Abnormal AI was born from an unexpected insight. Founded in 2018, the company applied lessons from large-scale Adtech, where machine learning models analyse vast datasets and make split-second behavioural decisions to a new mission: stopping cybercrime.
Before starting Abnormal, its founders spent years building AI systems in advertising technology. The experience revealed a blind spot in cybersecurity. The founders discovered what many insiders had missed: the AI that models behaviour can also stop the attacks that exploit it.
Attacks such as phishing, business email compromise, and account takeover often exploit normal human patterns rather than obvious technical vulnerabilities.
Abnormal AI is today well positioned to help organisations manage the next generation of AI-driven and automated cyberattack in priority markets such as Asia Pacific and Japan (APJ).
To find out more about Abnormal AI, iTNews Asia speaks with Tony Burnside, Abnormal AI’s Vice-President of Asia Pacific and Japan.
iTNews Asia: You’ve joined Abnormal AI as VP of APJ Sales at a time when organisations across the region are digitising quickly. With increasing digitisation, we’re also seeing cyberattacks now becoming smarter, faster, and more dangerous.
What drew you to the role, and how would you introduce Abnormal AI to readers who don’t know the company?
Burnside: There is no doubt that APJ is at an inflection point. Digitisation here is moving faster than almost anywhere, and every new cloud application, supplier and remote team widens the attack surface.
At the same time, attackers are using AI to work faster and sound more credible than ever before. I’ve spent my career selling cybersecurity and the last 12 years in this region, and what drew me to Abnormal is that it approaches the problem differently.
Abnormal is an AI-native behavioural security company that stops cyberattacks legacy security can’t see. It started with email, learning what normal looks like for every employee so it can spot the subtle anomalies behind business email compromise (BEC), phishing, and account takeover.
Abnormal now applies that same understanding of people and behaviour beyond the inbox to identity, collaboration tools, and AI.
For readers new to the company, think of it as security that understands how your people actually work, rather than only matching known threats.
The email security challenge
iTNews Asia: Email is now the primary entry point for attackers. Why is email their most accessible and most used attack surface, and what are security leaders in APJ telling you about it?
Email is the one channel every organisation has to leave open to the outside world. Anyone can reach any employee and a single convincing message can lead to stolen credentials, a fraudulent payment, or a foothold inside the network.
Attackers target people because they are usually easier to exploit than a hardened system, especially now that most attacks capitalise on abusing trust, not just technology.
Email is also where business gets done, from invoices and approvals to supplier negotiations. That gives attackers plenty of cover. A fraudulent request can look just like the dozens of legitimate ones that arrive each day.
What I hear from security leaders across APJ is that their teams are stretched and that attacks no longer look like the old phishing examples in awareness training. Many tell me their existing controls catch the obvious threats, but targeted, socially engineered ones get through. Many of these attacks contain no link or attachment at all, so leaders are looking for ways to detect intent and context.
iTNews Asia: Attackers, often using AI, can now write fluent, culturally convincing messages in many languages. In a region as linguistically diverse as APJ, how does that change or accelerate the risk?
AI removes one of the oldest giveaways. For years, poor grammar, awkward phrasing and a clumsy translation gave many phishing emails away, especially in languages where attackers lacked fluency. Generative AI erases those tells. An attacker can now produce a polished message in Japanese, Bahasa, Mandarin, Hindi, or Korean in seconds, with the right tone and business etiquette.
In APJ, that matters more than elsewhere. Organisations operate across many languages and cultures, and employees often work across several of them. Attackers can tailor each message to a local market at scale and at very low cost, and refine campaigns far faster than before, which makes them both broader and more personal.
The practical implication is that language quality can no longer be a signal of risk.
Defences have to look past how a message reads and ask whether the request, sender relationship, and behaviour make sense, in any language.
Good AI versus bad AI
iTNews Asia: AI is now transforming cybersecurity into an AI contest on both sides, where attackers and defenders of this fight are both trying to gain the upper hand.
How do you describe the difference between attackers using AI to deceive and defenders using AI to detect it?
Attackers use AI to imitate. They study how people write, how businesses operate, and what makes a request believable, then generate messages that blend into normal activity. Their goal is to look legitimate, and they need to succeed only once.
Defenders use AI to understand. Rather than asking whether something resembles a known threat, our models ask whether it fits what is normal for a specific person, supplier, and relationship. That is a different question, and it is harder to fool because the attacker can copy the style of a message, but struggles to replicate the full pattern of genuine behaviour behind it.
The contest is not just about who has better AI. It is about what the AI is aimed at. Attackers aim it at persuasion. Defenders should aim it at context: identity, relationships, communication patterns, and intent. The advantage goes to whoever has the richest understanding of normal. That is what Abnormal is built around.
iTNews Asia: Many attacks now look like routine business requests, which is where existing security boundaries, rules and known-bad signatures struggle. What does behavioural AI see that traditional approaches miss?
Traditional security tools rely on rules, reputation, and known-bad signatures. They work well on threats that have been seen before, such as a malicious link or a flagged domain, but many of today’s most damaging attacks contain none of the above. A request to change bank details, or an urgent message that appears to come from an executive has no malicious payload at all.
Behavioural AI builds a baseline of normal activity, such as who communicates with whom, how often, in what tone, and from which locations and devices. Against that baseline, behavioural AI goes beyond rules to see signals to detect things like a supplier writing from a new account, a payment request that departs from past patterns, or an unusual sign-in.
No single signal is conclusive. It’s the combination of tens of thousands of signals assessed in context that reveals the threat. It lets us catch attacks that look routine but are subtly wrong underneath and stop them before someone acts.
Where security goes next
iTNews Asia: As enterprises roll out AI agents, copilots, and other tools, where do you see risk moving once email is under control, and what does AI security mean in practice for a CISO? How critical is the CISO’s role, and how is it being reshaped?
Attackers follow the path of least resistance. As email gets better protected, risk moves to where identities, data, and trust sit. This can be cloud applications, collaboration platforms, compromised credentials, and even the AI tools themselves. Agents and copilots can reach sensitive data and act on someone’s behalf, so they become both a new asset to protect and a new route to exploit.
For a CISO, AI security in practice means answering three questions:
What AI is being used across the business, including unsanctioned tools?
What data can AI access?
And how do we detect when AI behaves abnormally?
The CISO role is moving from guarding the perimeter to enabling the business to adopt AI safely. That makes it more strategic and more visible at board level. The CISOs who do it well will be those who can say yes to innovation because they have visibility and control underneath it.
iTNews Asia: Why is Abnormal so well placed to help with the next generation of AI-driven and automated cyberattacks, and what other measures can organisations look at that carries over from securing email attacks?
Abnormal is a behavioural AI platform that is built to learn what normal looks like for every person and system. We have been solving the hardest version of this problem for many years, spotting attacks that have no obvious signature and succeed by looking normal. To achieve this depends on understanding behaviour, identity, and context at scale, and that same foundation applies as attackers and risk move beyond the inbox. It is why we are extending the platform to identity threats, the wider cloud and collaboration environment, and the governance of AI.
For organisations, several lessons carry over from email:
Establish a baseline of normal behaviour rather than relying only on known threats.
Treat identity as the new perimeter, with strong authentication and continuous monitoring of accounts.
Get full visibility of what tools and AI are in use.
Automate detection and response so your team’s time goes to judgement calls, not triage.
And keep training people, but as a complement to technology rather than a substitute.
APJ focus and close
iTNews Asia: How important is APJ to Abnormal, and which industries or markets are showing the strongest demand?
APJ is a strategic priority for Abnormal. The region combines rapid digital adoption, a diverse set of markets, and a threat environment that is growing more sophisticated every day, so there is both a strong need and real opportunity. Our investment in local teams, distributors, resellers, engineering, and customer support reflects that. Security leaders here want to work with people who understand their regulatory environment, languages, and business practices.
Demand is strong in sectors where trust and sensitive data are central. Financial services is an obvious one, as well as government and public sector, healthcare, education, and large enterprises in areas like manufacturing, retail, and technology.
Many of these organisations are consolidating tools and want to replace manual, rule-heavy approaches with AI-driven ones. We are seeing that momentum build across ANZ, Japan, Southeast Asia, and India, each with its own regulatory and language needs.
iTNews Asia: If a security leader in the region could do one thing this quarter to get ahead of AI-driven threats, what should it be?
Test your assumptions. Take a good look at which AI-enabled attacks your current controls would actually stop, particularly the ones with no malicious link or attachment, like a convincing payment change request or an impersonation of your CEO.
Many organisations discover that the threats most likely to hurt them are the ones their tools were not designed to see.
You can do that by running a proof of value on your live environment, or by reviewing recent incidents and near-misses to see what got through and why. Either way, you’ll leave with evidence rather than assumptions, a clear view of your gaps, and a stronger case for the board.
If you can only do one thing this quarter, make sure you understand where your real exposure is today and then prioritise from there.
Click Here For The Original Source.
——————————————————–
