Sublime Security

Sublime Security is an email security platform that enables security teams to detect and block inbox-based threats in real time. Unlike traditional Secure Email Gateways, the system utilizes API-based integration directly into cloud email environments like Microsoft 365 or Google Workspace. This allows for the inspection of emails after they pass the perimeter but before they are accessed by end users.

The platform stands out due to its open architecture, which allows security teams to write custom detection logic using MQL (Message Query Language). This flexibility enables the identification of highly specific phishing campaigns, Business Email Compromise (BEC), and supply-chain attacks that standard filters often miss. Automating the response to these threats significantly reduces the burden on IT security departments.

In addition, the tool provides comprehensive visibility into incoming email traffic and offers tools for forensic analysis. Community-driven threat intelligence allows users to benefit from insights into emerging threat patterns identified by other organizations within the network. Sublime Security thus represents a modern approach to the increasing professionalization of email-based cyber attacks.

• API-native integration — The tool integrates directly into cloud infrastructures without requiring MX record changes. This enables deep inspection within the environment while maintaining full email delivery speed.
• Message Query Language (MQL) — MQL allows security experts to define complex logic for identifying malicious emails. The language is optimized to filter metadata, headers, and body content with high precision.
• Forensics and Automation — Detected threats can be automatically moved to quarantine or deleted. Simultaneously, the platform provides dashboards for analyzing historical email data for proactive threat hunting.

The tool is primarily aimed at SOC teams, IT security managers, and system administrators in mid-sized to large enterprises. It is ideal for organizations operating cloud-based email infrastructure that require high flexibility in threat detection.

A security analyst notices a new wave of invoice fraud emails using specific linguistic patterns in the subject line. Using Sublime's MQL, the analyst writes a rule that checks for these exact patterns and suspicious domain similarities. Within minutes, the rule is applied across all active mailboxes. Emails meeting the criteria are automatically removed from employees' inboxes. The entire incident is documented without requiring manual intervention from affected staff.

• The tool is primarily aimed at SOC teams, IT security managers, and system administrators in mid-sized to large enterprises. It is ideal for organizations operating cloud-based email infrastructure that require high flexibility in threat detection.
• A security analyst notices a new wave of invoice fraud emails using specific linguistic patterns in the subject line.
• API-native integration: The tool integrates directly into cloud infrastructures without requiring MX record changes. This enables deep inspection within the environment while maintaining full email delivery speed.
• Message Query Language (MQL): MQL allows security experts to define complex logic for identifying malicious emails. The language is optimized to filter metadata, headers, and body content with high precision.
• Forensics and Automation: Detected threats can be automatically moved to quarantine or deleted. Simultaneously, the platform provides dashboards for analyzing historical email data for proactive threat hunting.

Sublime Security is not suitable for small businesses with minimal IT security staff, as writing custom MQL rules requires a technical background. Additionally, it is not directly applicable for organizations without cloud email connectivity, such as those relying solely on legacy on-premise Exchange servers.

• Abnormal Security — Paid · HQ: San Francisco, United States · Unclear
• Darktrace — Paid · HQ: Cambridge, United Kingdom · GDPR / EU
• Dropzone AI — Paid · HQ: Seattle, United States · Unclear
• Vectra AI — Paid · HQ: San Jose, United States · Unclear