I love the idea of crowdsourcing detection rules. You can take a new, novel phishing campaign and quickly turn it into a detection rule, backcheck it, and share it with the community, creating a kind of herd immunity, in a matter of minutes. Review collected by and hosted on G2.com.

I genuinely can’t think of anything I dislike. Review collected by and hosted on G2.com.

The detection logic is fully transparent and editable, and that's the thing I'd point to first. Every rule is human-readable, so when we see a new phishing pattern we can fork an existing rule, tune the conditions, and have it live the same day instead of filing a vendor ticket and waiting a release cycle. The rules live as code, which means we version control them and code review them like any other engineering work.

Onboarding was genuinely fast. It connects to our mail tenant over API rather than sitting inline, so there were no MX changes, no mail flow risk, and no added delivery latency. We were reviewing real detections within days of signing, and we could run in observation mode first to see what it would have caught before letting it take action on anything.

The verdict detail is what changed our day-to-day workflow the most. Instead of a black-box risk score, we get the specific signals behind a detection along with full message and attachment analysis, so triage on a reported message takes a couple of minutes rather than a manual header-and-link investigation. Being able to query historical mail with a real query language means email is now something we can actually hunt across, which we didn't have before.

Integrations have held up well. The API is complete enough that we pipe detections into our own SIEM and automation rather than living in one more console.

Detection quality on business email compromise, vendor and executive impersonation, credential phishing, and QR-code lures has been consistently strong. Support is responsive and technically credible, with direct access to people who know the product instead of a tiered queue. Review collected by and hosted on G2.com.

1. Built-in reporting and dashboards are the weakest part of the product. For the metrics leadership asks for, we end up exporting data into our own tooling rather than using what ships in the console. Review collected by and hosted on G2.com.

I've been using Sublime's agentic platform to safeguard my emails, and it's been quite impressive. They genuinely provide the transparency and automation needed to tackle advanced threats without all the hassle. This isn't just another generic security solution. It's truly tailored to the specific threats my organization encounters, cutting down on false positives and giving me peace of mind. Their AI agents work seamlessly, giving my team way more flexibility and efficiency. Definitely a trusted and proactive solution! Review collected by and hosted on G2.com.

Nothing so far has pushed me away from the platform Review collected by and hosted on G2.com.

The architecture is fantastic, the rules engine and how the platform is laid out is really solid. UI is easy to use. Can't wait for the MCP interface to make it even better! The sales and services team are fantastic, super responsive and really knowledgeable. Review collected by and hosted on G2.com.

Their Graymail feature is not full featured yet. They don't have an MCP interface yet. Review collected by and hosted on G2.com.

I like that Sublime has a high degree of accuracy out of the box negating a long tuning process. The regular updates to existing and creation of new core detections keeps us well protected. The ability to create custom detection, create bespoke automations is a massive plus point. I like that the detection logic is transparent, so you always know why something was flagged. The API features also make it simple to integrate into existing workflows and remove repetitive manual tasks. Review collected by and hosted on G2.com.

Sublime develops and releases new valuable features regularly that we would love to use. Unfortunately, inconsistencies in regional hosting outside of the direct control of Sublime can mean that sometimes these valuable new features don’t appear in our region right away. Review collected by and hosted on G2.com.

Excellent tool, efficacy right on par with Abnormal. More functionality from administrative perspective. Review collected by and hosted on G2.com.

I have not had any issues with the Sublime platform or their professional services! Continued support with dedicated engineer has been excellent. Review collected by and hosted on G2.com.

I appreciate how user-friendly both the UI and API of the Sublime Email Security Platform are, which allows me to create in-depth detections and automations easily. I like that Sublime MQL facilitates deep customization when creating detection rules, capturing specific scenarios with various email attributes. The platform provides complex detection rule creation that would be challenging with other solutions, and it's impressive how the functions in MQL allow for intricate rule construction, down to prevalence within the configured tenant. The powerful language of Sublime provides extensive coverage with its rules, which is another aspect I find valuable. Review collected by and hosted on G2.com.

Availability of ASA via the Sentinel integration? Allowing the summary to be forwarded to Sentinel. Review collected by and hosted on G2.com.

One of the strongest aspects of Sublime is how transparent its detections are. Instead of operating as a black-box filter, Sublime clearly shows why an email was flagged, including the specific signals, patterns, or behaviors that triggered the alert. This makes it much easier for IT and security teams to quickly validate threats, reduce false positives, and build trust in the system’s decision-making. That level of visibility also improves incident response and supports better long-term tuning, since administrators can understand exactly what the platform is catching and why. Review collected by and hosted on G2.com.

Sublime is primarily focused on detection and response rather than bundling broader end-user awareness or auxiliary security features, so organizations looking for an all-in-one suite may need to pair it with separate tools. In our case, moving from Avanan to Sublime also meant giving up some nice-to-have features such as geographic threat maps, Shadow IT visibility, and certain built-in reporting elements that were more readily available in the Avanan platform. Review collected by and hosted on G2.com.

I really like that the Sublime Email Security Platform is simple to use and very customizable, which is important for our large and sometimes complex organization. We love that the engineers are also the support team and are always happy to help, whether by jumping on a call or messaging in Teams. It's easy and straightforward to manage, thanks to this hands-off approach where it basically does everything itself. Review collected by and hosted on G2.com.

The only thing I can think of is there's a feature that only processes data in the US (ADE and the ability to automatically share emails with Sublime), whereas we need everything to be processed in the UK. It's just very key for us that everything's in the UK. Review collected by and hosted on G2.com.

I like that the Sublime Email Security Platform feels like an enterprise product and it was really easy to onboard our Google Workspaces account, all for free. I appreciate how it helps filter out malicious and spam content, while also allowing us to whitelist customer email domains and craft specific rules. The comprehensive rules make decision-making straightforward. Additionally, reviewing actions taken by the system has become an important internal security process to ensure we reduce false positives. The platform's interactive wizard automated our setup process, making it very easy to get started, and it feels very complete for the price point, especially since we're under the threshold for free use. Review collected by and hosted on G2.com.

It takes a little bit of trial and error to learn how to apply actions to the 700+ built-in rules, I would of appreciated some additional help/guidance on setting up rule actions from within the console. Review collected by and hosted on G2.com.