Global Tool Radar

Security & Privacy / Email Security Software

Abnormal Security Review, Pricing, Pros & Cons

Abnormal Security's core Inbound Email Security offer uses API-based behavioral AI to detect and remediate phishing, business email compromise, vendor fraud, impersonation, malware, malicious links and attachments, QR-code attacks, spam, and other anomalous inbound messages without rerouting mail.

Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • Your main email environment is Microsoft 365 or Google Workspace: Abnormal connects through the platform APIs without MX changes or mail rerouting and supports cross-platform search from one console.
  • BEC, vendor fraud, impersonation, and novel social engineering are priority risks: Inbound Email Security builds employee and vendor behavioral baselines and combines identity, behavioral, and content signals rather than relying only on signatures.
More buying conditions
  • The SOC wants automated remediation and integrated investigation workflows: The core page documents automatic message removal, Threat Log, Detection 360, Search & Respond, and unified quarantine, while the integration layer connects to SIEM, SOAR, EDR/XDR, IAM, and ITSM tools.
  • You need centralized administration across multiple Microsoft and Google tenants: TenantBase provides a single view for detections, configuration, reporting, and tenant-scoped access across multiple tenants.
Not for
  • You require a public price sheet before engaging sales: The retained core offer is quote-based, and the AWS route requires a private offer without a usable public per-mailbox rate.
  • You need an inline gateway or primary support for on-premises mail systems: The documented core deployment is API-based for Microsoft 365 and Google Workspace, with no MX changes or mail-flow rerouting.
More buying conditions
  • Your purchase must include account containment, abuse-mailbox automation, training, posture, graymail, or outbound DLP by default: Abnormal presents these as distinct products or add-on scopes rather than verified inclusions in core Inbound Email Security.
  • You need native email encryption, archiving, or broad content-aware DLP in the core purchase: These functions are not established for the core offer; Abnormal's current outbound data-protection product focuses specifically on misdirected emails.
Pricing
  • Sales-quoted subscription for the core Inbound Email Security offer, available directly and through an AWS Marketplace private offer. Public per-mailbox rates, payment timing, commitment term, renewal terms, minimum quantity, and implementation amounts are not established.
  • Inbound Email Security · Requires quote · custom quote
Free or trial access
  • No permanent free plan or time-limited free trial is publicly stated. Public demos, tours, and proof-of-value language are evaluation routes rather than plans.

Product scope

Product functionality and purchase scope

This profile evaluates Abnormal's current core Inbound Email Security subscription: behavioral detection, investigation, and automated remediation for inbound threats in Microsoft 365 and Google Workspace. Broader platform products and migration services are separated rather than treated as included plan features.

Product checked: Aug 12, 2026

Functionality reviewed
  • Inbound Email Security behavioral detection and automated message remediation
  • Threat Log, Detection 360, Search & Respond, and unified Microsoft quarantine workflows shown on the exact-product page
  • Microsoft 365 and Google Workspace API mailbox deployment
  • Multi-tenant administration and supported security-operations integrations available to Inbound Email Security customers
Non-target functionality excluded from scoring
  • Core Account Takeover Protection and broader Cloud Account Takeover Protection
  • AI Security Mailbox, formerly Abuse Mailbox Automation
  • Security Posture Management for Microsoft 365
  • Email Productivity graymail management
  • AI Phishing Coach training and coaching
  • Messaging Security for Slack, Microsoft Teams, and Zoom
  • Misdirected Email Prevention and other outbound data-protection scope
  • SEG Displacement Program, Solutions Architecture, and Professional Services engagements
Purchase paths

Pricing checked: Aug 12, 2026

  • Abnormal Cloud Email Security on AWS Marketplace: AWS Marketplace can transact a private offer containing an Inbound Email Security dimension. This route does not create another core plan or establish a reliable public price.

Pricing plans

Abnormal Security pricing table

Pricing checked: Aug 12, 2026

Official factConfidence 87%2 linked sources

Inbound Email Security is the single retained core offer. Account takeover protection, AI Security Mailbox, Email Productivity, Security Posture Management, Misdirected Email Prevention, and other platform products require separate commercial scoping. AWS Marketplace is an alternative private-offer route, not a second plan.

Official pricing page
PlanPriceBest for
Inbound Email Security
  • Requires quote · custom quote
Organizations seeking Abnormal's core behavioral inbound email protection for Microsoft 365 or Google Workspace without adding unrelated platform products to the evaluated purchase.
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

AI triage, remediation, and response for user-reported emailAdd-on

AI Security Mailbox is the current successor to Abuse Mailbox Automation and is explicitly described as an Inbound Email Security add-on.

Plan: Inbound Email Security: Optional add-onAI Security Mailbox
Official source
Adaptive graymail filtering and employee inbox productivityAdd-on

Email Productivity is an add-on for graymail, not another core plan or proof that all unwanted-email handling is bundled.

Plan: Inbound Email Security: Optional add-onEmail Productivity
Official source
Continuous Microsoft 365 configuration and posture monitoringAdd-on

The current product is Microsoft 365-specific and is explicitly available as an add-on to Inbound Email Security.

Plan: Inbound Email Security: Optional add-onSecurity Posture Management for Microsoft 365
Official source
Microsoft 365 and Google Workspace API mailbox deploymentIncluded capability

The core product uses cloud mailbox APIs and does not require MX changes or mail-flow rerouting.

Plan: Inbound Email Security: IncludedMicrosoft 365 and Google Workspace
Official source
Cross-platform cloud-account takeover detection and responseSeparate product

This broader cloud and SaaS account scope extends beyond the exact inbound email purchase.

Cloud Account Takeover Protection
Official source
Email and identity account-takeover detection and containmentSeparate product

The AWS listing provides a separate Core Account Takeover Protection dimension; its containment actions are not treated as core inbound-email features.

Core Account Takeover Protection
Official source
Incident-linked phishing simulations and coachingSeparate product

Training and coaching are not treated as included in the core Inbound Email Security entitlement.

AI Phishing Coach
Official source
Outbound misdirected-email blocking and sender self-remediationSeparate product

This is the current outbound accidental-data-loss product and has its own AWS dimension.

Misdirected Email Prevention
Official source
Slack, Microsoft Teams, and Zoom malicious-message detectionSeparate product

Collaboration-channel security is broader than inbound email and is not assumed in the core entitlement.

Messaging Security
Official source
REST API integrations for security and IT operationsThird-party integration

Official integration materials connect Inbound Email Security data to SIEM, SOAR, EDR/XDR, IAM, and ITSM workflows.

Abnormal API Integrations
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
78%
AI claim confidence
94%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
94%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 1 A1 documentary official sources and 14 A2 official product sources are linked.
  • 0 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Threat protection efficacy20%
89

The product combines behavioral baselines with identity, content, relationship, and reputation signals to address multiple inbound threat types, which supports broad threat coverage for cloud email security.

Detection accuracy17%
84

Detection 360 for submitted misses and false positives indicates feedback for quality review, but the facts do not publish measured accuracy rates, so buyers should validate performance on their own mail flow.

BEC and identity protection15%
92

Focuses heavily on identity and relationship signals, though full cloud account takeover protection is billed as a separate product.

Response operations14%
86

Integrates automatic malicious-message remediation with REST APIs for SIEM, SOAR, EDR/XDR, IAM, and ITSM.

Platform coverage and deployment13%
88

Documented API deployment for both Microsoft 365 and Google Workspace without mail-flow rerouting, plus fit for multi-tenant and acquisition-heavy administration, supports cloud-centric rollouts while excluding unsupported on-premises-only estates.

Governance and integrations11%
81

REST API hooks for SIEM, SOAR, EDR/XDR, IAM, and ITSM allow security and IT workflows to consume detections and drive response, with integration depth and bidirectional reliability left to buyer validation.

Support and total cost10%
50

Total cost is unpredictable due to undisclosed pricing, unstated commitment terms, and unverified migration or professional services fees.

Marketplace app signals

Marketplace app signals

These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.

AWS Marketplace4.8/5
Rating count
88 ratings
Evaluated scope
Full product listing
Storefront
AWS Marketplace
View source
Score83
Pricing modelSales-quoted subscription for the core Inbound Email Security offer, available directly and through an AWS Marketplace private offer. Public per-mailbox rates, payment timing, commitment term, renewal terms, minimum quantity, and implementation amounts are not established.
Use casedetect and automatically remediate advanced inbound email attacks in Microsoft 365 and Google Workspace using per-identity behavioral analysis
Company sizeEnterprise, Mid-market
Structured tags

Abnormal Security tag profile

Company size
  • Enterprise
  • Mid-market
Key features

Abnormal Security core capabilities

  • Per-employee and per-vendor behavioral baselines
  • Identity, behavioral, content, relationship, and reputation signal analysis
  • BEC, vendor fraud, phishing, impersonation, malware, malicious-link, attachment, QR-code, and spam detection
  • Automatic malicious-message remediation before user engagement
  • Threat Log with filterable message and verdict history
  • Detection 360 investigation of submitted misses and false positives
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Behavioral analysis uses identity, relationship, and content signals to detect payload-free BEC and vendor fraud.
  • Automating malicious-message remediation before user engagement helps reduce manual SOC overhead.
  • API-based integration deploys directly to supported cloud platforms without requiring MX record changes or mail flow rerouting.
Cons

What to confirm before buying

  • Public pricing, licensing minimums, payment terms, and commitment durations are completely undisclosed.
  • Essential gateway capabilities such as email archiving, outbound encryption, and broad DLP are not verified in the core package.
  • Advanced platform functions like account takeover protection, user training, and security posture management require separate, paid scoping.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGeminiGPTxAIRange
Threat protection efficacy9189874
Detection accuracy8984809
BEC and identity protection9395896
Response operations8686851
Platform coverage and deployment8590885
Governance and integrations8083813
Support and total cost50415817
email phishing bec detection9294904
email malware url protection9091865
email policy quarantine control78686810
email incident response workflow8882846
email delivery user experience8277825
Where models differ
  • Support and total cost: 41–58 (17-point range)
  • email policy quarantine control: 68–78 (10-point range)
  • Detection accuracy: 80–89 (9-point range)
GeminiAI-assisted buyer perspective84

Abnormal Security provides API-driven behavioral threat detection tailored for Microsoft 365 and Google Workspace, requiring buyers to validate core coverage boundaries and negotiate custom pricing.

Review confidence
84/100
Model details
Strengths
  • Behavioral analysis uses identity, relationship, and content signals to detect payload-free BEC and vendor fraud.
  • Automating malicious-message remediation before user engagement helps reduce manual SOC overhead.
  • API-based integration deploys directly to supported cloud platforms without requiring MX record changes or mail flow rerouting.
Cautions
  • Public pricing, licensing minimums, payment terms, and commitment durations are completely undisclosed.
  • Essential gateway capabilities such as email archiving, outbound encryption, and broad DLP are not verified in the core package.
  • Advanced platform functions like account takeover protection, user training, and security posture management require separate, paid scoping.
GPTAI-assisted buyer perspective82

Abnormal Security fits buyers that use Microsoft 365 or Google Workspace and want API-based inbound email protection focused on BEC, impersonation, vendor fraud, malware, and malicious links or attachments without rerouting mail. It is less suitable for buyers that need a traditional inline secure email gateway, public per-mailbox pricing, or a single core entitlement that also covers account takeover, training, posture, graymail, messaging, and outbound DLP.

Review confidence
82/100
Model details
Strengths
  • The core Inbound Email Security offer uses API-based behavioral analysis and automatic remediation, which supports inbound threat handling without mail-flow rerouting for Microsoft 365 and Google Workspace.
Cautions
  • Public pricing, minimums, commitment terms, and renewal terms are not established, so commercial comparison requires a quote or private offer review.
xAIAI-assisted buyer perspective82

Abnormal Inbound Email Security fits Microsoft 365 or Google Workspace buyers that want API-based behavioral detection and pre-engagement remediation for phishing, BEC, vendor fraud, and payload threats without mail-flow rerouting, provided the buyer validates the quoted commercial terms and separately scopes any account-takeover, posture, or user-reported automation needs.

Review confidence
82/100
Model details
Strengths
  • Behavioral baselines per employee and per vendor plus identity, content, relationship, and reputation signals support detection of BEC, vendor fraud, impersonation, and novel phishing that may lack traditional payloads.
  • Automatic malicious-message remediation can remove threats before user engagement across supported cloud mailboxes.
  • Threat Log, Detection 360, and Search & Respond give security teams investigation and bulk response paths across Microsoft 365 and Google Workspace.
  • API deployment without MX record changes or mail-flow rerouting can preserve existing delivery paths while adding inbound protection.
Cautions
  • Core pricing, unit, payment timing, commitment, renewal, and minimums are sales-quoted only, so budget and term certainty require a direct or AWS Marketplace private offer.
  • Account takeover protection, AI Security Mailbox, Security Posture Management, Misdirected Email Prevention, and related platform products need separate commercial confirmation and are not verified as core inclusions.
  • Buyers replacing a secure email gateway must validate any encryption, archiving, continuity, or broad DLP functions that are not published as part of the core inbound offer.
  • API-based detection and remediation should be tested against the buyer’s acceptable message-exposure window and notification behavior before production cutover.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
15
Broad product review sources
0
Marketplace and app-store sources
1
Editorial sources
0
Latest evidence check
Aug 12, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsPer-employee and per-vendor behavioral baselines Identity, behavioral, content, relationship, and reputation signal analysis BEC, vendor fraud, phishing, impersonation, malware, malicious-link, attachment, QR-code, and spam detection Automatic malicious-message remediation before user engagement Threat Log with filterable message and verdict history Detection 360 investigation of submitted misses and false positives Search & Respond across Microsoft 365 and Google Workspace REST API integrations for SIEM, SOAR, EDR/XDR, IAM, and ITSM workflows
  • No permanent free plan or time-limited free trial is publicly stated. Public demos, tours, and proof-of-value language are evaluation routes rather than plans.
  • Sales-quoted subscription for the core Inbound Email Security offer, available directly and through an AWS Marketplace private offer. Public per-mailbox rates, payment timing, commitment term, renewal terms, minimum quantity, and implementation amounts are not established.
  • Requires quote
  • Inbound Email Security is the single retained core offer. Account takeover protection, AI Security Mailbox, Email Productivity, Security Posture Management, Misdirected Email Prevention, and other platform products require separate commercial scoping. AWS Marketplace is an alternative private-offer route, not a second plan.
Verification notes and unresolved itemsOfficial pages now brand the vendor as Abnormal AI
  • the requested listing name Abnormal Security is retained, while the exact evaluated core offer is Inbound Email Security.
  • AWS Marketplace displays identical USD 1,000,000 12-month dimensions for multiple products and terms while instructing buyers to request a private offer.
  • Those amounts were not used because the listing does not establish a usable negotiated quantity, direct-market price, or product-specific commercial state.
  • Public numeric price, priced unit, payment timing, commitment term, renewal terms, minimum quantity, implementation amount, and trial terms remain unverified.
Sources checked

Sources checked

Abnormal Security source links

Abnormal - Cloud Email SecurityAWS MarketplaceLevel A2Linked to 5 scored claimsChecked Aug 12, 2026
Displace Your Secure Email GatewayAbnormal AILevel A2Linked to 0 scored claimsChecked Aug 12, 2026
Misdirected Email PreventionAbnormal AILevel A2Linked to 1 scored claimChecked Aug 12, 2026
Security Posture Management for Microsoft 365Abnormal AILevel A2Linked to 1 scored claimChecked Aug 12, 2026
AI Security MailboxAbnormal AILevel A2Linked to 1 scored claimChecked Aug 12, 2026
Cloud Account Takeover ProtectionAbnormal AILevel A2Linked to 1 scored claimChecked Aug 12, 2026
Core Account Takeover ProtectionAbnormal AILevel A2Linked to 1 scored claimChecked Aug 12, 2026
TenantBaseAbnormal AILevel A2Linked to 0 scored claimsChecked Aug 12, 2026

FAQ

Abnormal Security FAQ

What is the exact core Abnormal Security product in this profile?

Inbound Email Security. Abnormal's current legal page calls it the core offering, and this profile does not treat the broader platform as one automatically included bundle.

Does Abnormal support both Microsoft 365 and Google Workspace?

Yes. Abnormal documents API deployment for Microsoft 365 and Google Workspace without MX changes or mail-flow rerouting.

Can Inbound Email Security replace a secure email gateway?

Abnormal positions Microsoft 365 or Google Workspace plus Inbound Email Security as a SEG replacement and offers a structured SEG Displacement Program, but migration design should be validated for the existing environment.

Is account takeover protection included in Inbound Email Security?

Not as a verified core inclusion. Core Account Takeover Protection and the broader Cloud Account Takeover Protection scope are separately named products and require separate commercial confirmation.

What happened to Abuse Mailbox Automation?

It was upgraded and renamed AI Security Mailbox. The current product automates user-reported email triage, campaign remediation, and reporter responses, and is separately scoped from core Inbound Email Security.

Are security posture and data protection part of the core offer?

No inclusion is publicly established. Security Posture Management is a separate Microsoft 365 posture product, while Misdirected Email Prevention separately addresses accidental outbound data loss.

Does Abnormal publish prices, minimums, or contract terms?

No reliable public core price, priced unit, payment timing, commitment term, renewal term, or minimum quantity is established. Buyers must obtain a direct or AWS Marketplace private quote.

Popular comparisons

Common Abnormal Security comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Abnormal SecurityvsCisco Secure Email Threat Defense
83Gap 380

Enterprise / Mid-market

VS #2
Abnormal SecurityvsCloudflare Email Security
83Gap 380

Enterprise / Mid-market

VS #3
Abnormal SecurityvsProofpoint Core Email Protection
83Gap 380

Enterprise / Mid-market