Abnormal Security vs Doppel

Discovers shadow AI tool/agent/chat usage via email, OAuth, identity and browser signals and enforces policy automatically.

Answers security teams' questions about threats, attack patterns and risk across email and SaaS on demand, without writing queries.

Phishing simulation and training that generates its exercises from the real attacks aimed at that organisation rather than from static templates.

Automates phishing triage: answers every employee report in seconds and remediates campaign-wide threats without an analyst in the loop.

Combines a custom outbound DLP policy engine with an AI triage agent that evaluates matches in context, releasing benign messages and quarantining likely violations.

Behavioral AI that automatically moves low-priority promotional email (graymail) out of the inbox without manual rules.

Behavioral AI that catches hijacked sessions, abused OAuth grants and privilege misuse across email, IdP and SaaS.

Behavioral-AI email threat detection that builds per-employee/vendor baselines to catch BEC, phishing and payload-free social engineering before delivery.

Analyzes identity signals pre-provisioning (HR systems, IdP, email) to detect synthetic personas and coordinated nation-state infiltration campaigns.

Inspects Microsoft Teams and Slack for malicious URLs and weaponized attachments, auto-remediating high-risk messages.

Uses behavioral AI to detect outbound email sent to unintended recipients and quarantines it before delivery.

Checks a Microsoft 365 environment against CIS Benchmarks, detects configuration drift in real time and provides prioritized remediation.

Behavioural AI platform, powered by Abnormal's own Attune model, that baselines normal behaviour for every employee and vendor to detect phishing, business email compromise and account takeover that signature-based filters miss.

Abnormal's behavioural AI foundation model: builds a baseline for every identity from billions of signals so the products above it can flag anomalies in real time.

A reporting inbox for brand abuse, collecting impersonation reports into one triaged queue.

Finds and takes down impersonations of a company's brand used in social-engineering attacks.

Email defence aimed at social-engineering campaigns rather than at malware signatures.

Detects and disrupts attack campaigns that target a company's named executives.

Triages reported phishing at volume, sorting real campaigns from noise without an analyst per report.

Trains staff against social-engineering attacks, drawing its material from what Doppel observes in the wild.

Runs simulated social-engineering attacks against an organisation to expose where it is exposed.

Graph-driven defense capability that connects every spoofed domain, fake profile, impersonated ad and malicious text into a single interactive graph, exposing the full architecture of an impersonation campaign.

Detects impersonation of a brand across domains, social accounts and app stores and files takedowns.