What Abnormal AI does

Abnormal AI is an AI-native cybersecurity company founded in 2018 that provides a behavioral security platform for email, identity, and collaboration environments. The platform is powered by Attune, a proprietary behavioral AI foundation model trained on over one billion organizational behavioral signals, and operates as a cloud-native API that ingests signals from Microsoft 365, Google Workspace, Slack, Teams, Okta, and other enterprise systems without requiring MX record changes or endpoint agents. Its product surface spans a core Behavioral Security Platform with modules including Email Security, Account Takeover Protection, AI Security Mailbox, AI Phishing Coach, Security Posture Management, Messaging Security, Misdirected Email prevention, Identity Threat Protection, AI Security, and Infiltration Prevention.

The company sells via direct enterprise field sales to large organizations and reports penetration of more than 25% of the Fortune 500, with named customers spanning CVS Health, PepsiCo, Marriott, Lowe's, Liberty Mutual, Hitachi Energy, Unilever, Nestlé, Chipotle, Bristol Myers Squibb, Valvoline, Domino's, Boohoo, ADT, and Ingersoll Rand. Revenue is generated through SaaS subscriptions on a quote-based enterprise pricing model with no publicly disclosed tiers. The company has surpassed $200 million in annual recurring revenue and reports 100%+ year-over-year growth.

Abnormal AI is venture-backed (private, no IPO), with total disclosed proceeds of approximately $546 million across multiple rounds. The most recent round was a $250 million Series D in August 2025 at a $5.1 billion post-money valuation, led by Wellington Management with participation from Greylock, Menlo Ventures, Insight Partners, and CrowdStrike Falcon Fund. The company maintains operational entities in the United States (San Francisco HQ; Las Vegas legal address), Australia, the United Kingdom, Canada, Singapore, and India, and has expanded go-to-market into Germany, Japan, and France. It has been recognized as a Leader in the 2025 Gartner Magic Quadrant for Email Security (second consecutive year) and as a Leader in the Forrester Wave for Email, Messaging, and Collaboration Security.

Name

Abnormal AI

Legal name

Abnormal AI, Inc.

Website

https://abnormal.ai

Company type

Private

Founded year

2018

Operating status

Operating

Headcount range

1,001–5,000 employees

Short description

Abnormal AI is an AI-native cybersecurity company providing a behavioral AI security platform for email, identity, and collaboration threat detection, serving over 25% of the Fortune 500 via its Attune foundation model and API-based deployment.

Ownership category

akta.pro rank

Product category

Cloud Email Security

NAICS

Security Systems Services (except Locksmiths) (561621)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Email Phishing & BEC Protection (HDADAKAB)

akta.pro secondary industries

Identity, Access & Secrets Management for AI Systems (IAM for agents/models) (HDAAAKAJ), Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG), Enterprise AI Governance, Risk & Compliance Platforms (Model Risk, Audit, Policies) (HDAEANAE)

Keywords

• Behavioral AI security
• Email threat protection
• Cloud email security
• AI-native cybersecurity
• Identity threat detection

Headquarters

HQ city

Las Vegas

HQ country

United States

HQ region

North America

Offices8 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SaaS Subscription: Cloud-based email security platform sold as subscription service. Customers pay for access to the Behavioral Security Platform with various product modules including Email Security, Identity Security, AI Security, and Insider Threat protection. The company has surpassed $200 million in annual recurring revenue with 100%+ year-over-year growth.

Go-to-market motion2 records

Distribution channels3 records

Marketing channels6 records

Core offering

Abnormal AI sells a cloud-native Behavioral Security Platform that uses AI models trained on organizational communication patterns to detect and remediate email-borne attacks (BEC, phishing, account takeover, vendor email compromise, and AI-generated social engineering) that bypass traditional Secure Email Gateways. The platform deploys via API with no MX record changes or agents required and is anchored by the proprietary Attune 1.0 behavioral foundation model. Core product lines include Email Security, Messaging Security (Slack and Teams), and Identity & AI Security, sold to enterprise customers through a SaaS subscription model.

Product overview

Abnormal AI offers a Behavioral Security Platform—a unified platform-plus-modules architecture built around its proprietary Attune behavioral AI foundation model. The platform's core capabilities include Email Security (with sub-modules for Inbound Email Security, Account Takeover Protection, AI Security Mailbox, Email Productivity, AI Phishing Coach, Security Posture Management, and Misdirected Email), Identity & AI Security (Identity Threat Protection, AI Security, Infiltration Prevention), and Messaging Security for Slack and Teams. All capabilities are powered by Attune AI, which analyzes behavioral signals across email, identity, and AI interactions to detect anomalies and autonomous response. The platform is designed to replace traditional SEG-based email security with AI-native, behavioral-driven detection.

Differentiator

Problem solved

Functional benefit

Brands

• Attune: Behavioral AI Foundation Model - a behavioral foundation model designed to detect and block AI-driven cyberattacks
• AI Security Mailbox
• AI Phishing Coach

Products and services

• Behavioral Security Platform Cloud-native Behavioral Security Platform that builds per-organization behavioral baselines and uses the Attune 1.0 behavioral foundation model to detect and remediate email, identity, messaging, and AI-tool threats that bypass traditional Secure Email Gateways. Sold as a SaaS subscription to enterprise security teams and deploys via API with no agents or MX changes.
• Email Security Cloud-based email security solution that analyzes email content and sender behavior using behavioral AI to detect business email compromise, phishing, malware, account takeover, vendor email compromise, and misdirected emails. Targeted at enterprise organizations looking to displace legacy Secure Email Gateways.
• Messaging Security Behavioral AI protection for collaboration platforms including Slack and Microsoft Teams, applying the same anomaly detection used for email to messaging-based social engineering, insider threats, and data leakage. Sold to enterprise customers as part of the broader Behavioral Security Platform.
• Attune 1.0 Behavioral AI Foundation Model Proprietary behavioral foundation model for cybersecurity that detects AI-driven cyberattacks by analyzing organizational communication patterns. Powers the majority of detections across the Abnormal Behavior Platform and is delivered as part of Abnormal's Behavioral Security Platform subscription.

Quantifiable outcome

• 46x fewer missed attacks compared to general-purpose LLMs
• +6 more outcomes

Named customers15 records

Segments7 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration19 records

AI capability4 records

Feature3 records

Partnerships

Three partnerships are on record, tiered core.

• Arctic WolfcoreTechnology or IntegrationNew integration between Arctic Wolf Aurora Platform and Abnormal AI to improve email threat detection and response. The integration enhances protection against BEC, phishing, malware, and insider account threats by incorporating behavioral AI detections.
• MicrosoftcoreTechnology or IntegrationStrategic alliance and integration partnership. Abnormal AI provides email security for Microsoft 365 environments with deep native integration.
• CrowdStrikecoreTechnology or IntegrationUnified endpoint security partnership combining Abnormal AI's email security with CrowdStrike's endpoint protection for comprehensive threat coverage.

Scale indicators11 records

Recent moves6 records

Expansion highlights7 records

Direct peers

• Proofpoint: Proofpoint is a leading enterprise email security vendor offering anti-phishing, BEC protection, and threat intelligence. It is the most direct competitor to Abnormal in SEG-replacement and advanced email threat detection, serving similar Fortune 500 customers.
• Mimecast: Mimecast provides cloud-based email security, archiving, and continuity services. It directly competes with Abnormal in email phishing and BEC protection and shares a similar enterprise SaaS GTM motion.
• IRONSCALES: IRONSCALES offers an AI-powered email security platform focused on phishing and BEC detection with adaptive mailbox-level protection. It is a direct mid-market and enterprise competitor to Abnormal in the same behavioral AI category.
• Avanan: Avanan (a Check Point company) provides API-based email and collaboration security that deploys in front of cloud email platforms. Its API-first architecture and Microsoft/Google focus closely mirror Abnormal's deployment model.

Broad incumbents

• Microsoft Defender for Office 365: Microsoft's bundled email security offering inside Microsoft 365 is the largest incumbent in the space. Abnormal's Attune platform is explicitly positioned to displace Defender's signature-based detection with behavioral AI in Microsoft-centric enterprises.
• Cisco Secure Email (formerly IronPort): Cisco Secure Email is a long-standing on-premises and hybrid email security gateway competing in the SEG category Abnormal is displacing. Cisco's broader security portfolio and installed base make it a key incumbent Abnormal must win against in enterprise procurements.
• CrowdStrike Falcon Email Security: CrowdStrike's email security module extends its Falcon XDR platform into email threat detection. CrowdStrike is both a strategic investor in Abnormal (Falcon Fund) and a distribution partner, but also an adjacent competitor for security budget within shared customer accounts.

Emerging players

• SlashNext: SlashNext specializes in AI-based detection of BEC, phishing, and social-engineering attacks across email and messaging. It overlaps with Abnormal's behavioral detection thesis but with a more focused scope and earlier stage of scale.
• Perception Point: Perception Point delivers email and collaboration security via a managed service with AI and human-in-the-loop analysis. It competes with Abnormal in enterprise email threat detection, particularly for organizations preferring a managed-service delivery model.
• Sublime Security: Sublime Security offers an open, API-based email security platform with a focus on detection-as-code and community-shared rules. It targets similar enterprise customers with a developer-friendly alternative to Abnormal's proprietary behavioral model.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat7 records

Key risks5 records

Key highlights7 records

Customer concentration

Compliance16 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles19 records

Subsidiaries5 records

Funding overview

Funding rounds5 records

Investors9 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments1 record

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Abnormal AI