Sutter County Safeguards Critical Public Services with Abnormal AI

Sutter County, in Northern California, runs a centralized government that delivers services touching nearly every aspect of public life. From the Sheriff's Office and District Attorney to Public Health, Behavioral Health, and the Treasurer-Tax Collector's Office, county departments handle the responsibilities residents count on every day. A centralized IT team of 16 keeps the systems behind those services running, supporting more than a thousand employees across every county department.

The Sutter County Email Security Challenge: Fighting AI-Driven Attacks with a Small IT Team

Email threats evolved from computer viruses to AI-driven phishing, business email compromise (BEC), and account takeovers, and Sutter County's small IT team felt the strain. Microsoft 365's native filtering, even on the upgraded plan, kept letting sophisticated attacks through to inboxes, and the problem kept getting worse. The team relied on a separate security awareness training tool to manage user-reported phishing, with one person manually reviewing every report. Then an account takeover hit. That was the final straw. Sutter County needed a defense built to fight AI with AI, and turned to Abnormal.

Customer Key Challenges:

• Microsoft 365 native filtering missed sophisticated phishing and BEC.
• Manual user-reported phishing triage drained limited IT staff time.
• Account takeover was the final straw amid rising AI-driven attacks.

Abnormal Solution:

• Inbound Email Security stops phishing, spear phishing, and BEC with high accuracy and minimal false positives.
• Account Takeover Protection detects compromised accounts and contains attacks around the clock.
• AI Security Mailbox automates triage of user-reported phishing in real time, replacing manual review.

"The main reason I liked Abnormal is we need to fight AI attacks with AI. There's no other way we're going to keep up, especially in house." — Ken Sra, Sutter County General Services Director

The Abnormal AI Solution

Sutter County deployed Abnormal alongside Microsoft 365's native controls, layering behavioral AI on top of the native filtering. Inbound Email Security reads the full context of every message to catch business email compromise (BEC) and advanced phishing that get past native filters. AI Security Mailbox automates user-reported phishing triage in real time, removing malicious mail across inboxes and replying to employees in plain language, consolidating a workflow the team used to manage through a separate awareness platform. Account Takeover Protection monitors identity behavior and integrates with CrowdStrike to flag and contain suspicious activity around the clock.

Why Sutter County Chose Abnormal: Accuracy, Automation, and AI-First Defense

Accuracy decided the evaluation. In side-by-side POCs against several of the leading email security providers, Abnormal hardly produced any false positives, eye-opening for a team used to triaging false alarms. Knowing that one of the country's largest metropolitan counties ran Abnormal at scale sealed the decision. Inbound Email Security now catches the sophisticated threats that Microsoft 365's native filtering let through, without flagging legitimate mail. Account Takeover Protection, integrated with CrowdStrike, monitors identity activity 24/7, closing the gap that produced the compromise that pushed Sutter County to switch. AI Security Mailbox automates user-reported phishing triage in real time, replacing the manual review one person used to handle, and replies to employees with personalized AI-generated explanations of what's safe and what isn't.

Looking Ahead: AI Governance and Identity Protection

With email defense running on autopilot, Sutter County's next focus is two-fold: governing AI internally and tightening identity protection. Today's controls work, but the team wants something sharper than the current one-size-fits-all approach. Abnormal handles the email layer 24/7, freeing IT to design what comes next: an AI-native posture built on the same principle that brought them to Abnormal in the first place: fight AI with AI.

"With Abnormal, it automates the entire process of reviewing and responding to user-reported messages. As soon as a message is reported, Abnormal addresses it, which has been a great time saver." — Nicole Kroner, IT Deputy Director

Abnormal Products in Use:

• Inbound Email Security
• AI Security Mailbox
• Account Takeover Protection