LCI Automates Advanced Email Defense with Abnormal AI

The Governor's Office of Land Use and Climate Innovation (LCI) is California's hub for environmental planning and climate resilience. Based in Sacramento, the agency oversees environmental review processes statewide, while the Strategic Growth Council channels federal grants into land and community investment. LCI also maintains climate and fire-risk maps used by military units, state agencies, and the California public.

The LCI Email Security Challenge: Building from Scratch

Between 2022 and 2023, LCI experienced significant growth and expansion, nearly doubling its staff to 360 employees. The Governor's Office determined the agency had outgrown its shared infrastructure and empowered LCI to stand up its own independent IT environment, along with its own dedicated security program. Bradley Ponce arrived in late 2023 to lead that effort, building the security program from scratch alongside his team in the months that followed.

Ponce came with a plan. Phishing drove more than 90% of all threats, so email defense was a top priority. He also needed users to report suspicious messages without friction, inbox clutter managed automatically, and awareness training that ran continuously rather than as an annual event. That's when LCI turned to Abnormal AI.

Customer Key Challenges:

• LCI needed to build its own dedicated email security program after the Governor's Office empowered it to stand up independent IT infrastructure in 2023.
• Phishing drove 90%+ of attacks with no dedicated email defense.
• Awareness training tool struggled with campaign delivery.

Abnormal Solution:

• Inbound Email Security and Account Takeover Protection defend against advanced phishing and compromised accounts across LCI's Microsoft 365 environment.
• Email Productivity and AI Security Mailbox automate inbox management and user-reported email triage.
• AI Phishing Coach runs continuous, personalized simulations for each LCI employee.

"I think every company should have a product like this. It's like a firewall. If you don't have that, we're kind of in a lot of trouble." — Bradley Ponce, Chief Information Security Officer

The Abnormal AI Solution

LCI deployed Abnormal AI on top of its Microsoft 365 GCC environment alongside Microsoft Defender for Office 365. Abnormal connects via API, layering in without replacing Defender or changing routing. Abnormal builds a behavioral baseline across every sender and recipient, learning what normal looks like for each user and flagging deviations in real time. Inbound Email Security and Account Takeover Protection protect against advanced threats and internal compromises, while Email Productivity and AI Security Mailbox automate graymail management and user-reported email triage, respectively. AI Phishing Coach delivers personalized simulations and just-in-time coaching based on the real threats LCI's users encounter.

Why LCI Built Its Email Program Around Abnormal

Inbound Email Security is LCI's front line against phishing. When a campaign swept California agencies, Abnormal blocked it before reaching a single LCI mailbox while peers dealt with the fallout. It now stops more than 230 advanced attacks every month.

Meanwhile, AI Security Mailbox saves the team 20 hours monthly by automating the triage of user-reported messages. This has enabled LCI to further encourage more user reporting and cyber vigilance without adding manual work or overwhelming existing resources.

AI Phishing Coach replaced a struggling third-party tool with simulations built from real attacks. Ponce runs them continuously. "Cybersecurity is everybody's responsibility," he says. "I'm just the chief whistleblower."

A Security Program Built to Grow with LCI

LCI didn't have its own security program three years ago; it was built from scratch after the agency was empowered to stand up its own IT infrastructure. Today it stops more than 230 attacks every month, automates triage on thousands of reported emails, and runs personalized phishing simulations for every employee.

Bradley Ponce measures success by what doesn't happen. When Abnormal stops a phishing campaign before it reaches a single inbox, there's nothing to report, and that's precisely the point. For an agency protecting California's land data, climate maps, and communities, that quiet outcome is the whole program working.

"We do not want to make it hard for the business to report phishing. I want the business to be able to open an email and just report it as phish. And then behind the scenes Abnormal takes over and does its triaging, does its metrics. It's a pretty slick process." — Bradley Ponce, Chief Information Security Officer

Abnormal Products in Use:

• Inbound Email Security
• Account Takeover Protection
• AI Security Mailbox
• Email Productivity
• AI Phishing Coach