Aviatrix Stops Account Takeovers in Seconds with Abnormal AI

Aviatrix builds networking and network security software used by many of the world's largest enterprises to manage hybrid and multicloud infrastructure, giving cloud teams visibility and control as workloads scale across public and private clouds. Headquartered in Santa Clara, California, the company serves large, complex customer environments and is expanding into new AI-driven capabilities across its platform, reflecting its focus on staying ahead of how modern network infrastructure is built and operated.

The Aviatrix Email and Account Security Challenge

Most security at Aviatrix is about limiting exposure and reducing risk, such as disconnecting at-risk workloads from the Internet when necessary. Email requires a different approach. It acts as a storefront for customers, prospects, partners, and other stakeholders, so locking it down would lock out business. Matt Snyder, head of security operations and threat research, calls that unavoidable opening the prick in your sock, felt with every step and never going away. Snyder joined Aviatrix with Abnormal in place and was initially skeptical, having led detection elsewhere and watched tools like it cry wolf. Then he looked closer: a real attacker rerouting payroll was caught and stopped before the money moved. That's when Snyder saw what set Abnormal apart.

Customer Key Challenges:

• Phishing volume consumed hours from a lean security team.
• Account takeover alerts got lost in the noise of legacy tools.
• Time and capacity limitations required autonomous detection and remediation that existing solutions didn't provide.

Abnormal Solution:

• Inbound Email Security applies behavioral AI to stop phishing and business email compromise that static filters miss.
• Account Takeover Protection detects compromised accounts by behavior and auto-locks out attackers, even on medium-severity alerts.
• Replaced a legacy secure email gateway in a lightweight deployment that took a few clicks to configure.

"[With Abnormal], we've had VIP accounts, with legit account takeovers, that we remediated within seconds to minutes before any kind of damage was done. These are the kind of nightmare accounts. Had an hour gone by … massive pain could have been felt." — Matt Snyder, Head of Security Operations and Threat Research

The Abnormal AI Solution

Aviatrix replaced its previous secure email gateway with Abnormal AI, layering behavioral analysis on top of Microsoft 365 rather than adding another set of static rules. Inbound Email Security and Account Takeover Protection share one behavioral baseline, learning how every sender, recipient, and account normally behaves so the platform can flag account takeovers, business email compromise, and phishing that pattern-based filters miss. The security team also queries Abnormal's API directly from its own SOC AI agent, pulling account history into every investigation, while logs stream to Splunk for retention.

Why Aviatrix Keeps Betting on Abnormal AI

The payroll diversion attempt sealed it: Abnormal caught an account takeover that had already rewritten direct-deposit details and buried Microsoft's own alerts in a mail rule, days before payroll ran. Account Takeover Protection now runs with auto-remediation enabled down to medium severity for every account, including executives', and has remediated three VIP account takeovers within seconds to minutes of detection, before any damage occurred. Inbound Email Security has cut manual triage enough that Snyder's four-person team can focus on threat research instead of chasing reports, and turning on new capabilities takes a few clicks, not a deployment project. The team migrated off the prior gateway without disrupting mail flow, giving Snyder the confidence to call Abnormal the one tool he trusts to set and forget.

"Abnormal is our Costco hot dog. It's the one tool our security team wouldn't sacrifice. We have to stay proactive, and nothing else takes more work off our plate. Time and again, that added layer of defense has paid for itself in avoided incident costs and reduced remediation time. It's invaluable." — Matt Snyder, Head of Security Operations and Threat Research

What's Next for Aviatrix and Abnormal AI

Aviatrix has already signed on for AI Security Mailbox and AI Phishing Coach, extending the same behavioral AI to user-reported phishing triage and to training built from the real attacks the platform has caught, rather than staged simulations. For a four-person team stretched across detection, response, and research, that means less time on repetitive cleanup and more time on the proactive threat research Snyder wants his team focused on. Aviatrix is betting that the trust it built with Account Takeover Protection will extend to these new capabilities.

Abnormal Products in Use:

• Inbound Email Security
• Account Takeover Protection