Sublime Security is the adaptive, AI-powered cloud email security platform that combines best-in-class effectiveness with unprecedented visibility and control.
- Tweets 489
- Following 22
- Followers 2,493
- Likes 550
Pinned Tweet
We’re excited to announce that Sublime has raised $150M in a Series C led by @Georgian_io, joined by new investors @Avenir_Growth, @01Advisors, @jonoberheide, and @nicoleperlroth, and existing investors @IndexVentures, @IVP, @slow, and @CitiVentures.
This year we launched ASA and ADÉ, our AI agents that autonomously triage threats and auto-adapt coverage, freeing security teams from repetitive work and delivering rapid, tailored defenses. We’ve grown our customer base 4x since the beginning of the year while maintaining zero enterprise customer churn since company inception.
This funding accelerates our vision to deliver autonomous email security that adapts to each organization's unique needs, stopping sophisticated attacks while eliminating the manual work and vendor bottlenecks of legacy solutions.
Thank you to our customers, partners, and investors for being on this journey with us.
🔗 Read more: sublime.security/blog/sublim…
2
7
36
21,883
The narrative that rules are dead and AI should just be left alone is naive. More capable models don’t make testing, visibility, or control obsolete. How we build harnesses around our AI agents: sublime.security/blog/harnes…
48
Your employee sees a routine calendar invite. Their AI assistant sees hidden instructions to expose mailbox data. Sublime’s Email Prompt Injection Detection is now in public beta and catches these attempts at the email layer, no integration needed: sublime.security/blog/stop-e…
76
Congrats to Luke Wescott, Threat Detection Engineer at Sublime, whose calendar phishing research landed in The Guardian, MSN, Yahoo, Morning Brew, CISO Series, and more.
We’ve seen exponential growth in calendar invite phishing, and Luke walked The Guardian through how it works. Because the invite can land on a calendar even when the email is blocked, stopping it takes specialized detection, prevention, and remediation across both the inbox and the calendar.
🔗 Read the full story in The Guardian: theguardian.com/money/2026/o…
4
228
A quarantined phish and a suspicious PowerShell command look unrelated until they land in the same place. Sublime email telemetry now flows natively into Elastic Security, where Attack Discovery ties them into one attack chain. Thanks @elasticseclabs
9:00 a.m. A phishing email gets quarantined.
9:05 a.m. An endpoint runs a suspicious PowerShell command.
Each one looks handled on its own. The quarantine did its job, and one odd PowerShell process a day is background noise in most environments.
Together they're the opening moves of a campaign. Nobody sees them side by side because they live in 2 different tools.
Sublime Security's email telemetry now lands natively in Elastic Security, next to your endpoint, identity, and network data.
From there, Attack Discovery ties the quarantined email to the endpoint alerts and builds one attack chain. Mapped to MITRE ATT&CK, reasoning included.
Elastic Workflows opens a case and pings the analyst on Slack, evidence attached. Approve or reject from there.
The agents connect the signals and surface an evidence-backed decision. Consequential actions still go through the analyst.
Full walkthrough, including the 7-step flow and the two-stage rollout: go.es.io/4hHaGka
108
Adversaries are using invisible characters to evade email scanners and manipulate AI tools, including through prompt injection. Unicode tags were originally meant for encoding language metadata into text, but they don’t visually render. Just because humans can’t see them doesn’t mean AI agents can’t.
Check out our latest blog to see how attackers use them and how Sublime catches them. There could be a hidden message between the last word of this sentence and the period that follows: sublime.security/blog/hiding…
2
136
🏅 Sublime has been named "Email Security Platform of the Year" in the Cybersecurity Breakthrough Awards.
The award recognizes what we've been building: email security that works for modern security teams. Protection runs on its own, coverage gaps close in hours instead of waiting on a vendor cycle, and teams can see exactly why every decision was made.
1
1
3
127
Your phishing simulations should be as targeted as the attacks they're preparing people for. Tailored Phishing Simulations and Training is now GA: simulations built from attacks Sublime catches, plus training the moment someone clicks. sublime.security/blog/tailor…
2
3
277
Most DLP tools force you to choose: catch every violation, or keep the business moving. Sublime Email DLP just went GA and does both. Real violations get blocked, legitimate email keeps moving.
sublime.security/blog/email-…
2
2
6
2,305
A tough question we face at Sublime is, "how do we know our agents are actually improving with every attack?" In this new post about research from the Sublime AI team, we explore the use of an LLM-backed continual learning harness to evaluate AI decisions. Check it out: sublime.security/blog/scalin…
119
Calendar-based attacks have gone from hot to inferno since August. 1,000%+ MoM growth.
Why? Two chances to land: inbox and calendar. Most email security stops the inbox attack and ignores the calendar one entirely. Attackers exploit that gap deliberately, sending weak inbox lures to trip the alarm while the calendar payload sits waiting for a click.
Sublime stops both. Our latest Attack Spotlight breaks down a calendar invite attack abusing three free services to deliver an RMM payload.
sublime.security/blog/sublim…
1
1
156
Inside the Inbox is our monthly demo series. Each session is a live walkthrough of what Sublime actually does: including how our agents ASA (Autonomous Security Analyst) triages a user-reported email end-to-end, and how ADÉ (Autonomous Detection Engineer) builds and deploys a new detection in response to a real threat.
Don't miss our first session on Thursday, September 24th, with sessions each month following.
sublime.security/events/insi…
1
1
132
Financial fraud, fabricated threads, vendor impersonation, shady banking details... the usual playbook.
But the fake W-9 came with a PDF revision history showing it had already been used in prior fraud campaigns.
Our Detection team dug into the full lineage in our most recent Attack Spotlight: sublime.security/blog/fake-w…
2
124
Email security AI models keep getting better, but coverage gaps still take weeks to close and detection logic stays opaque. The issue isn't your model, it's your architecture.
Tomorrow, September 10, @jkamdjou and @DAlperovitch make the case for why the architecture underneath your email security product is the variable that actually matters.
Register: sublime.security/events/why-…
113
Sublime automates away 100+ hours of email investigation and triage for US Signal analysts ever year. Now those hours can be used for the high-level security tasks that only an expert can tackle.
Learn how Sublime frees up analyst time and security budget for US Signal: sublime.security/customers/u…
1
1
146
Vendors keep improving their models with AI, but the structural complaints from security teams haven't changed. @jkamdjou and @DAlperovitch make the case for why it's an architecture problem on September 10: sublime.security/events/why-…
1
2
146
Email is the top initial access vector. For most Falcon teams, that means leaving the platform to investigate it.
Today that changes.
Sublime is now live in the CrowdStrike Marketplace. Announcing at #FalCon2026.
sublime.security/blog/sublim…
1
1
182
Microsoft has proprietary email headers that can tell you if a message was spoofed or the account was compromised, why auth got bypassed, and why something landed in inbox instead of spam.
Breakdown from Sublime's detection engineers: sublime.security/blog/gettin…
136
Sublime's Security Threat Intel & Research team (STIR) is tracking DOUBLOON DREDGER – a threat actor launching token harvesting attacks from free Notion accounts, with custom PDFs that overlay 3 payloads on a single button. First-stage JS ties them to Tycoon2FA.
Full investigation + IOCs → sublime.security/blog/doublo…
1
273
While security vendors refine their AI models, attackers find coverage gaps that won't be closed for months. It doesn't matter how smart your AI is if it can't stay ahead of attackers, which is why architecture matters more than AI (especially post-Mythos).
On Sept 10, @jkamdjou and @DAlperovitch make the case for why detection architecture, not AI model quality, matters more in security.
🔗 Register today: sublime.security/events/why-…
148