Sublime Security review

Sublime Security is an email security platform aimed at detecting targeted threats and helping security teams handle the work that follows. Its stated coverage includes phishing and business email compromise, plus user-reported email triage, custom detection rules, investigation and response. The product uses AI agents for two specific tasks: an Autonomous Security Analyst to triage reported messages, and an Autonomous Detection Engineer to author and backtest detections for emerging threats. Those capabilities are intended to reduce manual work, but the published materials do not quantify time saved or detection accuracy.

The platform also offers email data-loss prevention (DLP), phishing simulations with just-in-time training, and M-SOAR for email threat detection through remediation. Pricing lists Core at $0 per month, monthly or annually, for organizations with up to 100 mailboxes. Enterprise terms are not published; the listing includes a 14-day free trial. DLP and tailored phishing simulations and training are listed as add-ons, with prices not published.

Sublime’s clearest appeal is the combination of email protection and tools for security teams to investigate and tune detections. Rather than treating the inbox as a simple block-or-allow problem, it offers reported-email triage, custom detections and M-SOAR alongside phishing and business email compromise protection. Its AI agents are assigned concrete workflow tasks: triaging reported mail and authoring and backtesting detections. The published materials do not establish how well those tasks perform in practice, but the scope is relevant for teams trying to keep up with targeted email attacks.

The Core plan also gives smaller organizations a published entry point: $0 per month for up to 100 mailboxes, according to the published pricing details. That is a useful contrast with the undisclosed Enterprise price, though the mailbox cap makes it a limited basis for comparing larger deployments.

Some Reddit users speak positively about Sublime. In one r/cybersecurity thread, commenters called it cheaper than Darktrace and praised its detection rules and automated detection engineer; another said it was more accurate than Abnormal in their evaluation. Those are individual reports, not independent comparative testing, so treat them as signals rather than proof.

The main buying obstacle is price visibility. Core is listed at $0 per month for up to 100 mailboxes, but Enterprise pricing and billing terms are not published. DLP and tailored phishing simulations and training are also priced separately, with no amounts listed. A team that needs those add-ons or exceeds the Core mailbox cap cannot work out its likely total from the published pricing information. The 14-day trial is listed for Enterprise; the materials do not specify its conditions or what happens when it ends.

The product description covers a wide set of capabilities, but the published material gives no measured detection rates, false-positive rates, or time saved in triage. Reddit comments include favorable comparisons with Darktrace and Abnormal, but those are user reports, not a controlled comparison, and one commenter explicitly cautions that results vary. We would not treat those claims as a substitute for checking fit against your own mail environment and workflow.

There is also little detail here about deployment requirements, integrations, support terms, or the limits of Enterprise features. Ask for those details and a written quote before comparing Sublime’s total cost with an incumbent or another vendor.

Sublime’s Core plan is listed at $0 per month, whether billed monthly or annually, for organizations with up to 100 mailboxes. That cap is the main limit: the pricing page does not publish a Core rate for larger organizations, so don’t assume you can add mailboxes at the same price.

The next tier is Enterprise, but its price and billing terms are not published. The listed 14-day free trial gives you a way to assess it, not a quote for what comes after. The jump from Core to Enterprise is therefore from free to an undisclosed price; we can’t calculate the cost difference or compare annual and monthly Enterprise billing.

Email DLP and Tailored Phishing Simulations and Training are listed as add-ons, with pricing not published. Confirm whether either is included in an Enterprise quote or charged separately. Core’s $0 listing is clear, but the total cost for a team above 100 mailboxes—or one that needs paid add-ons—is not.

The published materials don’t document Sublime’s migration process, supported integrations, data export options, retention terms, or how detections and policies transfer. Treat those as questions for the vendor, not assumed capabilities. Before moving, ask how mail flow is changed, whether existing rules can be imported, what happens to historical messages and investigation records, and how you would export data if you leave. Also confirm what support is available during cutover; the materials don’t specify it.

We don’t have Reddit posts or comments in the published material, so we can’t responsibly say what users report as reasons for leaving. The clearest switching risk in the published information is commercial: Enterprise pricing is unpublished, and DLP and phishing-training add-on prices are also not listed. Get those costs and contract terms in writing before replacing an incumbent. For Core, verify that the 100-mailbox limit fits; the published offer does not establish a priced path above it.