.
This update eliminates missed events, reduces configuration complexity from multiple components to just a Log Analytics Workspace, and expands data coverage to include Vendor Cases, Posture Changes, and Audit Logs. It is available alongside our existing pull-based model, giving you more flexibility in how you connect to Sentinel.
Now available.

Streamline your Sentinel deployment with our new push-based integration for faster setup, broader coverage, and greater reliability.

Microsoft Sentinel Push Integration

Third-Party Integration

You can now mark Safe messages as Spam directly from the AI Security Mailbox for more accurate message classification and improved threat reporting.
To use this feature:
<ul><li dir="ltr">Select a Safe message in AI Security Mailbox </li><li dir="ltr">Click ‘Spam’ → Remediate </li><li dir="ltr">The message will be marked as Spam across the portal</li></ul>
This update gives security teams greater control over how reported messages are categorized.

AI Security Mailbox

Reclassify Safe messages as Spam in AI Security Mailbox for sharper detection and more accurate reporting.

Remediate Safe Messages as Spam in AISM

Abnormal’s behavioral AI now protects Microsoft Teams messages in EU environments, detecting malicious links in both chats and channels with the same precision it brings to email.
All flagged messages surface in the Threat Log, giving your team a unified view across communication channels and accelerating response times. Learn more about our Microsoft Teams Messagings Security <a href="https://abnormal.ai/products/messaging-security">here</a>.

Messaging Security

Teams protection now available in EU with precise detection of malicious links in chats and channels.

Microsoft Teams Messaging Security is now available in the EU

You now have enhanced control over URL Rewriting deployment by enabling the feature for specific user groups instead of applying it tenant-wide.
To use this feature:
<ul><li>Configure an Microsoft Entra ID (Active Directory) group to define users</li><li>Select 'Custom' within URL Rewriting settings</li><li>Select 'Enable for a subset of users'</li><li>Add the Active Directory group</li></ul>
Note: This feature is currently available for M365 only. Google Workspace is not supported at this time.

Gain more control with URL Rewriting now configurable for specific user groups.

User Group Subsetting for URL Rewriting

You can now add images or logos to the header or footer of your GenAI responses in AI Security Mailbox. This enhancement supports branding requirements and helps end users identify legitimate emails.
To add an image:
<ol><li dir="ltr">Navigate to Step 1: Configure your AI Security Analyst and select Insert Images</li><li dir="ltr">Upload your desired image or logo</li><li dir="ltr">Preview the result in Step 3: Deploy to Your Security Mailbox</li></ol>
Note: Images can only be placed in the header or footer due to the dynamic nature of GenAI responses.

Add logos or images to AI Security Mailbox responses to support branding and boost user trust.

Customize GenAI Responses with Images and Logos

Several new features will be enabled to all Inbound Email Security customers on a rolling basis the week of May 12. These features include: 
<ul><li>Download a CSV export of Search and Respond results.</li><li>Option to remediate messages to a user's inbox directly from Search &amp; Respond, including when selecting bulk remediation.</li><li>Added a judgement column to the Search &amp; Respond table, with the ability to filter results based on judgement type.</li><li>Enhanced the message details shown when clicking into an individual message.</li></ul>
These features are intended to increase efficiency and streamline user workflows, while continuing to offer visibility for Abnormal users.

Platform

Search & Respond now supports CSV exports, inbox remediation, judgment filtering, and richer message details to streamline your workflow.

New Features in Search and Respond

You can now upload a .CSV file to contribute misclassification feedback. To upload a file:<ol><li>Navigate to Detection 360 and select 'CSV Upload'.</li><li>Select a report category.</li><li>Use the provided template to ensure correct formatting. </li></ol>

D360

Submit misclassification feedback at scale with new CSV upload support in Detection 360.

Bulk Upload Misclassifications in Detection 360 via CSV

AI Phishing Coach (New Add-On Module) Security awareness training gets an AI overhaul. AI Phishing Coach is a fully autonomous, agentic security awareness training platform delivering hyper-personalized phishing simulations based on real attacks, just-in-time generative AI coaching when employees report or fail a simulation, and AI-generated video training content tailored to your organization.
AI Data Analyst (Free for All Customers) Meet your always-on AI analyst. This new generative AI agent is easily asked through the “Reports” section of our Portal, allowing you to ask questions like “What were our top threats this quarter?” or “How many phishing attacks did we stop last month?” and quickly receive executive-ready reports and clear security insights bespoke to your organization.
Three Core Platform Upgrades (Free for All Customers)
<ul><li>Quarantine Release: View Microsoft-quarantined messages directly in the Abnormal portal through Search &amp; Respond. </li><li>Enterprise Remediation Settings: Customize remediation actions and folders by threat category to align with your risk tolerance. </li><li>URL Rewriting: Warn users before they click suspicious links and enable optional click tracking.</li></ul>

Our biggest release yet delivers autonomous security training, your own AI-powered analyst, and powerful new platform controls.

RSA 2025: Major Product Launches and Platform Upgrades Now Live

False positives that follow repeat patterns create repeat work. With Automated Repeat False Positive Prevention, you can now provide targeted feedback when reporting false positives to automatically prevent similar alerts from recurring.
When marking an ATO case as "Incorrect Detection" or "Undetermined Cause," you'll now see options to safelist specific indicators of compromise (IOCs) associated with that user. These options include:
<ul><li dir="ltr">Location: Safelist activity from specific countries or, for US activity, specific states</li><li dir="ltr">IP Address: Safelist specific IP addresses for known legitimate access points</li><li dir="ltr">VPN Usage: Safelist VPN connections for users who legitimately require them</li></ul>
Each safelist is applied at the user level for a period of several months to prevent alert recurrence while maintaining security. This customization is particularly valuable for organizations with global workforces or unique access patterns that might otherwise trigger false positives

Cut down on repeat false positives with user-level safelisting for IPs, locations, and VPNs now available in ATO case feedback.

Automated Repeat False Positive Prevention in Account Takeover Protection

In the rare instance that an employee does interact with a phishing email and falls victim to an account compromise, ATO now helps surface those emails directly in the Case timeline—highlighting up to five messages that likely contributed to the breach.
This enhancement provides deeper context for investigations, giving security teams a clearer understanding of how access was gained and when. It also helps uncover potential patterns that may indicate a larger campaign targeting other employees.

ATO Case timelines now highlight phishing emails linked to account compromise, giving you clearer insight into how breaches occur.

Emails Associated With Suspicious Sign-Ins in Account Takeover Case Timeline

We’ve made two changes to the GenAI responses configuration page to make it easier to customize your GenAI email responses for AI Security Mailbox.
Subject Line Variables Now Visible in the UI
You can now customize your GenAI email subject lines using supported variables—clearly displayed in the UI. Just click and choose from the “Available Variables” provided.
<img src="https://images.abnormalsecurity.com/production/images/unnamed_2025-04-09-230910_gowt.png?w=768&q=82&auto=format&fit=clip&dm=1744240151&s=1e7f540147473d20b22c7916e39b33b3" alt="" />
 AI Disclaimer Now Customizable
The disclaimer at the bottom of GenAI emails is now editable—with one key requirement: the line “This and the following content is powered by AI” is required and fixed. Everything else is fully editable (up to 500 characters) and text updates auto-save when customers click out of the box. 
<img src="https://images.abnormalsecurity.com/production/images/unnamed-1_2025-04-09-230934_xpow.png?w=768&q=82&auto=format&fit=clip&dm=1744240180&s=8d9ad87bc6a30fcb762f4d32be628a6b" alt="" />

Customize GenAI subject lines with new variable options and tailor your AI disclaimer for a more branded user experience.

Customizable Subject Lines and Disclaimers for GenAI Email Responses

Investigating account compromise requires a precise understanding of attacker behaviors and tactics. With GenAI Case Summaries, you now get a clear, plain-language explanation of every ATO Case—automatically. 
Out with the old descriptions that could often lack clarity of language and in with the new, AI-powered paradigm. Each Case includes a concise headline detailing attacker activity, a bulleted summary of tactics and key signals used in determining compromise, and user-specific context highlighting how this pattern of activity deviates from typical user behaviors. 
Whether it’s high, medium, or low confidence, the summary helps you understand what happened and why it matters—fast.
There’s nothing to enable—GenAI Case Summaries are available in the portal today, so you can start making sense of suspicious activity without the guesswork.<img src="https://images.abnormalsecurity.com/production/images/ATO-Gen-AI.png?w=512&h=225&auto=compress%2Cformat&fit=crop&dm=1743603991&s=671f542ef4c6fe6082b5447747a48603" alt="" />

GenAI Case Summaries bring clear, plain-language explanations to every ATO Case so you can understand attacker activity faster and with less guesswork.

GenAI Case Summaries in Account Takeover Protection

Adopting new technology can feel like a leap, but we’ve made it seamless with our phased rollout for GenAI auto-responses. What’s changed?
You can now enable GenAI auto-responses for up to 50 users, giving you the opportunity to test, familiarize yourself with the functionality, and meet change control requirements before transitioning your entire organization. This intentional subsetting approach ensures a smooth rollout and helps build confidence in the power of GenAI responses.
Ready to take the first step toward full-scale adoption? With Abnormal’s AI Security Mailbox settings, enabling GenAI Responses for select users has never been easier.

Test GenAI auto-responses with up to 50 users for a smooth, controlled rollout before scaling organization-wide.

Enabling GenAI Auto-Response Subsetting for AI Security Mailbox

We’ve introduced a powerful new filter for Account Takeover Protection Cases: the ability to sort by trigger signal.
This feature allows you to quickly organize and prioritize Cases based on the specific attack tactic detected. It’s designed to help you better respond to threats and identify Cases of compromise that may be part of the same attack, building on recent updates to filtering and search capabilities for even greater precision in managing account takeover risks.

Quickly sort ATO Cases by trigger signal to prioritize threats and spot patterns across related attacks.

Trigger Signal Filtering in Account Takeover Protection

When an account is compromised, there is no time to waste. Knowing this, we have evolved the listview in our Account Takeover Protection solution from a simple log to a dynamic incident queue. What does this mean?
To help quickly sort for the most critical identity incidents, the list view will now highlight high and medium confidence cases by default and allow you to filter the listview by Remediation status.
Additionally, Account Takeover Protection’s search functionality now allows for partial search terms rather than exact match, making it easier to find and investigate specific Cases.

The ATO list view is now a dynamic incident queue with new filters, default sorting by case severity, and improved search for faster investigations.

Dynamic Incident Queue and Enhanced Search in Account Takeover Protection

New tactics like session hijacking have made it easier than ever for attackers to compromise cloud email accounts, and Abnormal’s Core Account Takeover solution has long been effective at stopping such threats in Microsoft environments.
While Abnormal could detect compromised users in Google Workspace, it lacked the ability to remediate those accounts—a key step in the response process.
Today, we are pleased to announce the release of identity remediation for Google Workspace. Abnormal customers can now:
<ul><li dir="ltr">Automatically suspend Google access and force password resets for high-severity account takeover incidents.</li><li dir="ltr">Block account access with a single click through PeopleBase for users who appear suspicious but haven’t been confirmed as compromised over the course of typical threat-hunting activities.</li></ul>

Abnormal now supports identity remediation for Google Workspace so you can suspend access or force password resets during ATO incidents.

Extending Identity Remediation to Google Workspace to Stop Suspicious and Compromised Users

According to Okta, 34% of authentication traffic is malicious. Alarmingly, attackers are targeting Okta with highly sophisticated tactics and with increasing frequency.
Abnormal has been detecting suspicious and compromised users in Okta for two years, helping hundreds of customers gain greater visibility into threats to their cloud identities. Today, we are excited to announce Okta identity remediation to bolster threat hunting and streamline incident response.
Abnormal customers using the Okta API key integration can now:
<ul><li dir="ltr">Automatically suspend Okta access and force password resets for high-severity account takeover incidents.</li><li dir="ltr">Block account access with a single click through PeopleBase for users who appear suspicious but haven’t been confirmed as compromised over the course of typical threat-hunting activities.</li></ul>

Abnormal now enables identity remediation for Okta so you can suspend access or reset passwords to stop account compromise faster.

Expanding Okta Protections From Detection to Response With New Identity Remediation

When it comes to graymail, every organization is different and requires unique configurations. Abnormal has enhanced its Email Productivity solution to reflect this requirement.
Abnormal has introduced self-service configuration to give organizations (and end users) greater control over their inboxes and the graymail that often clutters it. These new self-service options allow you to:
<ul><li dir="ltr">Configure between modes: Passive mode allows you to specify an AD or Google Group that will use Email Productivity and Active mode enables for all email end users but allows you to specify exclusions</li></ul>
<img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfPu_SJurxnivMqLADaLVE48V3QsHoZsWKg0IphSMd9bgK87OPRuFsNkSjAfkMojIfkDF731AFCtXMVplb5HrlS0m0MeRnVKlNOD_Ai67_qdnp5RTLYdlWt4KBiSwJ6Dxi2pyoC?key=sWkOHpEx-btljuwBQMgcUG0f" width="474" height="162" alt="" />
 <ul><li dir="ltr">Grant or revoke the ability of end-users to create graymail safelists or blocklists</li></ul><div> </div><figure dir="ltr"><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdJkruq-4tsJHyt7qOUE55UPHUGCNLX0PBFBNFD8uPctT5HyFAyx_ORSmQmNbLMvcOdSymNx6vjMn1usSfIINXdjvns_9xDp3bvT_5qgfE5Rvmhv1-mqydRz9Rjgn995T0Z2x0m?key=sWkOHpEx-btljuwBQMgcUG0f" width="624" height="148" alt="" /><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdu6yPOO94AwsZzRWoGU7NnxUXOvg-KDpY2lae2wAnYbowtvnJo7zK6wrsnA7Qdebf4MB7Im769cec-y7fr4QiZXpe8OTkLioqlS6OfIxSo97XTPdLrfBpS4P64-yhmdn_9uwXomA?key=sWkOHpEx-btljuwBQMgcUG0f" width="624" height="139" alt="" /></figure>

Email Productivity

Email Productivity now includes self-service configuration so you can tailor graymail management to fit your organization’s needs.

Self-Service Configuration for Email Productivity

In the rare instance that Abnormal misses an attack, most customers use Search &amp; Respond to remediate and mark that email as a miss. The typical next step was to submit a separate ticket to Detection360 to report a False Negative to train and enhance Abnormal’s AI models.

Abnormal has now eliminated this extra step while expanding the value of Search &amp; Respond for not only hunting stray emails but strengthening the Abnormal product. Starting today, any email marked as a “missed attack” in Search &amp; Respond will give the option to automatically create a Detection360 case, instantly enriching the bespoke AI detection models developed for each customer.

Easily report false negatives directly from Search & Respond to help improve detection without submitting a separate ticket.

Introducing Detection360 Case Creation Directly Through Search & Respond

Cross-Product Integration

With multiple IT and Security teams and functions within a single organization using Abnormal—and often various subsidiaries with Abnormal sub-tenants managed by the parent organization—it is required that user management privileges be available to users beyond Portal administrators. In order to assign User Management capabilities to Custom Role users we have introduced two new permissions in a new User Management section:

Now, when a new custom role, non-admin user is created in Abnormal, administrators will have the option to grant user management privileges for a Portal feature or set of features—extending user provisioning and permissioning power but still maintaining appropriate access controls and adherence to organizational compliance requirements.

New User Management permissions let admins delegate provisioning and access control to custom role users while maintaining security and compliance.

Expansion of Abnormal RBAC with User Management for Custom Roles

PeopleBase and Account Takeover Protection now support the import and analysis of guest users across your connected mail, identity, and SaaS tenants, surfacing Notable Events that deviate from those users’ behavioral baselines—bolstering discovery and investigation of third-party threats to your cloud environment. 
Quickly determine when a third-party user has administrative access to a critical platform and enhance your threat hunting with deep behavioral insights.

PeopleBase and ATO now analyze guest users to surface risky behavior and uncover third-party threats across your cloud environment.

Third-Party Guest Users Analyzed in PeopleBase and Account Takeover Protection

Abnormal has added a new native integration with Rapid7 InsightIDR. The integration helps customers streamline threat analysis, reporting, and compliance needs by sending a variety of log events from Abnormal, including Email Threats, Account Takeover Activity, Abuse Mailbox Events, Audit Log Events, and Security Posture Management Events.

Abnormal now integrates with Rapid7 InsightIDR to stream log events for streamlined threat analysis, reporting, and compliance.

Rapid7 InsightIDR Integration

As Abnormal continues to fortify cloud identity protections, the next step is enhancing threat hunting workflows and ongoing investigations. 
While Abnormal can automate the hunt for compromised users with Account Takeover Protection, there are many reasons why a Microsoft 365 account should be disabled or user access revoked that do not fall into the realm of identity takeover by an external attacker (a known malicious insider or user who had left the organization but somehow maintained access, for instance). 
Now, directly through a user’s PeopleBase entry, all customers have the ability to manually suspend Microsoft 365 access:
<ul><li dir="ltr">Revoking active sessions</li><li dir="ltr">Disabling user accounts</li><li dir="ltr">Forcing password resets</li></ul>

You can now manually suspend Microsoft 365 access from PeopleBase to support broader threat response beyond account takeover.

Microsoft 365 Remediation in PeopleBase

When an employee reports an email as a phishing email, AI Security Mailbox leverages the AI detection engine to inspect and judge that message. If GenAI Responses are enabled, the AI Security Analyst will then respond to the reporter letting them know the classification of the reported message. Customers can now configure the AI Security Analyst to attach analyzed safe messages to the initial GenAI response email, allowing the reporter to interact with the determined safe email.

AI Security Mailbox can now attach analyzed safe messages to GenAI responses, giving reporters direct access to reviewed emails.

Attach Safe Emails to GenAI Responses

Google Workspace does not support configuring labels (folders) that are inaccessible to end-users. This includes the Trash label, which Abnormal currently remediates malicious emails to. Google customers can opt-in to a feature that remediates malicious messages to an inaccessible location by purging the initial email and storing a copy of it in internal data sources in case it needs to be restored.

Google customers can now opt in to purge-based remediation, storing malicious emails internally while keeping them hidden from end users.

Remediate Messages to an Inaccessible Location for Google Customers

When Abnormal processes messages, we perform a set of <a href="https://www.csoonline.com/article/564563/mastering-email-security-with-dmarc-spf-and-dkim.html">sender authentication checks</a> based on the protocols SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance). The results of these checks are displayed on the Email Details Page. Customers can now access this information as a new field in the Email Threats event type, allowing for ingestion into their SIEM integrations to extract relevant information to create incident response workflows. All this will be possible without having to manually access the Portal.

SPF, DKIM, and DMARC results are now included in Email Threats events for SIEM ingestion and automated incident response workflows.

Sender Authentication Results are Now Available in SIEM Events

Customers can already view Audit Logs in the Abnormal Portal and access data through our SIEM export events, but this information has historically not been available through our REST API. 
We are excited to expand our API functionality to include Abnormal Audit Logs. With this new Audit Log REST API endpoint, customers can ingest Abnormal Portal audit logs through the REST API and extract relevant information to create incident response workflows and alerts of suspicious user activity. All this will be possible without having to access audit logs in the Portal manually.

Abnormal Audit Logs are now accessible via REST API, enabling automated alerting and incident response without manual portal access.

New REST API Endpoint for Audit Log Data

Continuing the trend of new enhancements for Security Posture Management, status updates are now available for each posture change. While this may sound like a minor enhancement, this is an answer to a major customer need as Security Posture Management now allows security teams to coordinate a response to risky posture changes and ensure the entire team is appropriately notified of progress. 
Security teams can now track investigatory and remediation processes by labeling each risky posture change as:
<ul><li dir="ltr">“Needs review” for new or unread events</li><li dir="ltr">“In progress” if the team is currently investigating the change</li><li dir="ltr">“Acknowledged (resolved)” when a change has been corrected</li><li dir="ltr">“Acknowledged (not important)” for a change that was deemed to not be a risk</li></ul>
Further, any changes noted as “Acknowledged (not important)” will serve to enrich Abnormal’s AI models, refining future detections.

Security Posture Management now includes status tracking for posture changes, helping teams coordinate response and improve future detections.

Event Status Labels for Security Posture Management

An in-portal view of customer Success Criteria provides continuous insight into the value customers derive from the Abnormal platform. Using this feature, you can now communicate to us the value you derive from the Abnormal platform, grade what is most important to your organization, evaluate current performance, and leave any notes. <ol><li dir="ltr">Success Criteria: Portal admins can consider and capture how important each value statement is for your organization, and evaluate Abnormal’s current performance.</li><li dir="ltr">Feedback: Portal admins can share feedback based on success criteria evaluation with their Abnormal team.</li><li dir="ltr">In-Portal User Experience: Portal admins receive a personalized, in-product experience that represents the unique value of their Abnormal investment.</li></ol>

Success Criteria

AI Security Mailbox is a transformational AI upgrade to our former Abuse Mailbox Automation product. AI Security Mailbox leverages AI to automatically triage, remediate, and respond to user-reported phishing emails to enhance security operations and improve security awareness.
AI Security Mailbox has two distinct but related AI capabilities:

Personal AI Cyber Assistant for Every Employee

AI Security Mailbox introduces a new way to respond to reporters of phishing emails with more detailed and insightful responses. Customers can quickly enable GenAI Responses and configure the AI Security Analyst with a custom name and instructions. Customers can also chat with the AI Security Analyst to see how it performs based on the custom instructions provided. Once the configuration is complete, the AI Security Mailbox will respond with the classification of the reported message and provide additional context to educate the reporter.

AI Security Mailbox is now generally available, combining autonomous triage with personalized GenAI responses to transform user-reported phishing workflows.

What's New

Get the Latest Insights