Sublime Security
Editor's PickSerious BEC defense a small team can actually turn on: free for 100 mailboxes, no MX change
score
Visiting through this link may earn us a commission if you sign up, at no extra cost to you. It doesn't change our review, our lowest editorial scores go to vendors who pay us the most for placement just as often as ones who pay us nothing.
Sublime protects the inbox where the 'please update my direct deposit' email lands, and it's our pick for this category because it's the rare one an SMB can adopt without a project or a purchase order. The first 100 mailboxes are genuinely free, it connects to Microsoft 365 or Google Workspace over API without touching your MX records, and you're catching mail in minutes rather than scheduling a migration.
What sets it apart from a spam filter is that its detection engine is open and programmable, detections-as-code. The rules that flag a message are readable, tunable, and shareable, so when Sublime holds an email you can see exactly why: a lookalike sender, a banking-change request that came out of nowhere, tone and urgency that don't fit the person it claims to be from. There's even a free, open-source version of the platform on GitHub for teams that want to self-host and write their own detections. That transparency is the whole point, it's the opposite of a black-box score you're asked to trust.
Two honest caveats. Above 100 mailboxes it's a paid, quote-based subscription, so there's no public number to sanity-check your renewal against. And detections-as-code is only an advantage if someone on your side will actually use it, if nobody will ever read or tune a rule, you're getting a strong default engine and leaving its best feature on the table. If you'd rather a fully hands-off tool and don't mind paying for it, Abnormal is the premium alternative; if you want to start free and grow into the tuning, start here.
Is Sublime Security Worth It for a Business Under 50 Employees?
The email asking HR to “update my direct deposit” doesn't check your headcount first. It costs the same to send to a 12-person company as a 1,200-person one, and it's now the most common way businesses lose money to payroll fraud. Sublime is free up to 100 mailboxes, which covers most of the businesses this site is written for.
Short answer: yes, with almost no reason not to
Sublime's first 100 mailboxes are free: no credit card, no MX record change, connected over API to Microsoft 365 or Google Workspace in minutes. A business under 50 employees almost never crosses 100, even counting shared inboxes and a few former employees whose mail is still monitored. There's no real cost argument against trying it.
What it stops
Payroll diversion is a form of business email compromise, and the FBI recorded $3.05 billion in reported BEC losses in 2025. These emails usually carry no malware and no malicious link, just a convincing ask, which is why a traditional spam filter lets them through. There's nothing technically bad to detect. Sublime models what normal communication looks like at your organization and flags what a spam filter can't see: a banking-change request that doesn't match how that person usually writes.
What free actually covers
100 mailboxes, $0
No MX change, no credit card, and the same behavioral detection engine as the paid tier. Not a stripped-down trial.
The one real trade-off
Sublime's detection is open and programmable (detections as code), so you can see exactly why a message was held and tune the rule yourself. That beats a black-box score, but only if someone on your team will open the rule editor. If nobody will, you still get a strong default engine for free; you're just leaving its best feature unused. If fully hands-off matters more to you than free, Abnormal is the premium alternative, at real cost.
Run alongside it, not instead
If you're on Microsoft 365 Business Premium, you likely already own Defender for Office 365 Plan 1. Turn on its anti-phishing and impersonation policies too. The two cover different ground: Defender is strong on malware and malicious links, Sublime on the payload-free social-engineering email Defender's defaults tend to miss. And no software replaces the free procedural fix: verify every direct-deposit change by calling a number you already had on file, never one given in the request.
Bottom line
If you're under 50 employees on Microsoft 365 or Google Workspace, turn it on. It's free at that size, and the attack it catches is common and expensive. The BEC protection list covers the paid options for when you outgrow the free tier.
Pricing
Genuinely free for your first 100 mailboxes, no credit card and no MX change. Above that it's a paid, quote-based subscription priced per mailbox, contact the vendor for current pricing. A free, open-source self-hosted version of the platform is available on GitHub for teams that want to run and extend it themselves.
| Free (cloud) | $0 for 100 mailboxes no MX change, no credit card |
| Paid (cloud) | Custom, per mailbox quote-based above 100 mailboxes |
| Open source | $0 self-hosted the open Sublime Platform on GitHub |
Features
- First 100 mailboxes protected free
- API deployment on Microsoft 365 and Google Workspace with no MX record change
- Open, programmable detection engine (detections-as-code) you can read and tune
- Behavioral detection of BEC, payroll and vendor diversion, and credential phishing
- Message-query hunting across historical email
- Community-shared detection rules plus a free open-source self-hosted platform
- A real free tier (100 mailboxes) and no MX change, so a small team can switch it on today without a security project
- The open engine shows you why a message was flagged and lets you tune it, no black box
- Targets the behavioral tells of payroll-diversion BEC, the payload-free attacks a spam filter waves through
- Above 100 mailboxes pricing is quote-based, with no public number to compare against
- Detections-as-code only pays off if someone on your side will actually use it
- Still an email-security layer, it stops the request landing convincingly, it doesn't audit payroll records
Small and mid-size teams on Microsoft 365 or Google Workspace that want serious, tunable BEC and payroll-diversion protection they can turn on for free and grow into.
Teams that want a fully hands-off, nothing-to-configure product (look at Abnormal), or anyone who needs a tool that audits payroll data itself rather than the inbox.
Screenshots
Supported countries
Cloud email security, so it works anywhere Microsoft 365 or Google Workspace is used, not limited to the countries listed.
Integrations
Sublime Security alternatives
Tools worth comparing before you commit.
