Sublime Security
A New York-based vendor that replaces black-box secure email gateways with an open, detection-as-code email security platform.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Sublime Security builds email security around a detection-as-code model instead of a black-box classifier. Security teams write, test, and share detection logic through an open rules language and a community detection feed, giving analysts direct visibility into why a message was flagged and the ability to tune detections themselves rather than wait on a vendor’s model update.
Founded by Josh Kamdjou, a former offensive security operator, the New York-based company closed a $150 million Series C in October 2025 at a reported valuation near $926 million, and says it has quadrupled its customer base over the past year. Publicly cited users include Spotify, Snowflake, Elastic, Brex, and Ramp, and the company earned 14 G2 Enterprise badges in the Spring 2026 reports. In April 2026 it moved to a 100% channel-sales model built around services-led resale partners.
Its core differentiator against legacy secure email gateways and other cloud-native email security tools is transparency: rather than a proprietary model that analysts can’t inspect, detections are auditable, versionable, and collaboratively maintained.
Innovation Matrix Assessment
Has iterated from an open detection-rules model through a $150M Series C and a shift to 100% channel sales within six years, per IVP and company announcements.
Detection-as-code gives SOC analysts auditable, editable detection logic instead of a black box, addressing a real operational friction point with legacy email security.
A $150M Series C at a ~$926M valuation, named enterprise customers (Spotify, Snowflake, Elastic), and 14 G2 Enterprise badges for Spring 2026 are strong, if company-reported, adoption signals.
Detection-as-code is a genuine UX shift from legacy secure email gateways, but it competes in an already crowded, well-funded email security category rather than redefining it outright.
No independently audited detection-rate study or named-incident case study was found; G2 reviews are user-sourced sentiment, not a rigorous efficacy benchmark.
Email remains the dominant initial-access vector and AI-generated phishing is accelerating, keeping transparent, tunable detection logic relevant for the foreseeable future.
Why CISOs Should Care
Gives analysts an auditable, editable detection pipeline, so when phishing slips through or a rule is too noisy, the team can see and fix the exact logic instead of filing a ticket with the vendor.
What Makes It Different
Treats email detection logic as open, shareable, versioned code plus a community rule feed, rather than a proprietary classifier locked inside the platform.
The Matrix Verdict
68/100 — INCREMENTAL INNOVATOR
A well-funded, fast-growing challenger to legacy secure email gateways with real enterprise traction. It lands as an Incremental Innovator: a genuine transparency and tunability improvement, in a mature category, without independent efficacy validation yet.
Editorial Note: Claims vs. Verified Findings
Customer logos, 'quadrupled customers,' and G2 badge counts are company-published; no independent third-party detection-accuracy study was found.
Sources
Alternatives to Sublime Security
Forward
CISO ReviewedBuilds a mathematically accurate 'digital twin' of enterprise networks, letting teams verify network and security changes before they…
Dragos
Industrial control system and OT cybersecurity platform with threat intelligence, detection and incident response services.
Tailscale
A zero-configuration mesh VPN built on WireGuard that applies Google's BeyondCorp zero-trust model to make secure networking accessible…
Zscaler
A cloud-native security-service-edge pioneer that routes all user traffic through a global proxy cloud instead of backhauling it…
Claroty
Cyber-physical systems protection platform securing industrial, healthcare and enterprise IoT devices for critical infrastructure operators.
Island
Chromium-based enterprise browser that embeds governance, data-protection, and network controls at the browser layer.