What is Sublime Security?

Sublime is an email security platform that targets phishing, business email compromise and other email threats, deployed through an API with no MX changes. The vendor says it uses machine learning (Attack Score) and AI agents (ASA and ADÉ) to classify messages, triage reports and draft detection rules, and it runs as Sublime Cloud or self-hosted in the customer's AWS account.

Who it's for

Security teams that want visible detection logic, custom detections and hunting, and automated triage of user-reported email, on Google Workspace or Microsoft 365. The vendor says organizations protecting fewer than 100 mailboxes can start free, and its full platform is sold as Enterprise, now through channel partners.

Pros & cons

Strengths

The Attack Score docs describe a machine learning verdict (malicious, suspicious, spam, graymail and others) with a 0-100 raw score and the top 2-5 signals behind each verdict; the raw score is available through the API.
The ASA docs say its AI agent investigates user-reported and flagged messages, with modes of inactive (default), passive (reports only, never changes mail) and active (applies per-verdict actions you configure), and recommend a week or two in passive mode first.
The ADÉ docs say it writes a detection rule from a missed message, backtests it against historical email (14 days by default), and waits for analyst approval; auto-activation is optional with a preset 99% precision threshold.
The plans page lists API deployment with no MX changes, cloud or self-hosted options, SIEM and SOAR integrations, and custom detections and hunting; the ASA page lists Google Workspace and Microsoft 365 as supported environments and alerts via Slack, webhook or email.
The ASA and ADÉ docs say customer data is not used to train foundation models and is not retained by model providers; ASA sends only the parsed message data model, never the raw email.
The Enterprise add-ons are Email DLP (built-in PII, PHI and PCI detections, Microsoft Purview label enforcement) and Tailored Phishing Simulations and Training, which the docs say runs inside Sublime on Google Workspace and Microsoft 365.

Limitations

Prices are not published: the plans page lists one paid plan (Enterprise) and two add-ons with no prices, seat minimums or trial length, and a blog post dated April 28, 2026 says Sublime is moving to 100% channel sales.
ASA, ADÉ and the add-ons need an Enterprise subscription; ASA also needs a configured abuse mailbox, and self-hosted AWS deployments need a one-time setup and may incur per-report processing costs for ADÉ.
The free option is worded only as 'Start free with Sublime Cloud' for fewer than 100 mailboxes; no page read lists what it includes, and the Get Started page offers a free email Analyzer and an Enterprise evaluation but does not mention a free platform tier.
The vendor's own pages differ on model providers: the ASA docs say data is not retained by the model provider, while the ASA feature page says data is not shared with third-party model providers. The ADÉ docs say inference is geo-pinned in supported regions but some regions may route outside the geography.
The Enterprise terms say fees paid are non-refundable, orders renew automatically unless notice is given 30 days before the term ends, and Sublime may use customer data to train its internal algorithms where the customer has authorized sharing for that purpose.

Plans and pricing

Free option (Sublime Cloud): $0. Vendor says organizations protecting fewer than 100 mailboxes can start free; included features and limits are not listed on the pages read.
Enterprise (agentic email security): Contact sales. Lists ASA, ADÉ, automated remediation, API deployment with no MX changes, cloud or self-hosted deployment, SIEM and SOAR integrations. No public price.
Email DLP add-on: Contact sales. Enterprise add-on with built-in PII, PHI and PCI detections and attachment and image scanning. No public price.
Tailored Phishing Simulations and Training add-on: Contact sales. Enterprise add-on; the docs call it a paid add-on and require an active Enterprise subscription. No public price.

Read from the vendor's Plans page and docs, which list no prices, seat minimums or trial terms; fees under the Enterprise terms are invoiced in U.S. dollars per the order form. The vendor's April 2026 channel-sales post means pricing may come through resellers. Confirm on the live pricing page and with a Sublime partner.

Details checked October 2026 against the vendor's own pages. Prices and limits change, so confirm before you buy. Official pricing page ↗

Sources

This profile was compiled from these public pages. We have not run hands-on tests.

Summary