Sublime Security
Editor's PickSerious BEC defense a small team can actually turn on: free for 100 mailboxes, no MX change
score
Visiting through this link may earn us a commission if you sign up, at no extra cost to you. It doesn't change our review, our lowest editorial scores go to vendors who pay us the most for placement just as often as ones who pay us nothing.
Sublime protects the inbox where the 'please update my direct deposit' email lands, and it's our pick for this category because it's the rare one an SMB can adopt without a project or a purchase order. The first 100 mailboxes are genuinely free, it connects to Microsoft 365 or Google Workspace over API without touching your MX records, and you're catching mail in minutes rather than scheduling a migration.
What sets it apart from a spam filter is that its detection engine is open and programmable, detections-as-code. The rules that flag a message are readable, tunable, and shareable, so when Sublime holds an email you can see exactly why: a lookalike sender, a banking-change request that came out of nowhere, tone and urgency that don't fit the person it claims to be from. There's even a free, open-source version of the platform on GitHub for teams that want to self-host and write their own detections. That transparency is the whole point, it's the opposite of a black-box score you're asked to trust.
Two honest caveats. Above 100 mailboxes it's a paid, quote-based subscription, so there's no public number to sanity-check your renewal against. And detections-as-code is only an advantage if someone on your side will actually use it, if nobody will ever read or tune a rule, you're getting a strong default engine and leaving its best feature on the table. If you'd rather a fully hands-off tool and don't mind paying for it, Abnormal is the premium alternative; if you want to start free and grow into the tuning, start here.
Pricing
Genuinely free for your first 100 mailboxes, no credit card and no MX change. Above that it's a paid, quote-based subscription priced per mailbox, contact the vendor for current pricing. A free, open-source self-hosted version of the platform is available on GitHub for teams that want to run and extend it themselves.
| Free (cloud) | $0 for 100 mailboxes no MX change, no credit card |
| Paid (cloud) | Custom, per mailbox quote-based above 100 mailboxes |
| Open source | $0 self-hosted the open Sublime Platform on GitHub |
Features
- First 100 mailboxes protected free
- API deployment on Microsoft 365 and Google Workspace with no MX record change
- Open, programmable detection engine (detections-as-code) you can read and tune
- Behavioral detection of BEC, payroll and vendor diversion, and credential phishing
- Message-query hunting across historical email
- Community-shared detection rules plus a free open-source self-hosted platform
- A real free tier (100 mailboxes) and no MX change, so a small team can switch it on today without a security project
- The open engine shows you why a message was flagged and lets you tune it, no black box
- Targets the behavioral tells of payroll-diversion BEC, the payload-free attacks a spam filter waves through
- Above 100 mailboxes pricing is quote-based, with no public number to compare against
- Detections-as-code only pays off if someone on your side will actually use it
- Still an email-security layer, it stops the request landing convincingly, it doesn't audit payroll records
Small and mid-size teams on Microsoft 365 or Google Workspace that want serious, tunable BEC and payroll-diversion protection they can turn on for free and grow into.
Teams that want a fully hands-off, nothing-to-configure product (look at Abnormal), or anyone who needs a tool that audits payroll data itself rather than the inbox.
Screenshots
Supported countries
Cloud email security, so it works anywhere Microsoft 365 or Google Workspace is used, not limited to the countries listed.
Integrations
Sublime Security alternatives
Tools worth comparing before you commit.
