Founded in 1901, The Southport School (TSS) is a leading Anglican day and boarding school for boys on Queensland’s Gold Coast, serving Prep to Year 12. Known for its strong academics and holistic approach to boys’ education, TSS combines innovative teaching, leadership development, and co-curricular excellence in a diverse community of more than 1,700 students.

Over two decades at TSS, CIO Richard Humphreys has seen cyber risk evolve into one of the school’s most significant operational risks as systems moved to the cloud and identity became the new perimeter. Email remained the primary entry point for attacks, but as threat actors shifted from malware to increasingly sophisticated social engineering, TSS recognized that traditional secure email gateways (SEG) were no longer enough. Mimecast improved security when it was first deployed, but advanced threats still bypassed its static rules and signatures. The SEG also limited visibility within Microsoft 365, delaying broader security, compliance, and data governance initiatives.

Abnormal gave TSS a modern, cloud-native alternative to rules-based email security. Instead of relying on static rules and signatures, Abnormal uses behavioral AI to understand how users communicate, who they interact with, and what “normal” looks like across the organization. This enables Abnormal to detect and remediate the sophisticated threats targeting TSS, including BEC, impersonation, and vendor fraud. Abnormal has restored native Microsoft 365 mail flow, improving the school’s visibility across its broader security stack.

TSS continues to invest in Abnormal because it delivers outcomes the school could not achieve with a traditional SEG. Abnormal stops the impersonation and phishing attempts that previously reached staff inboxes, particularly those targeting executives and finance workflows. The IT team spends less time releasing held messages, troubleshooting false positives, and tuning brittle rules, and more time on strategic work like its Microsoft Purview program.

Additionally, Abnormal’s Email Productivity automatically sorts graymail into a dedicated promotions folder based on user preferences, allowing them to better focus on important messages. And with native Microsoft 365 mail flow restored, Defender and Purview now see the full email signal, enabling consistent sensitivity labelling, data loss prevention, and encryption and strengthening TSS’s overall security posture.

For TSS, adopting Abnormal was about more than replacing one email security tool with another. It marked a shift from perimeter-centric, gateway-based security to an AI-driven, cloud-native model aligned to Zero Trust and identity-first principles. With Abnormal, TSS has stronger protection against impersonation and BEC, better visibility across its environment, and a more streamlined architecture that enables long-term data governance and compliance.