Abnormal AI

Abnormal AI (formerly Abnormal Security) is an email security platform, and it's included here because payroll diversion fraud, someone impersonating an employee or an executive by email and asking HR or payroll to change direct deposit details, is genuinely one of the most common ways small and mid-size businesses actually lose money to 'payroll fraud' in practice. It's not exotic, it's a convincing email and a rushed approval.

Abnormal doesn't rely on the traditional approach of scanning for malicious links or attachments, because these attacks usually don't have any, they're just well-written social engineering. Instead it models normal communication behavior for your organization and flags anomalies: a request coming from a personal email address, a lookalike domain, unusual urgency or tone, a banking-detail change request that doesn't match how that person normally communicates.

This is a security tool, not an HR or finance tool, so it needs to be evaluated and bought by whoever owns your email security stack, and it doesn't touch payroll data directly. It stops the fraudulent request from landing convincingly in the first place, which is a different (and arguably more important) layer than anything that audits payroll after the fact.

Where Abnormal sits now is the premium end of this category. There's no free tier, pricing is per-mailbox and quoted, and onboarding is a paid, hands-on engagement (professional services commonly run five figures). What that buys is a genuinely hands-off, high-accuracy behavioral engine. If you want the same class of detection but need to start free and are willing to tune it yourself, Sublime is the SMB-accessible alternative, and it's our pick in this category for exactly that reason.