Abnormal Security
Abnormal Security (operating under the abnormal.ai brand) is an AI-native email and SaaS security platform that uses behavioral AI to model normal communication and identity behavior, then detect socially engineered email attacks, business email compromise, vendor email compromise, and account takeovers across Microsoft 365, Google Workspace, Slack, Zoom, and Microsoft Teams. The Behavior Platform is paired with AI Security Agents (AI Security Mailbox, AI Phishing Coach, AI Data Analyst) and exposes a gated REST API at api.abnormalplatform.com for SOC, SIEM, SOAR, and ticketing integrations. 4,500+ customers including 25% of the Fortune 500; named a 2024 Gartner Magic Quadrant Leader for Email Security Platforms.
More than an index entry, but the surface is still mostly links rather than artifacts — the cohort most likely to move a full band from modest, well-targeted work.
API Evangelist profiles Abnormal Security the way a machine reads it — 30 machine-readable artifacts across 1 API, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Abnormal Security scores 27.5/100 (emerging), with a separate agent-readiness read of 7/100 (human only). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-07-27 · rubric v0.5
How we profile Abnormal Security
Each block below is one kind of artifact we hold for Abnormal Security. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 1
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Abnormal Security Platform API
The Abnormal Security Platform REST API at api.abnormalplatform.com gives customers and integration partners programmatic access to detected threats, attack cases, abuse mailbox...
Pricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the six things the Kin Score reads for commercial clarity.
Published pricing tiers and plan structures.
Rate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Abnormal Security Rate Limits
RATE LIMITSFinOps 1
Cost, billing, and metering signals let a buyer model the financial operations of an API before it's live. We profile them for the same reason we profile pricing: the money is part of the contract.
Cost, billing, and metering signals for API financial operations.
Abnormal Security Finops
FINOPSFeatures 11
The notable capabilities this provider advertises, captured as structured features so they can be searched and compared instead of read one landing page at a time.
Notable capabilities this provider offers.
Behavior Platform
AI-native platform that models normal email and identity behavior to detect socially engineered attacks
Inbound Email Security
Autonomous AI defense against phishing, BEC, vendor email compromise, and other inbound email attacks
Account Takeover Protection
Detection and mitigation of account takeovers across email and identity platforms
Security Posture Management
Detection of Microsoft 365 misconfigurations before attackers can exploit them
Email Productivity
Personalized graymail filtering to reduce inbox noise without compromising security
Misdirected Email Prevention
Detect and prevent emails sent to the wrong recipient before data is exposed
AI Security Mailbox
AI agent that responds to user-reported emails and coaches users at superhuman speed
AI Phishing Coach
Hyper-personalized security training that reduces phishing susceptibility
AI Data Analyst
Natural-language security reporting that produces board-ready insights
SaaS Account Takeover Protection
Account takeover protection for SaaS applications such as Slack and Zoom
Messaging Security
Detection of malicious content inside Microsoft Teams
Scroll within the panel for all 11 ·
Security Posture 2
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Use Cases 5
What developers actually build with this provider — captured so the catalogue answers 'what is this for', not just 'what does this expose'.
What developers build with this provider.
BEC and Phishing Defense
Stop business email compromise, phishing, and vendor email compromise on Microsoft 365 and Google Workspace
Account Takeover Response
Detect and respond to compromised email and SaaS accounts in near-real time
SOC Automation
Use AI Security Agents to triage user-reported emails and automate SOC workflows
Security Posture Hardening
Continuously identify and remediate Microsoft 365 misconfigurations
Executive Reporting
Use the AI Data Analyst to deliver board-ready security reporting through natural-language queries
Integrations 8
Pre-built integrations with other platforms tell you where this provider already fits in a stack.
Pre-built integrations with other platforms and tools.
Microsoft 365
Native API-based integration with Microsoft 365 for email and identity protection
Google Workspace
Native API-based integration with Google Workspace email and identity surfaces
Microsoft Teams
Messaging security integration with Microsoft Teams
Slack
SaaS account takeover protection for Slack workspaces
Zoom
SaaS account takeover protection for Zoom accounts
SIEM
REST API forwarding of detected threats and cases into Splunk, Sentinel, Chronicle, and similar SIEMs
SOAR
Bidirectional integrations with Cortex XSOAR, Splunk SOAR, Tines, and other SOAR platforms
ITSM
Ticketing integrations with ServiceNow, Jira, and other ITSM tools
Scroll within the panel for all 8 ·
Resources
Every other property we hold for Abnormal Security — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 1
Portal, sign-up, and the first successful call
Documentation 1
Reference material describing how the API behaves
Access & Security 2
Authentication, authorization, and security posture
Operate 1
Status, limits, changes, and where to get help
Commercial 2
Pricing, plans, and the legal terms of use
Company 5
The organization behind the API
Other 1
Properties that don't map to a standard resource type
← All providers · Data indexed from github.com/api-evangelist/abnormal-security · machine-readable index on apis.io