How Abnormal AI Uses Behavioral AI to Detect Hidden Email Threats

Email is still where many attacks begin, but the way those attacks show up has changed. Security teams used to spend more time blocking malware, obvious spoofing, and messages. That work still matters, yet many of the attacks now arrive through trusted accounts, clean-looking messages, and valid sessions.

Twain Taylor, editor at Software Plaza, spoke to Ryan Schwarz, Senior Manager of Product Marketing at Abnormal AI, about that shift and why behavioral AI has become a larger part of modern email defense. The discussion centered on a simple problem. Attackers no longer need to look suspicious if they can look normal enough.

Modern attackers are no longer relying only on obviously malicious infrastructure. Many are using legitimate accounts, trusted services, and valid sessions to blend in.

Why traditional email security misses subtle threats

Rule-based email security can catch a lot of the noisy threats. It can still block known malicious domains, suspicious attachments, and common phishing patterns. The trouble is, the attackers have got smarter and adapted to those checks.

A domain that looks almost identical to a real one may still pass all the safety checks. A phishing email may be written in a way that means it no longer stands out as dodgy. A domain may be registered well in advance and left to sit around for a bit to make it look less suspicious when it’s used in an attack later. If an account has already been compromised, the attacker may not even need to pretend to send the email from somewhere dodgy.

That creates a problem for traditional email security. These systems are built to spot known bad signs, but many modern attacks do not look obviously malicious at first glance. They look normal enough to get through.

What Abnormal AI does differently

This is where the AI engine behind the Abnormal platform, known as Abnormal Behavior Technology (ABX), comes in. Unlike other AI tools that might start with a whole list of prelearned rules, ABX learns what normal looks like for the users, accounts, and their usual communication patterns right across the organisation.

ABX builds up a picture of typical behavior from the way people usually email, like who they email most and how often, but also the tone they usually use. It also considers what devices and browsers people use to log in, where they are when they log in, and what they normally get up to once they’re inside their account. The idea is to pick up on any activity that seems out of place, even if the email or login looks fine at first glance.

Abnormal brings this way of thinking to its Cloud Email Security products, which are designed to plug the gaps left by traditional security measures, stopping more attacks, automating boring tasks, and keeping email platforms safe from account takeovers and misconfigurations. That includes Inbound Email Security, which uses autonomous AI to stop email attacks. 

Email Account Takeover Protection, which detects and kicks in to prevent account takeovers on core email and identity platforms. Security Posture Management goes hunting for any Microsoft 365 misconfigurations that attackers could exploit before they even get a chance to.

Account Takeover Detection

When you fall victim to an account takeover, you’re left scratching your head trying to figure out what went wrong. The main reason for that confusion is that the attacker’s got a genuine login, so everything looks pretty normal at first glance. But then, as you start to dig deeper and compare that person’s activity with what the actual account owner normally does, that’s when all the suspicious stuff starts to pop up.

A user might normally switch between a few browsers in a pretty normal way. So seeing a new browser once might not mean much on its own. But if that happens alongside an unusual VPN pattern, a new location, a load of IP addresses all showing up at once, or a new MFA device registration, the whole picture starts to change quite quickly. This is the kind of activity Abnormal says its Email Account Takeover Protection is intended to detect and mitigate across the core email and identity platforms.

Why token replay is such a tricky thing to catch

Token replay attacks just make it all a lot harder. Here, the attacker steals a session token after the user has already logged in, which means they can get past MFA and get into cloud services without setting off the kind of login alert defenders are used to looking for.

At that point, the question is no longer just whether the login was proper. It becomes what the person is doing once they have already gotten into the system. That’s where behavioral analysis becomes a lot more useful than just a simple login check. This also goes some way to explain why Abnormal pairs account takeover protection with Security Posture Management, since misconfigurations in Microsoft 365 can create openings for attackers to get in before anyone even notices.

How does all that apply to phishing and response

The same approach is also relevant when it comes to phishing. AI-generated phishing emails can look pretty polished, use familiar language, and avoid the obvious giveaways that people used to rely on. 

ABX is intended to judge whether the message fits with the sender, the recipient, and the normal relationship between them, not just whether the wording looks clean. That all lines up with Abnormal’s Inbound Email Security product, which the company says is built to stop email attacks using autonomous AI.

What security teams should take from this

The larger takeaway from the conversation is straightforward. Many of today’s hardest email threats do not arrive with obvious warning signs. They arrive through real accounts, valid sessions, polished language, and behavior designed to look ordinary at first glance.

That is why behavioral AI has become more relevant in email security. It gives defenders a way to judge activity in context, connect weak signals, and catch account takeover or phishing activity that rule-based systems may miss. It also helps teams avoid chasing every harmless anomaly.

Readers who want the full discussion, including the demo examples and Ryan Schwarz’s breakdown of detection and remediation, should check out the webinar for more detail.