University of Portland Modernizes Email Defense with Abnormal AI

The University of Portland is a private Catholic research university on a riverfront campus in Portland, Oregon. Affiliated with the Congregation of Holy Cross, it enrolls undergraduate and graduate students across its schools of nursing, engineering, business, education, and arts and sciences. Founded in 1901, the university is known for small class sizes, close faculty mentorship, and a service-driven mission that draws students from across the country and around the world.

The University of Portland Email Security Challenge

Like most universities, Portland faced a steady stream of phishing: job scams aimed at students and emails impersonating university leadership sent from compromised .edu accounts at peer institutions. Because the messages came from trusted domains, they often bypassed the rule-based detection of existing tools, including a secure email gateway (SEG) and API-based solution. Adding to concerns, alerts from Microsoft about potential account takeovers often surfaced 12 to 24 hours after an initial incident, increasing the potential for subsequent compromises and lateral attacks. The team’s email security tools only further delayed investigation and response, forcing the team to hop between consoles and fragmented forensic data. That’s when the University of Portland turned to Abnormal.

Customer Key Challenges:

• Students targeted by job scams and impersonation from trusted .edu domains.
• Microsoft account takeover alerts arrived 12 to 24 hours after a compromise incident.
• Existing security tools required custom rules and tedious triage.

“It’s much more near real time than Microsoft’s own reporting, which is wonderful because that’s a consistent pain point. The proactive piece is just so nice because that really stops that mushrooming of the scam.” — Andrew Ridenauer, Information Security Analyst

The Abnormal AI Solution

The University of Portland replaced its existing SEG and API-based email security solution with the Abnormal Behavior Platform, deploying Inbound Email Security, Account Takeover Protection, and AI Security Mailbox ahead of fall semester. Inbound Email Security blocks impersonation and job scams aimed at student and faculty inboxes by building behavioral models for every sender. Account Takeover Protection watches identity signals across Entra ID and Microsoft 365 and locks out compromised accounts in near real time. AI Security Mailbox triages user-reported messages and surfaces clear verdicts.

Abnormal Solution:

• Inbound Email Security blocks job scams and leadership impersonation across 6,000 mailboxes.
• Account Takeover Protection detects and contains compromised accounts in near real time.
• AI Security Mailbox automates triage of user-reported messages and surfaces clear verdicts.

Why the University of Portland Chose Abnormal

Inbound Email Security let the University of Portland retire its email security stack and end the cycle of writing custom rules to chase phishing. Behavioral models detect impersonation from compromised .edu domains automatically, freeing the team to focus on higher-value initiatives. Account Takeover Protection delivers near-immediate alerts on compromised accounts, often hours ahead of native Microsoft alerts, and locks attackers out before they can attack laterally. AI Security Mailbox automates triage of user-reported messages and gives the team transparent verdicts they can trust. Because every product surfaces exactly why a message scored the way it did, Abnormal is far less of a black box than the tools it replaced. The platform now protects 6,000 mailboxes from a single console with minimal tuning.

“It’s nice to be able to pull up one email and see exactly why Abnormal judged it, however it judged it. In other systems, you might have to look in multiple places to see that complete picture.” — Matthew Moss, Windows System Administrator

What’s Next for the University of Portland

The University of Portland set out to consolidate its tools and get ahead of attacks instead of chasing them. With Abnormal, the team has done both. The shift frees Matthew, Andrew, and the broader IT staff to focus on the work that grows the university, not the work that defends it from yesterday’s compromise. For an institution that prides itself on small classes and hands-on mentorship, an inbox that quietly takes care of itself returns that same attention to the people who matter most: students, faculty, and staff.

Abnormal Products in use:

• Inbound Email Security
• Account Takeover Protection
• AI Security Mailbox