Abnormal AI Delivers Behavioral Foundation Model to Combat the Era of AI-Driven Attacks

Introducing Attune 1.0, the multimodal AI foundation that unifies identity, context, and content signals to prevent AI-driven attacks targeting the modern enterprise

LAS VEGAS--(BUSINESS WIRE)--Abnormal AI, the leader in AI-native behavioral security, today announced the launch of Attune 1.0, a behavioral foundation model for cybersecurity. Trained on more than one billion derived behavioral signals, Attune now powers 85%¹ of detections across the Abnormal Behavior Platform and establishes a shared intelligence layer for the company’s expanding security portfolio.

Communication is how organizations build trust. Today, that trust is being weaponized by attackers using AI to launch campaigns that are highly personalized for each and every target. This evolution requires defenders to assume that every attack is a novel attack.

Traditional security tools, which rely on rules and static threat intelligence, are struggling to keep pace with this shift. Attune 1.0 addresses this by bringing together Abnormal’s eight years of behavioral understanding into a single, unified model that is easier to manage and improve.

"Attackers are leveraging AI to imitate trusted behavior so convincingly that static rules and threat feeds struggle in the era of AI-driven attacks," said Evan Reiser, CEO and Co-Founder of Abnormal AI. "Attune 1.0 is how we close that gap—with a behavioral foundation model that understands normal organizational communication patterns. It gives customers a single intelligence layer that understands known good behavior, catches what isn’t, and strengthens every product we ship as part of the Abnormal Behavior Platform.”

Abnormal was Built for this Era of Novel Attacks

Unlike earlier detection systems that treated identity, behavior, and content as separate signals, Attune 1.0 utilizes a unified multimodal architecture. By learning these modalities jointly, the model better understands how signals reinforce or contradict one another to reveal patterns that attackers work hardest to hide. From inception, Abnormal has focused on knowing what’s normal in customers’ environments, enabling it to detect and block novel, AI-driven attacks when a deviation in behavior is found.

Key milestones of the Attune 1.0 milestone include:

• Efficacy Gains at Scale: Trained on large-scale behavioral signals, Attune is already detecting approximately 150,000 more attack campaigns per week than earlier systems, catching highly sophisticated messages that were previously undetectable.
• Higher Precision: By training on a larger volume of diverse data, the model delivers 50% higher precision compared to earlier systems.
• Stopping Novel Attack Campaigns: Attune recently identified and blocked a novel Microsoft Teams OAuth phishing campaign two months before it was publicly documented.
• Platform-Wide Intelligence: Attune already powers 85% of detections across the Abnormal Behavior Platform, providing higher precision and fewer false positives. This foundation establishes a shared behavioral layer across email, identity, and account takeover protection, catching more lateral attacks to better secure the entire employee lifecycle.

Attune 1.0 is Generally Available today.

Expanded Visibility and Fine-Tuned Control for Cloud Email Security

With the release of Attune 1.0, Abnormal continues on its promise of delivering a powerful, automated AI engine designed to prevent modern email-based attacks. Alongside this automation, Abnormal is delivering greater visibility and control, so customers can understand the platform’s autonomous detections and fine-tune them when needed:

• Detection 360 Insights (GA): Provides visibility into the behavioral reasoning behind every AI determination, helping analysts understand exactly why a message was flagged.
• Custom AI Models (Early Access): Enables security teams to influence and control the AI by defining environment-specific patterns using simple natural language descriptions. This allows users to influence and augment the AI specific to their environment.

Enhanced Automation for Human Risk Management

Abnormal is also delivering updates for AI Phishing Coach, transforming how organizations manage the human element of security and best train their employees. Abnormal is replacing one-size-fits-all compliance training with an automated, AI-driven system that helps turn real-world threats into personalized coaching. As the underlying behavioral layer within Abnormal improves, our ability to train on those results also improves:

• Phishing Risk Scoring (GA): Provides a continuously updated phishing-readiness signal based on actual simulation interactions, reporting activity, and training outcomes.
• BEC and VEC Simulations (GA): New simulation types, with data from the Abnormal relationship graph, mirror manager, colleague, and vendor interactions.

Additional Resources

• Visit Abnormal at RSAC 2026: Abnormal will be showcasing these innovations throughout the week at the company’s exclusive hub in San Francisco.
• Discover More about the Products in this blog post from CEO Evan Reiser.

Disclaimer

Statements in this communication that express beliefs or expectations about future events or performance are forward-looking in nature and are based on current assumptions. Actual results may differ materially. Abnormal AI undertakes no obligation to update these statements.

¹ Based on internal analysis of production telemetry from the Abnormal Behavior Platform. Results as of March 2026 indicate that Attune-powered models account for approximately 85% of malicious detections across the platform.

About Abnormal AI

Abnormal AI is the leading AI-native human behavior security platform, leveraging machine learning to stop sophisticated attacks and detect compromised accounts across email and connected applications. Our anomaly detection engine leverages identity and context to analyze normal behavior and assess the risk of every cloud email event—detecting and stopping sophisticated, socially-engineered attacks that target your organization's most valuable cybersecurity asset: your people.

You can deploy Abnormal in minutes with an API integration for Microsoft 365 or Google Workspace and experience the value of the platform instantly. Additional protection from Abnormal is available for Slack, Workday, ServiceNow, Zoom, and multiple other cloud applications. Abnormal is currently trusted by thousands of organizations, including more than 25% of the Fortune 500, as it continues to redefine how cybersecurity works in the age of AI. Learn more at abnormal.ai.