In 1958, Clatsop Community College (CCC) became Astoria, Oregon’s first school to offer vocational training and college prep. Overlooking the Columbia River, CCC's maritime program trains students on its boat for commercial fleet work. The school also partners with the US Coast Guard to provide continuing education for its captains. CCC has a unique two-year RN program and programs in other fields that are essential for a thriving community, such as automotive repair, welding, and firefighting.

Securing CCC's Microsoft 365 email system was a constant challenge due to ongoing student-related email attacks. "Scammers used to apply, get a student email address, use it to sign up for streaming services, and then resell the address," said Thomas Ank, Director of Computer Services and Information Security. "Now they go after student aid. They apply online, attend enough virtual classes to claim the funds, and then vanish, or they target our students for Pell Grant data," he added. Ank's team includes one full-time developer, one part-time staffer, and student workers, but most of the detection, remediation, and system tuning fell to Ank, even with M365's native security tools.

“If a great product does just one thing, I probably won't buy it, and a product that spots attacks but doesn't fix them just gives me more work to do. Abnormal gives us multiple kinds of value, including autoremediation. That has entirely shifted what I expect from vendors.”
- Thomas Ank, Director of Computer Services and Information Security

Ank wanted a solution that would better protect student email accounts from phishing and scams, but doubted he could find one, especially one that would fit the college’s budget. "My old salesperson called me up and said he had something for me—Abnormal AI. I figured 'Well, if it's junk, at least I'll get lunch,' but I was impressed." The POV that followed took less than ten minutes to set up, and Abnormal delivered results right away. "Within the first couple of hours, we got hit with a large-scale phishing for bank account information attack. It got through Defender and two other security layers, but Abnormal spotted it. That was pretty much when we decided," Ank said.

Abnormal has resolved CCC’s phishing and spam issues, with no false positives in the first 60 days, Ank noted. “Now I am concerned that with so few malicious emails coming in, users might let their guard down. So, I’m cranking up the testing cycle,” he added.

Ank said Abnormal’s ATO monitoring solution has been useful in an unexpected way. “We use it to watch for takeovers, and it also works for something that Abnormal probably didn't design it for—finding scammer email accounts that never should have been created,” he said. Instead of manually reviewing email accounts to look for those with high volumes of message forwards, Ank now reviews the ATO dashboard to see those indicators, along with others such as whether a VPN was used when the account was created. Then he can investigate further and shut down the fake accounts faster than before.

“When I first learned about Abnormal's graymail filter, I thought it was going to be one of those ho-hum features that people don't really notice. Instead, I'm getting people coming to me saying, ‘Thank you, thank you, thank you! My email box is clean,’ and happy users make me happy.”
- Thomas Ank, Director of Computer Services and Information Security

Ank now spends less time on email issues, thanks to Abnormal’s human behavior AI and responsive team members. "My questions get answered immediately," he said. "But I haven't needed a lot of support because Abnormal works 24 hours a day, 7 days a week. It doesn't get tired and make mistakes." Now that phishing, spam, and graymail messages don't reach user inboxes, Ank has more time to spot bad accounts, which is also faster with Abnormal's ATO data. "Abnormal does so much for us,” he said. “It's made a huge difference in what we can do with the resources we have."