Abnormal AI’s expanded security suite asks the question: What’s the true cost of fragmented security?

Imagine an airport where every runway has its own control tower. Each tower runs its own radar, keeps its own logbook, and follows its own rules. Every air traffic controller sees a slice of the sky, but nobody sees the whole picture.

Believe it or not, that is how many organisations, including Fortune 500 companies,  secure AI today. One tool discovers apps, another watches cloud posture, a third polices employee prompts, and a fourth tracks agents.

Abnormal AI is making the case for a single control tower.

The company has expanded its AI security suite around the same behavioural platform that underpins its email and identity protection. AI Governance, which discovers sanctioned and unsanctioned AI use and supports policy, spend visibility, and audit evidence, is generally available now. 

AI Cloud Security, AI Employee Guardrails, AI Agent Security, and AI Security Workbench are in private preview, with general availability planned for Q4 2026.

The hidden cost of fragmentation

The strongest argument for one suite is shared context. Behavioural AI works by learning what normal looks like, an approach Abnormal’s CISO Mike Britton described in our 2024 interview as baselining typical user behaviour across email and SaaS apps. Extending that same baseline to employees’ AI sessions and to agents means one consistent judgement of what is normal, rather than four.

Separate point products tend to bring overlapping licences, duplicate alerts, and policies that drift apart. 

Each one is a cost. Together they add up.

Scale makes the point sharper. Gartner predicts the average global Fortune 500 enterprise will have more than 150,000 agents in use by 2028, up from fewer than 15 in 2025. It also found only 13% of organisations think they have the right AI agent governance in place.

A buyer’s checklist for agent governance

For CISOs weighing a suite, four capabilities deserve testing.

• Discovery: can it find every sanctioned and unsanctioned AI tool and agent?
• Ownership: does each agent map to an identity and an accountable owner?
• Permissions: can teams see which tools and data each agent can reach?
• Enforcement: is there clear evidence of risky actions being blocked?

Abnormal’s rollout lends itself to a phased approach. Teams can start with AI Governance today, build an inventory, and add the preview modules as they reach general availability. As our look at the hidden foundation of AI governance argued, knowing what you have comes before controlling it.