Should Abnormal Security prioritize expanding its AI-powered email protection to cover more threat types or focus on improving accuracy for existing detections?

Introduction

The trade-off question at hand is whether Abnormal Security should prioritize expanding its AI-powered email protection to cover more threat types or focus on improving accuracy for existing detections. This scenario involves balancing the breadth of protection against the depth of accuracy in email security. I'll analyze this trade-off by examining the product context, potential impacts, key metrics, and experimental approaches to inform a strategic recommendation.

Step 1

Clarifying Questions (3 minutes)

• Based on the current market landscape, I'm thinking email threats are rapidly evolving. Could you provide insights into the most pressing emerging threats our customers are facing?

Why it matters: Helps prioritize expansion vs. improvement based on customer needs Expected answer: A few key emerging threats gaining traction Impact on approach: Would influence the direction of expansion if pursued

• Considering our business model, I assume accuracy directly impacts customer retention. What's our current churn rate, and how does it correlate with false positives/negatives?

Why it matters: Quantifies the business impact of accuracy improvements Expected answer: Moderate churn rate with strong correlation to accuracy issues Impact on approach: High correlation would prioritize accuracy improvements

• Looking at user behavior, I'm curious about the impact of false positives on productivity. Do we have data on how often users override or complain about blocked legitimate emails?

Why it matters: Assesses the real-world impact of our current accuracy levels Expected answer: Significant user frustration with false positives Impact on approach: High frustration would lean towards improving accuracy

• From a technical standpoint, I'm wondering about the scalability of our current AI models. How easily can we expand to new threat types without a complete architecture overhaul?

Why it matters: Determines the feasibility and resource requirements for expansion Expected answer: Moderate difficulty in expanding to new threats Impact on approach: Easy expansion might favor breadth, while difficult expansion could prioritize accuracy

• Regarding our team capacity, how are our data science and engineering resources currently allocated between model improvement and new threat development?

Why it matters: Assesses our ability to pursue either option effectively Expected answer: Resources are somewhat constrained, split between maintenance and development Impact on approach: Heavy constraints might favor focusing on one option over trying both