Abnormal Security CTO On Expanding Beyond Email Protection, IPO Aspirations

As Abnormal announced hitting $100 million in ARR along with a pair of big hires, Co-founder and CTO Sanjay Jeyakumar tells CRN this is just the ‘first act’ for the AI-powered cybersecurity vendor.

Abnormal Growth Curve

With the continued focus by hackers on leveraging email in many attacks, the threats associated with the inbox remain front-and-center for most partners and customers. But even with the massive need for innovation in the space, few email security startups have managed to grow into top players in the category in recent years — with Abnormal Security being a notable exception. Founded in 2018 by veterans of companies including Twitter and Google — CEO Evan Reiser and CTO Sanjay Jeyakumar — the company has become a major force in email security thanks to its platform powered by behavioral AI technologies. On Tuesday, Abnormal Security disclosed just how big its business has become, with the announcement that the company recently surpassed $100 million in annual recurring revenue.

The company also announced a pair of big hires on Tuesday: Michael DeCesare as its new president and Maya Marcus as its chief people officer. DeCesare had stepped down as CEO of cybersecurity vendor Exabeam in June, and prior to that had served as CEO of Forescout, including overseeing its initial public offering in 2017. Marcus had most recently served as vice president of people at cybersecurity giant Palo Alto Networks, and earlier had worked for Pure Storage and Nvidia.

The moves would appear to set up Abnormal Security to stick around as an independent company well into the future — something that Jeyakumar told CRN is, indeed, the goal. “I think what we’re doing [currently] is kind of our first act,” he said, noting that an IPO will be a “milestone that is required in our journey” at some point.

The announcements follow Abnormal’s latest product expansion, during last week’s Black Hat 2023 conference, in which the company unveiled new generative AI-related capabilities. The company said its new CheckGPT tool focuses on detecting attacks that were created using large language models.

What follows is an edited portion of CRN’s interview with Jeyakumar.

When it comes to email security, what’s the biggest differentiator for Abnormal Security?

We use the three pillars of identity behavior and content analysis to really deeply understand the environment, deeply understand users, understand what norms are within the environment — to go about detecting abnormal [activity]. And that’s the core pillar on which we’re building not just email security, but the rest of our product roadmap. It’s using AI to understand the customer environment, and the norms of communication, to be able to go and snipe out, what are all the signals that are abnormal within the platform and that ecosystem?

Where have you already gone beyond email security on your product roadmap?

We expanded out to Microsoft posture management. Because of the API architecture, we have very deep telemetry and understanding of the Microsoft ecosystem. And so we’re looking at all of the Microsoft audit logs, ingesting all of that into what we call our knowledge bases. First off, [that gives] the security team visibility and secondly, [it enables] configuration management for things like Microsoft.

Then we further increased the aperture to messaging solutions. So customers were asking, “For Teams, Slack, Zoom, I need one consistent solution.” And that’s how our product roadmap has evolved thus far.

What other areas are you considering expanding into?

[We plan to] open up to other cloud platforms. Messaging applications are just one type of a cloud platform. So you’ll see us extend it out to SaaS applications, for example, like Salesforce and Workday. There’s a lot of sensitive content in Salesforce and Workday, and our customers are saying, “Just as with Microsoft, I need to have the visibility of who’s logging in to each of these ecosystems for you to be able to learn what normal looks like — in terms of those access patterns for Salesforce and Workday, and alert me when those norms are breached.”

I think there’s a lot of solutions and companies out there that are trying to attack the [SaaS security] problem as their first product — as opposed to our motion, where we’re building off of email security — and [with] email security being a key problem for almost every company out there.

It sounds like it’s your plan to continue to stay independent, as Abnormal Security, well into the future?

Definitely. And that’s where it’s really exciting for Evan and myself to have a five year out, 10 year out, vision statement — in terms of what we could do to help our customers [in] cybersecurity. I think what we’re doing [currently] is kind of our first act. This is just the beginning. The ARR just provides that foundation, in terms of a financial foundation, that enables us to continue on this vision and journey. Evan and myself, we’ve been through acquisitions in the past — and we that’s where visions get curtailed. So we have our sights set on those five to 10 year out milestones.

Will you be looking to go public at some point?

I think going public will be a milestone that is required in our journey, to ensure that we’re able to achieve our five and 10 year out vision.