Sublime Security makes an email security platform for organisations on Microsoft 365 and Google Workspace. It stops targeted attacks such as business email compromise and credential phishing, and it lets security teams write and tune their own detections instead of relying on a closed black box.
It is aimed at security teams that want to see and control how their email defences make decisions, and to adapt them quickly when attackers change tactics.
At A Glance
| Vendor | Sublime Security |
|---|---|
| Category | Email security |
| Deployment | Fully managed in Sublime’s VPC, or self-managed in the customer’s VPC |
| Agentic AI | Autonomous Security Analyst (ASA) and Autonomous Detection Engineer (ADÉ) |
| Customers | Brex, FanDuel, Snowflake, Personio, Spotify |
| Leadership | Josh Kamdjou (Founder and CEO) |
| Market classification | Email & Communications Security |
What Sublime Security Does
Email remains the most common way attackers reach staff, and the threats keep shifting: calendar invite (ICS) phishing, callback and QR code lures, malware, ransomware and now prompt injection aimed at AI assistants that read the inbox. Sublime is built on the idea that defenders know their own environment best, so every detection is visible and editable, and new coverage specific to one organisation can go live without waiting for a vendor update. Each verdict comes with its reasoning, so analysts can see why a message was flagged. The platform also handles abuse mailbox automation, threat hunting across past messages, incident response and putting threat intelligence to work.
Products
Email Security
The core product protects inboxes from business email compromise, credential phishing, ICS phishing, callback phishing, QR code phishing and malware. It also catches prompt injection hidden in messages, which matters once AI agents start reading and acting on email. When a message is caught, Sublime can quarantine it, add a warning banner or send a webhook notification to other tools.
Email DLP
Email DLP applies the same engine to outbound mail, stopping sensitive data from leaving before a message is delivered. It is generally available.
Phishing Simulations And Training
Tailored Phishing Simulations and Training sends staff simulations modelled on the threats the organisation actually sees, then gives just-in-time training to anyone who falls for one. It is generally available.
How It Works
The detection engine ingests each message, evaluates it against detection rules and then runs the actions those rules call for. Rules are written in Message Query Language (MQL), Sublime’s own language for email, with function modules for strings, regex, files, machine learning, network and IP data, HTML and sender profiles. Rules can be grouped into YAML rule feeds, and YARA is supported for file analysis.
Sublime connects to Microsoft 365 and Google Workspace through their APIs, so no mail routing or MX record changes are needed. IMAP and direct API ingestion are available for other sources.
There are two ways to run it. In the fully managed model the platform runs in Sublime’s own VPC and is operated like ordinary SaaS. In the self-managed model it runs in the customer’s own VPC, including on AWS; Sublime supplies updates but cannot reach customer data.
Agentic AI Capabilities
Autonomous Security Analyst (ASA)
ASA triages emails that users report or that are flagged for review, clearing the abuse mailbox so analysts do not have to work through it by hand. When it confirms that a malicious message was missed, it hands the case to ADÉ.
Autonomous Detection Engineer (ADÉ)
ADÉ writes new MQL detections for emerging threats and backtests them against past mail. Each detection waits for one-click approval, or ADÉ can deploy it automatically once it meets a precision threshold the customer sets.
Integrations
| Area | Integrations |
|---|---|
| SIEM and SOAR | CrowdStrike Next-Gen SIEM, CrowdStrike Falcon Fusion, Tines (webhook) |
| Threat intelligence and sandbox | OpenCTI, CrowdStrike Falcon Sandbox |
| Export and alerting | Export to S3 (messages, audit logs, events), email, Slack and webhook alerts |
Company Background
| Founders | Josh Kamdjou (Founder and CEO) and Ian Thiel (Founder and COO). |
|---|---|
| Funding | More than $240 million raised in total, most recently a $150 million Series C led by Georgian. |
| Investors | Georgian, Avenir, 01 Advisors, Index Ventures, IVP, Decibel, Slow Ventures and Citi Ventures. |
Note: This overview is compiled from Sublime Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.