Modern Architecture For Modern Protection

Abnormal AI vs. Check Point(Avanan)

Abnormal is purpose-built for the modern cloud email environment with a pure API architecture that is designed to block advanced attacks—without rerouting mail, delaying delivery, or increasing operational burden.

The Result

Streamlined Protection That Detects Advanced Attacks

Advanced Protection Requires Deep Behavioral Analysis

Modern email attacks rarely contain known-bad indicators of compromise. Instead, cybercriminals are exploiting trust, legitimate infrastructure, and security blind spots through socially engineered attacks. Abnormal has witnessed threat actors:

Use QR codes and social engineering, not payloads.
Launch attacks from compromised internal and vendor accounts.
Abuse OAuth tokens and bypass MFA.

Abnormal’s AI Ingests Over 50,000 Behavioral Signals

Abnormal’s Behavioral AI is a key advantage in how we protect our customers.

Our AI ingests over 50,000 behavioral signals such as natural language indicators (tone, urgency, topic), third-party app permissions, mail configuration changes, device and location telemetry, attachment and URL characteristics.
Comprehensive AI analysis baselines known-good behavior within the customer tenant.
This allows us to detect subtle, intent-based anomalies and remediate threats before user interaction.

Check Point’s AI Relies on Known-Bad IOCs

Check Point’s AI primarily uses known-bad threats and predefined threat signatures to protect customers.

This includes known-bad static inputs like IOCs, regex patterns, and threat intelligence.
Their documentation does not call out unique user behavioral baselines over time.
This detection approach may have challenges in detecting attacks without IOCs—like advanced business email compromise (BEC) and vendor email compromise (VEC).

Source

Read more about how Abnormal’s Behavioral AI was able to detect and remediate advanced phishing and fraud attacks that Check Point missed in this blog

Abnormal’s Advanced Protection

Pure API Architecture Enhances Detection and Response

Abnormal’s pure API deployment is designed to:

Remediate threats before user interaction.
Not disrupt mail flow or interfere with Microsoft-native protections.
Preserve privacy by not storing legitimate communications.

Check Point falsely claims to have the same API architecture as Abnormal. In reality, they use transport rules and leverage the API for post-delivery remediation that has a documented five minute delay. Source

Identical Pre- and Post-Sales Experience

Abnormal’s Proof of Value (POV) is identical to the experience our customers receive in production:

Typical deployments take a couple of clicks.
The same API-based architecture powers both our POVs and customer environments.
No hidden changes. No surprises.

Check Point uses a journaling approach during the POV, but then typically shifts to an inline architecture when the prospect becomes a customer.

How Abnormal Delivers on Key Customer Needs Compared to Check Point