February 2026 Summaries

Sublime has enhanced its reporting and analytics capabilities to provide sharper, more actionable insights into email security environments, eliminating the need for security teams to manually sift through interfaces or take screenshots. The newly redesigned Attack Insights dashboard now includes interactive drill-downs, top attacker domains and sender addresses, and a visual breakdown of threat progression from detection to remediation. In addition, it features analytics for spam, graymail, email bombs, and an interactive Remediation Pipeline visualization to highlight automatic remediation processes. User Reports Overview updates offer improved visualizations of user report volume, classifications, and the effectiveness of automated responses, with the addition of stats on top reporters and automations. With full API access, users can integrate this data into existing tools and workflows, allowing security teams to gain deeper insights, identify high-risk individuals, and optimize their security strategies.

Sublime's Attack Spotlight series highlights the increasing sophistication of email threats, particularly through fake virtual meeting invitations, often exploiting platforms like Google Meet, Microsoft Teams, and Zoom. A recent attack involved a fake Google Meet invite from a newly registered domain, leading recipients to a fraudulent page that mimicked a Google Meet interface. This page prompted targets to download a malware-laden file disguised as a Google Meet installer, which, when executed, installed the Teramind remote monitoring tool, giving attackers control over the victim's system and notifying them via Telegram. The attack leveraged common tactics such as lookalike domains and intentional misspellings to evade detection, while Sublime's AI-powered detection engine effectively identified and neutralized the threat, underscoring the importance of advanced email security measures in combating these deceptive schemes.

Operational efficiency in security teams is significantly enhanced by the expansion of the Autonomous Security Analyst (ASA), an AI triage agent that now analyzes emails flagged as suspicious or unknown by the Sublime platform, which previously required manual review. This development allows ASA to autonomously handle over 99% of emails, enabling security analysts to focus on edge cases and reduce the time end users interact with potentially harmful emails. By utilizing tools like Natural Language Understanding and link analysis, ASA delivers high-confidence verdicts and automates triage actions, reducing human analyst interaction by 99.7%. Deployed across various environments with positive feedback, ASA's expanded capabilities represent a significant leap in automation, promoting a "set it and forget it" approach to email security without compromising effectiveness.

Sublime's Attack Spotlight series highlights a recent surge in email threats targeting real estate agents with malware and ransomware attacks via remote access tools like ScreenConnect and LogMeIn. These attacks often begin with adversaries posing as potential clients through contact forms on real estate websites or direct outreach, aiming to build trust through legitimate-sounding conversations. Once trust is established, they attempt to lure agents into fake Zoom meetings using deceptive links that install remote access tools, granting attackers control over the agents' systems. Sublime's AI-driven detection engine identifies these threats by spotting lookalike domains, social engineering tactics, and inconsistencies in sender identities. By using adaptive AI and machine learning, the platform effectively highlights suspicious indicators of such scams, providing crucial defenses against these evolving threats.