Notifications
Clear all
Topic starter
14/07/2026 4:22 pm
TL;DR: A side-by-side test found 326 confirmed threats that Abnormal did not identify, while more than 95% of alerts Abnormal called borderline were classified as spam by Proofpoint, highlighting how fragmented email security can distort detection quality and analyst workload, according to Proofpoint. The practical lesson is that coverage, visibility, and cost control now have to be evaluated together, not as separate buying decisions.
NHIMG editorial — based on content published by Proofpoint: the email security comparison with Abnormal and the operational impact of false positives
By the numbers:
- Proofpoint detected 326 confirmed threats that Abnormal did not identify at all.
- More than 95% of the emails that Abnormal labelled borderline were classified as spam by Proofpoint.
Questions worth separating out
Q: What breaks when email security relies on partial visibility and borderline detections?
A: Teams lose the evidence needed to distinguish phishing, spoofing, and legitimate mail flows, which slows triage and raises the chance that a real threat is dismissed as noise.
Q: Why do email threats matter to IAM and PAM teams, not just email teams?
A: Email often starts the chain that leads to account takeover, approval abuse, or privileged access misuse.
Q: How do organisations know if email security is actually working?
A: Look for fewer fraudulent requests reaching approval stages, faster triage of suspicious mail, and reduced analyst time spent on low-value noise.
Practitioner guidance
- Test email controls against the same live traffic set Run side-by-side comparisons on identical mail streams so detection, false positives, and investigation depth are measured under the same conditions.
- Require full-message forensic visibility Make complete headers, sender-path context, and retention of message metadata mandatory for any control used in incident response.
- Measure analyst time spent on ambiguous alerts Track how long staff spend reviewing borderline detections, then translate that into response delay, escalation fatigue, and hidden cost.
What's in the full article
Proofpoint's full post covers the operational detail this post intentionally leaves for the source:
- A side-by-side testing view of how the detections were compared against the same email stream.
- The specific false-positive and borderline classification patterns that shaped the customer’s decision.
- How the organisation consolidated email security, DLP, and archiving into a single operational model.
- The practical cost and response-efficiency considerations that were used to justify the change.
👉 Read Proofpoint's analysis of the email security comparison with Abnormal →
Email security consolidation: what it means for detection and response?
Explore further
14/07/2026 4:30 pm
Email security is now an identity governance problem, not just a messaging problem. The article shows that the real issue was not only detection efficacy but how email control quality affects account takeover risk, forensic confidence, and response speed. When email is the entry point for credential theft and identity abuse, the security stack has to be judged by its ability to support identity containment, not just inbox filtering. Practitioners should treat email controls as part of the access governance chain.
A question worth separating out:
Q: Who is accountable when account takeover exposes sensitive data?
A: Accountability sits across identity, security operations, and data governance because the incident spans authentication, access enforcement, and data protection. Frameworks such as OWASP NHI and NIST CSF both support the view that compromise response must include fast privilege restriction, not just detection and ticketing.
👉 Read our full editorial: Email security consolidation exposes the limits of point solutions
