Sublime Security

What it does

Sublime is a cloud email security platform that ingests messages from Microsoft 365 and Google Workspace, with IMAP and APIs also supported for direct ingestion. It evaluates messages with a message query language (MQL) and can quarantine messages, send webhook notifications, or insert warning banners, with detections that are readable and auditable.

Teams use Sublime to block phishing, business email compromise, and malware, auto-triage user-reported suspicious email, and threat hunt across their environment. Detections are programmable: teams can write, validate, and deploy their own MQL detections and backtest them against historical messages. Two AI agents are described: ADÉ writes and backtests detections, and ASA triages reported and flagged messages.

The Core plan is free for individual security practitioners and lightweight deployments, including the first 100 mailboxes, while Enterprise adds the full platform, premium support, and advanced controls and is obtained through a demo request. Some features, such as quarantine actions and graymail administration, differ by plan.

What it can do

• Blocks phishing, business email compromise, and malware in Microsoft 365 and Google Workspace
• Auto-triages user-reported suspicious email
• Threat hunts across an email environment
• Writes and backtests custom detections in message query language (MQL)
• Takes actions such as quarantine, webhook notification, and warning banners
• Analyzes links with headless browsers and detects vendor impersonation and sender behavioral anomalies

Works with

• Microsoft 365
• Google Workspace
• IMAP
• APIs for direct ingestion

Before you choose

• Features differ by plan, such as quarantine actions and graymail administration; confirm what your tier includes.
• Core is described as free for the first 100 mailboxes; confirm how it applies to larger deployments.
• Writing custom detections requires working with the message query language (MQL).

Listed under

• Security
• Cloud and data security

Get started

Core offers account creation; Enterprise uses a demo request.

1. Connect Microsoft 365 or Google Workspace, or configure IMAP or API ingestion.
2. Review the built-in detections and automations for baseline protection.
3. Write or backtest custom MQL detections against historical messages before deploying them to production.

Core is free for individual security practitioners, including the first 100 mailboxes. Enterprise pricing is arranged through a demo request, so buyers should confirm cost with Sublime.

Source: sublime.security/plans-detail, checked 29 Oct 2026. Prices can change; check before you buy.

Sources for this overview

Product pages, documentation, and pricing checked 29 Oct 2026. Each source supports part of the overview; availability and prices can change.

• Overview ↗docs.sublime.security
• Plans · Sublime Security ↗sublime.security

Company website

sublime.security: product, pricing and policy pages

Web archive

When the site first appeared

YC directory mirror

Batch and company name

Web search

Confirms the official site

Social accounts

Accounts the company links, and its posts on X

Human review

Checked by a person

knowledge_base

manual_review

Last checked 29 Oct 2026. Every field keeps its source and date; unknown means we couldn’t confirm it.