Uzabase Cuts Attack Emails and Manual Effort with Abnormal AI

Uzabase, which operates an economic information platform, adopted Abnormal AI to further strengthen its email security. The company built an environment capable of detecting sophisticated attacks, including those that spoof legitimate domains and services or impersonate real individuals, with high accuracy, while also significantly reducing the operational burden of managing email security.

The Uzabase Email Security Challenge

Uzabase operates the economic information platform Speeda and the social economic media platform NewsPicks. Email is Uzabase's primary attack surface, and CIO/CISO Kaichi Oh notes that phishing remains one of the leading paths into ransomware incidents. Google Workspace's native spam filter was the first line of defense, but targeted attacks increasingly slipped through and grew harder for employees to spot. When a user clicked a malicious link, the security team had to manually investigate, reset passwords, and remediate manually, while a growing stream of external phishing campaigns strained the team's capacity. That's when Uzabase turned to Abnormal.

Customer Key Challenges:

• Targeted attacks increasingly evaded Google Workspace's spam filter.
• Manual investigation, resets, and remediation strained the team.
• Phishing-driven ransomware posed a serious, escalating risk.

Results:

• Inbound Email Security blocks roughly 3,000 evasive attack emails every month that evade Google Workspace's spam filter.
• AI Security Mailbox and automated remediation significantly reduced manual triage.
• AI Phishing Coach turns real caught attacks into personalized staff training.

"Email security is the primary entry point for attacks, so it's a top priority to protect. Abnormal AI's high-accuracy detection and automated remediation let us protect the business from threats like targeted attacks while easing the burden on our security team." — Kaichi Oh, Senior Executive Officer, CIO/CISO

Abnormal AI Solution

Uzabase layered Abnormal's behavioral AI on top of Google Workspace's native defenses. Inbound Email Security learns normal sender and communication behavior across the organization to detect and automatically remediate attacks that spoof legitimate domains, services, and individuals. AI Security Mailbox triages every user-reported email and autonomously remediates confirmed and related threats across all mailboxes, removing the need for manual investigation. AI Phishing Coach builds on attacks Abnormal has already caught to deliver personalized, just-in-time coaching. The API-native architecture integrates directly into Uzabase's existing environment without disrupting mail flow.

High Accuracy, Low Burden: Why Uzabase Chose Abnormal

In its proof of concept, Abnormal stood out among the tools Uzabase evaluated for the fewest false positives and false negatives, with no manual rules or exception lists to maintain. Inbound Email Security now blocks an average of 3,000 additional attack emails a month that previously slipped past Google Workspace's filter, and over four months it caught roughly 30,000 attack and phishing emails before users could open them. AI Security Mailbox absorbed the burden that used to fall unevenly on individual help desk staff, cutting inquiry volume and the inconsistent handling that came with it. AI Phishing Coach now runs personalized simulations built from Uzabase's own caught attacks. The API-native deployment integrated with Google Workspace without any migration work.

Next: Deeper Visibility Through SIEM Integration

Uzabase is now exploring integration between Abnormal and its SIEM to cross-reference correlation data for a more detailed view of threat behavior. As Oh puts it, employees should be focused on the core business, not on staying safe. Increasingly, at Uzabase, they don't have to choose.

Abnormal Products in Use:

• Inbound Email Security
• AI Security Mailbox
• AI Phishing Coach