https://cybertoolchain.io/tools/abnormal-ai New releases and features in Abnormal AI, tracked by The Cyber Toolchain. en Sat, 31 Oct 2026 07:46:34 GMT https://abnormal.ai/platform/whats-new https://abnormal.ai/platform/whats-new Sat, 31 Oct 2026 07:46:34 GMT Abnormal AI adds time-series identity posture tracking, helpdesk reset risk signal detail, AI Data Analyst scheduling, and Segmented SaaS multi-tenant isolation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Identity Threat Protection now shows security grade and threat exposure over time, letting admins review up to 180 days of history with markers for improvements, regressions, and coverage changes, and filter identities at risk by attack scenario such as Helpdesk Impersonation, Vendor Email Compromise, and MFA Fatigue Push.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Identity Threat Protection now exposes the individual risk signals behind each Adaptive Identity Reset risk score, with per-signal ratings on a four-tier scale (Low, Moderate, Elevated, or High) and plain-language definitions alongside the identity quiz result. • AI Data Analyst adds scheduled reporting — one-time or recurring — with a 'Schedule as Custom Report' option that derives the reporting window from a chosen frequency, plus a new Report Repository for versioned downloads and full conversation history. • AI Data Analyst adds a single multi-tenant management view for MSSPs and multi-tenant customers to manage reporting across every tenant from one place. • Abnormal adds Segmented SaaS, letting organizations create separate Abnormal tenants for business units, subsidiaries, regions, or agencies that share one email tenant, with users assigned by email domain, directory group, or a list of user principal names, and each tenant getting its own admins, views, alerts, and data over a single integration. • AI Phishing Coach Settings page now groups every control into six tabs — Overview, Simulations, Coaching, Branding & Delivery, Exclusions, and Test — with Tenant Level / Account Level labels and a single Save across all tabs. • Launches a visual detection model that catches brand-impersonation attacks hidden in email screenshots and other image-based content. • Expands detection coverage for compromised-sender attacks with a newly launched Sender Compromise model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new https://abnormal.ai/platform/whats-new Fri, 23 Oct 2026 07:59:52 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/centralize-security-operations-with-google-secops-integration https://abnormal.ai/platform/whats-new/centralize-security-operations-with-google-secops-integration Wed, 24 Jun 2026 00:00:00 GMT New Google SecOps integration for centralized threat detection and SOAR automation • Adds native Abnormal AI connector to Google SecOps Marketplace for automated incident response via SOAR playbooks • Enables automatic ingestion of IES, AISM, ATO, Security Posture Management, and Audit Logs into Google SecOps SIEM Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/threat-led-posture-recommendations https://abnormal.ai/platform/whats-new/threat-led-posture-recommendations Wed, 24 Jun 2026 00:00:00 GMT Abnormal AI adds 15 threat-led M365 posture policies and CSV export for SPM. • Adds 15 first-party email posture policies for Microsoft 365, researched against active 2025–2026 attack campaigns and mapped to MITRE ATT&CK • Enables high-risk detection of M365 misconfigurations including unauthenticated Direct Send, mailbox forwarding, transport-rule persistence, Teams federation abuse from trial tenants, and audit-log tampering • Adds export capability for the ESPM evaluations page to CSV for audits, compliance reviews, and reporting Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/ai-phishing-coach-attack-library https://abnormal.ai/platform/whats-new/ai-phishing-coach-attack-library Thu, 18 Jun 2026 00:00:00 GMT New Attack Library page in Abnormal AI Phishing Coach to manage simulation templates • Adds a new Attack Library page that lists every AIPC-simulated template (click-phishing, credential-phishing, BEC, VEC) with tags, content previews, and metadata. • Adds per-template enable/disable toggles to the Attack Library, allowing immediate exclusion of specific templates from autopilot rotation without disabling entire attack types. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/ai-phishing-coach-nine-new-compliance-videos https://abnormal.ai/platform/whats-new/ai-phishing-coach-nine-new-compliance-videos Thu, 18 Jun 2026 00:00:00 GMT Abnormal AI Phishing Coach adds nine new compliance training modules covering PCI, GDPR, SOC 2, and more • Adds nine new Compliance framework modules for PCI, GDPR, SOC 2, PIPEDA, CCPA, HIPAA, FERPA, CMMC, and FFIEC to the AI Phishing Coach Video Library. • Adds a 'Compliance' section in the Video Library for organizing these new regulatory training modules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/url-rewriting-csv-export https://abnormal.ai/platform/whats-new/url-rewriting-csv-export Mon, 15 Jun 2026 00:00:00 GMT New 'Export CSV' button in the Abnormal AI URL Rewriting dashboard to download rewrite logs. • Adds an 'Export CSV' button to the URL Rewriting dashboard for exporting click tracking data as a 'Rewrite Logs' CSV file. • Enables selection of a custom date range (up to 180 days) for the rewritten URL activity export. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/ai-phishing-coach-reports-page-update https://abnormal.ai/platform/whats-new/ai-phishing-coach-reports-page-update Thu, 11 Jun 2026 00:00:00 GMT The AI Phishing Coach now offers a unified interface for generating and viewing Risk, Simulation, and Video Training reports. • Unified generator card with tabs for Risk, Simulation, and Video Training Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/ai-phishing-coach-risk-reporting https://abnormal.ai/platform/whats-new/ai-phishing-coach-risk-reporting Thu, 11 Jun 2026 00:00:00 GMT Adds AI Phishing Coach risk reporting with exportable per-employee Bayesian risk scores and simulation history • Exports employee risk workbooks pairing identities with Bayesian risk scores, variance against company average and global benchmark, plus phishing/credential/BEC-VEC simulation activity and training data Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/date-range-filters-for-ai-security-mailbox-portal-metrics https://abnormal.ai/platform/whats-new/date-range-filters-for-ai-security-mailbox-portal-metrics Wed, 10 Jun 2026 00:00:00 GMT Adds 7-day, 30-day, 90-day, and custom date range filters to AI Security Mailbox portal metrics • Adds support for selecting 7-day, 30-day, 90-day, and custom-range date filters on the AI Security Mailbox portal's top-level metrics view Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/search-respond-message-reclassification https://abnormal.ai/platform/whats-new/search-respond-message-reclassification Thu, 28 May 2026 00:00:00 GMT Adds message reclassification (Safe, Spam, Attack) and folder-only moves to Search & Respond • Allows admins to reclassify messages as Safe, Spam, or Attack directly in Search & Respond • Enables choice between full reclassification and folder-only move actions for flexible response Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/introducing-detection-360-visibility-ai-detection-agents https://abnormal.ai/platform/whats-new/introducing-detection-360-visibility-ai-detection-agents Thu, 28 May 2026 00:00:00 GMT Abnormal AI adds Detection 360 visibility and AI-driven auto-deployment for threat detection coverage. • Adds 'Detection 360 Timeline' for case-level traceability from user submissions to investigation and deployed detections. • Adds 'Detection 360 Dashboard' providing org-level visibility into detections, impacted messages, and trends on a unified console. • Introduces 'AI Detection Agents' to automatically investigate reported misses and deploy targeted detections for similar attack variants. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/external-tag-for-simulations-in-outlook https://abnormal.ai/platform/whats-new/external-tag-for-simulations-in-outlook Fri, 22 May 2026 00:00:00 GMT AI Phishing Coach now injects the Microsoft 'External' tag into Outlook simulations via DMI • Adds automatic injection of the Microsoft 'External' tag into Direct Mail Integration (DMI) simulations sent to Outlook users • Enables end-to-end simulation realism parity between DMI and SMTP delivery modes for phishing awareness training Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/redesigned-video-library https://abnormal.ai/platform/whats-new/redesigned-video-library Fri, 22 May 2026 00:00:00 GMT Redesigned Video Library adds categorized sections, dedicated Trainings tab, and list view for better content navigation. • Adds a Dedicated Trainings Tab to the video library so training videos are accessible from their own tab instead of being buried in the main list • Adds a List View option to the video library to display content as a list for faster skimming of titles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/google-phish-report-button-us-only https://abnormal.ai/platform/whats-new/google-phish-report-button-us-only Fri, 22 May 2026 00:00:00 GMT Adds a dedicated phish report button for Gmail to replace unreliable native reporting for AIPC simulations • Adds `Phish Report Button` as a native one-click feature in Gmail (web and mobile app) for Google Workspace customers to report suspicious emails and AIPC simulations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/anomaly-log-case-links-for-account-takeover https://abnormal.ai/platform/whats-new/anomaly-log-case-links-for-account-takeover Fri, 15 May 2026 00:00:00 GMT Anomaly Log now shows direct hyperlinks to linked Account Takeover cases • Surfaces numbered case hyperlinks in the Anomaly Log for anomalies connected to existing Account Takeover cases. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/advanced-remediation-configuration-for-account-takeover https://abnormal.ai/platform/whats-new/advanced-remediation-configuration-for-account-takeover Fri, 08 May 2026 00:00:00 GMT Adds granular remediation thresholds and per-tenant overrides for account takeover automation in Abnormal AI. • Adds `Advanced tab` to Automatic Remediation Threshold settings allowing independent configuration of actions (Revoke Sessions, Password Reset, Disable Account) for M365, Google Workspace, Okta at High, Medium, and Low confidence levels. • Adds `Custom` option in the `Basic tab` of Automatic Remediation Threshold settings to unlock full customized control over remediation actions. • Adds `Custom Tenant Settings` feature enabling admins to define per-tenant remediation behavior that overrides account-level defaults for specific tenants. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/quarterly-detection-accuracy-enhancements https://abnormal.ai/platform/whats-new/quarterly-detection-accuracy-enhancements Fri, 01 May 2026 00:00:00 GMT Abnormal AI updates credential-phishing/attachment detection heuristics and adds automated vendor fraud case generation. • Adds 21 new behavioral heuristics for enhanced attachment analysis engine targeting QR codes, JavaScript inside PDFs, and password-protected nested archives • Enables automated generation of vendor fraud cases via a deterministic vendor fraud policy layer within the AI Workflow • Increases overall processing throughput by approximately 38% for vendor fraud case classification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/expanded-training-library-for-ai-attacks https://abnormal.ai/platform/whats-new/expanded-training-library-for-ai-attacks Fri, 01 May 2026 00:00:00 GMT Expanded training library adds video content on deepfakes, smishing, MFA fatigue, and vendor email compromise. • Adds video modules covering multi-channel attacks spanning email, SMS, voice, collaboration tools, cloud services, and mobile • Adds coverage of major attack categories including deepfakes, OAuth abuse, BEC/VEC, and credential phishing • Provides a broader library to give security teams more flexibility to tailor training programs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/gws-calendar-invite-remediation-threat-log-calendar-invite-filter https://abnormal.ai/platform/whats-new/gws-calendar-invite-remediation-threat-log-calendar-invite-filter Fri, 01 May 2026 00:00:00 GMT GWS malicious calendar invite auto-remediation and new 'Calendar Invite' Threat Log filter. • Automatic removal of malicious calendar invites from Google Workspace calendars when linked emails are remediated as Attack, Borderline, or Spam • New Calendar Invite filter in the Threat Log across Portal, CSV export, SIEM, and REST API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/blocklisted-threat-log-filter-indicator https://abnormal.ai/platform/whats-new/blocklisted-threat-log-filter-indicator Thu, 30 Apr 2026 00:00:00 GMT Abnormal AI adds filter, visual indicator, CSV export, and API access for blocklisted threats in the Threat Log. • Adds `blocklisted` filter to the Threat Log to display blocklisted messages from the past two months • Adds a visual indicator on individual threat entries in the Portal for those blocklisted in the past two months • Exports blocklisted status via CSV export for offline analysis and reporting • Exposes blocklisted status through SIEM integrations and the REST API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/url-rewriting-click-events-api https://abnormal.ai/platform/whats-new/url-rewriting-click-events-api Thu, 30 Apr 2026 00:00:00 GMT New API endpoint returns structured data on rewritten URLs clicked by end users • Adds a new REST API endpoint to retrieve structured telemetry on rewritten URLs clicked by end users, including click type, timestamp, malicious link, message metadata, and explainability insights. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/new-apis-for-portal-posture-monitoring https://abnormal.ai/platform/whats-new/new-apis-for-portal-posture-monitoring Mon, 27 Apr 2026 00:00:00 GMT Adds REST APIs for retrieving portal users, roles, security settings, and API tokens to support SSPM/GRC posture monitoring. • Enables integration with SSPM or GRC tooling to continuously monitor Abnormal tenant configuration via new REST API endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/rest-api-self-service-token-flexibility https://abnormal.ai/platform/whats-new/rest-api-self-service-token-flexibility Thu, 23 Apr 2026 00:00:00 GMT Abnormal adds self-service REST API token management in the Portal with granular controls. • Adds the ability to create, rotate, and revoke REST API tokens directly in the Abnormal Portal, eliminating support-ticket delays. Breaking changes: • Existing REST API tokens will automatically expire in April 2027, requiring customers to create new tokens to maintain uninterrupted API access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/stream-abnormal-event-data-in-near-real-time-with-webhooks https://abnormal.ai/platform/whats-new/stream-abnormal-event-data-in-near-real-time-with-webhooks Thu, 23 Apr 2026 00:00:00 GMT Adds Webhook as a new SIEM integration type to stream Threats, Cases, Audit Logs, and more via HTTPS endpoints. • Supports sending Threats, Vendor Cases, AI Security Mailbox, Audit Logs, Account Takeover, Security Posture Management, and URL Rewriting Clicked events via webhook • Configures HTTPS endpoint with API Key, Basic Authentication, Bearer Token, or Custom Header authentication methods • Supports IP allowlisting and delivery with guaranteed retries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/simulation-targeting-with-google-groups https://abnormal.ai/platform/whats-new/simulation-targeting-with-google-groups Wed, 15 Apr 2026 00:00:00 GMT AI Phishing Coach now targets simulations using existing Google Groups for precise training alignment • Adds targeting of phishing simulations to existing Google Groups via the AI Phishing Coach Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/exception-workflow-in-security-posture-management https://abnormal.ai/platform/whats-new/exception-workflow-in-security-posture-management Wed, 15 Apr 2026 00:00:00 GMT SPM adds structured exception workflow with Accepted Risk and Excepted from Evaluations states for posture findings. • Adds time-bounded suppression via 'Accepted Risk' state to posture findings • Adds permanent exclusion via 'Excepted from Evaluations' state to posture findings • Enforces mandatory justification on every exception entry • Makes exception decisions visible in the immutable Activity Timeline • Allows filtering posture findings by workflow state: Untriaged, Investigating, Flagged, Accepted, Excepted Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/threatbase-tunnel-details https://abnormal.ai/platform/whats-new/threatbase-tunnel-details Mon, 13 Apr 2026 00:00:00 GMT ThreatBase adds VPN/proxy/TOR tunnel context to IP lookups, showing provider and anonymity status. • Adds VPN, proxy, and TOR tunnel details (provider, anonymity, entry/exit IPs) to ThreatBase IP address search results Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/v2-multi-language-video-training https://abnormal.ai/platform/whats-new/v2-multi-language-video-training Thu, 09 Apr 2026 00:00:00 GMT Abnormal AI V2 Multi-Language Video Training adds 16 new native languages • Adds Dutch, Polish, Italian, Indonesian, Malay, Swedish, Norwegian, Finnish, Danish, Czech, Hungarian, Thai, Vietnamese, Serbian, Turkish, and Bengali to video training language support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/japanese-localization-for-ai-phishing-coach https://abnormal.ai/platform/whats-new/japanese-localization-for-ai-phishing-coach Thu, 09 Apr 2026 00:00:00 GMT Abnormal AI adds full Japanese localization for the AI Phishing Coach interface. • Adds Japanese localization to Threat Simulations, Video Training, Reports, Risk Management, and Settings pages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/new-detections-for-mistyped-and-wrong-external-recipients https://abnormal.ai/platform/whats-new/new-detections-for-mistyped-and-wrong-external-recipients Wed, 08 Apr 2026 00:00:00 GMT Abnormal AI adds 'Mis-Typed Recipient' and 'Wrong External Recipient' detections to Misdirected Email Prevention. • Adds `Mis-Typed Recipient` detection to Misdirected Email Prevention for lookalike addresses • Adds `Wrong External Recipient` detection to Misdirected Email Prevention for similar names across different domains Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/bulk-remediation-at-scale-in-search-respond https://abnormal.ai/platform/whats-new/bulk-remediation-at-scale-in-search-respond Tue, 07 Apr 2026 00:00:00 GMT Abnormal AI raises Search & Respond bulk remediation limit to 200k messages per action via UI • Increases Search & Respond bulk remediation limit to 200,000 messages in a single action Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/extended-end-user-controls-learning-window-for-graymail https://abnormal.ai/platform/whats-new/extended-end-user-controls-learning-window-for-graymail Mon, 06 Apr 2026 00:00:00 GMT Abnormal AI extends graymail end-user control learning window from 7 to 90 days • Extends the Email Productivity (graymail) end-user control learning window from 7 days to 90 days, allowing reclassifications to train the model for up to 90 days after delivery Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/export-user-management-data-to-a-csv https://abnormal.ai/platform/whats-new/export-user-management-data-to-a-csv Thu, 02 Apr 2026 00:00:00 GMT New UI feature to export user management data (users, roles, permissions) to CSV for audit and compliance. • Adds 'export to CSV' button in Settings → User Management for users and roles • Excludes legacy EU datacenters from new CSV export availability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/indicators-filter-for-account-takeover-anomaly-log https://abnormal.ai/platform/whats-new/indicators-filter-for-account-takeover-anomaly-log Wed, 01 Apr 2026 00:00:00 GMT New Indicators filter added to Anomaly Log for Account Takeover anomaly categorization • Adds an `Indicators` filter to the Anomaly Log UI, allowing categorization of anomalies by indicator type (e.g., Admin Console Activity, High-Risk Sign-In, VPN usage) • Integrates the new Indicators filter alongside existing filters (Date Range, Event Types, Platform) to enable faster triage based on observed behavior types Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/global-safelist-now-applies-to-teams-messaging-security https://abnormal.ai/platform/whats-new/global-safelist-now-applies-to-teams-messaging-security Tue, 31 Mar 2026 00:00:00 GMT Global Safelist now covers Teams messages for unified trusted sender management • Global Safelist rules applied to email are automatically extended to Teams Messaging Security Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/abnormals-phish-report-button-for-microsoft https://abnormal.ai/platform/whats-new/abnormals-phish-report-button-for-microsoft Thu, 26 Mar 2026 00:00:00 GMT Abnormal AI releases general availability for its Microsoft Phish Report Button, enabling in-client threat reporting from Outlook desktop and mobile. • Adds a native 'Phish Report Button' to Microsoft Outlook (desktop and mobile) allowing employees to report suspicious emails with one click • Automatically moves reported emails to Deleted Items upon submission via the Phish Report Button • Provides instant recognition for users who correctly identify AI Phishing Coach simulations through the in-client reporting interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/turn-jit-quizzes-on-or-off https://abnormal.ai/platform/whats-new/turn-jit-quizzes-on-or-off Thu, 26 Mar 2026 00:00:00 GMT Abnormal AI adds admin toggle for Just-In-Time Training quizzes to reduce user interruptions. • Adds ability for admins to enable or disable Just-In-Time (JIT) Training quizzes org-wide via the AI Phishing Coach settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/updated-data-privacy-retention https://abnormal.ai/platform/whats-new/updated-data-privacy-retention Mon, 23 Mar 2026 00:00:00 GMT Abnormal AI updates MEP data handling with 180-day retention and new audit log events for compliance • Extends retention for misdirected email metadata and related detection signals to 180 days • Adds new audit log events capturing when users view the outbound log and open specific misdirected email detections Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/customer-feedback-in-the-outbound-log https://abnormal.ai/platform/whats-new/customer-feedback-in-the-outbound-log Mon, 23 Mar 2026 00:00:00 GMT Outbound Log now surfaces free-text SOC feedback on MEP decisions directly in the message details view. • Adds visible display of admin-submitted free-text feedback for Misdirected Email Prevention (MEP) decisions within the 'Misdirected Email Prevention (MEP) Outbound Log' activity log and message details view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/detection-360-insights-generally-available https://abnormal.ai/platform/whats-new/detection-360-insights-generally-available Tue, 17 Mar 2026 00:00:00 GMT Abnormal AI Detection 360 now provides explainable case insights via its UI to show reasoning and impact of analyst feedback. • Adds `AI-generated case insights` in the Detection 360 UI that reveal behavioral signals behind classification verdicts • Adds `Clear reasoning` in the Detection 360 UI showing how identity, language, and context contributed to detection outcomes • Adds `Actionable insights` in the Detection 360 UI highlighting detection improvements resulting from analyst False Positive/Negative reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/introducing-phishing-risk-scoring-an-abnormal-approach-to-changing-and-measuring-human-behavior https://abnormal.ai/platform/whats-new/introducing-phishing-risk-scoring-an-abnormal-approach-to-changing-and-measuring-human-behavior Tue, 17 Mar 2026 00:00:00 GMT Abnormal AI introduces dynamic Phishing Risk Scoring for continuous human risk management. • Adds dynamic, behavior-based Phishing Risk Scoring to quantify human susceptibility across the enterprise. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/simulate-realistic-social-engineering-attacks-with-ai-phishing-coach https://abnormal.ai/platform/whats-new/simulate-realistic-social-engineering-attacks-with-ai-phishing-coach Tue, 17 Mar 2026 00:00:00 GMT Adds AI-driven BEC and VEC social engineering simulations to Abnormal's Phishing Coach • New BEC and VEC simulations in AI Phishing Coach that use behavioral relationship patterns to generate realistic manager, colleague, and vendor fraud scenarios. • AI Phishing Coach now automatically delivers tailored simulations based on identified communication patterns to test employee responses to social engineering attacks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/introducing-attune-1-0-the-behavioral-foundation-model-for-cybersecurity https://abnormal.ai/platform/whats-new/introducing-attune-1-0-the-behavioral-foundation-model-for-cybersecurity Tue, 17 Mar 2026 00:00:00 GMT Attune 1.0 introduces a unified behavioral foundation model for identity, behavior, and content signals in Inbound Email Security. • Unifies identity, behavior, and content signals in Attune 1.0 to surface subtle anomalies missed by stitched detection systems Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/attachment-analysis-expanded-coverage https://abnormal.ai/platform/whats-new/attachment-analysis-expanded-coverage Thu, 12 Mar 2026 00:00:00 GMT Abnormal AI expands attachment metadata visibility with new REST API endpoint and SIEM field. • Adds `attachment_analysis` field to SIEM “Email Threats” events for richer investigation context • Adds REST API support for `/messages/{message_id}/attachment/{attachment_name}` endpoint • Expands attachment metadata (MD5, SHA256, SHA1 hashes, type, size) visibility in Portal Message Details View Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/continuous-vendor-intelligence-in-vendorbase https://abnormal.ai/platform/whats-new/continuous-vendor-intelligence-in-vendorbase Tue, 10 Mar 2026 00:00:00 GMT VendorBase now auto-adds new vendors from invoices and refreshes contact/risk context with new signals. • Adds automatic onboarding of newly seen vendors to VendorBase as soon as they start sending invoices • Enhances vendor intelligence to refresh contact details and update risk context with new signals Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/email-productivity-dashboard-revamp https://abnormal.ai/platform/whats-new/email-productivity-dashboard-revamp Mon, 09 Mar 2026 00:00:00 GMT Abnormal AI revamps Email Productivity dashboard with mode-aware views and CSV exports • Adds a mode‑aware view that auto-adjusts to deployment stages (All Active, All Passive, Partial) to show graymail remediation progress • Adds independent filters for user type (VIP vs. non‑VIP) and status (Active vs. Passive), plus the ability to hide bypassed senders • Enables CSV exports of graymail reporting with day‑by‑day breakdowns by frequency, senders, and recipients Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/simulation-grouping-with-active-directory https://abnormal.ai/platform/whats-new/simulation-grouping-with-active-directory Thu, 05 Mar 2026 00:00:00 GMT Abnormal AI adds Active Directory group targeting for phishing simulations to align tests with real team structures. • Target phishing simulations using existing Active Directory groups Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/account-takeover-case-page-updates https://abnormal.ai/platform/whats-new/account-takeover-case-page-updates Mon, 02 Mar 2026 00:00:00 GMT Abnormal AI adds Post-Compromise Activity filter and reorders Initial Access Vector on ATO Cases page • Adds `Post-Compromise Activity` filter to the Account Takeover Cases list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai https://abnormal.ai/platform/whats-new/custom-banners-subject-prefixes-for-phishing-simulations https://abnormal.ai/platform/whats-new/custom-banners-subject-prefixes-for-phishing-simulations Mon, 23 Feb 2026 00:00:00 GMT Adds custom subject prefixes, warning banners, and HTML banner support for phishing simulations • Add a custom subject line prefix (up to 30 characters) to all simulation emails Full history on Cyber Toolchain: https://cybertoolchain.io/tools/abnormal-ai