A year ago, Mohit Khare was the only detection engineer in Abnormal AI’s India office, building the region’s detection practice from a single desk. Today he leads a growing detection team there and owns attachment-based attack detection for Abnormal’s email product end to end, work that includes the company’s first per-attachment machine learning model and the routing layer other teams now run on. Both arcs happened in the same twelve months, powered by one instinct: notice the gap nobody’s covering, build the fix, and make it something others can stand on.
Chasing a Moving Target
Mohit didn't come to security in a straight line. Before Abnormal, he spent years building consumer products at scale in India, in transport at Gojek and then in fintech at CRED, where he led payments for rent, education, and utility bills for millions of people. Payments taught him what it means for a system to work and stay safe at the same time, and it primed him for a different kind of problem.
What pulled him toward security was the shape of the fight itself: most engineering problems, once solved, stay solved. Detection doesn't work that way.
"Detection is the opposite: the moment you close a door, a real human on the other side goes looking for the next window."
That fight plays out in the overlooked corners of a message: a QR code, a calendar invite, JavaScript buried inside an SVG. Attackers move there because nobody's looking yet, and for Mohit, closing those blind spots is both a puzzle and a mission.
The First Brick in the Platform
The clearest example came with Abnormal's first per-attachment machine learning model. Before it, the company scored an email as a whole, so signal from individual attachments simply wasn't being collected.
Training a good classifier took weeks. Getting it to run reliably inside the live pipeline, at the volume Abnormal processes every day, without slowing anything down, took much longer. A model going live and a model working turned out to be two different claims, so Mohit leaned on shadow-mode rollouts and built measurement in from the start, proving it was doing something before anyone trusted it.
Once live, it measurably lifted how many attacks the company caught on attachment-bearing mail. What Mohit cares about most is what it made possible downstream: every model and rule that came after could build on that same feature stream.
"That first model was really the first brick in the platform."
The Layer Other Teams Run On
The next problem wasn't handed to him. Abnormal's best detection, the deep models, URL analysis, full detonation, can't run on every message without slowing the pipeline down. Mohit noticed too much of that budget was going to low-risk traffic while genuinely suspicious messages got the same treatment as everything else.
He built a routing layer to fix it for his own attachment traffic, then designed it as something bigger: a rule-aware control plane any team could plug into without rebuilding the underlying machinery. It now handles that kind of routing decision for traffic across the company, at a scale no one could manage by hand.
What happened next is the part of the year Mohit keeps coming back to: custom AI models started routing through the layer, URL processing rode on top of it, and the Outbound team adopted the attachment signals he had built for an entirely different purpose. "Nobody's doing that as a favor," Mohit said. "They're doing it because it saves them from reinventing it, and that's the real proof you built the right thing."
"It stops being 'a detector Mohit shipped' and becomes the thing the next generation of detection is built on."
From Solo to a Team
While Mohit built that platform, he was also building Abnormal's detection presence in India, essentially from nothing. His manager joined about a month after him, but there was no local team and no one nearby who already knew the systems. Most of the work happened across time zones with teams in the United States, almost entirely self-directed, with no playbook to follow, so he wrote one as he went.
What turned that into a team was hiring, ownership, and structure landing together. The India detection team has grown well beyond just him, with more engineers joining, and Mohit has stayed hands-on in interviewing and onboarding so the bar holds from the start. The team took on real ownership, payload and attachment detection, vendor fraud, and increasingly the AI workflows the wider organization now uses, and Mohit stepped into the onsite leader role for detection to match it, mentoring the engineers around him and helping shape the roadmap.
The job changed with the team. Early on, success meant one question: was the detection he shipped catching more attacks? As onsite leader, the measure flipped to what the team built and whether he had set them up to do their best work.
"Detectors get replaced; a strong team and a real practice compound."
He still stays deep in the technical work, on purpose: leading detection he doesn't understand isn't something he wants to do.
Two Layers of AI
AI shows up for Mohit in two places, and the same instinct runs through both.
Inside the product, the AI in Abnormal’s detection pipeline isn’t a chatbot sitting off to the side, it does detection work the moment a message is evaluated. Attackers often bury a malicious link inside an email or attachment, betting a scanner alone won’t catch the intent behind it. Abnormal investigates those links deeply, combining static signals with LLM-based reasoning. The same approach turns Abnormal’s own misses into fixes: when an attack slips through, an LLM reads the message, reasons about why it evaded detection, and surfaces the signal that should have caught it.
In how he builds, Mohit is an AI Champion, part of a peer group pushing AI adoption from a novelty into how people work. That has meant contributing to company-wide efforts like Testbox, Abnormal's AI-assisted testing platform, and shipping around ten reusable AI skills into Nora, Abnormal's internal agent, an instinct for sharing his own workflow that made him one of the top engineers in Abnormal's internal Nora competition. It also reshaped how he builds day to day: once agents could carry a task end to end, the bottleneck was no longer the code he could personally ship, it was him, working through problems one at a time. So he flipped to parallel, one agent researching an attack, another drafting the detector, another running tests, while he reviews and steers.
"My leverage now is how well I can break a problem into parallel pieces and direct AI at them."
It's the same skill he uses leading the team in India: break the problem down, hand well-scoped pieces to the right person or agent, and keep it all coherent.
Earning the Next Problem
Within a year, Mohit went from new hire to the person people go to for payload detection at Abnormal, and nobody assigned him that role. He noticed the company's heaviest detection work was going to its least risky traffic, flagged it, and was handed the room to build the fix instead of being told to stay in his lane. He also shipped Abnormal's first per-attachment machine learning model, from the detection practice he was still building in India.
"Once you feel that, it changes how you show up: you stop waiting for permission and start looking for the next problem worth owning."
What's next runs on two tracks: pushing further into visual and agentic detection on the platform he already built, so AI handles more of the hardest calls by reasoning about intent, and turning the India detection team from a single hire into a real engine by hiring well and growing them into owners.
A year ago, that team didn't exist. Mohit wants the next one to leave it producing detection impact on its own, with leaders in place to sustain it.
Abnormal is built for engineers who’d rather notice the gap and build the fix than wait for someone else to. Explore more of Mohit’s work on his website, and open roles on our website.