Sublime Security develops an agentic email security platform built to prevent, investigate, and adapt to email-borne threats. The company focuses on giving security teams more control over detection and response through specialized AI agents, transparent analysis, and organization-specific coverage rather than one-size-fits-all policies. Its platform is designed for modern cloud email environments and supports Microsoft 365, Google Workspace, IMAP, and direct message ingestion.
Sublime Security positions its offering around three outcomes: stopping sophisticated attacks with fewer false positives, reducing analyst workload through automated triage, and accelerating coverage for new threats as they emerge. The company supports both fully managed and self-managed deployment models, allowing customers to adopt it as SaaS, run it in a private cloud model, or self-host it within their own environment.
Offerings, Capabilities, and Integrations
Sublime Security combines inbound email protection, abuse mailbox automation, threat hunting, detection engineering, and outbound data protection in a single platform. Its architecture is programmable and API-native, enabling teams to inspect messages, apply custom rules, quarantine or modify messages, and automate actions such as webhooks, alerts, and warning banners.
The platform integrates directly with Microsoft 365 and Google Workspace without requiring MX record changes, and it can also ingest messages from IMAP-compatible sources. Deployment options include multi-tenant SaaS, single-tenant private cloud, and self-hosted environments. Sublime Security also supports telemetry export to SIEM and SOAR tools, threat intelligence ingestion using indicators and YARA, S3 export, and identity integrations for SSO and provisioning.
Products and Services
- Sublime Platform: Core cloud email security platform for detecting, blocking, investigating, and automating response to phishing, BEC, malware, and other email-borne threats across Microsoft 365, Google Workspace, IMAP, and direct ingestion sources.
- ASA (Autonomous Security Analyst): AI analyst that investigates and triages user-reported and suspicious emails, produces explainable verdicts, and helps automate abuse mailbox workflows and downstream response actions.
- ADÉ (Autonomous Detection Engineer): AI agent that analyzes missed or emerging attacks and automatically generates, validates, and backtests new detection rules tailored to a customer’s environment before deployment.
- Email Data Loss Prevention: Outbound and internal email DLP capability that applies contextual analysis, deep file inspection, and policy-driven actions to detect and prevent sensitive data exposure over email.
- EML Analyzer: Free email analysis tool and API for analyzing individual EML files with Sublime’s message analysis and rule logic, useful for fast threat assessment, testing, and training.
- Sublime Core Feed: Continuously updated feed of detection rules and threat intelligence content that customers and researchers can use to extend coverage for new email attack techniques.
- Sublime Cloud: Fully managed deployment option operated by Sublime Security for customers that want SaaS delivery with direct API-based integration into supported email environments.
Target Customers
Sublime Security targets security teams responsible for protecting cloud email environments, particularly organizations running Microsoft 365 or Google Workspace. Its fit is strongest for teams that need better protection against phishing, business email compromise, malware, QR-code attacks, and other evolving email threats without relying on opaque, static controls.
The platform is also aimed at organizations that want to automate high-volume abuse mailbox triage, create organization-specific detections, and extend email security telemetry into broader SOC workflows. Buyers include teams spanning security operations, IT, threat intelligence, and threat detection that want to layer modern email defense onto their existing stack without replacing native controls or changing mail routing.
Cloud Integrations and Marketplace
- AWS Marketplace: Sublime Security offers the Sublime Email Security Platform through AWS Marketplace and supports self-managed deployment in customer AWS environments, including AWS CloudFormation-based installation.
- Microsoft Azure Marketplace: Sublime Security lists the Sublime Email Security Platform in Microsoft Azure Marketplace and documents Azure-based self-managed deployment options for the platform.
Key People
- Josh Kamdjou: Founder & CEO
- Colin Jones: President
- Ian Thiel: Founder & COO
- Andrew Becherer: Chief Information Security Officer
- Bobby Filar: Head of AI
- Alex Orleans: Head of Threat Intelligence
Key Facts
- Headquarters: Washington, DC, USA
- Employees: Approximately 300 employees
- Annual Revenue: Undisclosed
- Parent Company: None
- Subsidiaries: None
- Publicly Listed: No
Analyst Recognitions
- Gartner: 2026 Gartner Peer Insights, Email Security market: Sublime Email Security Platform held a 4.9/5 rating based on 20 reviews..
