The short answer: yes, and there's close to no reason not to
Sublime's first 100 mailboxes are genuinely free, no credit card, no MX record change, connected over API to Microsoft 365 or Google Workspace in minutes. A business under 50 employees, even generously counting shared inboxes and a few departed employees whose mail still gets checked, almost never crosses that number. There's no meaningful cost argument against trying it.
What it actually stops
Payroll diversion is a form of business email compromise, and the FBI tracked $3.05 billion in reported BEC losses in 2025 alone. These emails usually carry no malware and no malicious link, just a convincing ask, which is exactly why a traditional spam filter waves them through: there's nothing technically bad to detect. Sublime models what normal communication looks like for your organization and flags the tell that a spam filter can't see, a banking-change request that doesn't match how that person actually communicates.
What free actually covers
100 mailboxes, $0
No MX change, no credit card, the same behavioral detection engine as the paid tier, not a stripped-down trial.
The one real trade-off
Sublime's detection is open and programmable, detections-as-code, which means you can see exactly why a message was held and tune the rule yourself. That's a genuine advantage over a black-box score, but only if someone on your team will actually open the rule editor. If nobody will, you're still getting a strong default engine for free, which is fine, just know you're leaving the tool's best feature unused. If fully hands-off matters more to you than free, Abnormal is the premium alternative, at real cost.
What to do alongside it, not instead of it
If you're on Microsoft 365 Business Premium, you likely already own Defender for Office 365 Plan 1, turn on its anti-phishing and impersonation policies too, they're complementary, not competing: Defender's strength is malware and malicious links, Sublime's is the payload-free social-engineering email that Defender's defaults tend to miss. And software doesn't replace the free procedural fix: verify every direct-deposit change with a callback to a number you already had on file, never one provided in the request.
Bottom line
Worth it for essentially every business under 50 employees on Microsoft 365 or Google Workspace, it's free at your scale and catches a real, common, expensive attack. See the full BEC protection category for the paid options once you outgrow the free tier.