Abnormal AI Delivers Behavioral Foundation Model to Combat the Era of AI-Driven Attacks

Abnormal AI, the leader in AI-native behavioral security, announced the launch of Attune 1.0, a behavioral foundation model for cybersecurity. Trained on more than one billion derived behavioral signals, Attune now powers 85%¹ of detections across the Abnormal Behavior Platform and establishes a shared intelligence layer for the company’s expanding security portfolio.

Also Read: AiThority Interview with Glenn Jocher, Founder & CEO, Ultralytics

Communication is how organizations build trust. Today, that trust is being weaponized by attackers using AI to launch campaigns that are highly personalized for each and every target. This evolution requires defenders to assume that every attack is a novel attack.

Traditional security tools, which rely on rules and static threat intelligence, are struggling to keep pace with this shift. Attune 1.0 addresses this by bringing together Abnormal’s eight years of behavioral understanding into a single, unified model that is easier to manage and improve.

“Attackers are leveraging AI to imitate trusted behavior so convincingly that static rules and threat feeds struggle in the era of AI-driven attacks,” said Evan Reiser, CEO and Co-Founder of Abnormal AI. “Attune 1.0 is how we close that gap—with a behavioral foundation model that understands normal organizational communication patterns. It gives customers a single intelligence layer that understands known good behavior, catches what isn’t, and strengthens every product we ship as part of the Abnormal Behavior Platform.”

Abnormal was Built for this Era of Novel Attacks

Unlike earlier detection systems that treated identity, behavior, and content as separate signals, Attune 1.0 utilizes a unified multimodal architecture. By learning these modalities jointly, the model better understands how signals reinforce or contradict one another to reveal patterns that attackers work hardest to hide. From inception, Abnormal has focused on knowing what’s normal in customers’ environments, enabling it to detect and block novel, AI-driven attacks when a deviation in behavior is found.

Key milestones of the Attune 1.0 milestone include:

• Efficacy Gains at Scale: Trained on large-scale behavioral signals, Attune is already detecting approximately 150,000 more attack campaigns per week than earlier systems, catching highly sophisticated messages that were previously undetectable.
• Higher Precision: By training on a larger volume of diverse data, the model delivers 50% higher precision compared to earlier systems.
• Stopping Novel Attack Campaigns: Attune recently identified and blocked a novel Microsoft Teams OAuth phishing campaign two months before it was publicly documented.
• Platform-Wide Intelligence: Attune already powers 85% of detections across the Abnormal Behavior Platform, providing higher precision and fewer false positives. This foundation establishes a shared behavioral layer across email, identity, and account takeover protection, catching more lateral attacks to better secure the entire employee lifecycle.

Attune 1.0 is Generally Available today.

Expanded Visibility and Fine-Tuned Control for Cloud Email Security

With the release of Attune 1.0, Abnormal continues on its promise of delivering a powerful, automated AI engine designed to prevent modern email-based attacks. Alongside this automation, Abnormal is delivering greater visibility and control, so customers can understand the platform’s autonomous detections and fine-tune them when needed:

• Detection 360 Insights (GA): Provides visibility into the behavioral reasoning behind every AI determination, helping analysts understand exactly why a message was flagged.
• Custom AI Models (Early Access): Enables security teams to influence and control the AI by defining environment-specific patterns using simple natural language descriptions. This allows users to influence and augment the AI specific to their environment.

Enhanced Automation for Human Risk Management

Abnormal is also delivering updates for AI Phishing Coach, transforming how organizations manage the human element of security and best train their employees. Abnormal is replacing one-size-fits-all compliance training with an automated, AI-driven system that helps turn real-world threats into personalized coaching. As the underlying behavioral layer within Abnormal improves, our ability to train on those results also improves:

• Phishing Risk Scoring (GA): Provides a continuously updated phishing-readiness signal based on actual simulation interactions, reporting activity, and training outcomes.
• BEC and VEC Simulations (GA): New simulation types, with data from the Abnormal relationship graph, mirror manager, colleague, and vendor interactions.

Also Read: ​​The Infrastructure War Behind the AI Boom

[To share your insights with us, please write to psen@itechseries.com]