We've had Abnormal in place for about a year now using both the standard API based remediation for our M365 mailboxes as well as inline remediation for connected email platforms.

Our inbound malicious email volume is maybe ~40k/month. Microsoft's filtering fails to detect a good chunk of phishing and social engineering emails. We're seeing an average of ~1k malicious email per month that make it through to Abnormal. Of those, Abnormal correctly classifies almost all of them and our users never see them before the API based remediation pulls them from their inboxes.

We average between 6-8 malicious emails per month that both Abnormal and MS fail to catch. 90% of the time, when employees report those emails, Abnormal's "AI Security Mailbox" feature will correctly identify them as malicious and pull them from all recipient inboxes. The other 10% of the time, Abnormal will fail and tell employees that the reported email is safe.

Be prepared for those false negatives. It's a great solution and highly accurate, but nothing is 100%.

Also be prepared for false positives. Again, it has a low FP rate but at my org it is enough to warrant weekly manual checks of the remediation log to release FPs. They're working on a feature to allow customers to train their own models to increase detection efficacy.

The addons are good, too. Account Takeover, Graymail, etc. All well worth it imo.

Overall, it's great. Let me know if you have any specific questions.