March 2026 Summaries

Sublime, a company specializing in email security, has been awarded 14 Enterprise badges in the G2 Spring 2026 reports, covering key categories such as Intelligent Email Protection, Email Anti-Spam, and Cloud Email Security. These accolades, based on customer reviews, highlight Sublime's exceptional integration into enterprise workflows, ease of use, and quality of support. The company is praised for its robust API that allows enterprises to customize and automate workflows, contributing to significant time savings. Customers appreciate Sublime's intuitive platform, which supports complex detection rule creation and offers a seamless user experience. The badges signify not only strong product performance but also positive customer-vendor relationships, underscoring Sublime's reputation as a trusted provider in the email security space.

ADÉ (Autonomous Detection Engineer) by Sublime has become generally available, offering Enterprise customers an AI-driven solution for autonomously detecting and responding to novel email threats with full transparency and customization options. This AI agent, which was in public beta since September, enables quick generation of organization-specific coverage, allowing security teams to transform new email attacks into effective detections within hours. ADÉ is designed to operate autonomously, providing security teams the option to incorporate a human-in-the-loop for additional oversight and control, while also offering full coverage for malicious messages, spam, and graymail. It enhances security operations by seamlessly integrating with existing workflows, maintaining transparency through detailed summaries and audit logs, and labeling coverage by attack type and detection methods. This functionality supports a shift from static defenses to an adaptive system that continuously evolves, ensuring that organizations remain protected from emerging threats without additional manual effort.

Sublime’s Attack Spotlight series highlights the evolving email threat landscape, showcasing real-world attack samples, such as a sophisticated Zoom impersonation scam designed to deceive targets into downloading malicious software. This particular attack utilizes AI-generated emails to mimic legitimate Zoom meeting invitations, directing users to a fake Zoom meeting page created with JavaScript. The page simulates technical difficulties and prompts users to download a purported Zoom update, which is actually a remote administration tool allowing attackers to control the target's system. Sublime's AI-powered detection engine identifies such threats by recognizing suspicious indicators, like mismatched URL domains and the use of free email providers. The series emphasizes the importance of adaptive email security platforms that utilize AI to detect and prevent these types of scams, while also advising readers to stay informed through regular updates and newsletters.

Data loss via email is a significant security risk, often overlooked by traditional Data Loss Prevention (DLP) platforms that are not optimized for email. To address this, Sublime has launched Sublime Email DLP, extending its transparent, organization-specific protection to both outbound and internal emails, integrated seamlessly with Microsoft 365 and Google Workspace. This new tool uses the same detection methods and enrichment functions as Sublime's inbound protection, offering unified detection and audit logging for compliance and security confidence. Organizations can craft policies tailored to their specific data protection needs, avoiding rigid templates and enabling coverage for various data types, including PII, financial data, healthcare information, and secrets. Sublime Email DLP enables a unified triage experience by integrating with existing inbound threat detection, thereby eliminating blind spots and enhancing detection efficacy. The platform is currently in public beta, accessible to existing Sublime customers and available for demo to new users.

Sublime is an email security platform designed to enable rapid historical threat hunting and detection backtesting, crucial for security teams such as SOC, incident response, and detection engineers. Utilizing Message Query Language (MQL), Sublime efficiently processes millions of messages by separating data into warm and cold storage, querying lightweight metadata first to minimize cold storage requests, and parallelizing operations for speed. The platform employs a two-phase approach comprising candidate selection and evaluation, where cheap operations filter potential messages before expensive operations further refine the selection. Innovative techniques like predicate pushdown and period chunking enhance query performance, while a robust caching strategy optimizes enrichment functions like ml.logo_detect. Sublime addresses challenges like database dead tuples and high DB load by leveraging indexed cursors and aggregation tactics, ensuring scalable and swift hunts at enterprise levels. Future improvements aim to dynamically adjust processor allocation based on demand and utilize lossy data structures to enhance candidate selection, maintaining the platform's commitment to speed and efficiency in threat detection.