Abnormal AI, formerly Abnormal Security, is a behavioral-AI email security and identity threat protection platform from Abnormal AI, Inc., deployed by API into Microsoft 365 or Google Workspace, with pricing available only on request from the vendor.
Listing updated . Checked by MSP Software .
Abnormal AI, formerly known as Abnormal Security, is a behavioral-AI email security and identity threat protection platform from Abnormal AI, Inc., aimed at medium and large organisations, including managed service providers protecting client Microsoft 365 or Google Workspace tenants. It connects by API rather than by changing MX records, scanning mail after delivery and using models trained on behavioural signals to flag phishing, business email compromise, executive impersonation and account takeover that bypass gateway-based filters. Alongside inbound protection it covers outbound data loss prevention through configurable email DLP rules, graymail triage that moves low-value mail into a separate folder or label rather than a quarantine portal, and an AI Phishing Coach that gives individual users real-time feedback on reported or simulated phishing. The same behavioural model extends to identity threat protection across email, identity providers and SaaS applications, and to governance of AI tools and agents used inside an organisation.
Abnormal AI does not publish pricing on its website; the pricing page returns no plans or figures, and the company sells through a demo request rather than a self-serve signup, so a specific quote is needed for any deployment (checked September 2026). No free trial or free tier is published. The platform integrates natively by API with Microsoft 365, Google Workspace, Okta and CrowdStrike, plus a stated 100 or more additional tools, and also covers messaging platforms including Slack, Microsoft Teams and Zoom. Abnormal AI, Inc. gives a United States contact address and holds a wide set of compliance certifications, including ISO 27001, SOC 2 Type II and FedRAMP Moderate, which is worth checking against a specific client's regulatory requirements.
MSPs should confirm on a demo whether Abnormal AI supports a multi-tenant reseller or MSP delivery model, since the site is written for direct enterprise buyers, and ask for a quote scoped to a realistic mailbox count rather than treating the sales conversation as enterprise-only. It suits a security-focused MSP whose clients already run Microsoft 365 or Google Workspace and want behavioural detection for business email compromise on top of native filtering, more than one that wants a fixed, published per-mailbox price to quote clients up front.
Abnormal AI is worth a demo for an MSP with security-focused clients who have outgrown native Microsoft 365 or Google Workspace filtering and want behavioural detection for business email compromise rather than another rules-based gateway. It suits shops comfortable quoting a bespoke, enterprise-style deal, since Abnormal AI publishes no pricing and no free trial, unlike rivals such as Proofpoint Essentials or IRONSCALES that publish more of their commercial terms. Because the product is built for direct enterprise sales, confirm explicitly on a demo whether Abnormal AI supports an MSP's multi-tenant management and billing needs rather than just a single large client, and ask what a realistic mailbox-count quote looks like before comparing it against a published per-mailbox competitor.
Coro A consolidated SMB and MSP cybersecurity platform sold via partners on quote-only, per-user pricing. No reviews yet 
Material Security Email and workspace security for Microsoft 365 and Google, priced from $4 per user monthly. No reviews yet · from US$4.00
Guardz Unified MDR, endpoint, email and identity security for MSPs, priced per user on request. No reviews yet 
IRONSCALES API-based phishing and BEC protection for Microsoft 365 and Google Workspace, quote-based. No reviews yet All alternatives to Abnormal AI| Feature | Supported | Note |
|---|---|---|
| Phishing and malware filtering | yes | Detects phishing and malware by API, post-delivery, using behavioural models rather than signature or gateway filtering. |
| Spoofing and impersonation protection | yes | Core use case: flags business email compromise, executive impersonation and account takeover that pass standard authentication checks. |
| Email continuity | no | Deploys by API with no MX record change and does not sit in the mail flow, so it does not offer mail continuity or failover routing. |
| Archiving | unknown | Not described on the vendor's product pages fetched for this listing. |
| Security awareness training bundle | yes | AI Phishing Coach gives individual users real-time feedback on reported or simulated phishing. |
| API-based post-delivery scanning | yes | Vendor states deployment by API in about 60 seconds, with no agents, proxies or MX changes required. |
| DMARC monitoring | unknown | Not described on the vendor's product pages fetched for this listing. |
| Attachment sandboxing | unknown | Not described on the vendor's product pages fetched for this listing. |
| Data loss prevention | yes | Outbound Email DLP Rules let admins define and enforce policies for sensitive data. |
| Email encryption | unknown | Not described on the vendor's product pages fetched for this listing. |
| Microsoft 365 integration | yes | Native API integration with Microsoft 365 (and Google Workspace). |
| Self-service quarantine | no | Vendor explicitly avoids quarantine portals, instead moving low-value mail automatically into a Promotions folder or Graymail label. |
Abnormal AI does not publish a price list, so no per-mailbox or per-user figure is stated on its website (checked September 2026). Pricing is quoted directly by the vendor's sales team after a demo, based on the specific deployment. Anyone comparing it against a published per-mailbox competitor needs to request a quote first.
Abnormal AI does not publish a free trial or a free tier on its website. The company's stated route to evaluate the product is a sales-led demo request rather than self-serve sign-up, so anyone wanting hands-on access should expect to speak with the vendor first.
No, Abnormal AI connects by API rather than by changing MX records, so mail continues to flow through Microsoft 365 or Google Workspace as normal while Abnormal AI scans it after delivery. The vendor states this deployment takes about 60 seconds and needs no agents or proxies. Because it does not sit in the mail path, it does not provide mail continuity or failover routing.
Yes, Abnormal AI is the current name of the company previously known as Abnormal Security; abnormalsecurity.com now redirects to abnormal.ai. It has not been acquired by another company and remains independent, so existing Abnormal Security customers and contracts carry over under the new name.
Abnormal AI integrates by API with Microsoft 365 and Google Workspace as its two main email platforms, plus identity and endpoint tools including Okta and CrowdStrike, and messaging platforms including Slack, Microsoft Teams and Zoom. The vendor states it connects to more than 100 tools in total. Anyone with a less common email or identity platform should confirm it is on Abnormal AI's current integration list before buying.
Reviews are moderated. How reviews work.
Share what it is like to use this product day to day. Your experience helps other MSPs choose with confidence.
Write the first review
