Abnormal AI behavioural email security

Abnormal AI sits behind Microsoft 365 or Google Workspace over the API rather than in front of them as a gateway: nothing changes in the MX record, and it sees mail that has already passed every signature and reputation check. Detection is behavioural — it learns how each person communicates, with whom, from where and about what — which is what lets it stop a message carrying no link, no attachment and no malware, only a request to change bank details that the recipient has no particular reason to doubt. The same signal applies to the account itself: a hijacked session is revoked in under a second rather than reported in the morning. It is a layer on top of the mail provider's own filtering, not a replacement for it.