Abnormal AI

No entries match these filters. Clear filters

1. announced Nov 3, 2026 · issue 130

   Abnormal AI adds AI Governance as a standalone product, discoverable without Inbound Email Security, connecting to Microsoft 365 or Google Workspace in read-only mode⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Activate AI Governance as a new standalone entry point into Abnormal AI's platform without purchasing Inbound Email Security first.
   📍In the Abnormal AI App Store, select AI Governance and complete onboarding. Connect to Microsoft 365 (via the Graph API) or Google Workspace in read-only mode. Additional products such as Inbound Email Security, Identity Threat Protection, and Infiltration Prevention can be added from the same platform at any time.
   • Abnormal AI now offers AI Governance as a standalone product that customers can purchase and activate independently, without first buying Inbound Email Security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • AI Governance connects to Microsoft 365 via the Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. or to Google Workspace in read-only mode to discover every AI tool, agent, and chat in an organization.
   • AI Governance maps sensitive data found in LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered chat tools — including uploaded files and images — to compliance frameworks.
   • AI Governance inventories AI agents across connected platforms, auditing the access each holds and flagging dormant, orphaned, or overprivileged agents.
   • AI Governance surfaces AI spend from invoice emails and unsanctioned subscriptions alongside IT-approved spend.

   5 details in Everything

2. announced Nov 3, 2026 · issue 130

   Abnormal AI adds AI Governance as a standalone product to discover, inventory, and report on AI tools and agents across an organization⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Activate AI Governance for an organization that does not yet use Abnormal for email, to begin discovering unsanctioned AI tools within about a week.
   📍In the Abnormal portal, go to the AI App Store and select AI Governance, then follow the activation steps to connect your environment.
   • AI tool discovery identifies AI tools in use across connected environments and classifies each as sanctioned, tolerated, or unsanctioned.
   • AI agent inventory finds agents across connected platforms and flags those that are dormant, orphaned, or overly permissioned so teams can revoke stale access.
   • AI chat insights surfaces sensitive data — credentials, personal information, and financial data, including content inside uploaded files and images — shared with AI assistants, with findings ranked by severity.
   • AI spend and compliance reporting consolidates AI subscriptions and invoices (including spend outside approved procurement) and maps findings to reference compliance frameworks to support audit and board reporting.

   4 details in Everything

3. changelog Oct 31, 2026 · issue 126

   Abnormal AI adds time-series identity posture tracking, per-signal reset risk detail, AI Data Analyst scheduling with a Report Repository, and Segmented SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. multi-tenant isolation.

   • Identity Threat Protection now shows security grade and threat exposure over time, letting admins review up to 180 days of history with markers for improvements, regressions, and coverage changes, and filter identities at risk by attack scenario such as Helpdesk Impersonation, Vendor Email Compromise, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Fatigue Push.
   • Identity Threat Protection now exposes the individual risk signals behind each Adaptive Identity Reset risk score, with per-signal ratings on a four-tier scale (Low, Moderate, Elevated, or High) and plain-language definitions alongside the identity quiz result.
   • AI Data Analyst adds scheduled reporting — one-time or recurring — with a Schedule as Custom Report option that derives the reporting window from a chosen frequency, plus a new Report Repository for versioned downloads and full conversation history.
   • AI Data Analyst adds a single multi-tenant management view for MSSPs and multi-tenant customers to manage reporting across every tenant from one place.
   • Abnormal adds Segmented SaaS, letting organizations create separate Abnormal tenants for business units, subsidiaries, regions, or agencies that share one email tenant, with users assigned by email domain, directory group, or a list of user principal names, and each tenant getting its own admins, views, alerts, and data over a single integration.

   +1 more show less

   • AI Phishing Coach Settings page now groups every control into six tabs — Overview, Simulations, Coaching, Branding & Delivery, Exclusions, and Test — with Tenant Level / Account Level labels and a single Save across all tabs.

   6 details in Everything

   • Updated detection Malicious link detection — URL verdict scoring
   • New detection Visual detection model for image-based brand impersonation
   • Updated detection Malicious link detection — URL-hosting platform remediation (Week of Oct 30)
   • Updated detection Brand impersonation detection — visual deception evasion
   • New detection Sender Compromise model
4. changelog Oct 23, 2026 · issue 117
   • Updated detection Graymail classification improvement for promotional messages disguised as replies
5. AI Detection Engineer: A Faster, More Visible Response to Every Report Sep 30, 2026 · release notes

   AI Detection Engineer auto-investigates misjudgments and deploys custom detectors from Detection 360 or AI Security Mailbox.

   └──▷ HOW TO FIND IT
   Confirm a misjudgment in Detection 360 or AI Security Mailbox to trigger AIDEN's automatic investigation and detector deployment workflow.
   📍In the console, go to Detection 360 or AI Security Mailbox and confirm a report as a misjudgment.
   • Introduces AI Detection Engineer (AIDEN) to automatically investigate reported misjudgments in Detection 360 and AI Security Mailbox, building and deploying customer-specific detectors without rule-writing.
   • Adds a unified dashboard to visualize AIDEN's investigation results and track every deployed detector with full traceability to caught messages and suppressed false positives.

   2 details in Everything

6. Executive-Ready PDF Report Sep 30, 2026 · release notes

   AI Phishing Coach adds Executive-Ready PDF Reports with AI analysis and filtering on the dashboard.

   • Adds Export Executive Report button on the Executive Dashboard and Reports page to generate a branded PDF with AI-generated analysis

   1 detail in Everything

7. CSV Export for Supply Chain Sep 28, 2026 · release notes

   Abnormal AI adds one-click CSV export for Supply Chain vendor data via UI navigation

   └──▷ HOW TO FIND IT
   Export vendor data to CSV for offline compliance auditing.
   📍In the console, go to Behavioral Intelligence › Supply Chain and click Export to CSV
   • Adds Export to CSV button under Behavioral Intelligence > Supply Chain for direct vendor dataset download
   • Includes Tenant column in exports for multi-tenant environment support

   2 details in Everything

8. Adaptive Identity Reset Enrollment Sep 25, 2026 · release notes

   Abnormal AI adds filtering and searching to Adaptive Identity Reset enrollment roster

   └──▷ HOW TO FIND IT
   When/why you'd use this — the value or use case.
   📍In the console, go to Adaptive Identity Reset enrollment and filter by department Engineering and job title Admin.
9. Weekly Abnormal Detection Enhancements Sep 25, 2026 · release notes

   New internal-account compromise detections added to catch targeted attacks disguised as routine coworker email

   • Improves precision of subject-matching detection to reduce false positives without sacrificing threat coverage

   1 detail in Everything

10. Targeted Video Training by Groups or Departments Sep 23, 2026 · release notes

    New UI feature allows Admins in Abnormal AI console to assign Video Training to specific AD/Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. groups, Google Groups, or departments for automatic lifecycle management.

11. Per-Applicant PDF Export Sep 18, 2026 · release notes

    Infiltration Prevention admins can now download a per-applicant PDF report for individual flagged applicants via the Abnormal Portal UI.

    • Adds per-applicant PDF export capability to Infiltration Prevention admins, allowing download of a summary report containing review triggers, applicant identity/standing, and supporting evidence.

    1 detail in Everything

12. Filter Flag by Reason Sep 18, 2026 · release notes

    Abnormal AI adds Filter By control to filter flagged candidates by specific flag reasons like VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. submission.

    └──▷ HOW TO FIND IT
    Isolate all candidates flagged specifically as Submission via VPN to investigate a potential threat group.
    📍In the Infiltration Prevention interface, use the new Filter By control to select Submission via VPN, then export the results to CSV.
    Review only candidates associated with known threat indicators without manual row-by-row filtering.
    📍In the Infiltration Prevention interface, apply a filter in Filter By for Known Threat Indicator, then export the filtered CSV.
    • Adds the ability to filter flagged candidates in the Infiltration Prevention UI by one or more flag reasons (e.g., Submission via VPN, Known Threat Indicator).
    • Updates CSV exports to reflect the currently applied Filter By selections for flagged candidates.

    2 details in Everything

13. Personal and Logged-Out AI Usage Sep 16, 2026 · release notes

    AI Governance browser extension now detects ChatGPT usage from personal and logged-out accounts.

    └──▷ HOW TO FIND IT
    Monitor enterprise AI governance by detecting personal ChatGPT usage that bypasses central APIs.
    📍Install the AI Governance browser extension to capture conversations from 'personal, free, and logged-out accounts'.
14. SIEM Feed for AI Tools Sep 14, 2026 · release notes

    SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Feed for AI Tools now sends governance events and block/unblock instructions to SIEM/SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. destinations

    • Adds ability to send AI Governance events (new tool discovery, status changes, risk incidents) to existing SIEM or SOAR destinations.
    • Provides block and unblock instructions for customer-managed enforcement workflows via the SIEM feed.

    2 details in Everything

15. AI Chat Attachment Content Scanning Sep 14, 2026 · release notes

    AI Governance Chat Insights now scans contents of attachments in ChatGPT and Claude conversations.

    • Extends visibility beyond chat text to identify sensitive information employees may be sharing with AI tools through uploaded files
    • Reads and analyzes text and images within files attached to ChatGPT and Claude conversations

    2 details in Everything

16. Weekly Abnormal Detection Enhancements Sep 11, 2026 · release notes

    New detections for credential-phishing lures, HR-themed phishing from internal accounts, and password-spray on dormant mailboxes.

    • Adds enhanced detection of credential-phishing lures disguised as fake voicemail and media-player attachments
    • Adds detections for HR-themed phishing sent from compromised internal accounts at educational institutions
    • Adds detections for password-spray attacks that succeed on dormant, unmonitored shared mailboxes

    3 details in Everything

17. Per-Schedule Attack Selection Sep 9, 2026 · release notes

    Abnormal AI adds per-schedule attack selection to tailor phishing simulations for specific employee groups.

    • Adds per-schedule attack selection capability to configure allowed simulation types and employee impersonation at the Group schedule level

    1 detail in Everything

18. Attack Library Grid View Sep 7, 2026 · release notes

    Abnormal AI adds a thumbnail-based Grid view for bulk enabling/disabling of attacks in the Attack Library.

    • Adds a thumbnail-based Grid view to the Attack Library that allows admins to visually scan and toggle attack states without opening individual items.

    1 detail in Everything

19. Weekly Abnormal Detection Enhancements Sep 4, 2026 · release notes

    New ML models for BEC/wire-fraud, rare-domain phishing, and QR-code phishing detection

    • Enhanced detection of BEC and wire-fraud campaigns with new machine-learning models and feature extraction logic.
    • Expanded phishing and investment-fraud detection to catch attacks using rare domain extensions.

    2 details in Everything

20. Bulk Actions for Applicant Clusters Sep 3, 2026 · release notes

    Adds bulk review decisions and cluster hiding for applicant clusters in Infiltration Prevention

    └──▷ HOW TO FIND IT
    Bulk-approve or reject a group of suspected coordinated applicants in one action to save investigation time.
    📍In the Infiltration Prevention console, select an applicant cluster and use the new Apply review decision bulk action.
    Remove handled clusters from the active view without losing data, keeping the workspace focused on pending items.
    📍In the Infiltration Prevention console, select a cluster and click Hide to remove it from the current list while preserving its history.
    • Infiltration Prevention admins can now apply a review decision across an entire cluster of related applicants instead of reviewing each person individually.
    • Admins can hide clusters they have already handled while keeping them accessible for future reference.

    2 details in Everything

21. AI Phishing Coach: Better Security Habits Through Personalized Training Aug 31, 2026 · release notes

    AI Phishing Coach adds QR-code simulations, in-thread follow-ups, Precision Training calibration and generative content creation.

    • Introduces Precision Training which automatically calibrates simulation type, frequency, and difficulty to each employee’s phishing risk score and past interactions
    • Adds support for QR-code simulations as a delivery method for realistic phishing exercises
    • Enables in-thread follow-ups to deliver training content directly within existing communication channels
    • Provides generative AI capabilities to create custom simulations, campaigns, and training videos in minutes

    4 details in Everything

22. Email DLP Rules: Enforce Outbound Data Policies with Less Noise Aug 31, 2026 · release notes

    Abnormal AI Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Rules Early Access: Regex, phrase, metadata, and Boolean logic policies with AI Triage Agent auto-remediation.

    • Email DLP Rules enters Early Access for enforcing outbound data policies via regex, phrase matching, metadata, and Boolean logic.
    • AI Triage Agent automatically releases benign matches or quarantines likely violations with transparent reasoning.
    • Policy definitions support exclusions to reduce noise in outbound filtering.

    3 details in Everything

23. Custom AI Models and Custom Rules: Control, Without The Code Aug 31, 2026 · release notes

    Abnormal AI introduces Custom AI Models and Custom Rules for organization-specific control without code.

    • Adds Custom AI Models generally available to all customers at no additional cost, allowing description of patterns in natural language alongside Abnormal’s behavioral AI.

    1 detail in Everything

24. Next-Generation Detection and Explanations for MEP Aug 28, 2026 · release notes

    MEP now includes AI-generated explanations in outbound logs and end-user notifications.

    └──▷ HOW TO FIND IT
    Review why an outbound email was flagged for misdirection directly in the log.
    📍Check the outbound log entry for the flagged message to see the AI-generated explanation.
    Decide whether to re-send or cancel an email after receiving a notification.
    📍Read the AI-generated explanation in the end-user email notification for the flagged message.
    • Adds AI-generated explanations to every flagged email in the outbound log
    • Adds AI-generated explanations to end-user email notifications for flagged emails

    2 details in Everything

25. Weekly Abnormal Detection Enhancements Aug 28, 2026 · release notes

    Enhanced BEC/wire-fraud spoofed name detection and expanded vendor fraud email coverage

    • Enhanced detection of BEC and wire-fraud attempts that impersonate VIPs through spoofed names and content
    • Expanded coverage for vendor fraud emails sent from domains confirmed malicious through detection research

    2 details in Everything

26. announced Aug 26, 2026 · issue 058

    Abnormal AI Phishing Coach gains Precision Training, Attack/Training/Campaign Creator, QR code simulations, and in-thread follow-up

    • New Precision Training capability automatically adjusts simulation frequency and difficulty based on individual employee behavior signals — employees with elevated risk get more frequent, harder simulations; low-risk employees get fewer.
    • New Attack Creator lets admins describe a phishing scenario in plain language to generate a realistic simulation stored in the Attack Library.
    • New Campaign Creator enables ad hoc or baseline simulation campaigns to be scheduled and sent from the Attack Library, including AI-generated attacks.
    • New Training Creator lets admins enter a prompt and imagery to generate custom training video modules, with module recommendations driven by Abnormal's observed threat patterns.
    • New QR Code Phishing Simulations train employees to treat QR codes in email with the same suspicion as suspicious URLs; simulations render even in email clients that block images.

    +1 more show less

    • New In-Thread Follow-Up re-engages employees who neither clicked nor reported a simulation by sending a follow-up inside the same email thread, mirroring real attacker tactics.

    6 details in Everything

27. announced Aug 26, 2026 · issue 058

    Abnormal AI launches Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Rules (Early Access): AI-assisted outbound email policy enforcement with a Triage Agent to cut false positives.

    └──▷ HOW TO FIND IT
    Review Triage Agent verdicts and reasoning for outbound policy matches to prioritize which flagged messages need analyst attention.
    📍In the Abnormal console, go to Outbound Log, filter by the relevant Email DLP Rule, and inspect the plain-language Triage Agent explanation alongside each flagged message verdict.
    • New Email DLP Rules (Early Access) lets security and compliance teams define, validate, and enforce outbound email policies using a rule builder that supports regex, phrase matching, metadata conditions, and Boolean logic — including AND/OR nesting, condition groups, and exclusions.
    • Includes prebuilt templates for common data types such as financial information and personally identifiable information (PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.), reducing time to first policy.
    • Rules scan outbound message content and supported attachments, with the ability to scope enforcement by department or workflow for controlled rollout.
    • New Triage Agent evaluates each flagged message against the rule's stated intent, sender-recipient relationship, and surrounding message context to distinguish genuine violations from routine business traffic.
    • Triage Agent generates a plain-language description of each rule's intent and editable exclusions during rule creation, letting teams encode business context that pattern logic alone cannot capture.

    +1 more show less

    • Teams can validate rules against sample emails before live deployment to confirm policy accuracy prior to enforcement.

    6 details in Everything

28. announced Aug 26, 2026 · issue 058

    Abnormal AI adds Control Center, Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Rules with AI Triage Agent, and enhanced AI Phishing Coach (GA August 31).

    └──▷ HOW TO FIND IT
    When you need to suppress a known-safe outbound pattern (e.g., invoices from your billing system) without manual SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. review, tune an Email DLP Rule exclusion so the AI Triage Agent auto-releases those messages.
    📍In Abnormal, go to Email DLP Rules › New Rule, define your policy using regex or phrase matching, add exclusions in plain language (e.g., 'exclude messages from billing@yourcompany.com'), and enable AI Triage Agent review to auto-release matches with benign business context.
    When you want to block or allow email based on an organization-specific pattern without writing detection code, create a Custom Rule in Control Center and validate it against real examples before enabling it.
    📍In Abnormal, go to Control Center › Custom Rules › New Rule, specify conditions using available message attributes (sender domain, subject keywords, header values, etc.), test the rule against real message examples, and publish to enforce the policy.
    When a specific employee repeatedly ignores phishing simulations, use In-Thread Follow-Up in AI Phishing Coach to automatically re-engage them in context rather than waiting for the next scheduled campaign.
    📍In Abnormal, go to AI Phishing Coach › Campaign Creator, create or select a campaign with In-Thread Follow-Up enabled, then Precision Training will automatically increase simulation frequency for non-responsive employees and reduce it as behavior improves.
    • Adds Control Center, a no-cost capability of Inbound Email Security, with Custom AI Models (GA) and Custom Rules (Early Access) for organization-specific detection without detection engineering.
    • Adds Custom Rules (Early Access) in Control Center: define precise block/allow conditions using more than 50 message attributes and validate rules against real message examples.
    • Adds Custom AI Models (GA) in Control Center: create organization-specific detection models from plain-language descriptions to teach Abnormal patterns unique to the business.
    • Adds Control Center decision transparency: shows which layer — core AI, custom model, or custom rule — made each detection decision.
    • Adds Email DLP Rules (Early Access): define outbound data-loss policies using regex, phrase matching, metadata conditions, Boolean logic, and exclusions.

    +6 more show less

    • Adds AI Triage Agent within Email DLP Rules: automatically reviews flagged outbound messages for business context, auto-releases benign messages, and quarantines likely violations.
    • Adds Outbound Log: records every AI Triage Agent verdict for audit visibility.
    • Adds Precision Training to AI Phishing Coach: automatically adjusts simulation frequency and difficulty per employee based on response behavior, and assigns reinforcement training when needed.
    • Adds In-Thread Follow-Up to AI Phishing Coach: re-engages employees who ignore a phishing simulation.
    • Adds QR Code simulation type to AI Phishing Coach's simulation library.
    • Adds Attack Creator, Training Creator, and Campaign Creator to AI Phishing Coach: generate custom simulations and training content from plain-language prompts and deploy campaigns targeting emerging or business-specific scenarios.

    11 details in Everything

29. announced Aug 26, 2026 · issue 058

    Abnormal AI launches Control Center for Inbound Email Security with Custom Rules and Custom AI Models

    • Introduces Custom AI Models (Generally Available): analysts describe a detection pattern in natural language to create a dedicated AI model, backtested against recent organizational mail before deployment, runnable in Passive mode before full enforcement.
    • Introduces Custom Rules (Early Access): build organization-specific enforcement rules from more than 50 email attributes using AND, OR, and Except When logic — no proprietary query language required — with per-user or org-wide scoping.
    • Adds Passive mode for both Custom Rules and Custom AI Models, letting teams observe which messages a rule or model would match before enabling enforcement, reducing risk when moving to Active mode.
    • Each Custom Rule and Custom AI Model assigns a verdict of Attack, Spam, or Safe, with Custom Rules taking precedence over Custom AI Models, which in turn override Abnormal's core AI detection.
    • Control Center is available to all Abnormal customers at no additional cost.

    5 details in Everything

30. Expanded Detection 360 Case Creation via Search and Respond Aug 14, 2026 · release notes

    Abnormal AI adds in-app Detection 360 case creation for Missed Spam and False Positives via Search & Respond.

31. REST API Token Expiry Notifications Aug 13, 2026 · release notes

    Abnormal AI adds automatic email notifications for REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. token expiry

    └──▷ HOW TO FIND IT
    Ensure integrations work uninterrupted while strengthening security posture
    📍In the console, turn on automatic expiry alerts and configure notifications by tenant or recipient.
    • Adds automatic email notifications to alert admins before REST API tokens expire
    • Adds configuration by tenant or recipient to tailor which alerts are sent

    2 details in Everything

32. AI App Store Aug 6, 2026 · release notes

    Abnormal AI launches the AI App Store in the Portal for self-service product discovery and activation.

    └──▷ HOW TO FIND IT
    Activate Identity Threat Protection directly from the portal interface.
    📍Navigate to the AI App Store in the Abnormal Portal, locate Identity Threat Protection, and click the Install button.
    • Adds Self-Service Activation via an Install button in the Abnormal Portal to enable new products like Identity Threat Protection, AI Governance, and Infiltration Prevention without manual provisioning
    • Introduces Smart Integration Recommendations that automatically suggest features to configure and platforms to integrate within the Abnormal Portal UI

    2 details in Everything

33. Identity Threat Protection Aug 4, 2026 · release notes

    Abnormal AI launches Identity Threat Protection with ISPMISPMIdentity Security Posture Management: a discipline for continuously discovering, assessing, and remediating identity-related risks across users, accounts, and entitlements, giving cyber tools a unified view of identity exposure., Threat Library, NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. visibility, and Adaptive Identity Reset.

    • Identity Security Posture Management (ISPM) surfaces misconfigurations ranked by real attack susceptibility mapped to your unique vulnerabilities.
    • Threat Library shows MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.-mapped identity threat scenarios with coverage status mapped to your environment.
    • NHI visibility and Identity Graph allows you to understand the behavioral patterns of human and non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls., their access and relationships.
    • Adaptive Identity Reset protects the helpdesk from being socially engineered with an automated password and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. reset feature scored against real user behavior.

    4 details in Everything

34. PeopleBase is now Human Identities, the Hub for Per-Identity Behavioral Intellig Aug 3, 2026 · release notes

    Abnormal AI introduces Human Identities hub with Overview tab, Activity feed, and Identity Graph for per-identity behavioral analysis.

    └──▷ HOW TO FIND IT
    Investigate a suspicious identity's normal behavior across devices and networks in one view.
    📍In the console, go to Human Identities and select an identity to view the Overview tab.
    Analyze a specific identity's activity history filtered for threats.
    📍In the console, go to Human Identities › [Identity Name] and use the Activity feed filters to view threats.
    • Adds an Overview tab providing a single-screen view of sign-in patterns, network locations, and device/browser/OS/app usage for any identity
    • Adds a filterable Activity feed showing complete sign-in history for each identity with links to associated cases
    • Adds an interactive Identity Graph displaying a person's identities, group memberships, and roles across platforms
    • Adds Non-Human Identity ownership visibility into service principals, credentials, and OAuth grants tied to each person

    4 details in Everything

35. AI Governance Aug 3, 2026 · release notes

    Abnormal AI launches AI Governance for discovering and scoring unsanctioned AI tool risk via behavioral correlation.

    • Adds AI Discovery capability to detect AI tools, agents, and risky chats across the organization
    • Adds Risk Scoring based on vendor trust, data sensitivity, and permissions
    • Adds Usage & Spend Monitoring including shadow AI spend flagged from vendor invoices
    • Adds Automated Outreach to users of unsanctioned tools

    4 details in Everything

36. Infiltration Prevention Aug 3, 2026 · release notes

    Abnormal AI adds Infiltration Prevention to detect synthetic identities entering ATS via Greenhouse or Workday integrations

    • Adds Onboarding Pipeline Assessment that integrates with Greenhouse or Workday to analyze every new identity before provisioning.
    • Adds Impersonation Detection capabilities to identify fabricated credentials, VoIP burner numbers, and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-masked locations.
    • Adds Campaign Correlation to spot threat actors attempting to enter multiple departments or locations simultaneously.
    • Adds Evidence Briefs that send cited impersonation evidence to the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. for investigation.

    4 details in Everything

37. Suppressing AISM Auto-Responses for "Not Junk" Reports Jul 17, 2026 · release notes

    AISM auto-responses suppressed for Not Junk reports to reduce noise while preserving visibility

    └──▷ HOW TO FIND IT
    Stop receiving automated replies for false-positive Not Junk reports to reduce helpdesk noise.
    📍Report a message as Not Junk in the inbox; verify no AISM auto-response is received while visibility remains in the portal.
    • Suppresses automatic AISM replies when users mark messages as Not Junk
    • Preserves full message analysis and visibility in the AI Security Mailbox portal without config changes

    2 details in Everything

38. Weekly Abnormal Detection Enhancements Jul 17, 2026 · release notes

    Abnormal AI adds QR-code scanning for base64 calendar images, enhanced ACH/extortion detection via rich-text embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG., and account takeover signals from VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./hosting IPs.

    • Deploys QR-code scanning for base64-encoded images embedded in calendar invite descriptions
    • Enhances attachment analysis with rich-text embeddings and category tags to catch ACH fraud, extortion, and other text-heavy threats
    • Strengthens account takeover detection for logins at unusual times, catching subtle account compromises
    • Adds detection that flags account takeovers combining password resets and new MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. device registrations from first-time VPN or hosting IPs

    4 details in Everything

39. Get Board-Ready Answers with Your AI Data Analyst Jul 15, 2026 · release notes

    Abnormal AI adds AI Data Analyst with conversational Q&A, scheduled reporting, and a multi-tenant Report Repository.

    • Adds AI Data Analyst for conversational Q&A that grounds answers in Abnormal environment data (threats blocked, people protected, risk surfaced).
    • Adds ability to schedule recurring or one-time reports with smart defaults via the AI Data Analyst interface.
    • Adds Schedule as Custom Report option to turn any question into an ongoing report without extra setup.
    • Adds new Report Repository for tracking every report and conversation, including versioned downloads and full history.
    • Adds multi-tenant reporting management across every tenant from a single view, built for MSSPs and multi-tenant customers.

    5 details in Everything

40. Safelisting for Teams Messaging Security Jul 6, 2026 · release notes

    New Teams Messaging Security tab allows sender domain and URL safelisting

    └──▷ HOW TO FIND IT
    Navigate to the new tab to add a trusted partner domain that would otherwise trigger detection alerts.
    📍In the console, go to Feature Settings › Messaging Security and add the partner-portal domain to the Sender Domain Safelist.
    • Adds a new Messaging Security tab in Feature Settings to manage Teams-specific safelists
    • Enables Sender Domain Safelist entries to bypass detection models for trusted senders like IT helpdesks
    • Enables URL Safelist entries to exclude known-good URLs from malicious link scoring without ignoring other flags
    • Automatically migrates existing Global safelist entries to the new Teams safelist scope per tenant
    • Provides a full audit log for all changes made to Teams-specific safelist entries

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Global safelist no longer applies to Teams; existing Global safelist entries are automatically migrated to the Teams safelist
41. Microsoft Sentinel Integration Replacement Jul 2, 2026 · release notes

    Abnormal AI introduces a new native Microsoft Sentinel connector replacing the legacy Azure Function-based integration

    • Adds support for the Codeless Connector Framework (CCF) in Abnormal's Microsoft Sentinel integration, enabling near real-time event ingestion via a push-based model.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The legacy Azure Function-based integration is replaced by the new native connector; users must migrate to the new CCF-based method before Microsoft ends support for the HTTP Data Collector API on September 14, 2026.
42. Weekly Abnormal Detection Enhancements Jul 2, 2026 · release notes

    Weekly Abnormal Detection Enhancements - Week of July 2

    • Strengthened detection of attachment-based spam and phishing sent through trusted email providers.
    • Enhanced detection of disguised renewal scams that use hidden characters to evade filters.

    2 details in Everything

43. Auto-Forwarding & Google Groups Protection for Google Workspace Jun 30, 2026 · release notes

    Abnormal AI introduces pre-delivery scanning and remediation for auto-forwarded emails and Google Groups in Workspace

    • Adds Auto-Forwarding Protection for Google Workspace to scan emails before they are forwarded to third-party services or sent to collaborative inboxes.
    • Adds Google Groups Protection for Google Workspace to provide pre-delivery scanning and remediation for messages directed to shared mailboxes.

    2 details in Everything

44. Pre-Delivery Mail Flow Dashboard Jun 30, 2026 · release notes

    New Pre-Delivery Mail Flow Dashboard adds real-time per-mailbox protection monitoring and stuck mail remediation via Portal UI

    • Adds the Pre-Delivery Mail Flow Dashboard to monitor protection status (Active, Pending, Inactive, or Stuck Mail) and email volume across all inline monitored mailboxes.
    • Adds filtering by protection status, email address search, and domain-level rollups within the dashboard to identify coverage gaps.
    • Adds the Undelivered Mail page in the Portal for viewing stuck messages and taking action (forward, delete, or download).

    3 details in Everything

45. Centralize Security Operations with Google SecOps Integration Jun 24, 2026 · release notes

    New Google SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. integration for centralized threat detection and SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. automation

    └──▷ HOW TO FIND IT
    Install the connector from Google SecOps Marketplace to enable SOAR playbooks for Abnormal AI threats
    📍In Google SecOps Marketplace, search for Abnormal AI and install the native connector.
    Configure YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules to convert SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. events into SOAR cases automatically
    📍Create a YARA-L detection rule that maps incoming SIEM events from Abnormal AI to SOAR cases, eliminating manual triage.
    • Adds native Abnormal AI connector to Google SecOps Marketplace for automated incident response via SOAR playbooks
    • Enables automatic ingestion of IES, AISM, ATO, Security Posture Management, and Audit Logs into Google SecOps SIEM

    2 details in Everything

46. Threat-Led Posture Recommendations Jun 24, 2026 · release notes

    Abnormal AI adds 15 threat-led M365 posture policies and CSV export for SPM.

    └──▷ HOW TO FIND IT
    Export SPM evaluation results for compliance review or audit trails.
    📍Navigate to the ESPM evaluations page and select Export › CSV
    • Adds 15 first-party email posture policies for Microsoft 365, researched against active 2025–2026 attack campaigns and mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior.
    • Enables high-risk detection of M365 misconfigurations including unauthenticated Direct Send, mailbox forwarding, transport-rule persistence, Teams federation abuse from trial tenants, and audit-log tampering
    • Adds export capability for the ESPM evaluations page to CSV for audits, compliance reviews, and reporting

    3 details in Everything

47. Weekly Abnormal Detection Enhancements Jun 19, 2026 · release notes

    Weekly Abnormal Detection Enhancements - Week of June 19

    • Enhanced detection of callback fraud and invoice scams hiding inside PowerPoint slide images
    • Closed an evasion gap where attackers buried malicious payloads inside forwarded email (.eml) attachments
    • Launched new training model for strengthening detection of sophisticated phishing using high-quality visual signals
    • Improved detection of high-risk Japanese-language phishing, reducing missed attacks for Japanese-language email environments
    • Added detections for notifications about unauthorized bank account changes in HR systems

    5 details in Everything

48. AI Phishing Coach Attack Library Jun 18, 2026 · release notes

    New Attack Library page in Abnormal AI Phishing Coach to manage simulation templates

    • Adds a new Attack Library page that lists every AIPC-simulated template (click-phishing, credential-phishing, BEC, VEC) with tags, content previews, and metadata.
    • Adds per-template enable/disable toggles to the Attack Library, allowing immediate exclusion of specific templates from autopilot rotation without disabling entire attack types.

    2 details in Everything

49. AI Phishing Coach Nine New Compliance Videos Jun 18, 2026 · release notes

    Abnormal AI Phishing Coach adds nine new compliance training modules covering PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly., GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., and more

    • Adds nine new Compliance framework modules for PCI, GDPR, SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2, PIPEDA, CCPA, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., FERPA, CMMC, and FFIEC to the AI Phishing Coach Video Library.
    • Adds a Compliance section in the Video Library for organizing these new regulatory training modules.

    2 details in Everything

50. URL Rewriting CSV Export Jun 15, 2026 · release notes

    New Export CSV button in the Abnormal AI URL Rewriting dashboard to download rewrite logs.

    └──▷ HOW TO FIND IT
    Export last month's URL rewriting logs for compliance reporting using the dashboard UI.
    📍In the Abnormal AI platform, navigate to the URL Rewriting click tracking dashboard and click Export CSV. Select a date range covering up to 180 days (e.g., the previous month) to download the Rewrite Logs CSV file.
    • Adds an Export CSV button to the URL Rewriting dashboard for exporting click tracking data as a Rewrite Logs CSV file.
    • Enables selection of a custom date range (up to 180 days) for the rewritten URL activity export.

    2 details in Everything

51. AI Phishing Coach Reports Page Update Jun 11, 2026 · release notes

    The AI Phishing Coach now offers a unified interface for generating and viewing Risk, Simulation, and Video Training reports.

    • Unified generator card with tabs for Risk, Simulation, and Video Training

    1 detail in Everything

52. AI Phishing Coach Risk Reporting Jun 11, 2026 · release notes

    Adds AI Phishing Coach risk reporting with exportable per-employee Bayesian risk scores and simulation history

    • Exports employee risk workbooks pairing identities with Bayesian risk scores, variance against company average and global benchmark, plus phishing/credential/BEC-VEC simulation activity and training data

    1 detail in Everything

53. Date Range Filter for AI Security Mailbox Portal Metrics Jun 10, 2026 · release notes

    Adds 7-day, 30-day, 90-day, and custom date range filters to AI Security Mailbox portal metrics

    └──▷ HOW TO FIND IT
    Filter mailbox activity metrics to a specific period via the UI to analyze trends.
    📍In the AI Security Mailbox portal, select the desired date range (7-day, 30-day, 90-day, or custom) from the metrics view filter options.
54. Weekly Abnormal Detection Enhancements May 29, 2026 · release notes

    New weekly detections for SVG phishing, reply-to redirection, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. reset abuse

    • Adds support for enhanced detection of SVG-based phishing that hides encoded content
    • Adds multi-signal detection linking help-desk social engineering to follow-on sign-ins from unfamiliar IPs
    • Adds detections for suspicious help-desk-driven MFA resets where the actor initiating the reset is not the target user

    3 details in Everything

55. Search & Respond Message Reclassification May 28, 2026 · release notes

    Adds message reclassification (Safe, Spam, Attack) and folder-only moves to Search & Respond

    • Allows admins to reclassify messages as Safe, Spam, or Attack directly in Search & Respond
    • Enables choice between full reclassification and folder-only move actions for flexible response

    2 details in Everything

56. Introducing Detection 360 Visibility + AI Detection Agents May 28, 2026 · release notes

    Abnormal AI adds Detection 360 visibility and AI-driven auto-deployment for threat detection coverage.

    └──▷ HOW TO FIND IT
    Monitor the end-to-end lifecycle of detected threats on a single console to assess protection efficacy.
    📍In the Abnormal AI platform, navigate to the Detection 360 Dashboard to view org-level visibility into detections and impacted messages trends.
    Leverage automated investigation for missed threats to reduce manual triage effort.
    📍Report a missed threat via the platform; AI Detection Agents will automatically investigate the miss and deploy targeted detections for similar variants.
    • Adds Detection 360 Timeline for case-level traceability from user submissions to investigation and deployed detections.
    • Adds Detection 360 Dashboard providing org-level visibility into detections, impacted messages, and trends on a unified console.
    • Introduces AI Detection Agents to automatically investigate reported misses and deploy targeted detections for similar attack variants.

    3 details in Everything

57. External Tag for Simulations in Outlook May 22, 2026 · release notes

    AI Phishing Coach now injects the Microsoft External tag into Outlook simulations via DMI

    └──▷ HOW TO FIND IT
    Run DMI-based phishing simulations against Outlook users that include the External banner, ensuring realistic engagement without switching to SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure..
    📍No code or CLI required; the feature is automatically enabled for all AI Phishing Coach customers.
    • Adds automatic injection of the Microsoft External tag into Direct Mail Integration (DMI) simulations sent to Outlook users
    • Enables end-to-end simulation realism parity between DMI and SMTP delivery modes for phishing awareness training

    2 details in Everything

58. Redesigned Video Library May 22, 2026 · release notes

    Redesigned Video Library adds categorized sections, dedicated Trainings tab, and list view for better content navigation.

    └──▷ HOW TO FIND IT
    Navigate directly to training videos without scrolling through general content.
    📍In the Video Library, click the Trainings tab.
    Skim video titles quickly using a list layout instead of cards.
    📍In the Video Library, switch the view mode to List View.
    • Adds a Dedicated Trainings Tab to the video library so training videos are accessible from their own tab instead of being buried in the main list
    • Adds a List View option to the video library to display content as a list for faster skimming of titles

    2 details in Everything

59. Abnormal's Phish Report Button for Google (US Tenants Only) May 22, 2026 · release notes

    Adds a dedicated phish report button for Gmail to replace unreliable native reporting for AIPC simulations

    └──▷ HOW TO FIND IT
    Enable reliable reporting of phishing simulations that native Gmail buttons miss or delay
    📍In Gmail, click the Phish Report Button in the message header to instantly report a simulation or real phish to Abnormal AIPC
60. Weekly Abnormal Detection Enhancements May 22, 2026 · release notes

    Enhanced detection of suspicious messages from trusted senders with subtle attack indicators

61. Anomaly Log Case Links for Account Takeover May 15, 2026 · release notes

    Anomaly Log now shows direct hyperlinks to linked Account Takeover cases

    └──▷ HOW TO FIND IT
    Jump directly from an anomaly log entry to its related Account Takeover case without manual search.
    📍In the Anomaly Log, click the numbered case hyperlink for a specific anomaly.
62. Weekly Abnormal Detection Enhancements May 15, 2026 · release notes

    Enhanced phishing detection for first-contact senders via new signal correlation

    • Enhances phishing detection for first-contact senders by correlating trust, content, and authentication signals to bypass reputation filters

    1 detail in Everything

63. Advanced Remediation Configuration for Account Takeover May 8, 2026 · release notes

    Adds granular remediation thresholds and per-tenant overrides for account takeover automation in Abnormal AI.

    • Adds Advanced tab to Automatic Remediation Threshold settings allowing independent configuration of actions (Revoke Sessions, Password Reset, Disable Account) for M365, Google Workspace, Okta at High, Medium, and Low confidence levels.
    • Adds Custom option in the Basic tab of Automatic Remediation Threshold settings to unlock full customized control over remediation actions.
    • Adds Custom Tenant Settings feature enabling admins to define per-tenant remediation behavior that overrides account-level defaults for specific tenants.

    3 details in Everything

64. Quarterly Abnormal Detection Accuracy Enhancements May 1, 2026 · release notes

    Abnormal AI updates credential-phishing/attachment detection heuristics and adds automated vendor fraud case generation.

    • Adds 21 new behavioral heuristics for enhanced attachment analysis engine targeting QR codes, JavaScript inside PDFs, and password-protected nested archives
    • Enables automated generation of vendor fraud cases via a deterministic vendor fraud policy layer within the AI Workflow
    • Increases overall processing throughput by approximately 38% for vendor fraud case classification

    3 details in Everything

65. Expanded Training Library for AI Attacks May 1, 2026 · release notes

    Expanded training library adds video content on deepfakes, smishing, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. fatigue, and vendor email compromise.

    • Adds video modules covering multi-channel attacks spanning email, SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., voice, collaboration tools, cloud services, and mobile
    • Adds coverage of major attack categories including deepfakes, OAuth abuse, BEC/VEC, and credential phishing
    • Provides a broader library to give security teams more flexibility to tailor training programs

    3 details in Everything

66. GWS Calendar Invite Remediation & Threat Log Calendar Invite Filter May 1, 2026 · release notes

    GWS malicious calendar invite auto-remediation and new Calendar Invite Threat Log filter.

    • Automatic removal of malicious calendar invites from Google Workspace calendars when linked emails are remediated as Attack, Borderline, or Spam
    • New Calendar Invite filter in the Threat Log across Portal, CSV export, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.

    2 details in Everything

67. Weekly Abnormal Detection Enhancements May 1, 2026 · release notes

    Abnormal AI adds SVG phishing, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. vendor fraud precision, and education giveaway scam detections in Weekly Abnormal Detection Enhancements.

    • Expanded SVG phishing detection to cover embedded text, base64 payloads, QR codes, and OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels.-identified impersonated logos

    1 detail in Everything

68. Blocklisted Threat Log Filter & Indicator Apr 30, 2026 · release notes

    Abnormal AI adds filter, visual indicator, CSV export, and API access for blocklisted threats in the Threat Log.

    └──▷ HOW TO FIND IT
    Filter the Threat Log to view only blocked threats.
    📍In the Threat Log, apply the blocklisted filter.
    Export blocklisted threat data for offline reporting.
    📍In the Portal, go to Threat Log › Export and select CSV to include blocklisted status.
    • Adds blocklisted filter to the Threat Log to display blocklisted messages from the past two months
    • Adds a visual indicator on individual threat entries in the Portal for those blocklisted in the past two months
    • Exports blocklisted status via CSV export for offline analysis and reporting
    • Exposes blocklisted status through SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integrations and the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.

    4 details in Everything

69. URL Rewriting Click Events API Apr 30, 2026 · release notes

    New API endpoint returns structured data on rewritten URLs clicked by end users

70. New APIs for Portal Posture Monitoring Apr 27, 2026 · release notes

    Adds REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. for retrieving portal users, roles, security settings, and API tokens to support SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications./GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. posture monitoring.

    • Enables integration with SSPM or GRC tooling to continuously monitor Abnormal tenant configuration via new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints.

    1 detail in Everything

71. Weekly Abnormal Detection Enhancements Apr 24, 2026 · release notes

    Weekly Abnormal Detection Enhancements adds detections for malicious SVG scripts, Japanese attacks, and aged lookalike credential harvesting.

    • Launched detections for malicious scripts hidden inside SVG image attachments
    • Strengthened detection coverage for localized Japanese-language attacks
    • Added detections for credential-harvesting attacks that use aged lookalike domains impersonating internal IT support and help desk roles

    3 details in Everything

72. REST API Self-Service & Token Flexibility Apr 23, 2026 · release notes

    Abnormal adds self-service REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. token management in the Portal with granular controls.

    • Adds the ability to create, rotate, and revoke REST API tokens directly in the Abnormal Portal, eliminating support-ticket delays.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing REST API tokens will automatically expire in April 2027, requiring customers to create new tokens to maintain uninterrupted API access.
73. Stream Abnormal Event Data in Near-Real Time with Webhooks Apr 23, 2026 · release notes

    Adds Webhook as a new SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration type to stream Threats, Cases, Audit Logs, and more via HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoints.

    └──▷ HOW TO FIND IT
    Stream Threats and Vendor Cases to a SIEM endpoint using Bearer TokenBearer TokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. auth.
    📍1. In the Abnormal Portal, go to Integrations › SIEM. 2. Select Webhook as the integration type. 3. Enter your HTTPS endpoint URL. 4. Choose Bearer Token for authentication and provide the token. 5. Select Threats and Vendor Cases as event types. 6. Validate endpoint and test delivery.
    • Supports sending Threats, Vendor Cases, AI Security Mailbox, Audit Logs, Account Takeover, Security Posture Management, and URL Rewriting Clicked events via webhook
    • Configures HTTPS endpoint with API Key, Basic Authentication, Bearer Token, or Custom Header authentication methods
    • Supports IP allowlisting and delivery with guaranteed retries

    3 details in Everything

74. Simulation Targeting with Google Groups Apr 15, 2026 · release notes

    AI Phishing Coach now targets simulations using existing Google Groups for precise training alignment

75. Exception Workflow in Security Posture Management Apr 15, 2026 · release notes

    SPM adds structured exception workflow with Accepted Risk and Excepted from Evaluations states for posture findings.

    └──▷ HOW TO FIND IT
    Permanently exclude a finding from future evaluations while documenting the reason.
    📍In the SPM console, open the finding and select Excepted from Evaluations, then provide the mandatory justification.
    Filter the posture dashboard to show only findings currently under review or approved.
    📍Apply a filter in SPM for workflow state: Investigating, Flagged, or Accepted.
    • Adds time-bounded suppression via Accepted Risk state to posture findings
    • Adds permanent exclusion via Excepted from Evaluations state to posture findings
    • Enforces mandatory justification on every exception entry
    • Makes exception decisions visible in the immutable Activity Timeline
    • Allows filtering posture findings by workflow state: Untriaged, Investigating, Flagged, Accepted, Excepted

    5 details in Everything

76. ThreatBase Tunnel Details Apr 13, 2026 · release notes

    ThreatBase adds VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./proxy/TOR tunnel context to IP lookups, showing provider and anonymity status.

    └──▷ HOW TO FIND IT
    Assess if a suspicious IP is routing through an anonymizing service during investigation
    📍In ThreatBase, search for an IP address and review the tunnel details section in the results.
77. Weekly Abnormal Detection Enhancements Apr 10, 2026 · release notes

    New subject-line analysis for suspicious patterns and expanded link analysis for obfuscated URLs.

    • Launched subject-line analysis to identify suspicious patterns and evasion techniques used in attack campaigns
    • Expanded link analysis to improve detection of malicious or obfuscated URLs embedded in email content

    2 details in Everything

78. V2 Multi-Language Video Training Apr 9, 2026 · release notes

    Abnormal AI V2 Multi-Language Video Training adds 16 new native languages

    • Adds Dutch, Polish, Italian, Indonesian, Malay, Swedish, Norwegian, Finnish, Danish, Czech, Hungarian, Thai, Vietnamese, Serbian, Turkish, and Bengali to video training language support

    1 detail in Everything

79. Japanese Localization for AI Phishing Coach Apr 9, 2026 · release notes

    Abnormal AI adds full Japanese localization for the AI Phishing Coach interface.

    • Adds Japanese localization to Threat Simulations, Video Training, Reports, Risk Management, and Settings pages.

    1 detail in Everything

80. New Detections for Mistyped and Wrong External Recipients Apr 8, 2026 · release notes

    Abnormal AI adds Mis-Typed Recipient and Wrong External Recipient detections to Misdirected Email Prevention.

    └──▷ HOW TO FIND IT
    Review misaddressed emails in the UI to identify potential typos or wrong-domain recipients.
    📍In the console, go to Misdirected Email Prevention and review the Unlikely recipient and Likely recipient fields for new detections.
    • Adds Mis-Typed Recipient detection to Misdirected Email Prevention for lookalike addresses
    • Adds Wrong External Recipient detection to Misdirected Email Prevention for similar names across different domains

    2 details in Everything

81. Bulk Remediation at Scale in Search & Respond Apr 7, 2026 · release notes

    Abnormal AI raises Search & Respond bulk remediation limit to 200k messages per action via UI

82. Extended End-User Controls Learning Window for Graymail Apr 6, 2026 · release notes

    Abnormal AI extends graymail end-user control learning window from 7 to 90 days

83. Weekly Abnormal Detection Enhancements Apr 3, 2026 · release notes

    Abnormal AI adds BCC-only phishing, brand impersonation on new domains, and scam TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. detection enhancements for the week of April 3.

    • Added detection for coordinated phishing campaigns leveraging BCC-only delivery to evade traditional filters
    • Enhanced detection of brand impersonation attacks that redirect users to newly created or obscure domains
    • Strengthened detection of scam emails from newly registered or suspicious top-level domains with poor sender reputation
    • Improved account takeover detection by refining burst analysis to distinguish malicious activity from benign traffic spikes

    4 details in Everything

84. Export User Management Data to a CSV Apr 2, 2026 · release notes

    New UI feature to export user management data (users, roles, permissions) to CSV for audit and compliance.

    └──▷ HOW TO FIND IT
    Export user and role access control data for compliance reporting.
    📍In the console, go to Settings › User Management, select the Users or Roles tab, and click the export to CSV button (top-right).
    • Adds export to CSV button in Settings → User Management for users and roles
    • Excludes legacy EU datacenters from new CSV export availability

    2 details in Everything

85. Indicators Filter for Account Takeover Anomaly Log Apr 1, 2026 · release notes

    New Indicators filter added to Anomaly Log for Account Takeover anomaly categorization

    └──▷ HOW TO FIND IT
    Filter anomalies by specific behavior signals like high-risk sign-ins to speed up triage in the UI.
    📍In the Anomaly Log, select Indicators from the filter dropdown and choose High-Risk Sign-In or other indicator types.
    • Adds an Indicators filter to the Anomaly Log UI, allowing categorization of anomalies by indicator type (e.g., Admin Console Activity, High-Risk Sign-In, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. usage)
    • Integrates the new Indicators filter alongside existing filters (Date Range, Event Types, Platform) to enable faster triage based on observed behavior types

    2 details in Everything

86. Global Safelist Now Applies to Teams Messaging Security Mar 31, 2026 · release notes

    Global Safelist now covers Teams messages for unified trusted sender management

    └──▷ HOW TO FIND IT
    Reduce false positives for trusted senders in Teams without separate configuration
    📍In the Abnormal portal, add the sender domain to the Global Safelist (previously used for email only). These rules now apply automatically to Teams Messaging Security.
    • Global Safelist rules applied to email are automatically extended to Teams Messaging Security

    1 detail in Everything

87. Weekly Abnormal Detection Enhancements Mar 27, 2026 · release notes

    New detections for vendor billing fraud via lookalike domains and programmatic account deletions.

    • Added detection for vendor billing fraud using newly registered lookalike reply-to domains to redirect payments
    • Launched detection for programmatic account deletions to identify suspicious bulk removal activity

    2 details in Everything

88. Abnormal’s Phish Report Button for Microsoft Mar 26, 2026 · release notes

    Abnormal AI releases general availability for its Microsoft Phish Report Button, enabling in-client threat reporting from Outlook desktop and mobile.

    └──▷ HOW TO FIND IT
    Deploy the new in-client reporting button to an Outlook environment using the provided manifest file.
    📍Follow the US Deployment Guide or EU Deployment Guide linked in the release notes to configure the Phish Report Button manifest in your Microsoft environment.
    • Adds a native Phish Report Button to Microsoft Outlook (desktop and mobile) allowing employees to report suspicious emails with one click
    • Automatically moves reported emails to Deleted Items upon submission via the Phish Report Button
    • Provides instant recognition for users who correctly identify AI Phishing Coach simulations through the in-client reporting interface

    3 details in Everything

89. Just-In-Time Training Quizzes Toggle Mar 26, 2026 · release notes

    Abnormal AI adds admin toggle for Just-In-Time Training quizzes to reduce user interruptions.

    └──▷ HOW TO FIND IT
    Admins managing training fatigue can use this setting to pause JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. quiz interruptions for all users across the organization.
    📍In the AI Phishing Coach settings, toggle the Just-In-Time Training Quizzes switch to enable or disable them org-wide.
    • Adds ability for admins to enable or disable Just-In-Time (JIT) Training quizzes org-wide via the AI Phishing Coach settings.

    1 detail in Everything

90. Updated Data Privacy & Retention Mar 23, 2026 · release notes

    Abnormal AI updates MEP data handling with 180-day retention and new audit log events for compliance

    • Extends retention for misdirected email metadata and related detection signals to 180 days
    • Adds new audit log events capturing when users view the outbound log and open specific misdirected email detections

    2 details in Everything

91. Customer Feedback in the Outbound Log Mar 23, 2026 · release notes

    Outbound Log now surfaces free-text SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. feedback on MEP decisions directly in the message details view.

    └──▷ HOW TO FIND IT
    View historical SOC feedback for a specific misdirected email detection without consulting external ticketing systems.
    📍In the Outbound Log, click on a MEP entry to open message details and review the admin-submitted feedback text.
92. Detection 360 Insights (Generally Available) Mar 17, 2026 · release notes

    Abnormal AI Detection 360 now provides explainable case insights via its UI to show reasoning and impact of analyst feedback.

    • Adds AI-generated case insights in the Detection 360 UI that reveal behavioral signals behind classification verdicts
    • Adds Clear reasoning in the Detection 360 UI showing how identity, language, and context contributed to detection outcomes
    • Adds Actionable insights in the Detection 360 UI highlighting detection improvements resulting from analyst False Positive/Negative reports

    3 details in Everything

93. Introducing Phishing Risk Scoring: An Abnormal Approach to Changing (and Measuri Mar 17, 2026 · release notes

    Abnormal AI introduces dynamic Phishing Risk Scoring for continuous human risk management.

    • Adds dynamic, behavior-based Phishing Risk Scoring to quantify human susceptibility across the enterprise.

    1 detail in Everything

94. Simulate Realistic Social Engineering Attacks With AI Phishing Coach Mar 17, 2026 · release notes

    Adds AI-driven BEC and VEC social engineering simulations to Abnormal's Phishing Coach

    • New BEC and VEC simulations in AI Phishing Coach that use behavioral relationship patterns to generate realistic manager, colleague, and vendor fraud scenarios.
    • AI Phishing Coach now automatically delivers tailored simulations based on identified communication patterns to test employee responses to social engineering attacks.

    2 details in Everything

95. Introducing Attune 1.0: The Behavioral Foundation Model for Cybersecurity Mar 17, 2026 · release notes

    Attune 1.0 introduces a unified behavioral foundation model for identity, behavior, and content signals in Inbound Email Security.

    • Unifies identity, behavior, and content signals in Attune 1.0 to surface subtle anomalies missed by stitched detection systems

    1 detail in Everything

96. Weekly Abnormal Detection Enhancements Mar 13, 2026 · release notes

    New detections for graymail with phishing-training classification, deep PDF invoice inspection, display-name spoofing, vendor fraud, and credential phishing patterns.

    • Enhanced graymail detection with integrated phishing-training classification to reduce inbox noise
    • Launched deep PDF invoice inspection to improve vendor fraud detection accuracy
    • Added detection for display-name spoofing attacks that use rare, unusually long sender names
    • Introduced vendor fraud detection using font-based signals to identify altered invoices and payment requests
    • Deployed detection for credential phishing disguised as bid and proposal requests targeting procurement workflows

    +3 more show less

    • Released detection for credential phishing abusing trusted Salesforce automated emails with embedded malicious links
    • Launched detections for vendor fraud using newly registered or mismatched reply-to domains to redirect payments
    • Deployed detection for Microsoft billing impersonation using phone-based callback phishing

    8 details in Everything

97. Attachment Analysis Expanded Coverage Mar 12, 2026 · release notes

    Abnormal AI expands attachment metadata visibility with new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. field.

    └──▷ TRY IT
    Fetch attachment metadata via API for a specific message to correlate artifacts quickly.
    copy

    $ GET /messages/{message_id}/attachment/{attachment_name}

    • Adds attachment_analysis field to SIEM Email Threats events for richer investigation context
    • Adds REST API support for /messages/{message_id}/attachment/{attachment_name} endpoint
    • Expands attachment metadata (MD5, SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., SHA1 hashes, type, size) visibility in Portal Message Details View

    3 details in Everything

98. Continuous Vendor Intelligence in VendorBase Mar 10, 2026 · release notes

    VendorBase now auto-adds new vendors from invoices and refreshes contact/risk context with new signals.

    └──▷ HOW TO FIND IT
    Automatically detect and ingest a new vendor into your risk profile the moment they send an invoice, without manual entry.
    📍In VendorBase, verify that newly seen vendors appear in the list upon receiving their first invoice email.
    • Adds automatic onboarding of newly seen vendors to VendorBase as soon as they start sending invoices
    • Enhances vendor intelligence to refresh contact details and update risk context with new signals

    2 details in Everything

99. Email Productivity Dashboard Revamp Mar 9, 2026 · release notes

    Abnormal AI revamps Email Productivity dashboard with mode-aware views and CSV exports

    • Adds a mode‑aware view that auto-adjusts to deployment stages (All Active, All Passive, Partial) to show graymail remediation progress
    • Adds independent filters for user type (VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. vs. non‑VIP) and status (Active vs. Passive), plus the ability to hide bypassed senders
    • Enables CSV exports of graymail reporting with day‑by‑day breakdowns by frequency, senders, and recipients

    3 details in Everything

100. Weekly Abnormal Detection Enhancements Mar 6, 2026 · release notes

     Weekly enhancements: improved vendor billing fraud detection via reply-to domain mismatch and Microsoft Entra credential change monitoring

     • Launched Microsoft Entra detection correlating password or MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. changes with anomalous sign-ins to flag active takeovers
     • Improved vendor fraud detection using reply-to domain mismatch analysis on billing change requests
     • Added Microsoft Entra detection for suspicious credential additions enabling long-term account persistence

     3 details in Everything

101. Simulation Grouping with Active Directory Mar 5, 2026 · release notes

     Abnormal AI adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. group targeting for phishing simulations to align tests with real team structures.

     • Target phishing simulations using existing Active Directory groups

     1 detail in Everything

102. Account Takeover Case Page Updates Mar 2, 2026 · release notes

     Abnormal AI adds Post-Compromise Activity filter and reorders Initial Access Vector on ATO Cases page

103. Weekly Abnormal Detection Enhancements Feb 27, 2026 · release notes

     Weekly Abnormal Detection Enhancements adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-based lateral phishing labeling, vendor-domain relationship detection, and Entra MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. removal alerts.

     • Adds expanded LLM-based labeling of lateral phishing to accelerate model tuning and improve detection accuracy
     • Improves misdirected email detection using aggregated sender-recipient communication history
     • Launches vendor-domain relationship detection to better identify lookalike domains in misdirected emails
     • Adds Microsoft Entra detection for MFA removal to identify high-risk post-compromise activity

     4 details in Everything

104. Custom Banners & Subject Prefixes for Phishing Simulations Feb 23, 2026 · release notes

     Adds custom subject prefixes, warning banners, and HTML banner support for phishing simulations

     • Add a custom subject line prefix (up to 30 characters) to all simulation emails

     1 detail in Everything

105. Employee Impersonation Toggle Feb 20, 2026 · release notes

     New Employee Impersonation toggle in Simulation Settings allows admins to disable BEC simulations.

     • Employee Impersonation toggle added to Simulation Settings to control phishing simulations
     • Automatic disabling of Business Email Compromise (BEC) and related impersonation-based scenarios when the toggle is off

     2 details in Everything

106. Trend Timeline in SPM Feb 18, 2026 · release notes

     SPM reports now include a Trend Analysis view to track compliance posture over time.

     • Adds Trend Analysis view inside SPM to display 30-day posture trends
     • Enables distinguishing accepted risk from non-compliance in the Trend Timeline

     2 details in Everything

107. Weekly Abnormal Detection Enhancements Feb 13, 2026 · release notes

     New weekly detection enhancements for malicious HTML audio attachments, lateral compromise in education, and brute-force sign-ins.

     • Launched detections for malicious HTML content disguised as audio file attachments
     • Added detections for lateral account compromise attacks in educational institutions
     • Deployed brute-force sign-in detections using location and failed login patterns

     3 details in Everything

108. Enhanced Simulation Log Visibility Feb 10, 2026 · release notes

     Enhanced Simulation Log Visibility

     └──▷ HOW TO FIND IT
     View all AI Phishing Coach simulation activity in a single, unified view within the Operational Dashboard.
     📍Navigate to Operational Dashboard › Simulation Logs
     Filter the Simulation Logs view to isolate only failed simulations for targeted investigation.
     📍In the Simulation Logs view, apply a filter for Failed status.
     • The Operational Dashboard now displays all AI Phishing Coach simulation activity in a single, unified view.
     • The Simulation Logs view enables filtering to isolate failed simulations from the full log set.

     2 details in Everything

109. Customizable Manual Account Remediation Feb 9, 2026 · release notes

     Abnormal AI adds manual account remediation dialog with selectable actions (revoke sessions, disable account, force password reset)

     └──▷ HOW TO FIND IT
     Use the dialog to suspend a user but skip forcing a password reset for a specific scenario.
     📍In PeopleBase, select Suspend -> deselect Force Password Reset -> Confirm
     • Adds selectable/deselectable specific remediation actions in the manual remediation/suspend dialog
     • Enables self-service testing of individual remediation integrations via test accounts

     2 details in Everything

110. Strategic & Operational Insights for Account Takeover Feb 6, 2026 · release notes

     Abnormal AI adds Account Takeover Dashboard, Anomaly Log, and Attack Vector Classifications for deeper visibility.

     └──▷ HOW TO FIND IT
     Review trends in confirmed account takeover cases and investigate related incidents.
     📍In the console, go to Account Takeover › Dashboard
     Search for suspicious identity or email activity that did not result in a confirmed case.
     📍In the console, go to Account Takeover › Anomaly Log
     Analyze aggregated attack methods and initial access vectors for detected account takeover incidents.
     📍In the console, go to Account Takeover › Attack Vector Classifications
     • Adds the Account Takeover Dashboard showing identity, email, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. signal correlation into confirmed ATO cases
     • Adds the Anomaly Log providing a searchable view of suspicious activity even when no case is created
     • Adds Attack Vector Classifications identifying initial access vectors and aggregated patterns for ATO cases

     3 details in Everything

111. Vendor Email Compromise (VEC) Simulations Feb 5, 2026 · release notes

     AI Phishing Coach adds Vendor Email Compromise (VEC) simulations using active VendorBase data.

     • Adds VendorEmailCompromise simulation type to AI Phishing Coach for training against vendor fraud attacks
     • Integrates active vendors from VendorBase to generate realistic VEC scenarios
     • Enables testing of decision-making beyond clicks by marking simulated replies as failures

     3 details in Everything

112. Platform Integrations RBAC Feb 5, 2026 · release notes

     Extends RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to platform integrations for tenant-level and org-wide granular access control.

     • Enables configuring least-privilege permissions specifically for platform integrations.

     1 detail in Everything

113. New Search & Respond API Endpoints Feb 4, 2026 · release notes

     New Search & Respond REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints enable programmatic message search and remediation from SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. platforms.

     • Adds new Search & Respond REST API endpoints for programmatically searching for messages
     • Adds new Search & Respond REST API endpoints for triggering remediation actions

     2 details in Everything

114. Expanded Enterprise Remediation Settings Jan 30, 2026 · release notes

     Adds self-service Portal controls for Google Workspace hidden folder remediation and Outlook/Google borderline handling.

     • Admins can now manage Google Workspace hidden folder remediation directly in the Portal without opening a support ticket
     • Administrators can configure borderline remediation for Outlook tenants to route messages to recoverableitemsdeletions instead of standard deletion
     • Administrators can configure borderline remediation for Google Workspace tenants to route messages to Trash instead of deleting them immediately
     • The Portal now allows applying hidden folder remediation specifically to attack, borderline, and spam message categories for Google Workspace

     4 details in Everything

115. Streaming Google Sign-in Event Ingestion Jan 26, 2026 · release notes

     Abnormal AI adds near real-time ingestion and analysis of Google sign-in events for Account Takeover customers.

     • Enables near instant streaming ingestion and evaluation of Google Workspace sign-in events, removing the need for periodic API polling.

     1 detail in Everything

116. Weekly Abnormal Detection Enhancements Jan 23, 2026 · release notes

     Abnormal AI adds detection for calendar invites with abnormal durations, Google Drive + password pairings, and Docusign invoice fraud.

     • Added detection to identify suspicious calendar invites with abnormal durations
     • Added detection for emails that pair Google Drive links with password phrases to block advanced phishing attacks
     • Added detection of new invoice fraud attacks leveraging Docusign

     3 details in Everything

117. Multi-Language Video Training Jan 22, 2026 · release notes

     AI Phishing Coach adds multi-language video training for global workforces

118. Department-based Simulation Grouping Jan 22, 2026 · release notes

     Department-based simulation grouping enables targeted phishing training with per-department frequency and guidelines

     • Allows phishing simulations to be targeted to specific departments for department-aware training campaigns
     • Enables application of different simulation frequencies and guidelines per department to match team operational needs
     • Permits inclusion or exclusion of specific departments from simulation delivery

     3 details in Everything

119. Notification Groups Jan 20, 2026 · release notes

     Adds Notification Groups feature via Settings > Notifications for tenant and severity-based alert routing

     └──▷ HOW TO FIND IT
     Route critical tenant alerts to a specific team using the new Notification Groups interface.
     📍In the console, go to Settings › Notifications and create or configure your groups
     • Adds Notification Groups to Settings > Notifications for managing alert recipients by tenant and severity level
     • Provides default groups (Critical, Warning, Info) that automatically include new event types

     2 details in Everything

120. Enhanced Threat Details for Microsoft Teams Messaging Security Jan 20, 2026 · release notes

     Enhanced visibility for blocked Microsoft Teams attacks with expanded signal details and attachment analysis in Threat Log

     └──▷ HOW TO FIND IT
     Review the specific signals that caused a Teams message to be blocked to tune detection policies or reassure users.
     📍Navigate to the Threat Log in the Abnormal AI console and select a blocked Teams message to view its threat details.
     • Blocked Microsoft Teams attacks now display human-readable threat reasons explaining the detection outcome.
     • Malicious URL analysis surfaces expanded data across 13+ signals including phishing likelihood, malware likelihood, suspicious URL patterns, redirects, domain age, DNS validation, and IP/country context.
     • Malicious attachment analysis provides deeper file inspection with static analysis results, prior Abnormal verdicts, Microsoft verdicts, and metadata such as name and size.

     3 details in Everything

121. Enhanced Explainability for Misdirected Email Prevention Jan 20, 2026 · release notes

     Abnormal AI adds structured explanations for misdirected email detections in the Outbound Log

     └──▷ HOW TO FIND IT
     Understand why an outbound message was flagged as misdirected by reviewing structured risk signals in the Outbound Log.
     📍In the console, go to Outbound Log › click a detected item › Review the updated Analysis Overview for plain-language reasons and key risk signals
     Compare who was intended vs. who received the email using new recipient context.
     📍In the Outbound Log › click a detected item › View "more likely / less likely recipient" context
     Investigate specific content contributing to the detection by viewing highlighted text.
     📍In the Outbound Log › click a detected item › Switch to Text Analysis to see highlighted entities and phrases
     • Adds an updated Analysis Overview with plain-language reasons and key risk signals (such as rare recipient behavior and autofill risk) for misdirected email detections
     • Adds "more likely / less likely recipient" context to compare the intended recipient with who actually received the email
     • Adds a switch to Text Analysis to view highlighted entities and phrases in the email content that contributed to the misdirected email decision

     3 details in Everything

122. Video Training Quizzes Jan 15, 2026 · release notes

     AI Phishing Coach adds post-video quizzes with configurable pass thresholds for user-level comprehension tracking

     • Adds Video Training Quizzes that appear at the end of video training content to validate understanding
     • Enables admins to configure pass thresholds and review quiz results via the platform interface
     • Tracks quiz performance per user for reporting and analysis of training effectiveness

     3 details in Everything

123. Gen-AI Explanation Flyout and Before vs After JSON View in SPM Drift Log Jan 15, 2026 · release notes

     SPM Drift Log adds Gen-AI explanation flyouts and side-by-side before/after JSON views.

     └──▷ HOW TO FIND IT
     Validate the exact configuration difference between the previous and current state.
     📍In the Abnormal SPM console, open the Drift Log and select the side-by-side JSON view for a drift event.
     • Adds Gen-AI summary flyouts to SPM Drift Log events for clear posture change explanations
     • Adds side-by-side before and after JSON views in SPM Drift Log for exact configuration diffs

     2 details in Everything

124. Business Email Compromise (BEC) Simulations Jan 15, 2026 · release notes

     AI Phishing Coach adds BEC simulations impersonating managers, colleagues, and subordinates with failure detection on user reply.

     • BEC simulations now include impersonation of managers, colleagues, and subordinates to test trust-based attacks
     • Simulations are marked as failed when a user replies, signaling risky engagement

     2 details in Everything

125. Account Takeover Page Enhancements Jan 13, 2026 · release notes

     New Account Takeover page filtering, sorting, and UI enhancements.

     └──▷ HOW TO FIND IT
     Prioritize investigation by finding the most recently updated cases first.
     📍In the Account Takeover list view, click the sort header for Last Updated to reverse chronological order.
     • Adds filtering by platform and case status on the Account Takeover page
     • Adds sorting by First Observed or Last Updated for case lists
     • Adds a new Clear Filters button to reset the view
     • Adds less commonly used filters to a dedicated More Filters panel
     • Displays employee initials in the cases list

     5 details in Everything

126. Outbound Volume at a Glance for Misdirected Email Jan 12, 2026 · release notes

     Outbound Log now shows 30-day email volume for Misdirected Email Prevention.

     └──▷ HOW TO FIND IT
     Quickly validate that key mail flows are being inspected by Abnormal during security audits.
     📍In the Abnormal Portal, go to Misdirected Email Prevention › Outbound Log and check the metric at the top of the log.
127. Auto-Remediation of Malicious Teams Messages Jan 9, 2026 · release notes

     Abnormal AI adds auto-remediation for malicious Microsoft Teams messages with configurable threat policies

     • Admins can now automatically remove malicious Microsoft Teams messages based on configurable threat policies
     • Define default remediation actions for Attack and Borderline Teams threats
     • Automatically soft-delete malicious messages at detection time

     3 details in Everything

128. Attachment Scanning in Teams Jan 9, 2026 · release notes

     Abnormal AI now scans Microsoft Teams attachments for malware and displays detections in Threat Logs.

     └──▷ HOW TO FIND IT
     Monitor Microsoft Teams chat for malware uploads via the dashboard.
     📍In Abnormal AI, navigate to Threat Logs to view file metadata and threat rationale for detected Teams attachments.
     • Enables automatic scanning and identification of malicious files shared in Microsoft Teams messages
     • Displays detailed Teams attachment detections (file metadata and threat rationale) in Threat Logs

     2 details in Everything

129. CC Managers on Just-in-Time Training Reminders Jan 8, 2026 · release notes

     Adds CC Managers in JIT Reminders setting to AI Phishing Coach for automated manager notifications.

     └──▷ HOW TO FIND IT
     Automate manager visibility for incomplete phishing training by enabling the new CC toggle in AI Phishing Coach advanced settings.
     📍In the console, go to Settings › AI Phishing Coach › Simulation Settings, expand Advanced Settings and enable CC Managers in JIT Reminders.
     • Adds CC Managers in JIT Reminders toggle under Settings > AI Phishing Coach > Simulation Settings > Advanced Settings to automatically CC managers on JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. training reminder emails.

     1 detail in Everything

130. New Simulation and Training Controls Dec 11, 2025 · release notes

     New Admin controls for JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. training timing and simulation types

     • Adds UI controls to enable or disable 24-hour and 7-day JIT training follow-ups.
     • Adds ability to select which phishing simulation types (Click, Credential) Autopilot includes.

     2 details in Everything

131. Segmented Insights in AI Phishing Coach Dec 11, 2025 · release notes

     Adds Office, Manager, Department, and Country filters to the Executive Dashboard for segmented performance metrics

132. Status Visibility and Subsetting Dec 11, 2025 · release notes

     Adds MEP status indicators and subsetting to Misdirected Email Prevention via Settings UI

     └──▷ HOW TO FIND IT
     Verify that Misdirected Email Prevention is active and processing outbound mail correctly.
     📍Go to Settings → Misdirected Email Prevention in the UI to view status indicators
     Enable Misdirected Email Prevention for a specific department as part of a targeted rollout.
     📍Go to Settings → Misdirected Email Prevention and select the target group or department to enable protection
133. “Hide Deleted Apps” Filter in AppBase Dec 10, 2025 · release notes

     AppBase adds a Hide deleted apps checkbox to filter out deprovisioned applications

     └──▷ HOW TO FIND IT
     Streamline AppBase view by filtering out inactive apps to focus on active integrations
     📍In AppBase, enable the Hide deleted apps checkbox
134. Fewer False Positives, Smarter Claims Filtering Dec 8, 2025 · release notes

     Smarter intent-aware filtering for claims topics reduces false positives by better understanding message intent.

     • Improves understanding of claims-related content to reduce false positives in claims topic filtering.

     1 detail in Everything

135. Date-Based Filtering for Account Takeover Dec 8, 2025 · release notes

     New date-based filtering presets for Account Takeover cases in Abnormal AI.

     └──▷ HOW TO FIND IT
     Quickly review account takeover activity for the last month without manual date selection.
     📍Select Account Takeover in the console, then apply the 30 days quick preset filter.
     • Adds date range filters and quick presets (7 days, 30 days) to Account Takeover case search.

     1 detail in Everything

136. More Realistic, Direct Simulations in AI Phishing Coach Dec 4, 2025 · release notes

     Abnormal AI Phishing Coach adds API-first direct inbox delivery and dynamic lookalike domains.

     • API-first delivery injects simulations directly into employee inboxes
     • Dynamic lookalike domains (typosquatted) for more realistic phishing simulations

     2 details in Everything

137. Customer Branding in AI Phishing Coach Dec 4, 2025 · release notes

     AI Phishing Coach now supports customer branding via logo uploads in settings.

     └──▷ HOW TO FIND IT
     Branding phishing training emails and modules with your corporate logo to increase engagement and trust.
     📍In the AI Phishing Coach settings, upload your company's logo file.
     • Adds the ability to upload company logos in AI Phishing Coach settings to brand training content and communications.

     1 detail in Everything

138. RBAC Saved Custom Roles Dec 3, 2025 · release notes

     Abnormal AI adds saved custom RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles via Settings > User Management for scalable team access control

     └──▷ HOW TO FIND IT
     Create a new custom role and assign permissions via the User Management interface.
     📍Go to Settings › User Management, click Add User and + Create New Role.
     • Adds the ability to create and save custom user roles within the RBAC framework for reuse across teams

     1 detail in Everything

139. GenAI Posture Drift Explanations for Security Posture Management Dec 2, 2025 · release notes

     New GenAI Posture Explanations in Drift Log explain posture changes, config shifts, and security implications.

     • Adds GenAI Posture Explanations to the Drift Log, providing clear summaries explaining why a posture changed, what shifted in configuration, and the security impact
     • Enables viewing raw JSON before and after each change directly in the Drift Log for deeper visibility into exact environment updates

     2 details in Everything

140. Platform Integration Alerts Nov 24, 2025 · release notes

     Abnormal AI now alerts on platform integration failures via email

     • Adds proactive email alerts when platform integrations fail to prevent coverage gaps in ATO and SPM
     • Configurable notification recipients via Settings with automatic fallback to the Abnormal Global Admin

     2 details in Everything

141. New Job Title & Language Fields Added to AI Phishing Coach Reports Nov 21, 2025 · release notes

     Admin reports now include Job Title and Language segmentation fields for deeper workforce analytics.

     └──▷ HOW TO FIND IT
     Identify which departments have the highest phishing simulation failure rates to target security awareness efforts.
     📍Filter your Simulation Report by Job Title to view Failure Rate, Report Rate, and Training Completion Rate per role.
     • Adds Job Title and Language fields to Simulation Report data
     • Adds Job Title field to Video Training Report data
     • Adds failure rate, report rate, and training completion rate metrics segmented by Job Title in Simulation Reports

     3 details in Everything

142. Filter Microsoft Teams Threats in the Threat Log Nov 18, 2025 · release notes

     Adds Source Platform filter to Threat Log for Microsoft Teams threat isolation

     └──▷ HOW TO FIND IT
     Isolate and review only Microsoft Teams threats in the Abnormal Portal Threat Log.
     📍In the Abnormal Portal, go to Threat Log › Open Filters › select Source Platform › choose Microsoft Teams
     • Enables filtering Threat Log views specifically to Microsoft Teams threats for faster triage

     1 detail in Everything

143. Enhanced Video Training Reporting Workbook Nov 12, 2025 · release notes

     Enhanced Video Training Reporting Workbook replaces CSV with multi-tab Excel workbook for departmental analysis.

     • Replaces the Video Training CSV export with a multi-tab Excel workbook for deeper engagement insight.
     • Adds segmented views by Department, Manager, Office, and Country to identify training gaps.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The legacy Video Training CSV export is replaced and no longer available in this form.
144. Export “Not Analyzed” Submissions from AI Security Mailbox Nov 11, 2025 · release notes

     Adds ability to export Not Analyzed submissions from the AI Security Mailbox with a new context column

     └──▷ HOW TO FIND IT
     Export unanalyzed items from the mailbox for offline review
     📍Submissions › Not Analyzed → Download Spreadsheet
     • Admins can now export submissions from the Not Analyzed tab in the AI Security Mailbox for deeper review
     • Export includes a new Reason for No Analysis column to provide context for why an item was not analyzed
     • Export options include Download in Browser and Send Download to Email

     3 details in Everything

145. Groups for VIP Management Nov 11, 2025 · release notes

     Abnormal AI adds automated VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. tagging by linking Microsoft 365 groups

     └──▷ HOW TO FIND IT
     Link an existing M365 group to automatically manage VIP status in Abnormal AI.
     📍Navigate to Settings › VIP Management, then click Manage VIPs and select your Microsoft 365 group
     • Adds automatic VIP status management linked to Microsoft 365 groups for dynamic user tagging
     • Introduces Settings > VIP Management UI section with a Manage VIPs action for configuration

     2 details in Everything

146. AI Phishing Coach Executive Dashboard Nov 11, 2025 · release notes

     New Executive Dashboard for Abnormal AI Phishing Coach tracks simulation metrics and training effectiveness

     • Adds Simulation Failure Funnel metric tracking user engagement from email open to failure or training completion
     • Adds Simulation Report Rate metric measuring user reporting of simulated phishing emails
     • Adds Training Completion Rate metric measuring completion rates across assigned trainings
     • Adds Failure Rate by Attack Type metric showing phishing susceptibility by type over time
     • Adds Report Rate by Attack Type metric showing how often users report each attack type over time

     +2 more show less

     • Adds Training Effectiveness by Cohort metric comparing last month's training completions to this month's simulation performance
     • Adds Top VIPs Failing Simulations metric identifying high-value individuals with the most simulation failures

     7 details in Everything

147. Weekly Abnormal Detection Enhancements Nov 7, 2025 · release notes

     Abnormal AI adds graymail safe sender logic updates, localized detection in German and Japanese, and Microsoft 365 calendar invite remediation.

     • Expanded safe sender logic for graymail detection to reduce false positives in mail filtering
     • Implemented enhanced localized language detection in German and Japanese
     • Introduced malicious calendar invite remediation for Microsoft 365

     3 details in Everything

148. Enhanced Simulation Reporting Workbook Nov 4, 2025 · release notes

     New multi-tab Excel reporting workbook replaces CSV for phishing simulations.

     • Adds a multi-tab Excel workbook replacing the previous Simulation Report CSV to provide segmented views by Department, Manager, and Office
     • Prebuilt tabs for All Data Export, Top Failing Users, Top Reporting Employees, and Training Completion Rates in the new workbook

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Simulation Report CSV is replaced by the multi-tab Excel workbook
149. Announcing Misdirected Email Prevention Nov 4, 2025 · release notes

     Abnormal AI adds Misdirected Email Prevention (MEP) using behavioral AI to detect and block misaddressed emails.

     • Adds Misdirected Email Prevention (MEP), a new capability that uses behavioral AI to detect misaddressed emails and mis-attached files by analyzing recipient context without requiring rules or policies.
     • Automatically blocks detected misdirected messages, routes them to Microsoft quarantine, and alerts the sender with self-remediation guidance.

     2 details in Everything

150. Nested Folders for Graymail Oct 31, 2025 · release notes

     Nested folder support for Promotions in Graymail across M365 and GWS

151. Email Digest: Evolving from Inbox Insights Oct 31, 2025 · release notes

     Inbox Insights is now Email Digest with sender/subject details and a de-branded experience

152. Quarantine Release with Abnormal Scoring Oct 31, 2025 · release notes

     Adds Abnormal scoring and judgment filtering to the Microsoft Quarantine view in Search & Respond.

     └──▷ HOW TO FIND IT
     Filter quarantined emails by Abnormal's threat assessment to quickly identify malicious items in the Microsoft quarantine view.
     📍In Search & Respond, go to Quarantine Release and set the filter Abnormal Judgment to Malicious.
     • Displays Abnormal judgments alongside Microsoft judgments side-by-side for each quarantined message
     • Applies Abnormal behavioral scoring to all messages in the Microsoft Quarantine
     • Enables filtering quarantined messages by Abnormal judgment (Safe, Suspicious, or Malicious)
     • Supports filtering by Received Time only in Search & Respond for all Abnormal messages without requiring sender, subject, or recipient filters

     4 details in Everything

153. O365 Calendar Invite Attack Remediation Oct 31, 2025 · release notes

     Abnormal AI introduces automatic removal of malicious calendar invites linked to remediated emails and a new Calendar Invite Attack Insight.

     └──▷ HOW TO FIND IT
     Use guided setup to grant Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. and PowerShell permissions for automated remediation of malicious calendar invites.
     📍Initiate the guided setup in the Abnormal console to grant Graph API and PowerShell permissions for deletion and restoration.
     • Adds automatic detection and deletion of .ics and embedded calendar events tied to remediated messages
     • Surfaces calendar-based attack activity directly in the Threat Log for faster investigation

     2 details in Everything

154. URL Rewriting: Enhanced Explainability Oct 31, 2025 · release notes

     Abnormal AI adds explainability for URL rewriting via Click Tracking Dashboard visibility and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. click-event publishing.

     • URL Rewriting now displays the specific reason a link was rewritten to improve user trust and reduce false-positive perception.

     1 detail in Everything

155. New Coverage for Microsoft Defender and Purview in Security Posture Management Oct 31, 2025 · release notes

     Abnormal AI SPM adds detection of configuration drift for Microsoft Defender and Purview environments.

     • Delivers deeper insight into Microsoft 365 security alignment and compliance gaps

     1 detail in Everything

156. Multi-language Simulations & Coaching Oct 30, 2025 · release notes

     AI Phishing Coach adds automatic language detection and multi-language simulations for global teams

     • Adds automatic language detection from GWS or M365 user profiles to determine the employee's preferred language for AI Phishing Coach content.
     • Enables localized phishing simulations, just-in-time coaching, and email reminders in employees' detected languages.

     2 details in Everything

157. AI-powered Simulation Guidelines Oct 28, 2025 · release notes

     Abnormal AI adds AI-powered Simulation Guidelines for phish campaign control via natural language.

     • Adds AI-powered simulation control that refines which simulations are delivered or excluded based on admin prompts
     • Enables flexible inclusion and exclusion of training topics, difficulty levels, or behavioral themes in simulations
     • Introduces adaptive optimization that updates Auto-pilot’s simulations based on admin feedback

     3 details in Everything

158. Weekly Abnormal Detection Enhancements Oct 24, 2025 · release notes

     Abnormal AI enhances link detection, campaign correlation, and enables date-only search in Search and Respond.

     └──▷ HOW TO FIND IT
     Use the updated search flexibility to quickly find messages by date without specifying additional complex filters.
     📍# In Search and Respond, simply filter by date: # Filter: Date is Last 7 Days
     • Enabled more accurate detection of attacks leveraging links in subject lines
     • Improved campaign group correlation logic for attacks with similar characteristics
     • Enabled faster and more flexible message search and review in Search and Respond, with date as the only required selector

     3 details in Everything

159. Expanded Reporting Metrics for AI Phishing Coach Simulations Oct 23, 2025 · release notes

     New reporting metrics in AI Phishing Coach UI and CSV export: employee status, manager, department, location.

160. Credential Phishing Now in AI Phishing Coach Oct 16, 2025 · release notes

     Abnormal AI adds realistic credential phishing simulations with just-in-time coaching for Google, Microsoft, LinkedIn and other platforms

     • Adds support for credential phishing simulations mimicking Google, Microsoft, LinkedIn, X, Apple, Stripe, and GitHub to identify employees willing to enter credentials.

     1 detail in Everything

161. Weekly Abnormal Detection Enhancements Oct 10, 2025 · release notes

     Weekly Abnormal AI detection enhancements for executive invoice fraud, conference scams, Adobe/Xero abuse, and research solicitation.

     • Adds advanced detection of executive invoice fraud attempts
     • Improves identification of urgent conference invitation scam campaigns
     • Enhances detection of attacks abusing Adobe and Xero platforms as payload domains
     • Strengthens detection of research paper and publishing solicitation attacks

     4 details in Everything

162. Self-Service Video Training Generation in AI Phishing Coach Oct 9, 2025 · release notes

     Self-service branded video training generation in AI Phishing Coach

     └──▷ HOW TO FIND IT
     Configure automated video generation without support tickets by navigating the settings interface.
     📍In the console, go to Settings › AI Phishing Coach. Underneath Generate Video Training Content, upload your company logo and a short description. Save changes to generate training videos automatically.
163. Audit Log for AI Phishing Coach Simulation Reports Oct 6, 2025 · release notes

     Abnormal AI introduces an audit log for AI Phishing Coach simulation reports to provide admin visibility into past activities.

     • Adds an audit log for AI Phishing Coach simulation reports, providing a full history of simulation activity for security awareness admins.
     • Enables on-demand generation and review of simulation reports asynchronously.

     2 details in Everything

164. Priority Assessment & Improved Risk Filtering in Security Posture Management Sep 30, 2025 · release notes

     Posture Details now show exposure impact and time-to-fix estimates for prioritization

     • Shows exposure impact highlighting business and security consequences in Posture Details
     • Adds time-to-fix estimates for remediation timelines in Posture Details

     2 details in Everything

165. RBAC for Knowledge Bases Sep 23, 2025 · release notes

     Extends RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to PeopleBase, AppBase, TenantBase, ThreatBase for granular access control

166. Micro-Learning Video Library Sep 18, 2025 · release notes

     Abnormal AI adds a Micro-Learning Video Library for AI Phishing Coach training

     └──▷ HOW TO FIND IT
     Access the new micro-learning modules in the AI Phishing Coach interface to engage users with shorter, focused content.
     📍In the Abnormal AI console, navigate to the AI Phishing Coach section to find the Micro-Learning Video Library.
     • Adds the Micro-Learning Video Library to replace long videos with five focused micro-training topics: Introduction, Threat Awareness, Emerging Threats, Ethical & Social Responsibility, and Best Practices.

     1 detail in Everything

167. One-Click Integration for Microsoft Teams Messaging Security Sep 17, 2025 · release notes

     Abnormal AI adds one-click onboarding flow for Microsoft Teams Messaging Security integration.

     • Enables One-Click Integration flow to onboard Microsoft Teams Messaging Security without manual scripts
     • Removes Microsoft per-message charges for Teams messaging protection

     2 details in Everything

168. Manual Remediation for Microsoft Teams Threats Sep 17, 2025 · release notes

     New manual remediation capability allows admins to delete malicious Teams messages via Threat Log.

     └──▷ HOW TO FIND IT
     Remediate a post-delivery threat in Microsoft Teams by manually deleting the malicious content via the console.
     📍1. Go to Threat Log 2. Locate the malicious Teams message 3. Click Select Remediation Options 4. Select Block and click Remediate
     • Adds manual deletion of malicious Microsoft Teams messages directly from the Threat Log for admin control over channels and DMs.

     1 detail in Everything

169. Export AppBase Data to a CSV Sep 16, 2025 · release notes

     Export AppBase third-party application inventory data directly to CSV via the AppBase interface.

     └──▷ HOW TO FIND IT
     Export all third-party apps connected to your Microsoft 365 tenant for offline analysis.
     📍Navigate to AppBase › Click Export to CSV
170. Schedule Targeted Video Training Sep 9, 2025 · release notes

     Abnormal AI adds ability to schedule targeted video training for specific employee groups in AI Phishing Coach

     └──▷ HOW TO FIND IT
     Schedule a phishing training session for a specific group
     📍Use the Schedule Targeted Video Training feature in AI Phishing Coach to select employee groups and set training dates.
     • Enables tracking of all sessions, past and upcoming, with simplified compliance reporting
     • Allows editing or extending trainings anytime to ensure employee coverage

     2 details in Everything

171. Just-in-Time Quizzes & Reminders for AI Phishing Coach Sep 3, 2025 · release notes

     Adds Just-in-Time Quizzes & Reminders to AI Phishing Coach to validate understanding and enforce completion.

     • Adds automatic just-in-time quizzes on the coaching landing page to validate employee understanding of security topics
     • Adds automated reminders sent after 24 hours and again after 7 days for employees who have not completed the quiz

     2 details in Everything

172. Enhanced Simulation Visibility with Email Open Tracking Sep 1, 2025 · release notes

     Abnormal AI adds email open tracking to simulation timeline in AI Phishing Coach for deeper phishing engagement insight.

173. Email Productivity Enhancements Aug 25, 2025 · release notes

     Abnormal AI adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for Graymail Dashboard, wildcard/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. bypass rules with CSV bulk upload/export, and multi-tenant scoping

     • Role-Based Access Controls (RBAC) to control who can view the Graymail Dashboard and manage Email Productivity settings
     • Wildcard & CIDR Support in Bypass Filter Management for domains and IP ranges
     • Bulk Upload via CSV to import multiple bypass rules at once
     • CSV Export of bypass rules including metadata such as type, value, tenant, creation date, and comments
     • Multi-Tenant & Segmented SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Support to scope rules to specific tenants

     5 details in Everything

174. Threat Alerts for Microsoft Teams Aug 22, 2025 · release notes

     Abnormal AI adds automatic high-severity threat alerts in Microsoft Teams

     └──▷ HOW TO FIND IT
     Configure the integration to receive automated alerts for critical threats in your teams channel.
     📍In the console, go to Settings › Notifications › Microsoft Teams Messaging Security and add individual recipients.
     • Adds automatic Microsoft Teams alert delivery for high-severity threats detected by Abnormal
     • Adds a new configuration path Settings > Notifications > Microsoft Teams Messaging Security to manage alert recipients

     2 details in Everything

175. Per-Tenant Remediation Configuration for Account Takeover Aug 22, 2025 · release notes

     Adds per-tenant account takeover remediation configuration via a new Add Custom Settings UI option.

     └──▷ HOW TO FIND IT
     Tailor remediation rules for a specific tenant within a multi-tenant Abnormal deployment.
     📍In the Abnormal UI, navigate to Settings › Account Takeover and click Add Custom Settings to configure tenant-specific policies.
     • Configures Account Takeover remediation settings separately for each tenant

     1 detail in Everything

176. VIP Management Settings Aug 18, 2025 · release notes

     Adds manual and auto VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. management via Settings > VIP Management portal

     └──▷ HOW TO FIND IT
     Configure which job titles automatically tag users as VIPs in the portal.
     📍In the console, go to Settings › VIP Management and click Manage VIPs
177. Announcing Security Posture Management for Microsoft 365 Aug 5, 2025 · release notes

     Abnormal AI adds Microsoft 365 Security Posture Management (SPM) add-on to detect tenant misconfigurations.

178. Enhanced Just-in-Time Coaching Experience in AI Phishing Coach Aug 4, 2025 · release notes

     Redesigned Just-in-Time coaching pages in AI Phishing Coach with richer visuals and behavioral insights

179. URL Rewriting: Safelisting and Blocklisting Self-Service Aug 4, 2025 · release notes

     Abnormal AI adds self-service safelisting and blocklisting controls for URL Rewriting in the Abnormal Portal.

     └──▷ HOW TO FIND IT
     Add a trusted domain to the safelist for URL Rewriting using the Abnormal Portal UI.
     📍In the Abnormal Portal, navigate to Settings › Message Remediation, click on the URL Rewriting tab, and click Add Entry for URL Rewriting Safelist.
     • Enables customers to configure URL Rewriting safelists and blocklists directly via Settings > Message Remediation in the Abnormal Portal

     1 detail in Everything

180. Automated Threat Hunter for Account Takeover Protection Jul 14, 2025 · release notes

     New Automated Threat Hunter for Account Takeover Protection using continuous login history analysis

     • Adds automated ATO case creation and confidence updates when historical login matches emerging IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
     • Provides enriched threat context for account takeover investigations to accelerate response.

     2 details in Everything

181. Microsoft Sentinel Push Integration Jul 11, 2025 · release notes

     Abnormal AI adds push-based Microsoft Sentinel integration for direct event streaming.

     • Adds push integration mode for Microsoft Sentinel to stream events directly to Log Analytics Workspace without custom Function Apps
     • Expands data coverage in push integration to include Vendor Cases, Posture Changes, and Audit Logs

     2 details in Everything

182. Remediate Safe Messages as Spam in AISM Jul 9, 2025 · release notes

     Allows marking Safe messages as Spam directly in AISM AI Security Mailbox

     └──▷ HOW TO FIND IT
     Correct misclassified safe messages as spam to improve classification accuracy in AISM.
     📍In the AI Security Mailbox, select a Safe message and click Spam → Remediate
     • Adds the ability to remediate Safe messages as Spam within the AI Security Mailbox interface

     1 detail in Everything

183. Microsoft Teams Messaging Security is now available in the EU Jul 8, 2025 · release notes

     Microsoft Teams messaging protection now covers EU tenants, surfacing detections in the Threat Log.

     • Abnormal’s behavioral AI protects Microsoft Teams messages in EU environments.

     1 detail in Everything

184. User Group Subsetting for URL Rewriting Jul 1, 2025 · release notes

     Adds user-group subsetting for URL Rewriting in Abnormal AI M365 deployments

     └──▷ HOW TO FIND IT
     Roll out URL rewriting to a pilot group (e.g., IT or Security team) before tenant-wide activation.
     📍Navigate to the URL Rewriting settings in the Abnormal AI console, select Custom configuration, check 'Enable for a subset of users', and add the target Microsoft Entra ID group.
     • 'Enable for a subset of users' option added to the URL Rewriting settings UI, allowing selective deployment via Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. groups for M365 tenants.

     1 detail in Everything

185. Customize GenAI Responses with Images and Logos May 21, 2025 · release notes

     Abnormal AI lets you add images or logos to GenAI response headers/footers in AI Security Mailbox.

     └──▷ HOW TO FIND IT
     Brand your AI-generated email replies so recipients instantly recognize them as legitimate internal communications.
     📍1. Navigate to the AI Security Analyst configuration page. 2. Select Insert Images and upload your logo. 3. Preview the placement in Step 3 before deploying to your mailbox.
     • Adds the ability to upload and insert images or logos into the header or footer of GenAI responses within the AI Security Mailbox.

     1 detail in Everything

186. New Features in Search and Respond May 12, 2025 · release notes

     Adds CSV export, bulk remediation to inbox, judgement column/filter, and enhanced message details in Search & Respond

     • Download a CSV export of Search and Respond results.
     • Option to remediate messages to a user's inbox directly from Search & Respond, including when selecting bulk remediation.
     • Added a judgement column to the Search & Respond table, with the ability to filter results based on judgement type.
     • Enhanced the message details shown when clicking into an individual message.

     4 details in Everything

187. Bulk Upload Misclassifications in Detection 360 via CSV May 7, 2025 · release notes

     Adds CSV bulk upload for misclassification feedback in Detection 360

     └──▷ HOW TO FIND IT
     Submit bulk misclassification feedback via CSV in the UI.
     📍Navigate to Detection 360 and select CSV Upload.
188. RSA 2025: Major Product Launches and Platform Upgrades Now Live Apr 28, 2025 · release notes

     Abnormal AI launches AI Phishing Coach module, AI Data Analyst agent, and platform upgrades for quarantine viewing, remediation customization, and URL rewriting.

     └──▷ HOW TO FIND IT
     Ask the AI Data Analyst for specific threat insights via natural language in the Portal.
     📍In the Abnormal Portal, go to Reports and type "What were our top threats this quarter?" into the AI Data Analyst interface.
     Configure remediation actions for specific threat categories using Enterprise Remediation Settings.
     📍In the Abnormal Portal settings, navigate to Enterprise Remediation Settings and customize actions/folders by threat category.
     • Adds AI Phishing Coach as a new paid add-on module for autonomous, agentic security awareness training with personalized phishing simulations and just-in-time generative AI coaching
     • Adds AI Data Analyst, a free generative AI agent accessible via the Reports section of the Portal that answers natural language questions about threats and security insights
     • Enables viewing Microsoft-quarantined messages directly in the Abnormal portal through the existing Search & Respond feature under the new Quarantine Release capability
     • Introduces Enterprise Remediation Settings allowing customization of remediation actions and folders by threat category to align with risk tolerance
     • Adds URL Rewriting capability to warn users before clicking suspicious links and enables optional click tracking

     5 details in Everything

189. Automated Repeat False Positive Prevention in Account Takeover Protection Apr 18, 2025 · release notes

     Automated Repeat False Positive Prevention in Account Takeover Protection

     └──▷ HOW TO FIND IT
     Suppress recurring ATO alerts from legitimate users connecting from specific regions or IPs by providing targeted feedback.
     📍In the Account Takeover Protection console, mark a case as Incorrect Detection or Undetermined Cause and select safelist options for Location, IP Address, or VPN Usage.
     • Enables safelisting specific IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (Location, IP Address, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Usage) at the user level to prevent alert recurrence for several months

     1 detail in Everything

190. Emails Associated With Suspicious Sign-Ins in Account Takeover Case Timeline Apr 10, 2025 · release notes

     Abnormal AI highlights up to five suspicious emails in Account Takeover case timelines.

     └──▷ HOW TO FIND IT
     Investigate an ATO incident by viewing the specific phishing emails in the case timeline to understand the initial access vector.
     📍In the Abnormal AI console, navigate to the Account Takeover (ATO) case details and open the Timeline view to see associated suspicious emails.
191. Customizable Subject Lines and Disclaimers for GenAI Email Responses Apr 9, 2025 · release notes

     Adds UI controls for customizable GenAI email subject line variables and editable disclaimers in AI Security Mailbox

     └──▷ HOW TO FIND IT
     Customize a GenAI email subject line using available variables via the UI.
     📍In the GenAI responses configuration page, click Available Variables to insert supported variables into your custom subject line template.
     Edit the AI disclaimer text appended to GenAI email responses.
     📍In the GenAI responses configuration page, edit the disclaimer field (up to 500 characters) ensuring the required line 'This and the following content is powered by AI' remains intact; changes auto-save on blur.
     • Makes available subject line variables visible in the UI for customization of GenAI email subject lines.

     1 detail in Everything

192. GenAI Case Summaries in Account Takeover Protection Apr 2, 2025 · release notes

     Adds AI-powered plain-language case summaries for Account Takeover Protection cases in the Abnormal portal.

     └──▷ HOW TO FIND IT
     Quickly assess the severity and reasoning behind a detected account compromise directly within the Abnormal portal without waiting for manual investigation notes.
     📍In the Abnormal portal, navigate to an active ATO Case to view the new GenAI summary section.
     • Automatically generates clear headlines, bullet-point summaries of attacker tactics, and user-specific behavioral context for every ATO Case.
     • Provides confidence-level context (high, medium, low) to help security teams understand what happened and why it matters faster.

     2 details in Everything

193. Enabling GenAI Auto-Response Subsetting for AI Security Mailbox Jan 29, 2025 · release notes

     Enabling GenAI Auto-Response Subsetting for AI Security Mailbox

     └──▷ HOW TO FIND IT
     Select up to 50 users to test GenAI auto-response functionality in the AI Security Mailbox settings before wider rollout.
     📍Navigate to the Abnormal Platform › AI Security Mailbox settings and enable GenAI Auto-Responses for a subset of users (max 50).
     • Adds ability to enable GenAI auto-responses for up to 50 selected users via the AI Security Mailbox settings.
     • Introduces phased rollout capability for GenAI auto-responses to facilitate testing and change control before full-scale adoption.

     2 details in Everything

194. Trigger Signal Filtering in Account Takeover Protection Jan 16, 2025 · release notes

     Adds sort-by-trigger-signal capability to Account Takeover Protection Cases view.

195. Dynamic Incident Queue and Enhanced Search in Account Takeover Protection Dec 18, 2024 · release notes

     Dynamic incident queue with high/medium confidence highlighting and partial search in Account Takeover Protection

     └──▷ HOW TO FIND IT
     Quickly identify critical identity incidents in the listview by default
     📍Navigate to Account Takeover Protection › Incident Queue (high/medium confidence cases highlighted)
     Filter incidents based on their remediation state
     📍In the Account Takeover Protection listview, apply filter Remediation status
     • Adds dynamic incident queue in the Account Takeover Protection listview that highlights high and medium confidence cases by default
     • Enables filtering the Account Takeover Protection listview by Remediation status
     • Allows partial search terms instead of exact match in Account Takeover Protection search functionality

     3 details in Everything

196. Extending Identity Remediation to Google Workspace to Stop Suspicious and Compro Nov 11, 2024 · release notes

     Abnormal AI adds automated Google Workspace identity remediation capabilities for suspected and confirmed account takeovers

     └──▷ HOW TO FIND IT
     Manually block access for a suspicious user identified during threat hunting activities
     📍In the Abnormal PeopleBase interface, locate the suspicious user and select Block Account Access
     • Adds automatic suspension of Google access and forced password resets for high-severity account takeover incidents in Google Workspace
     • Enables manual blocking of Google Workspace user accounts via a single click in PeopleBase for suspicious users during threat hunting

     2 details in Everything

197. Expanding Okta Protections From Detection to Response With New Identity Remediat Nov 11, 2024 · release notes

     Abnormal AI adds Okta identity remediation: auto-suspend accounts and force password resets for high-severity incidents.

     • Enables automatic suspension of Okta access and forced password resets for high-severity account takeover incidents via the existing Okta API key integration
     • Adds single-click account blocking in PeopleBase for suspicious users during threat hunting

     2 details in Everything

198. Self-Service Configuration for Email Productivity Oct 31, 2024 · release notes

     New self-service options in Abnormal Email Productivity for configuring passive/active modes and user safelist/blocklist permissions

     • Enables configuration of Email Productivity into Passive mode (specifying an AD or Google Group) or Active mode (enabling all users with exclusion lists)
     • Grants or revokes end-users the ability to create graymail safelists or blocklists via self-service

     2 details in Everything

199. Introducing Detection360 Case Creation Directly Through Search & Respond Oct 24, 2024 · release notes

     Abnormal AI Search & Respond now offers one-click creation of Detection360 cases when marking missed attacks.

     └──▷ HOW TO FIND IT
     Create a Detection360 case for a missed attack without leaving the Search & Respond interface.
     📍In Search & Respond, mark an email as a missed attack and select the option to 'create a Detection360 case'.
     • Adds the option to automatically create a Detection360 case directly from the missed attack workflow in Search & Respond

     1 detail in Everything

200. Expansion of Abnormal RBAC with User Management for Custom Roles Oct 21, 2024 · release notes

     Abnormal RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. adds User Management permissions to custom roles for finer-grained user provisioning control.

     • Adds User Management section with new permissions for custom roles in Abnormal RBAC
     • Enables portal administrators to grant user management privileges to non-admin custom role users

     2 details in Everything

201. Third-Party Guest Users Analyzed in PeopleBase and Account Takeover Protection Sep 21, 2024 · release notes

     Third-Party Guest Users Analyzed in PeopleBase and Account Takeover Protection

     • PeopleBase supports import and analysis of guest users across connected mail, identity, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tenants.
     • Account Takeover Protection now surfaces Notable Events for guest user behavior deviations.

     2 details in Everything

202. Rapid7 InsightIDR Integration Sep 3, 2024 · release notes

     Abnormal AI adds native integration with Rapid7 InsightIDR for threat analysis and compliance reporting.

     • Enables sending Email Threats, Account Takeover Activity, Abuse Mailbox Events, Audit Log Events, and Security Posture Management Events to Rapid7 InsightIDR

     1 detail in Everything

203. Microsoft 365 Remediation in PeopleBase Aug 28, 2024 · release notes

     New PeopleBase UI actions to manually suspend Microsoft 365 access: revoke sessions, disable accounts, and force password resets.

     • Adds Revoke active sessions action in PeopleBase to immediately terminate a user's M365 logins
     • Adds Disable user accounts action in PeopleBase to suspend M365 identity access
     • Adds Force password resets action in PeopleBase to invalidate current credentials

     3 details in Everything

204. Attach Safe Emails to GenAI Responses Aug 20, 2024 · release notes

     Configures AI Security Analyst to attach analyzed safe emails in phishing reports

     └──▷ HOW TO FIND IT
     Enable safe email attachments in GenAI phishing reports via the UI
     📍In the AI Security Mailbox settings, enable Attach analyzed safe messages for GenAI Responses
205. Remediate Messages to an Inaccessible Location for Google Customers Aug 7, 2024 · release notes

     Abnormal AI adds opt-in remediation to an inaccessible location for Google Workspace customers

     • Google customers can now opt-in to remediate malicious emails by purging the initial message and storing a copy in internal data sources.

     1 detail in Everything

206. Sender Authentication Results are Now Available in SIEM Events Jul 18, 2024 · release notes

     Abnormal AI adds sender authentication results (SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders./DKIMDKIMAn email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit./DMARC) to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Email Threats events

     • Adds sender authentication fields to the Email Threats event type for ingestion into SIEM integrations
     • Exposes SPF, DKIM, and DMARC check results directly in SIEM without manual portal access

     2 details in Everything

207. New REST API Endpoint for Audit Log Data Jul 18, 2024 · release notes

     New REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint for ingesting Abnormal Portal audit logs

208. Event Status Labels for Security Posture Management Jun 21, 2024 · release notes

     Security Posture Management now supports labeling risky posture changes as Needs review, In progress, or Acknowledged.

     • Adds Needs review label for new or unread risky posture changes
     • Adds In progress label to indicate active investigation of a posture change
     • Adds Acknowledged (resolved) label when a risky change has been corrected
     • Adds Acknowledged (not important) label for changes deemed not to be a risk

     4 details in Everything

209. Success Criteria Jun 3, 2024 · release notes

     Adds a Success Criteria section for portal admins to evaluate value and performance.

     └──▷ HOW TO FIND IT
     Portal admins use this to communicate value derived from the platform and grade organizational priorities.
     📍Navigate to the Success Criteria section in the Abnormal portal
210. Abuse Mailbox Automation is Now AI Security Mailbox May 15, 2024 · release notes

     Abnormal AI rebrands Abuse Mailbox to AI Security Mailbox with GenAI responses and autonomous triage.

     └──▷ HOW TO FIND IT
     Configure the AI analyst to adopt a specific persona and provide tailored educational context to reporters.
     📍In the console, go to AI Security Mailbox settings, enable GenAI Responses, and set the Analyst name and instructions.
     • Enables GenAI Responses and custom AI Security Analyst instructions for user-reported phishing
     • Provides a dashboard collating all messages analyzed by AI Security Mailbox for reporting

     2 details in Everything

211. Introducing ThreatBase May 13, 2024 · release notes

     Abnormal AI introduces ThreatBase for cross-customer threat intelligence on IP addresses.

     • Adds ThreatBase to surface behaviorally derived cross-customer and cross-platform threat intelligence.
     • Enables querying ThreatBase for an IP address to view an Abnormal threat report including IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. metadata, associated APTs, common attacks, behavioral patterns, and malicious activity.

     2 details in Everything

212. Security Posture Management Updates May 5, 2024 · release notes

     Abnormal AI SPM adds directory view filters and High Risk explanations for anomalous changes.

     └──▷ HOW TO FIND IT
     Filter the SPM directory view to identify unacknowledged high-risk changes affecting sensitive actors.
     📍In the portal, go to Security Posture Management › Directory View and apply filters for Risk Level: High, Event Type: added, and Acknowledged: No.
     Review why a specific SPM event triggered a High Risk alert to understand the anomaly.
     📍Click on an SPM notification in the portal to open the event details and read the High Risk explanation and Suggested next steps.
     • Adds Risk Level, Actor, Event Type, Posture Category, and Acknowledged columns to the SPM directory view for filtering
     • SPM event details now include an explanation of why a change is classified as High Risk along with suggested remediation steps

     2 details in Everything

213. RBAC Improvements Apr 2, 2024 · release notes

     Abnormal AI introduces Custom RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles replacing Per-Product Admin for granular tenant controls.

     • Custom RBAC roles are now available to replace the Per-Product Admin option.
     • SPM customers can specify specific user accounts allowed to view Security Posture Management tabs in Portal.
     • SPM customers can specify specific user accounts allowed to acknowledge posture changes.

     3 details in Everything

214. Google Chronicle Integration Apr 1, 2024 · release notes

     New native integration with Google Chronicle for ingesting email threat and account takeover logs

215. New Phishing Simulation Auto-Response Category Mar 5, 2024 · release notes

     Adds Phishing Simulation Response auto-response category for simulated phishing reports in Abnormal AI

216. Regex for Search & Respond Mar 4, 2024 · release notes

     Search & Respond now supports Regex for Sender and Recipient Email Address fields

     └──▷ HOW TO FIND IT
     Investigate emails from senders matching a specific pattern, such as any address ending in @temp-mail.com, to identify potential spoofing or disposable email abuse.
     📍Click the Use Recipient/Sender Regex button in Search & Respond and enter a regex pattern like .*@temp-mail\.com$ in the Sender Email Address field.
     • Adds support for Regular Expression patterns in the Sender Email Address search field within Search & Respond.
     • Adds support for Regular Expression patterns in the Recipient Email Address search field within Search & Respond.

     2 details in Everything

217. Filter for QR Code Attacks in Threat Log Jan 24, 2024 · release notes

     New QR code attack filtering in Threat Log and enhanced detection for emails with malicious QR images.

     └──▷ HOW TO FIND IT
     View all attacks remediated by the new QR code detector in the Threat Log interface.
     📍In the console, go to Threat Log and apply the filter for QR code detector remediation events.
     • Adds the ability to filter Threat Log to view all attacks remediated by the new QR code detector

     1 detail in Everything

218. Deeper Insights and Confidence Scores in Email Account Takeover Protection Enhan Dec 14, 2023 · release notes

     Abnormal Email Account Takeover Protection adds confidence scoring and signal context to investigate email account takeover cases.

219. Email Productivity is Now Available for Google Workspace Dec 11, 2023 · release notes

     Email Productivity now available for Google Workspace with NLP/ML graymail detection and dashboard

     • Adds Email Productivity capability for Google Workspace to detect and remove graymail using NLP and ML models
     • Integrates graymail label in Gmail to automatically move removed promotional messages out of the primary inbox
     • Provides a new graymail dashboard showing daily volume trends, top targeted users/executives, and time savings metrics

     3 details in Everything

220. Ingest Abnormal data into CrowdStrike Next-Gen SIEM Nov 15, 2023 · release notes

     Adds Abnormal Security integration for CrowdStrike Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. to ingest email events.

221. New Events in Email Security Posture Management to Help Stop Consent Phishing Oct 31, 2023 · release notes

     Email Security Posture Management now surfaces new events for OAuth consent phishing detection

     • Surfaces when a new application has been granted access permissions
     • Surfaces when a new user has been added to a mail tenant
     • Surfaces when users are assigned to an application

     3 details in Everything

222. Email Account Takeover Protection: Detect the Signs of MFA Bypass in Compromised Oct 31, 2023 · release notes

     Abnormal AI adds detection signals for suspicious device registration indicating MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. bypass in compromised accounts.

     • Adds new signals to detect suspicious device registration that could indicate an attacker has manipulated the account and may be attempting to establish persistence.

     1 detail in Everything

223. Enhancements to Email Account Takeover Protection Case Explainability Oct 31, 2023 · release notes

     Email Account Takeover Protection cases now include detection confidence scores and detailed anomalous event explainability.

     • Adds detection confidence scores to Email Account Takeover Protection cases to quantify risk.
     • Adds detailed descriptions explaining why specific events triggered an Email Account Takeover case.
     • Adds rarity metrics for user activity to contextualize anomalous behavior.
     • Enhances identity details in cases with breakdowns of location, IP, client app, and browser.

     4 details in Everything

224. Email Productivity: Detection Efficacy and Delegate Management Update Aug 15, 2023 · release notes

     Email Productivity now recognizes end user movements for delegate-managed mailboxes and adds a new graymail detector.

     • Adds recognition of end user movements for mailboxes managed by delegates.
     • Adds a new detector that extends signals and attributes for detecting graymail based on message folder movements, engagement, and inbound statistics.

     2 details in Everything

225. New API Endpoints: Dashboard Metrics and Remediation History Aug 9, 2023 · release notes

     New API endpoints added for dashboard metrics and remediation history in Abnormal AI.

     • Adds new API endpoints to retrieve dashboard metrics (e.g., total attack count, attack type breakdown) via service calls
     • Adds new API endpoint to retrieve the latest status of a message following judgment changes, such as post-remediation in Abuse Mailbox Automation

     2 details in Everything

226. Mail Filter Rules and Additional App Permission Changes in Email Security Postur Jul 31, 2023 · release notes

     Email Security Posture Management now alerts on specific configuration changes to mail filters and third-party app permissions.

     • Surfaces configuration changes to mail rule filters in Email Security Posture Management
     • Surfaces additional third-party application permissions (e.g., joining video calls, creating/sending email) in Email Security Posture Management

     2 details in Everything

227. Email-Like Events Now Analyzed in Email Account Takeover Protection Cases Jul 31, 2023 · release notes

     Abnormal AI now analyzes Slack, Zoom, and Okta events in Email Account Takeover Protection cases.

228. Email Account Takeover Protection Ingestion of Posture Events Jul 31, 2023 · release notes

     Email Account Takeover Protection now ingests posture events for user privilege and conditional access changes.

     • Aggregates these posture signals within existing Account Takeover Cases

     1 detail in Everything

229. Abuse Mailbox Automation (Now AI Security Mailbox) Data Now Available in Existin May 8, 2023 · release notes

     AI Security Mailbox data is now available in existing Splunk, SumoLogic, and IBM QRadar SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integrations.

     • Adds AI Security Mailbox detection data to the existing Splunk integration
     • Adds AI Security Mailbox detection data to the existing SumoLogic integration
     • Adds AI Security Mailbox detection data to the existing IBM QRadar integration

     3 details in Everything

230. Announcing Email-Like Security for Slack, Zoom, and Microsoft Teams May 8, 2023 · release notes

     Abnormal AI adds monitoring and security actions for Slack, Zoom, and Teams.

     • Adds Email-Like Messaging Security to monitor Slack, Microsoft Teams and Zoom for messages containing suspicious URLs and flag them for review.
     • Adds Email-Like Account Takeover Protection to analyze authentication activity in Slack, Teams and Zoom, alerting on sign-ins from blocked browsers, risky locations, or known-bad IPs.
     • Adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. activity monitoring from Okta and Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. as evidence for account takeover alerts.
     • Adds Email-Like Security Posture Management to monitor privilege changes in Slack, Microsoft Teams and Zoom, surfacing high-impact admin rights changes.

     4 details in Everything

231. Portal Enhancements: Abnormal App Store, Deployment Overview, and Platform Integ May 8, 2023 · release notes

     New Abnormal App Store, Deployment Overview visualization, and expanded Platform Integrations for Slack, Zoom, Teams, AAD, Okta via API.

     • Abnormal App Store added to the Portal allowing customers to browse products and initiate purchases directly.

     1 detail in Everything

232. PeopleBase and TenantBase Now Available for Google Workspace Mar 8, 2023 · release notes

     Abnormal AI adds PeopleBase and TenantBase knowledge bases for Google Workspace to map users and tenants.

     └──▷ HOW TO FIND IT
     Map user behavior to identify compromised accounts by viewing dynamic profiles in the Abnormal platform.
     📍Navigate to Knowledge Bases › PeopleBase in the Abnormal console
     Audit the organization's email tenant landscape for visibility into attack entry points.
     📍Navigate to Knowledge Bases › TenantBase in the Abnormal console
     • Adds PeopleBase for Google Workspace, providing dynamic user profiles and activity timelines.
     • Adds TenantBase for Google Workspace, providing an inventory of all email tenants and their associated activities.

     2 details in Everything

233. Introducing Security Posture Management (Generally Available) Mar 1, 2023 · release notes

     Abnormal AI GA releases Security Posture Management for cloud email configuration visibility and risk monitoring

     • Adds a Security Posture Management add-on that surfaces and centralizes visibility into user privilege changes, application permissions, and mail tenant conditional access policies
     • Enables scheduling of email notifications for high-impact configuration changes via behavioral profiles from PeopleBase, AppBase, and TenantBase
     • Provides an export to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. capability for configuration change events
     • Introduces an acknowledgement workflow to denote when configuration changes have been addressed

     4 details in Everything

234. MFA Bypass Detection in Abnormal Account Takeover Protection Jan 19, 2023 · release notes

     Abnormal AI adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Bypass detection to Account Takeover Protection

     • Automatically opens an Abnormal Case upon detection of any identified MFA Bypass attack pattern

     1 detail in Everything

235. Lateral Burst Detection Jan 13, 2023 · release notes

     Abnormal AI adds Lateral Burst Detection for anomalous outbound email patterns from compromised accounts.

236. Hijacked Thread Detection Dec 5, 2022 · release notes

     Abnormal AI adds Hijacked Thread Detection analyzing message body and headers for malicious unrelated conversations.

     • Adds text-based attributes to analyze email message body and headers to identify hijacked thread attacks.

     1 detail in Everything

237. Introducing Security Posture Management (Early Access) Nov 29, 2022 · release notes

     Abnormal AI introduces Early Access Security Posture Management for cloud email configuration gaps.

     └──▷ HOW TO FIND IT
     Monitor cloud email environments for high-risk configuration drifts using the new add-on.
     📍In the Abnormal AI console, navigate to the Security Posture Management section to view risk posture and acknowledgement workflows.
     • Security Posture Management add-on monitors for high-risk configuration drifts such as privilege escalations and new third-party apps in cloud email environments
     • Platform utilizes Abnormal Knowledge Bases (PeopleBase, AppBase, TenantBase) to detect potentially harmful or unexpected configuration changes
     • Teams receive notifications for identified changes and can perform actions via a simple acknowledgement workflow

     3 details in Everything

238. New Sender IP Address and URL for Search & Respond Nov 28, 2022 · release notes

     Search & Respond adds new Sender IP Address and URL in Body filters to locate email records.

     └──▷ HOW TO FIND IT
     Filter emails in Search & Respond by the originating IP address to investigate potential spoofing or malicious sources.
     📍1. Go to Search & Respond. 2. Click the Filters dropdown. 3. Select Sender IP Address and enter the target IP.
239. Detection 360 Filters Nov 20, 2022 · release notes

     Abnormal AI adds UI filters for Detection 360 cases by sender, recipient, subject, and status.

     └──▷ HOW TO FIND IT
     Quickly find all submitted D360 cases from a specific VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. user by filtering on the Sender field and VIP status.
     📍In the console, go to Investigate › Detection 360, click Filter By, set Sender to <vip_name>, Status to Submitted, and VIP to Yes.
     • Adds the ability to filter all Detection 360 (D360) cases by Sender (name or email), Recipient (name or email), Subject (title), Submitted by (name), Case Number, Time span, Status (Resolved/Submitted), and VIP status.
     • Exposes a Filter By pop-up in the UI under Investigate > Detection 360 to apply these filters.

     2 details in Everything

240. Introducing Knowledge Bases: AppBase, PeopleBase, TenantBase Nov 14, 2022 · release notes

     Abnormal AI adds TenantBase, AppBase, and PeopleBase Knowledge Bases for Microsoft 365 attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. visibility

     • Adds TenantBase Knowledge Base to centralize business-critical tenant configuration settings previously scattered across multiple control panes
     • Adds AppBase Knowledge Base to provide visibility into third-party applications and vendors with access to the Microsoft 365 environment
     • Adds PeopleBase Knowledge Base to map employees and their potential role as entry points for account takeovers or privilege escalations

     3 details in Everything

241. New SIEM Event Fields Nov 14, 2022 · release notes

     Abnormal AI adds attack_score and folder_locations fields to the threats SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. event type.

     • Adds attack_score field to the threats event in the SIEM export schema.
     • Adds folder_locations field to the threats event in the SIEM export schema.

     2 details in Everything

242. New SIEM Event Type: Audit Log Nov 14, 2022 · release notes

     Abnormal AI adds Audit Log event type to its SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. export schema and API for ingestion.

243. Detection 360 Email Notifications Nov 13, 2022 · release notes

     Detection 360 now sends email notifications when cases are resolved.

     • Adds email notifications for Detection 360 case resolution events.

     1 detail in Everything

244. API Endpoint Enhancement for Abuse Mailbox Automation (Now AI Security Mailbox) Nov 9, 2022 · release notes

     New GET /abuse_mailbox/not_analyzed endpoint to view unanalyzed phishing reports via API

245. Abuse Mailbox Automation (Now AI Security Mailbox) Now Analyzes and Surface Mult Oct 24, 2022 · release notes

     Abnormal AI AI Security Mailbox now surfaces multi-forwarded email threads in Email Summary view.138 chars

     └──▷ HOW TO FIND IT
     Inspect multi-forwarded phishing reports to quickly identify the original sender and reply chain.
     📍In the Abnormal console, view the Email Summary for a reported message in AI Security Mailbox.
     • The Email Summary view now includes context about forwards or replies within the message.
     • Analysis details now show the origin of the email (e.g., "this email is the first in a thread with two replies.").

     2 details in Everything

246. New Search & Respond Fields and Filters Oct 19, 2022 · release notes

     Abnormal AI adds Graymail filtering, Message ID, and Attachment name fields to Search & Respond

     └──▷ HOW TO FIND IT
     Filter search results to show only Graymail messages when Email Productivity is enabled.
     📍In Search & Respond, select Graymail from the filter dropdown
     Search for a specific email by its unique Message ID.
     📍In Search & Respond, enter the message ID into the Message ID field
     Find emails containing a specific attachment filename.
     📍In Search & Respond, enter the filename into the Attachment name field
     • Adds Graymail filter option for customers with Email Productivity enabled to limit search results to Graymail messages only
     • Adds new searchable Message ID field in Search & Respond UI
     • Adds new searchable Attachment name field in Search & Respond UI

     3 details in Everything

247. BERT Large Language Model (LLM) Oct 11, 2022 · release notes

     Abnormal AI adds BERTBERTA transformer encoder trained to understand text using context on both sides of a word. Its representations are useful for search, classification and other language-understanding tasks. Large Language Model enhancement for polymorphic email campaign detection and intent understanding.

     • Adds BERT Large Language Model (LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.) to detection models to improve determination of similar emails within the same polymorphic campaign
     • Enables Abnormal to understand content, text, and attacker intention via context-aware embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. in a highly scalable manner

     2 details in Everything

248. Detection 360 API Endpoint Oct 6, 2022 · release notes

     New API endpoint added to fetch and view Detection 360° reports.

     • Adds a new API endpoint for fetching Detection 360° report lists and viewing case details including summaries, statuses, and message analyses.

     1 detail in Everything