Abnormal AI expands email security from detection to data protection and phishing-simulation training
Abnormal AI announced an expansion of its email security platform with three new capabilities: Control Center, Email DLP Rules, and AI Phishing Coach upgrades.
Together, the launch extends Abnormal’s behavioral AI across all three surfaces of email risk: what comes into the inbox, what leaves the organization, and how people are trained to recognize an attack.
Attackers have changed the economics of cybercrime. Generative AI now lets them research targets, write convincing messages, and shift tactics faster than signature-based defenses can track. The most effective attacks no longer carry obvious malware or suspicious domains; they look like normal business activity until the behavior gives them away. Abnormal learns how organizations normally communicate, then identifies the moment that pattern breaks.
“The role of email security is expanding,” said Evan Reiser, CEO of Abnormal AI. “Organizations still need to stop sophisticated inbound attacks, but they’re increasingly looking to the same platform to address outbound data loss, employee phishing risk, and greater control over automated detection. Securing email now means addressing risk from multiple directions: the threats coming in, the sensitive information going out, and the people attackers continue to target. These new capabilities expand how Abnormal helps organizations manage that risk.”
Control Center layers optional control on top of Abnormal’s detection engine without introducing code or complexity. It also lets teams create custom detection models and rules tailored to their organization, without writing code. Control Center shows which layer (the core behavioral AI, a custom model, or a custom rule) made each decision, so security teams can investigate faster and explain automated decisions in the context of their own policies.
Email DLP Rules combine explicit outbound policy controls (built with regex, phrase matching, metadata conditions, Boolean logic, and exclusions) with contextual review from an AI Triage Agent. The agent evaluates a rule’s intent, the sender, and the surrounding message context, then auto-releases benign messages and quarantines likely violations while recording every verdict in an outbound log for audit visibility. It is designed to give organizations a practical way to enforce outbound policy without taking on the manual review burden that many DLP deployments create at scale.
Upgraded AI Phishing Coach capabilities help security teams calibrate phishing-simulation training to how their organization is actually being targeted, rather than delivering the same exercise to everyone on a fixed calendar. Using engagement and risk signals from across your organization, the platform adjusts simulation difficulty, and recommends reinforcement training. Administrators can also generate custom simulations and training content from a plain-language description. All simulation content and follow-up actions remain fully visible and configurable.
Custom AI Models within Control Center, and the newest AI Phishing Coach capabilities, are generally available starting August 31. Custom Rules within Control Center and Email DLP Rules are available in early access starting August 31.