Slow Iteration, Low Early Precision
Shipping detection products is one of the hardest challenges in cybersecurity, especially when balancing accuracy and velocity. Amal Bhatnagar, Senior Data Scientist at Abnormal, tackled that challenge head-on with a new AI-driven workflow for the company's Outbound Email Security (MEP) product.
The result was improved detection, faster time-to-production, and a scalable blueprint for how AI can accelerate zero-to-one product development across Abnormal.
Zero-to-one detection products often start as experiments. They need to move fast to capture opportunities — but speed without validation can be costly.
When Amal joined the MEP team, the product was in early development, and the path to a production-ready release was slow. The challenges were clear:
- Low initial precision: Early models required substantial tuning before results were usable.
- Long development cycles: It took 3–4 weeks to go from idea to production.
- Limited validation: Early MVPs skipped testing steps, which slowed the path to a reliable release.
The result was product delays and slow experimentation velocity. Amal knew AI could change that.
An AI-Enabled Detection Workflow
Amal redefined the MEP development process by embedding AI and data science into every stage of the workflow, from ideation to production.
Here's how it works:
- Collaborates with Product to describe desired features and use cases in plain English — no code required to capture intent, logic, and edge cases before any implementation begins.
- Feeds the requirements into AI coding tools to generate candidate detection logic and deployment-ready scripts, then adapts and refines the generated code to fit Abnormal's infrastructure.
- Runs AI-generated detection models on sample data to simulate false positive rates and collects immediate feedback from Product teams to confirm true vs. false positives before anything reaches production.
- Uses AI to rewrite and clarify code, summarize logic, and generate documentation for engineering handoff, improving reproducibility and accelerating the path from MVP to productionization.
This new workflow created a tight human-in-the-loop cycle: Product provides intent, AI generates the first version, and Data Science validates and improves it using structured feedback.
Faster, Smarter, and More Accurate Detection
The results from this new AI-driven workflow were immediate and measurable.
- Feature validation time fell from 3–4 weeks to just 1–2 days.
- Idea-to-production cycles compressed from weeks to days, end to end.
By Q4, the team could identify, validate, and ship detection logic in a single day — something previously impossible without AI.
Validation runs showed a marked improvement in precision, confirmed by Product review of flagged messages. The workflow also became a reliable product unblocker, moving MEP out of the experimental phase and serving as a model for future Abnormal detection teams.
AI as a Multiplier for Human Insight
This system doesn't replace human expertise — it amplifies it.
- AI speeds up generation: AI coding tools handle boilerplate code and MVP creation.
- Humans validate nuance: Product and Data Science teams provide real-world feedback to correct and refine outputs.
- Documentation happens automatically: Each iteration produces clean, shareable context for engineering handoff.
The end result is a hybrid workflow where AI handles repetitive coding and analysis, freeing experts to focus on validation, interpretation, and innovation.
Redefining Zero-to-One Development
What started as a fix for one product has become a model for all early-stage detection work at Abnormal.
This approach has already:
- Sustainability improved detection precision.
- Expanded detection coverage with a batch of new features in a single quarter.
- Improved collaboration between Data Science, Product, and Engineering, thanks to AI-generated documentation.
Scaling AI Across Detection Products
The success of MEP's AI-enabled workflow is shaping Abnormal's approach to other detection teams. The next phase will explore:
- Extending the workflow beyond its current rule-based starting point.
- Automating validation using historical performance data and simulated edge cases.
- Standardizing AI documentation across teams to streamline productization.
As AI continues to accelerate how detection logic is designed, validated, and deployed, the line between ideation and production will keep shrinking — and Abnormal's detection products will become even more adaptive, precise, and intelligent.
What Makes the AI Experimentation Engine Awesome
Amal's work on the MEP detection workflow is a masterclass in applied AI innovation. By combining deep data science expertise with the creative use of generative AI tools, he built a repeatable process that turns slow, error-prone development into a rapid, data-backed feedback loop.
It's a powerful example of Abnormal's culture in action, where AI doesn't just assist in building products — it transforms how they're built.