How to Use Abnormal Security in 2026: Step-by-Step Guide

Abnormal Security addresses the biggest gap in enterprise email security: attacks that don't use malicious links or attachments — business email compromise (BEC), vendor fraud, and social engineering attacks that use clean domains, convincing language, and no traditional IOCs.

Why Traditional Email Security Fails

Secure Email Gateways (SEGs) like Proofpoint and Mimecast rely on known threat indicators — malicious URLs, suspicious domains, known malware signatures. BEC attacks use none of these. A CFO receives a convincing email from an attacker impersonating the CEO asking to wire money to a new vendor — the email comes from a clean domain, uses perfect English, and contains no malicious links. Traditional tools miss it.

Behavioral AI Baseline

Abnormal Security builds a behavioral baseline for every person in your organization — email communication patterns, typical senders, normal request types, writing style, business relationships. When an email deviates from baseline (an unfamiliar sender requesting financial action, an unusual wire transfer request, a vendor claiming a new bank account), Abnormal flags it regardless of technical indicators.

Identity Analysis

Abnormal analyzes the full identity context around every email: Is this sender's domain newly registered? Does the email header match the display name? Has this sender ever corresponded with this recipient before? Does the request pattern match previous interactions? Identity analysis catches impersonation attacks where the display name looks right but the underlying domain is wrong.

Attack Detection Types

Abnormal covers: business email compromise, phishing, vendor email compromise, payroll diversion, credential harvesting, account takeover (detecting compromised legitimate accounts), and supply chain fraud.

Remediation

When Abnormal detects an attack, it can automatically remediate — removing the email from all recipients' inboxes, notifying security teams, and providing attack analysis. The post-attack report explains exactly what happened, who was targeted, and what indicators triggered the detection.

Pricing

Abnormal Security pricing is per-mailbox per-month. Typical pricing ranges from $3-8/mailbox/month depending on modules and contract size. Enterprise deployments start at several hundred thousand dollars annually.