Notifications
Clear all
Topic starter
27/06/2026 1:41 pm
TL;DR: Customers average 462 advanced attacks per month per 1,000 mailboxes bypassing Microsoft native controls, according to Abnormal AI. Its behavioral model is trained on more than 1 billion signals and now powers 85% of detections across the platform, and the governance lesson is that intent-based identity and communication profiling is now essential because signature-only controls cannot keep pace with socially engineered abuse.
NHIMG editorial — based on content published by Abnormal AI: Key insights on behavioral AI detecting advanced email attacks
By the numbers:
- Abnormal customers average 462 advanced attacks per month per 1,000 mailboxes bypassing Microsoft native controls.
- 44% of employees who read a vendor email compromise message engage with it.
- Since Attune launched, unique attack detections rose approximately 68%.
Questions worth separating out
A: Use behavioural detections that model each identity’s normal communication, authentication, and request patterns.
Q: Why do rules-based email controls fail against modern phishing and vendor impersonation?
A: They depend on known indicators, but modern attacks often avoid those indicators entirely.
Q: How can organisations tell whether email AI is actually improving security?
A: Look for measurable reductions in false positives, faster analyst review, and higher-confidence detections that explain why a message was flagged.
Practitioner guidance
- Rebuild detections around identity-specific baselines Prioritise controls that compare a message against the sender’s communication history, authentication pattern, and relationship context rather than broad organisational norms.
- Harden vendor-change workflows Require secondary verification for banking detail changes, invoice amendments, and other relationship-sensitive requests, especially when the request arrives in an existing thread.
- Test for signature blind spots Run controlled simulations of thread hijacking, lookalike domains, and internal-account abuse to see whether current tools detect intent when payloads remain clean.
What's in the full article
Abnormal AI's full research covers the operational detail this post intentionally leaves for the source:
- Customer-specific detection telemetry showing how behavioural AI reduces false positives in production email environments
- Expanded examples of thread hijacking and vendor impersonation patterns that bypass native Microsoft controls
- How the platform’s model uses production feedback to sharpen detections without manual rule writing
- Operational context on why some detections move from analyst review to automation with minimal friction
👉 Read Abnormal AI's analysis of behavioral email attacks bypassing Microsoft controls →
Email attacks bypassing Microsoft controls: what IAM teams should know?
Explore further
27/06/2026 3:07 pm
Behavioral email security is really identity security in another form. The article shows that the most effective detections are built on per-identity behavioural baselines, not org-wide averages. That is the same governance problem IAM teams face everywhere: the control fails when it assumes one normal pattern fits all users, vendors, and service relationships. Practitioners should treat messaging behaviour as identity evidence, not just content risk.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: What should teams prioritise when evaluating behavioural email security tools?
A: Prioritise per-identity baselines, explainable detections, and a feedback loop that improves with live production traffic. Those capabilities matter more than broad claims about AI because they determine whether the tool can detect abuse that looks normal in content but abnormal in context. Without them, the platform will struggle with invoice fraud, executive impersonation, and thread hijacking.
👉 Read our full editorial: Behavioral AI exposes email attacks that bypass native Microsoft controls
