Does Abnormal hold FedRAMP authorization?

Yes. Abnormal holds FedRAMP Moderate Authorization (product ID FR2425960757 on the FedRAMP Marketplace), sponsored by the Tennessee Valley Authority. For state and local agencies, Abnormal also holds GovRAMP Moderate Authorization, sponsored by the University of Texas at Austin. CJIS attestation is also current.

How does Abnormal deploy without disrupting mail flow?

Abnormal connects via API to Microsoft 365 or Google Workspace — no MX record changes, no mail rerouting, no inline inspection. For government environments with strict change management processes, this means no change advisory board approval for mail flow modifications. The integration is read/write via Graph API or Google API, and the platform begins learning behavioral baselines immediately.

Can Abnormal detect internal email threats that our gateway misses?

Yes. Because Abnormal integrates via API, it sees internal-to-internal email that no gateway can access. This means lateral phishing from compromised employee accounts, unauthorized mail rule changes, and internal BEC attempts are all visible. A gateway operating as an inline mail filter structurally cannot inspect internal traffic.

What happens if Abnormal incorrectly flags a legitimate email?

It happens — rarely. Abnormal achieves 99.99% detection accuracy across enterprise deployments. When a false positive does occur, the message is easy to release from quarantine, and the behavioral model updates to prevent recurrence. The platform is designed to over-protect and provide simple overrides rather than let attacks through.

How does Abnormal help with BOD 25-01 and SCuBA compliance?

Security Posture Management continuously monitors your M365 tenant configuration against CIS benchmarks and Microsoft best practices — surfacing misconfigurations, tracking drift, and providing step-by-step remediation guidance. This directly supports the continuous monitoring and secure configuration requirements of BOD 25-01 and CISA's SCuBA baselines.

Public Sector

Behavioral AI Knows How Your Agency Actually Communicates

Your team stops impersonation and vendor fraud targeting finance and procurement staff — deployed via API in minutes, no MX changes, FedRAMP Moderate authorized.

Request a Demo

Year-over-year increase in ransomware incidents targeting government bodies

Trend Micro, H1 2025

$0B

BEC losses reported to the FBI in 2024 — second costliest cybercrime category

FBI IC3 2024 Annual Report

BEC attacks blocked per customer monthly your gateway marked safe

Abnormal Platform Data

Take A Product Tour

The Challenge

Your Gateway Delivers the Attacks That Drain Public Funds

Director Impersonation Requesting Emergency Wire Transfers

Attackers use publicly available org charts to impersonate agency directors and request urgent fund transfers to "new vendors." The email

Vendor Invoice Fraud Inside Existing Procurement Threads

Compromised contractor accounts reply within active procurement email threads with updated banking details.

Credential Phishing Disguised as M365 Admin Notifications

Attackers send fake Microsoft 365 security alerts to IT staff, directing them to adversary-in-the-middle login pages that capture session tokens

Lateral Phishing from Compromised Employee Accounts

A compromised staff account sends internal emails to payroll requesting direct deposit changes or to colleagues sharing malicious links.

Grant Disbursement Redirection via Spoofed Program Officers

Attackers impersonate federal program officers and send emails to state agencies with "updated" disbursement instructions.

Real Incident

AAcountycountyfinancefinancedirectordirectorreceivesreceivesananemailemailfromfromaaknownknowncontractorcontractor——samesamethread,thread,samesamesignature,signature,samesamedomaindomain——requestingrequestingupdatedupdatedwirewireinstructionsinstructionsforforaa$1.2M$1.2Minfrastructureinfrastructurepayment,payment,andandthethegatewaygatewaydeliversdeliversititwithoutwithoutaasinglesinglealertalertbecausebecauseeveryeveryauthenticationauthenticationcheckcheckpasses.passes.

Based on a real customer incident

How It Works

Behavioral AI for Public Sector

Know When a Vendor Account Is Compromised — Before the Fraudulent Invoice Arrives

VendorBase maintains a federated database of vendor compromise indicators across all Abnormal customers, including 25% of the Fortune 500.

Detect Compromised Staff Accounts from Authentication Anomalies — Not Just Email Content

Account Takeover Protection correlates sign-in locations, MFA changes, device fingerprints, and email behavior to identify compromised government accounts in seconds.

Reclaim Analyst Hours Your Team Spends Triaging User-Reported Emails

AI Security Mailbox autonomously investigates every user-reported email, classifies it, remediates associated campaign messages, and responds to the reporting employee — all without analyst involvement.

Over 25% of the Fortune 500 Trust Abnormal AI to Make Automated, Critical Security Decisions

Our Impact

What Public Sector Leaders Are Saying About Abnormal AI

“That’s what I really liked. It really didn’t take more than five hours to kind of really get it up and running, to kind of fine-tune it. All the process took about a week. Boy, that’s quick. In pure honesty, I was planning to cut costs, and cutting Abnormal would be part of that cost-cutting. “But then we did the cost-benefit analysis, and it didn’t really make any sense to take Abnormal out and, you know, increase the risk. Our cyber exposure would have significantly gone up had we removed Abnormal. So Abnormal stays at AC Transit.”

Tas Jalali

Head of cybersecurity, AC Transit

“I’ve been waiting for complaints from our stakeholders since deployment, but there are none. Even the Executive Director, our toughest critic, personally thanked me for the Promotions folder, which is a huge deal for our agency. Abnormal is helping us change the narrative around technology, not as a threat to jobs, but as a way to secure our ecosystem and improve the lives of our people.”

Dr. Teresa Stillwell

CIO, Florida Department of Veterans' Affairs

Abnormal powers over 4,500 customers, including over 25% of the Fortune 500.

Customer Stories

FAQ

Related Resources

Webinars

The Detection Gap: Why AI-Powered Attacks Are Winning Against Legacy Email Security

Watch this on-demand webinar to learn how AI-powered BEC attacks bypass secure email gateways, and how behavioral AI can detect what legacy tools miss.

White Papers

The Essential Guide to Human Risk Management

Learn why traditional security awareness training fails to reduce real-world risk and how modern human risk management helps organizations measure and reduce risky behavior over time.

Data Sheets

Displace Your Secure Email Gateway

Stop sophisticated email attacks that target your employees using native cloud-based email security plus Abnormal.

View All Resources

See the Attacks Your Gateway Delivered Last Month

Request a demo to see how Abnormal protects your agency — results from your own environment in 48 hours.

Request a Demo

Identity & AI Security

Platform

Product Resources

Support

Featured

Thought Leadership

Featured

Company

News & Events

Featured

Behavioral AI Knows How Your Agency Actually Communicates

Your Gateway Delivers the Attacks That Drain Public Funds

Director Impersonation Requesting Emergency Wire Transfers

Vendor Invoice Fraud Inside Existing Procurement Threads

Credential Phishing Disguised as M365 Admin Notifications

Lateral Phishing from Compromised Employee Accounts

Grant Disbursement Redirection via Spoofed Program Officers

Behavioral AI for Public Sector

Know When a Vendor Account Is Compromised — Before the Fraudulent Invoice Arrives

Detect Compromised Staff Accounts from Authentication Anomalies — Not Just Email Content

Reclaim Analyst Hours Your Team Spends Triaging User-Reported Emails

Over 25% of the Fortune 500 Trust Abnormal AI to Make Automated, Critical Security Decisions

What Public Sector Leaders Are Saying About Abnormal AI

FAQ

Related Resources

See the Attacks Your Gateway Delivered Last Month