Land + Water Modernizes Email Security with Abnormal AI

Land + Water is the UK’s leading civil and environmental engineering company working in some of the world’s most diverse habitats, across the UK’s coastlines, canals, and rivers. Headquartered just outside Guildford, its team supports projects across the UK, including marinas, waterways, and early works on major national infrastructure projects. Roughly 180 employees and a network of subcontractors deliver complex civil engineering work, often from temporary pop-up sites that span weeks or years.

Land + Water’s Email Security Challenge: Outgrowing Legacy Tools as Phishing Threats Escalate

For 14 years, Nick Lunn has run IT and cybersecurity at Land + Water as a one-person team. As the business moved deeper into Microsoft 365, the impact of a single compromised account grew and phishing became more sophisticated. The company’s first secure email gateway (SEG) delayed attachments and disrupted a legal case. The company switched to a new SEG, but it let too much spam and impersonation through and pulled Lunn into hours of manual triage each week. Then a phishing campaign hit a quarter of active mailboxes in 20 minutes. One user nearly entered credentials in a token theft scheme that bypassed multi-factor authentication (MFA). That’s when Land + Water turned to Abnormal.

Customer Key Challenges:

• Sophisticated phishing bypassed legacy email filters at scale.
• Manual remediation of spam and impersonation messages required hours of work each week.
• Token theft nearly compromised an account and bypassed MFA.

Abnormal Solution:

• Inbound Email Security uses behavioral AI to block advanced phishing, impersonation, and business email compromise (BEC).
• AI Security Mailbox auto-triages every user-reported message and explains the verdict back to employees.
• Account Takeover Protection uses identity signals to detect compromised accounts and locks attackers out automatically.

“What sold it for me in the end was that with Abnormal, you don’t need to touch it. I just went for the one that would make my life easier.” — Nick Lunn, Head of IT and Cybersecurity

The Abnormal AI Solution

Land + Water deployed Abnormal AI alongside Microsoft 365 and is winding down its legacy secure email gateway (SEG), shifting from pattern-matching filters to behavioral AI. The platform learns normal behavior for every sender, every recipient, and every sign-in across the environment, then flags anomalies in real time. Inbound Email Security covers the inbox against advanced attacks, Account Takeover Protection secures identity, AI Security Mailbox closes the loop on what employees report, and Email Productivity handles graymail. The four products share the same behavioral foundation, so what one module learns, the others can use.

Why Land + Water Chose Abnormal

Abnormal’s value became apparent during the trial phase. Running passively alongside the existing SEG, Abnormal flagged every malicious message slipping through, and Lunn used the evidence to win board approval. Inbound Email Security now stops over 500 advanced attacks every month, including the credential phishing and impersonation that bypassed earlier filters. Account Takeover Protection has held the company at zero account compromises since deployment. AI Security Mailbox replies to every user-reported message with an AI-generated verdict, reinforcing a culture where employees feel comfortable flagging anything suspicious. Email Productivity auto-remediates roughly 30,000 graymail messages a month with only one false positive to date.

“It just showed how much was getting through that Abnormal would have stopped if it was activated. I used all of that in my proposal to the board to get the sign-off.” — Nick Lunn, Head of IT and Cybersecurity

Retiring the SEG and Exploring Smarter Security Training

With Abnormal in place, Land + Water plans to retire its SEG when the contract expires this year. Lunn is also evaluating AI Phishing Coach, which delivers personalized phishing simulations and just-in-time coaching grounded in real attacks Abnormal catches, a fit for a workforce spread across pop-up sites, marinas, and home networks where security literacy varies. For a one-person IT team that’s seen the business through 14 years of transformation, the next chapter is less about adding tools and more about making each one earn its place.

Abnormal Products in Use:

• Inbound Email Security
• Account Takeover Protection
• AI Security Mailbox
• Email Productivity