Abnormal AI Reveals the Growing Risk of Human Error in Enterprise Email

98% of security leaders consider misdirected email a significant risk—surpassing even malware and credential theft

LAS VEGAS--(BUSINESS WIRE)--Abnormal AI, the leader in AI-native human behavior security, today released a new research report, 2025 State of Misdirected Email Prevention: Keeping Sensitive Data Out of the Wrong Inboxes, revealing that one of the most damaging and overlooked risks in enterprise cybersecurity comes not from malicious attackers, but from human mistakes.

Based on a survey of more than 300 security and IT professionals, the report highlights the growing prevalence and business impact of legitimate messages sent to the wrong recipient—also known as misdirected emails—which can result in data breaches, regulatory violations, remediation costs, and reputational damage.

The research makes clear that this concern is more than theoretical. Ninety-eight percent of security leaders consider misdirected email as a significant risk when compared to other risks like malware and insider threats. And those fears are being realized with 96% of organizations surveyed experiencing data loss or exposure from misdirected email in the past year, with 95% reporting measurable business impact such as remediation costs, compliance violations, or damage to customer trust.

“This report offers a sobering realization,” said Mike Britton, CIO at Abnormal AI. “The same inboxes attackers target are also the source of accidental data loss within organizations. Enterprises have invested heavily in stopping inbound threats like phishing, but outbound email remains a major vector for human error—one that has historically been overlooked.”

Additional findings include:

• 47% of security and IT professionals learn of misdirected emails from recipients rather than from security tools.
• 97% believe behavioral AI can help prevent accidental data loss before it occurs.
• The average enterprise spends over 400 hours per year managing false positive alerts from data loss prevention (DLP) or email security tools.
• Misdirected emails account for 27% of all data protection incidents under the GDPR last year, contributing to over $1.2 billion in fines worldwide.

The research underscores the pitfalls of traditional email security and DLP tools, built to detect external attacks—not the unintentional data loss caused by internal human error. Behavioral AI, by contrast, models typical communication patterns and can identify deviations that indicate misdirected emails, stopping dangerous activity in its tracks by intervening before sensitive data leaves the organization.

“This is a visibility problem as much as it is a technology one,” Britton added. “Traditional tools can’t differentiate a legitimate customer email from a sensitive message going to the wrong recipient. Protecting data today requires more than defending against external threats—it means understanding and supporting human behavior. Organizations that integrate AI-driven insights with user-centric safeguards are better positioned to prevent mistakes from turning into breaches.”

Additional Resources:

• Download the full 2025 State of Misdirected Email Prevention Report to explore the complete findings.
• Read our blog to learn more about Abnormal’s Misdirected Email Prevention solution.

About Abnormal AI:

Abnormal AI is the leading AI-native human behavior security platform, leveraging machine learning to stop sophisticated inbound attacks and detect compromised accounts across email and connected applications. The anomaly detection engine leverages identity and context to understand human behavior and analyze the risk of every cloud email event—detecting and stopping sophisticated, socially-engineered attacks that target the human vulnerability.

You can deploy Abnormal in minutes with an API integration for Microsoft 365 or Google Workspace and experience the full value of the platform instantly. Additional protection is available for Slack, Workday, ServiceNow, Zoom, and multiple other cloud applications. Abnormal is currently trusted by more than 3,200 organizations, including over 20% of the Fortune 500, as it continues to redefine how cybersecurity works in the age of AI. Learn more at abnormal.ai.