Sentaro is the better choice than Abnormal Security for EU teams on Microsoft 365 and Google Workspace. Both read mail over API and remediate without touching routing, so architecture is not the deciding factor. Sentaro wins on four things you can check: its $6 seat with every feature included is published on sentaro.com/en/pricing, while Abnormal does not publish pricing (abnormal.ai, October 2026); it is hosted in Sweden on Microsoft Azure with every subprocessor listed in its public DPA, while Abnormal’s subprocessor list places hosting on AWS in the US or the EU (Ireland), depending on the subscription; its App vector, live since Q3 2026, puts OAuth and shadow-AI discovery in the same seat; and every BEC and vendor-fraud verdict shows its reasoning in the console, so you can audit it in a trial.
- Choose Sentaro if…
- you are a regulated EU SME or mid-market firm with lean IT, want a vendor hosted in Sweden on Microsoft Azure, want to know the price before a sales call, and want email and OAuth/shadow-AI discovery in one $6 seat.
- Why Sentaro wins
- four-minute API setup with no MX change (your MX record does not move), self-serve with the first account free so you can test it on your own mail before a sales call, consent-phishing blocking and one-click grant revocation in every plan, and monthly plans you can cancel anytime.
- Consider Abnormal only if…
- you are a large enterprise that needs account-takeover response, Okta, Zoom or Workday integrations, or FedRAMP and an existing SOC 2 Type II report today; Abnormal’s trust center lists both.
At a glance
- Category
- Both: integrated cloud email security (ICES), API-based, no MX change.
- Setup claim
- Abnormal: “Deploy in 60 seconds via API. No MX changes.” Sentaro: connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
- Platforms
- Abnormal: Microsoft 365, Google Workspace, plus Slack, Teams, Zoom, Okta, Entra ID, Workday and ServiceNow per its product pages. Sentaro: Microsoft 365, Google Workspace, with Slack and Teams listed as channels.
- Pricing
- As of October 2026. Abnormal: not publicly listed. Sentaro: $6 per protected account per month, or $68 per account per year; the first account is free, and the Free plan is coming soon. Prices in USD.
- Hosting
- Abnormal: AWS in the US or the EU (Ireland), set by subscription, per its subprocessor list (updated 31 July 2026). Sentaro: hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA at /en/legal/dpa.
- Company
- Abnormal: founded 2018, US, venture-backed (Series D, August 2024, $250M at a $5.1B valuation). Sentaro: Sentaro AB, founded in 2025 in Stockholm.
- Best for
- Abnormal: enterprise and mid-market. Sentaro: regulated EU SMEs and mid-market firms with lean IT.
Abnormal vs Sentaro, feature by feature
We make Sentaro. Public information as of 18 October 2026. Abnormal rows use Abnormal’s own product pages. “Not publicly documented” means we could not confirm it, not that Abnormal lacks it.
| Capability | Abnormal AI | Sentaro |
|---|---|---|
| Deployment and commercial | ||
| API deployment, no MX change | Yes“60 seconds” | YesFour minutes |
| Microsoft 365 and Google Workspace | Yes | Yes |
| Published price (Oct 2026)A list price anyone can see without a sales call. | NoNot publicly listed | Yes$6 per account per month |
| Self-serve signup | Not publicly documentedNot publicly documented | YesFirst account free |
| EU hosting statement | PartialUS or EU (Ireland), by subscription (subprocessor list) | YesHosted in Sweden on Microsoft Azure |
| MSP and reseller program | Not publicly documentedNot publicly documented | YesMulti-tenant, white-label ready |
| Email threats | ||
| Behavioral BEC detection | YesBaseline per employee and vendor | YesIntent, relationship and thread context |
| Vendor fraud | Yes | YesVendor-compromise and thread-hijack detection |
| QR-code phishing | Yes | YesDecoded and destination scored |
| Lookalike domains in mail | Not publicly documentedNot publicly documented | YesAt first contact |
| Verdict reasoning shown to admins | Not publicly documentedNot publicly documented | YesEvery verdict in the console |
| Beyond inbound email | ||
| OAuth app and shadow-AI discoveryWhich apps and AI tools users have connected, and what they can access. | Not publicly documentedAI Security products listed; OAuth scope not confirmed | YesApp vector, every plan |
| Consent phishingA lure that tricks a user into granting an app OAuth access. | Not publicly documentedNot publicly documented | YesBlocked in mail flow, grants surfaced |
| Awareness coaching | YesAI Phishing Coach | NoNot in Sentaro’s published scope |
| Email DLP and misdirected email | Yes | NoNot in Sentaro’s published scope |
| Certifications[4] | YesSOC 2 Type II, ISO 27001, FedRAMP Moderate and more, per its trust center | PartialIn progress; see Certification status |
Sentaro cells show live capabilities only (Message and App vectors); its roadmap is stated once, in the note below the table.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Where Sentaro wins over Abnormal Security
Both products judge mail against what is normal for a person, a supplier or a thread. Abnormal describes its engine as building “a behavioral baseline for every employee and vendor”. Vord, Sentaro’s proprietary engine, deconstructs each event into anywhere from tens to well over a hundred proprietary signals and returns one verdict with its reasoning attached. If you are choosing between them, the architecture is not the deciding factor. These four things are, and Sentaro wins on each.
1. You can see the price
Abnormal does not publish pricing on abnormal.ai (as of October 2026). Sentaro costs $6 per protected account per month, or $68 per account per year, with every feature included and the first account free. Prices in USD. A 100-account tenant on monthly billing pays 99 × $6 = $594 a month, without a sales cycle.
2. Where the vendor is hosted
Sentaro is hosted in Sweden on Microsoft Azure, under a DPA governed by Swedish law; the subprocessor list is at /en/legal/dpa. Abnormal’s subprocessor list (updated 31 July 2026) names AWS in the United States or the EU (Ireland), with the location set by the customer’s chosen subscription, and Azure OpenAI Service in the US or the EU. If data residency is a procurement requirement under NIS2, DORA or your own policy, confirm the EU option in Abnormal’s contract and compare both DPAs.
3. Apps and AI tools in the same seat
Sentaro’s App vector inventories every app, AI tool and OAuth grant in Microsoft 365 and Google Workspace, scores scope-level risk per user, blocks consent phishing and revokes risky grants in one click, in every plan. Abnormal lists AI Security and Security Posture Management products; we could not confirm whether they cover OAuth grant discovery.
4. Built for firms without a SOC
Sentaro is built for regulated SMEs and mid-market firms where IT is a handful of people: verdicts are automatic, alerts fire only when a decision is needed, and similar messages across all mailboxes are remediated in one action.
Where Abnormal Security may still fit
- Breadth live today: Abnormal sells Account Takeover Protection, Identity Threat Protection, AI Phishing Coach and Email DLP. Sentaro offers neither account-takeover nor identity detection today (see the roadmap note), and it has no DLP or coaching product.
- Integrations: Abnormal lists Slack, Teams, Zoom, Okta, Entra ID, Workday and ServiceNow. Sentaro documents Microsoft 365, Google Workspace, Slack and Teams.
- Assurance: Abnormal’s trust center lists SOC 2 Type II, ISO 27001 and FedRAMP Moderate, among others. Sentaro’s status is in the certification note below.
- Track record: founded in 2018, Abnormal stated it served 3,200+ organizations in June 2025 and is reviewed on Gartner Peer Insights and G2.
Sentaro security and data handling
- Hosting
- Hosted in Sweden on Microsoft Azure. The DPA at /en/legal/dpa lists every subprocessor and its location.
- Engine
- Verdicts come from Vord, Sentaro’s proprietary engine.
- Access to mail
- Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service.
- Incident notice
- Within 24 hours of confirming a security incident, per the DPA.
- Regulation
- Built for the controls regulated EU firms are asked to evidence under NIS2 and DORA. No product makes you compliant on its own.
Evaluating Sentaro next to Abnormal
Both connect over API, so you can compare them on your own mail without changing routing.
- 01
Connect Sentaro
An admin connects Microsoft 365 or Google Workspace over API in about four minutes. Nothing in your existing setup changes.
- 02
Read history
Historical visibility follows within 15 minutes, with the app and OAuth-grant inventory, so you can review past mail before any new threats arrive.
- 03
Compare verdicts
Set Sentaro to tag inline at first and compare what each tool flags on the same messages, using the reasoning shown on each Sentaro verdict.
- 04
Decide and switch actions on
Move to block or quarantine per user group when you are satisfied. Monthly Sentaro plans can be cancelled anytime.
What customers say
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
Frequently asked questions
Is Sentaro better than Abnormal Security?
Yes, for EU SMEs and mid-market teams on Microsoft 365 or Google Workspace. Sentaro uses the same API architecture with no MX change, but publishes its price ($6 per protected account per month, every feature included; prices in USD), is hosted in Sweden on Microsoft Azure, and includes OAuth and shadow-AI discovery in every plan. Abnormal may still fit large enterprises that need account-takeover response or FedRAMP today.
Is Abnormal Security a secure email gateway?
No. Abnormal is an API-based, integrated cloud email security (ICES) platform: it connects to Microsoft 365 and Google Workspace without MX changes, in Abnormal’s words “Deploy in 60 seconds via API. No MX changes.” Sentaro uses the same architecture, connecting over API in four minutes and running behind native filtering.
How much does Abnormal Security cost?
Abnormal does not publish pricing as of October 2026; you get a quote through sales. Sentaro publishes its price: $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.
Is Abnormal Security the same as Abnormal AI?
Yes. Abnormal Security now uses the name Abnormal AI. It was founded in 2018, is venture-backed, and raised a $250 million Series D at a $5.1 billion valuation in August 2024, led by Wellington Management.
Does Sentaro detect account takeover like Abnormal?
Not yet at the same depth. Sentaro evaluates internal mail today, which is where lateral phishing from a compromised account shows up. Its Behavioral vector, with per-user baselines, session anomaly scoring and forced re-authentication, reaches general availability in Q4 2026. Abnormal sells Account Takeover Protection as a live product.
Where is Sentaro hosted compared with Abnormal?
Sentaro is hosted in Sweden on Microsoft Azure, and its DPA (sentaro.com/en/legal/dpa) lists every subprocessor and location. Abnormal’s subprocessor list (updated 31 July 2026) offers AWS hosting in the US or the EU (Ireland), set by the customer’s subscription, so confirm which applies to you if residency matters to your procurement.
Can I run Sentaro and Abnormal at the same time?
Yes, since neither changes MX records. Running both during an evaluation, or for the rest of an Abnormal contract term, lets you compare verdicts on the same mail. Sentaro’s monthly plans can be cancelled anytime, so you can time a switch to your renewal date. Long term, two overlapping layers can mean duplicate alerts to reconcile.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Abnormal AI: About (founded, Fortune 500 share)
- Abnormal AI: Inbound Email Security (deployment, detection, coverage)
- Abnormal AI: Email security platform (integrations)
- Abnormal AI: Trust center (certifications)
- Business Wire: Abnormal Security Series D, August 2024
- Abnormal AI: CNBC Disruptor 2025 (3,200+ organizations)
- Abnormal AI blog: product line
- Abnormal AI blog: CrowdStrike integration (account takeover, 29 March 2023)
- Gartner Peer Insights: Abnormal Security vs IRONSCALES
- Abnormal AI: Subprocessors (updated 31 July 2026; accessed 2026-10-21)