Abnormal AI knows when a perfectly polite email is trouble

Imagine an email from a supplier. The spelling is immaculate. The tone is friendly. There is no sinister attachment, only a request to send the next payment to a different bank account. Everything looks respectable, which is precisely the trouble. A criminal who understands office routine can dress a theft as Tuesday’s paperwork.

Abnormal AI has built its business around that uncomfortable possibility. It learns the relationships and habits inside an organization, then looks for requests that do not belong. The interesting question becomes whether the message makes sense for this sender, this recipient and this particular piece of business.

The advertising people enter the inbox

Co-founders Evan Reiser and Sanjay Jeyakumar arrived with experience in large-scale machine learning and behavioral modeling. Reiser had led advertising product and machine-learning teams at Twitter; Jeyakumar had been a systems architect there. Advertising had taught them to infer behavior from enormous quantities of data. Cybersecurity offered another use for that skill: recognizing an impostor’s interruption of an ordinary relationship.

They founded Abnormal in 2018. Greylock incubated the company and led its $24 million Series A, announced with the public product launch in 2019. The architecture mattered. Connecting through cloud APIs gave the product access to organizational context and internal email traffic, without requiring the mail-routing changes associated with a separate gateway.

Even the name needed an adjustment. Reiser says the original Abnormal AI label made buyers think of science fiction, so the founders adopted Abnormal Security. In April 2025 they restored the original name. The technology’s premise had stayed remarkably consistent; the audience’s willingness to hear “AI” had changed.

Three defenses, one stubborn problem

Valvoline’s published customer story makes the problem tangible. It used a secure email gateway, Microsoft 365’s native security and another API-based solution. Attacks still reached inboxes. Senior information-security director Corey Kaemming described spear phishing and invoice fraud involving sums from $5,000 to millions. Training helped, but, as he put it, “humans will always make mistakes”.

The tools also demanded labor. Kaemming said four to five analysts had spent 90% of each day on email-related tasks. During Abnormal’s evaluation, the team reported higher-fidelity alerts and better handling of QR-code attacks than its other solution. Valvoline subsequently removed its gateway. The case study lists more than 9,100 protected mailboxes.

“humans will always make mistakes”

Corey Kaemming / Valvoline

That is a vendor-published account, rather than a universal performance promise. Still, it supplies a useful buying criterion: count the hours spent investigating and cleaning up email, alongside the attacks caught. A dashboard full of alerts can look impressively busy while keeping everyone else impressively busy, too.

A subscription to fewer investigations

Abnormal sells enterprise software. Its publicly described email pricing model is per user mailbox, with the price varying by selected features. Procurement can run through partners or a private marketplace offer. The sensible comparison includes subscription spend, investigation effort and the operational burden of the tools it might replace.

Inbound Email Security targets phishing, business email compromise and vendor fraud. Account Takeover Protection looks for compromised accounts. AI Security Mailbox investigates employee-reported messages and handles responses; Email Productivity tackles unwanted graymail. AI Phishing Coach adds personalized simulations and training, while AI Data Analyst helps turn security activity into reports.

The alternatives include Proofpoint, Mimecast, Cisco and native cloud-email defenses. Abnormal’s pitch centers on behavioral context and API integration; competitors also use AI. Its distinction is an approach and an architecture, rather than ownership of those two fashionable letters.

For a buyer, the practical exercise is to trial representative attacks and unusual legitimate workflows. Check which messages get removed, how quickly remediation happens and who can reverse a mistake. Supported integrations and appropriate permissions matter. A model cannot act on activity its connections never expose.

The evaluation should also include data access. Security teams are giving software visibility into sensitive relationships and authority to intervene. Review those permissions, the handling of message data and the audit trail before expanding automation. Convenience still needs an accountable owner.

The spreadsheet surrendered first

There is a revealing smaller story inside the company. Operations manager Brynn Collins coordinated staffing for an AI Supervision team of 60 analysts across 42 workflows. Availability, training and queue pressure changed constantly. Abnormal says earlier spreadsheet formulas struggled with that variability.

Collins used ChatGPT Enterprise and iterative code generation to build an engine that combined live inputs and posted staffing assignments. The company reports more than 40 hours of weekly coordination eliminated and over $45,000 in estimated annual ROI. Crucially, Collins recognized outputs that ran successfully but assigned people incorrectly. Her knowledge of the work supplied the judgment the code lacked.

The inbox was the opening move

The commercial growth financed a wider ambition. In August 2024, Abnormal announced a $250 million Series D led by Wellington Management at a $5.1 billion valuation, and said it had crossed $200 million in annual recurring revenue. ARR is a subscription run rate, rather than a statement of annual accounting revenue.

By September 2026, its suite announcement reported more than 5,000 customers, including 30% of the Fortune 500. An August OpenAI partnership and September distribution through SoftBank in Japan added development and sales relationships. The expanding platform now addresses identity threats and AI use alongside email.

The September 24 AI suite announcement deserves a careful reading. AI Governance was generally available, offering visibility into AI tools, usage and costs. AI Cloud Security, AI Employee Guardrails, AI Agent Security and AI Security Workbench remained in private preview. Those names describe the next bet; availability determines what a buyer can actually deploy.

For readers, the transferable lesson is modest and useful. Understand ordinary work before trying to automate its defense. Measure the labor you remove. Keep someone who knows the business close enough to recognize a convincing mistake. Respectability has always been an excellent disguise; now it has an inbox.