Abnormal Security cost: $42 to $96 per mailbox per year

Behavioural-AI email security emerged as a distinct product category through 2018-2022 as the limitations of gateway-style scanning became visible against sophisticated phishing attacks. The premise of behavioural-AI is that an attack pattern can be detected not by examining the email content for malicious-indicator patterns but by examining the email metadata (sender-recipient relationship history, communication frequency, language pattern, topic novelty) for behavioural-anomaly patterns that signal something is wrong even when the content passes content-based scanning.

The category leaders in 2026 are Abnormal Security (independent, founded 2018), Tessian (acquired by Proofpoint November 2024, now bundled with TAP), and IRONSCALES (independent, founded 2014). Sublime Security has emerged through 2023-2025 as a newer entrant with detection-as-code positioning. The functional positioning across vendors is similar; the differentiation is in modelling depth, deployment ease, and pricing.

The attack patterns behavioural-AI catches best are sophisticated BEC (where the lure is grammatically perfect and refers to real organisational context), AitM lures from compromised legitimate domains (where reputation-lookup passes because the domain is legitimate), and vendor-impersonation through compromised supplier mailboxes (where the sender is real but the message intent is fraudulent). For organisations facing material exposure to these patterns, behavioural-AI is one of few product categories that meaningfully reduces residual risk. The post-delivery operating model (analysing email after it has arrived in the mailbox) means the product can use full-mailbox context for detection rather than just the inbound-stream view that gateway-style products see.[Gartner Magic Quadrant Email Security 2024 + Forrester Wave Enterprise Email Security 2024]

Abnormal Security pricing in 2026 sits at an estimated $42 to $96 per mailbox per year. The wide band reflects substantial variation by tier and organisation size. Mid-market typically lands $50 to $75 per mailbox; enterprise volume-discounted typically $42 to $60. The pricing is materially higher than gateway-style alternatives (Microsoft Defender for Office 365 Plan 2 at near-zero incremental cost for M365 E5 customers, Proofpoint TAP at $36 to $108 per user year) but the value proposition is different.

The premium justification rests on attack-pattern coverage. Gateway-style products are highly effective against bulk and lower-sophistication phishing at low per-mailbox cost. The limit of gateway-style effectiveness is the residual sophisticated-attack category that bypasses reputation-lookup and rule-based scanning because the lure is grammatically perfect, uses a legitimate (or compromised-legitimate) sender domain, and references real organisational context. This residual category produces the highest per-event cost (because sophisticated attacks are typically targeted at high-value identities and high-value transactions) and is exactly what Abnormal's behavioural-AI is designed to catch.

The ROI calculation reflects this. For a mid-market organisation paying $96,000 per year for TAP plus $120,000 per year for Abnormal (2,000 mailboxes at $48 and $60 respectively), total email-security spend is $216,000 per year. Against the modelled $4.20M average mid-market breach cost (see /by-scale/mid-market), the combined program pays back on a single avoided sophisticated-attack event. The dual-product architecture is now the standard for mid-market and enterprise organisations facing meaningful sophisticated-attack exposure.[Abnormal Security pricing triangulation from USASpending + reseller catalogues + buyer-community reports 2024-2025]

Examples assume the typical dual-product architecture (Abnormal alongside a gateway-style product). Abnormal-only deployments are possible and produce lower total spend but are best suited to organisations primarily exposed to sophisticated rather than bulk attacks.[Triangulated from Abnormal public contract records + reseller catalogue data]

In November 2024, Proofpoint announced its acquisition of Tessian, the second-largest independent behavioural-AI email-security vendor at the time. The acquisition consolidated the behavioural-AI category in a way that has reshaped buyer decision-making through 2025-2026. Pre-acquisition, Tessian competed with Abnormal as the independent-vendor alternative; post-acquisition, Tessian operates as the bundled-with-TAP behavioural-AI layer in Proofpoint's stack, with Abnormal as the leading independent option.

The acquisition's effect on Abnormal pricing has been measurable. With one fewer independent competitor in the category, Abnormal's pricing power has firmed; the bottom-of-band pricing has compressed slightly. The acquisition also created a strategic-decision point for buyers who were previously running Tessian alongside a non-Proofpoint gateway product. The post-acquisition Tessian product is integrated more tightly into the Proofpoint stack, which makes it more attractive for existing Proofpoint customers and less attractive for non-Proofpoint customers who wanted Tessian-independent.

The current independent-vendor competitive landscape includes Abnormal (clear category leader by customer count), IRONSCALES (lower-priced alternative with similar functional positioning), Sublime Security (newer entrant with detection-as-code differentiation), and a handful of smaller players. For most buyers in 2026, the practical decision is between Abnormal and IRONSCALES on price-versus-feature, with Tessian-via-Proofpoint as the bundled alternative for existing Proofpoint customers.[Proofpoint-Tessian acquisition announcement November 2024 + post-acquisition product-integration analysis 2025]

• Proofpoint TAP cost
• KnowBe4 cost
• Proofpoint PSAT cost
• BEC cost (Abnormal core use case)
• AitM cost (compromised-legitimate-domain pattern)
• Spear phishing cost
• Phishing cost in manufacturing (vendor-BEC use case)
• Phishing cost in legal services
• databreachcost.com
• mdrcost.com