Sublime Email Security for Security Hub Extended

What do you like best about the product?

I've been using Sublime's agentic platform to safeguard my emails, and it's been quite impressive. They genuinely provide the transparency and automation needed to tackle advanced threats without all the hassle. This isn't just another generic security solution. It's truly tailored to the specific threats my organization encounters, cutting down on false positives and giving me peace of mind. Their AI agents work seamlessly, giving my team way more flexibility and efficiency. Definitely a trusted and proactive solution!

What do you dislike about the product?

Nothing so far has pushed me away from the platform

What problems is the product solving and how is that benefiting you?

Email security with automation and high fidelity detections and response

What do you like best about the product?

The architecture is fantastic, the rules engine and how the platform is laid out is really solid. UI is easy to use. Can't wait for the MCP interface to make it even better! The sales and services team are fantastic, super responsive and really knowledgeable.

What do you dislike about the product?

Their Graymail feature is not full featured yet. They don't have an MCP interface yet.

What problems is the product solving and how is that benefiting you?

Layered email security.

What do you like best about the product?

The detection logic is fully transparent and editable, and that's the thing I'd point to first. Every rule is human-readable, so when we see a new phishing pattern we can fork an existing rule, tune the conditions, and have it live the same day instead of filing a vendor ticket and waiting a release cycle. The rules live as code, which means we version control them and code review them like any other engineering work.

Onboarding was genuinely fast. It connects to our mail tenant over API rather than sitting inline, so there were no MX changes, no mail flow risk, and no added delivery latency. We were reviewing real detections within days of signing, and we could run in observation mode first to see what it would have caught before letting it take action on anything.

The verdict detail is what changed our day-to-day workflow the most. Instead of a black-box risk score, we get the specific signals behind a detection along with full message and attachment analysis, so triage on a reported message takes a couple of minutes rather than a manual header-and-link investigation. Being able to query historical mail with a real query language means email is now something we can actually hunt across, which we didn't have before.

Integrations have held up well. The API is complete enough that we pipe detections into our own SIEM and automation rather than living in one more console.

Detection quality on business email compromise, vendor and executive impersonation, credential phishing, and QR-code lures has been consistently strong. Support is responsive and technically credible, with direct access to people who know the product instead of a tiered queue.

What do you dislike about the product?

1. Built-in reporting and dashboards are the weakest part of the product. For the metrics leadership asks for, we end up exporting data into our own tooling rather than using what ships in the console.

What problems is the product solving and how is that benefiting you?

The core problem it solves is that our previous email controls caught commodity spam and known-bad indicators but missed the attacks that actually cause damage: business email compromise, vendor and executive impersonation, payment fraud attempts, and credential phishing that carries no malware and no known-bad URL. Those messages were landing in inboxes, and we were finding out about them from user reports rather than from a detection.

The second problem was that we had no way to act on what we knew. With a traditional gateway, our own threat intelligence and the patterns we saw in our own environment couldn't be turned into a control without opening a vendor ticket. Sublime closed that gap. When we see something new, we write or tune a rule ourselves and it's protecting the whole org that day.

The third was visibility. Email used to be the one major surface our detection team couldn't investigate. We had no way to search historical messages, so questions like "who else received this" or "has this sender pattern shown up before" took hours of manual work or went unanswered. Now that's a query.

The benefits have been concrete. Phishing triage that used to mean manually pulling headers, unpacking attachments, and checking links now takes a couple of minutes per message because the analysis is already done and the reasoning is visible. Fewer malicious messages reach users, so we spend less time on post-delivery cleanup and searching for who clicked. Our detection engineers can own email coverage directly instead of routing everything through IT or the vendor. And because it deploys over API with no mail flow changes, we got all of that without a migration project or any risk to mail delivery.

What do you like best about the product?

Excellent tool, efficacy right on par with Abnormal. More functionality from administrative perspective.

What do you dislike about the product?

I have not had any issues with the Sublime platform or their professional services! Continued support with dedicated engineer has been excellent.

What problems is the product solving and how is that benefiting you?

Much better efficacy than our previous solution, drastic reduction of phishing emails making it through to end users. The graymail feature is also cleaning up inboxes from excessive marketing emails.

What do you like best about the product?

I love the idea of crowdsourcing detection rules. You can take a new, novel phishing campaign and quickly turn it into a detection rule, backcheck it, and share it with the community, creating a kind of herd immunity, in a matter of minutes.

What do you dislike about the product?

I genuinely can’t think of anything I dislike.

What problems is the product solving and how is that benefiting you?

With many of the large email security vendors, analysts and engineers are largely at the mercy of the vendor when it comes to detection logic. You get whatever rules and detections they provide, with limited ability to really tune them to your environment.

Sublime completely changes that. As an analyst or engineer, I can build custom detection rules around virtually any property or behavior observed in an email. Those rules aren't limited to stopping future messages either. I can take something I just discovered, write a detection for it, and immediately look back across 30, 60, 90+ days of email to determine whether it ever reached anyone in the organization. If it did, I can remediate it, while also protecting the environment from anything matching that detection going forward.

The addition of AI-assisted and agentic workflows has made this even more powerful. Building and refining custom detections is incredibly fast, without taking away the transparency or control that makes Sublime so useful in the first place.

I've also helped onboard Sublime at multiple companies, and deployment is refreshingly simple. You can connect an environment and start getting meaningful visibility and protection in a matter of minutes rather than turning implementation into a weeks-long professional services project.

That combination of visibility, control, rapid response, and ease of deployment is what makes Sublime stand out for me.