Architecture comparison

Abnormal Security vs Okta

Abnormal Security runs closer to the foundational model (Native (own / self-hosted weights)) than Okta (Middleware / wrapper). No shared foundational model — different bets.

Abnormal Security

Cybersecurity

Proximity

Native (own / self-hosted weights)

Models

proprietary / self-built models

Cloud · datastore

AWSPostgreSQLAmazon S3 (data lake/object storage)Elasticsearch/OpenSearch (log/search, inferred)

Compliance

SOC 2 (inferred from enterprise email security norm)ISO 27001 (inferred)GDPR-aligned data processing (inferred)

Architecture

Abnormal runs a cloud-native, API-first behavioral AI platform that integrates with cloud email and collaboration suites (e.g., Microsoft 365, Google Workspace) outside the mail flow, ingesting user, email, and identity telemetry into proprietary behavioral models and a data lake to drive detection, response, and human-risk scoring.[1][5][7][8][9] Its core is a proprietary behavioral foundation model and related ML pipelines hosted in its own cloud environment, exposed through its SaaS console and APIs rather than via public/open-source model distribution.[7][9]

Okta

Cybersecurity

Proximity

Middleware / wrapper

Models

middleware / wrappers

Cloud · datastore

AWSMySQLDynamoDBRedis

Compliance

SOC 2FedRAMP (High)ISO 27001

Architecture

AWS-native identity cloud (workforce + Auth0 customer identity) on MySQL/DynamoDB with a multi-tenant cell architecture. AI is in-house threat-detection ML plus assistant LLMs.

← Full orbit map · Score your own stack →