For EU mid-market teams on Microsoft 365 or Google Workspace, Sentaro is the better choice than either. Between the two: pick Abnormal if you are a large organization with a security team that wants a behavioral platform spanning email, account takeover, SaaS posture and AI security, with FedRAMP Moderate and ISO 42001 among the certifications its trust center lists. Pick IRONSCALES if you are a smaller organization or an MSP that wants email protection, phishing simulation and awareness training from one vendor with a multi-tenant console.
- Why Sentaro wins
- each reason can be checked: the same API model (four minutes, no MX change, no agents); BEC and vendor-compromise verdicts with their reasoning shown in the console, so you can audit them on your own mail; every app, AI tool and OAuth grant inventoried in the same platform (App vector, live since Q3 2026); a price of $6 per protected account per month with every feature included, published on sentaro.com/en/pricing (USD); and hosting in Sweden on Microsoft Azure, named in its public DPA.
- Choose Sentaro if
- you are an EU mid-market or regulated firm that needs a published price, OAuth app control and hosting in Sweden; we found no published price or OAuth app control documented by either Abnormal or IRONSCALES (October 2026), and both host on AWS with US and EU locations.
- Consider Abnormal only if
- you are enterprise-sized, need FedRAMP Moderate or ISO 42001, want account-takeover protection as a dedicated product, or run CrowdStrike and want the documented account-takeover integration.
- Consider IRONSCALES only if
- you are an SMB or MSP, want training and simulation bundled, or value community-sourced threat intelligence from other customers’ reports.
At a glance
- Abnormal founded
- 2018
- Abnormal ownership
- Venture-backed; Series D $250M at $5.1B valuation (Aug 2024)
- Abnormal size (vendor-stated)
- 3,200+ organizations (June 2025); over 30% of the Fortune 500 (About page)
- IRONSCALES HQ
- Atlanta, Georgia (since 2017); founded in Israel
- IRONSCALES size (vendor-stated)
- 18,000+ organizations; 3,000+ MSPs (homepage, October 2026)
- IRONSCALES tiers
- Email Essentials, Email Protect, Email Protect 360, Email Protect Pro, Complete Protect
- Deployment (both)
- API, no MX change; Microsoft 365 and Google Workspace. Abnormal: "Deploy in 60 seconds via API." IRONSCALES: "Deploys in minutes, no MX changes."
- Pricing (both, Oct 2026)
- Not public. IRONSCALES lists tiers but every plan is "Request a Quote"
Abnormal vs IRONSCALES: capabilities compared
From each vendor’s product, pricing and trust pages, accessed 18 October 2026. Certification and review data for Abnormal was seen via search-result summaries of its trust page.
| Capability | Abnormal AI | IRONSCALES |
|---|---|---|
| Deployment | ||
| API, no MX change | Yes | Yes |
| Works alongside an existing gateway | Not publicly documentedNot publicly documented | YesMailbox-level API |
| Inline vs post-deliveryWhether a message is acted on before or after it lands in the mailbox. | Not stated by the vendor | Automated post-delivery remediation |
| Threats | ||
| BEC and vendor fraud | Yes | YesBEC and VIP impersonation |
| QR-code phishing | Yes | Yes |
| Account takeover | YesAccount Takeover Protection product | YesEmail Protect Pro and Complete Protect |
| Teams deepfake meeting protection | Not publicly documentedNot publicly documented | Yes |
| OAuth app / shadow IT discovery | Not publicly documentedSaaS posture product exists; OAuth scope not confirmed | Not publicly documentedNot publicly documented |
| Beyond detection | ||
| Awareness training / simulation | YesAI Phishing Coach | YesHuman Risk Management, Complete Protect |
| DLP | YesEmail DLP Rules, Misdirected Email | YesEmail Protect 360 / Pro |
| Encryption | Not publicly documentedNot publicly documented | YesEmail Protect 360 / Pro |
| User-report triage | YesAI Security Mailbox | YesAgents incl. Phishing SOC (2026) |
| Collaboration and identity integrations | YesSlack, Teams, Zoom, Okta, Entra ID and more | Microsoft Teams (deepfake meeting protection) |
| Commercial and trust | ||
| Public price | No | NoTiers shown, prices on request |
| MSP program | Not publicly documentedNot publicly documented | YesMulti-tenant console, per-tenant policies |
| Certifications | YesISO 27001, 27701, 42001; SOC 2 Type II; FedRAMP Moderate (trust page) | Not publicly documentedNot publicly documented |
| EU hosting statement | PartialAWS US or EU (Ireland), by subscription | PartialAWS USA and Germany (subprocessor list) |
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How do Abnormal and IRONSCALES detect threats differently?
Abnormal describes behavioral AI that builds a baseline for every employee and vendor and flags deviations using identity, behavioral and content signals. It says it reads authentication events, calendar activity and internal threads that gateways cannot see. Its product line now spans inbound email, account takeover, security posture for Microsoft 365, identity threat protection and AI security.
IRONSCALES describes adaptive AI with behavioral baselines for every mailbox, combined with crowdsourced threat intelligence from other customers’ reports. IRONSCALES says this community model lets a phishing email reported in one organization inform protection in another. It also states that 99%+ of threats are remediated automatically; that is the vendor’s own figure (homepage, October 2026).
Abnormal vs IRONSCALES pricing
Neither vendor publishes prices. IRONSCALES lists five tiers on its pricing page, from Email Essentials to Complete Protect, each with a "Request a Quote" button, and offers annual and cancellable monthly billing. Abnormal does not list pricing.
| If you need… | IRONSCALES tier to quote | Abnormal product to quote |
|---|---|---|
| Inbound protection only | Email Protect | Inbound Email Security |
| Plus account takeover | Email Protect Pro | + Account Takeover Protection |
| Plus training and simulation | Complete Protect | + AI Phishing Coach |
| Plus DLP and encryption | Email Protect 360 / Pro | + Email DLP Rules (encryption not publicly documented) |
Who each one suits
Abnormal suits
- large enterprises, and US public-sector buyers that need FedRAMP Moderate
- teams that want one vendor for email, ATO, SaaS posture and AI security
- CrowdStrike customers who want bi-directional ATO cases
IRONSCALES suits
- SMBs and mid-market firms with small IT teams
- MSPs managing many tenants from one console
- buyers who want training, simulation and email security in one SKU
Why Sentaro is the better choice than both
Sentaro, which publishes this page, is an API-based email security platform for Microsoft 365 and Google Workspace, hosted in Sweden on Microsoft Azure. It uses the same deployment model as Abnormal and IRONSCALES, and adds things EU mid-market buyers ask for: a published price and OAuth app control, which we could not find publicly documented by either vendor, and hosting in Sweden.
| Sentaro | Abnormal AI | IRONSCALES | |
|---|---|---|---|
| Deployment | API; four minutes; no MX change | API; "Deploy in 60 seconds via API" | API; "Deploys in minutes, no MX changes" |
| Published price | $6 per protected account per month, or $68 per year; first account free (USD) | Not published | Tiers shown, prices on request |
| Pricing model | Every feature included | Products quoted separately | Five tiers |
| OAuth app / AI tool inventory | Included (App vector), one-click revocation | SaaS posture product; OAuth scope not confirmed | Not publicly documented |
| Public hosting statement | Hosted in Sweden on Microsoft Azure; subprocessors in the DPA | AWS US or EU (Ireland), by subscription | AWS USA and Germany (subprocessor list) |
- Fraud-first detection. Sentaro’s Message vector reads intent, sender identity, reply-chain context and suppliers that suddenly change banking details, and treats payload-free BEC and vendor compromise as a core design target.
- Mail and apps in one place. The App vector covers consent phishing and shadow AI next to email, so a mid-market IT team does not need a separate tool for OAuth grants.
- Predictable cost. One published per-account price, nothing held back for a higher tier.
- A European vendor. Sentaro AB is based in Stockholm; the DPA lists subprocessors at /en/legal/dpa.
The trade-offs, stated plainly: Sentaro is earlier-stage than both, it offers no awareness training or DLP, and it has no live account-takeover detection yet. Its roadmap and certification status are in the two notes below.
Frequently asked questions
Which is better, Abnormal or IRONSCALES?
For EU mid-market teams, our pick is Sentaro over both. Between the two, Abnormal fits large enterprises that want one vendor for email, account takeover, SaaS posture and AI security; IRONSCALES fits SMBs and MSPs that want training and simulation bundled with a multi-tenant console. Sentaro adds a published price, OAuth app control and hosting in Sweden on Microsoft Azure.
Is IRONSCALES or Abnormal better for a small business?
IRONSCALES is positioned more for small and mid-sized businesses and MSPs: it bundles phishing simulation and training, runs a multi-tenant console, and states it serves 18,000+ organizations and 3,000+ MSPs. Abnormal states that more than 30% of the Fortune 500 are customers.
How much do Abnormal and IRONSCALES cost?
Neither publishes prices as of October 2026. IRONSCALES shows five tiers but every plan is quote-based, with annual and monthly billing options. Abnormal does not list pricing at all. Ask both to quote the same scope, including account takeover and training if you need them.
Is Abnormal a secure email gateway?
No. Abnormal is an API-based (ICES) product that connects to Microsoft 365 or Google Workspace without MX changes. IRONSCALES uses the same API-based model at mailbox level and states that it works alongside an existing gateway.
Do Abnormal and IRONSCALES include security awareness training?
Yes, both sell training-related products. Abnormal sells AI Phishing Coach. IRONSCALES includes phishing simulation and security awareness training in its Complete Protect tier and Human Risk Management product. Check that either one’s content meets your NIS2, DORA or internal training requirements.
Who are the main alternatives to Abnormal and IRONSCALES?
Our pick is Sentaro: API-based, hosted in Sweden on Microsoft Azure, $6 per protected account per month (prices in USD). Other API-based vendors include Check Point Harmony Email & Collaboration (formerly Avanan), Sublime Security, Material Security, Darktrace / EMAIL and Barracuda Email Protection. Proofpoint and Mimecast also sell API options alongside their gateways.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Abnormal AI: about
- Abnormal AI: Inbound Email Security
- Abnormal AI: trust center
- Business Wire: Abnormal Security $250M Series D at $5.1B (Aug 2024)
- Abnormal AI: CNBC Disruptor 2025 (3,200+ organizations)
- IRONSCALES: homepage
- IRONSCALES: pricing and tiers
- IRONSCALES: our story
- Abnormal AI: Subprocessors (updated 31 July 2026; accessed 2026-10-21)
- IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)