Notifications
Clear all
Topic starter
27/06/2026 2:01 pm
TL;DR: AI-era security is increasingly judged on detection of compromised accounts and socially engineered abuse, not just platform breadth, while Abnormal AI says it was named to the Forbes 2025 Cloud 100 for the third year in a row and entered the top 20 for the first time, citing 3,200-plus customers and 25% of the Fortune 500 as evidence of growth.
NHIMG editorial — based on content published by Abnormal AI: Abnormal AI Secures Spot on Forbes 2025 Cloud 100 for Third Year Running
By the numbers:
- Abnormal AI is currently trusted by more than 3,200 organizations, including 25% of the Fortune 500.
- The Cloud 100 reviewed submissions from hundreds of cloud startups and private companies worldwide.
Questions worth separating out
Q: How should security teams detect compromised human accounts across cloud apps?
A: Security teams should correlate identity logs, mailbox activity, and connected-application telemetry so suspicious behaviour is visible in context.
Q: Why do connected applications increase identity risk after account takeover?
A: Connected applications increase identity risk because they extend trust beyond the login event into business workflows and shared data paths.
Q: How do behaviour analytics complement IAM controls?
A: Behaviour analytics complement IAM by detecting misuse of valid access after authentication has already succeeded.
Practitioner guidance
- Map connected-app trust paths Identify which business applications inherit trust from a primary human account and which actions remain possible after compromise.
- Correlate IAM events with behaviour signals Join authentication logs, mailbox activity, and application telemetry so suspicious access patterns can be investigated in context.
- Review recovery workflows for account compromise Test how quickly security and IAM teams can disable sessions, revoke tokens, and cut off app access when a human identity is hijacked.
What's in the full analysis
Abnormal AI's full post covers the operational detail this post intentionally leaves for the source:
- The specific Cloud 100 evaluation context and how the ranking methodology compares market leadership, valuation, operating metrics, and people and culture.
- The company’s year-over-year milestones, including its autonomous AI agents launch, Japan expansion, and FedRAMP Moderate Authorization timeline.
- The vendor’s own explanation of how its cloud email event analysis works across Microsoft 365, Google Workspace, Slack, Workday, ServiceNow, and Zoom.
- The full list of third-party recognitions cited alongside the Cloud 100 placement, including Gartner Peer Insights, CNBC Disruptor 50, InfraRed 100, and CRN awards.
👉 Read Abnormal AI’s Cloud 100 announcement and AI-native security update →
AI-native human behavior security: what the Cloud 100 spot signals?
Explore further
27/06/2026 3:36 pm
Cloud security recognition now reflects identity risk, not just infrastructure scale. The Cloud 100 framing matters because modern cloud security value is increasingly tied to how well a platform handles compromised accounts, behavioural anomalies, and trusted-app abuse. That is a shift away from perimeter-centred thinking and toward identity-centric detection. For practitioners, the takeaway is that cloud security evaluation should now include identity behaviour as a first-class requirement.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, a confidence gap that often mirrors weak telemetry across connected identity surfaces.
A question worth separating out:
Q: What should teams prioritize after a human account is compromised?
A: Teams should prioritize containment actions that cut off active misuse before the attacker can move into connected systems. That means revoking tokens, terminating sessions, reviewing app permissions, and checking for abnormal business actions such as message forwarding, workflow manipulation, or unauthorized file access. Speed matters because valid credentials can look normal until the abuse is well underway.
👉 Read our full editorial: AI-native human behavior security and Cloud 100 recognition
