First, the news: we’ve raised a $20M Series A led by Index Ventures, with participation from existing investors Decibel Partners and Slow Ventures. Jahanvi Sardana from Index is joining Ian and me on the board of directors.
I’m also incredibly excited to share that Dmitri Alperovitch, Co-founder and former CTO of CrowdStrike, is also a new investor and has joined our board as an observer. Shardul Shah (Index) and Dan Nguyen-Huu (Decibel) will round out our board, also as observers.
Now, a story.
“QWERTYUIOP”
The year is 1971 and Ray Tomlinson, a computer programmer working at ARPANET, sends a test message as innocuous as random letters on a keyboard. Little did he know that his program, which he built during his free time, would change the course of history. Years later his invention will be known as “electronic mail”, or “e-mail” for short.
Fast forward over 50 years and email isn’t all that different. Anyone, anywhere on the internet can email anyone, anywhere on the internet. That is the magic of email. It’s what makes it indispensable for businesses and personal use, and also what makes it ripe for abuse.
The Story
In 2019 I pitched Ian a simple idea: I’d spent my career doing offensive cyber work, first for the Department of Defense then in the private sector, and wanted to build a product that would stop me as an attacker. It just so happened that a week before, Ian’s mom fell victim to an email attack, so he felt very close to the problem.
I love building software to solve problems. At the time I had a working product and early traction for a better mouse trap, and we set off to build and grow a company together.
Then the inevitable happened: we missed an attack for one of our customers.
Over the next 12 hours, we went heads down updating our detection models to close the gap, and released the fix.
Then it hit us. If we continued down this path, we will always be the bottleneck. The barrier to sending email attacks is so low, and email environment diversity is so large. There will always be more attackers and more misclassifications than we could ever keep up with. There will always be a long queue of fixes, and work must get prioritized in some way. That leaves customers dealing with repeated missed attacks or false positives for weeks, months, sometimes indefinitely.
We realized that the approach to email security over the past decades, despite seeing tons of incredible innovation, was still fundamentally the same: a black box.
Lessons from EDR
Years ago, we saw Antivirus (AV) in the endpoint space superseded by Endpoint Detection & Response (EDR). EDR supplemented static signature-based detection with behavioral detection and machine learning, and also gave defenders the ability to do their own detection and response.
EDR gave defenders: (1) better detection and (2) more control.
This is what we wanted Sublime to do for email.
Sublime is taking a novel approach to disrupt the email security market, a space that is long overdue for a disruption. With its focus on ease of use and deep integrations with native cloud platforms, they are displacing legacy ineffective and cumbersome solutions.
- Dmitri Alperovitch, Co-founder and former CTO, CrowdStrike
We went back to the drawing board and re-built the platform from the ground up. The foundation: Message Query Language (MQL), a fully transparent and customizable swiss army knife to control the entirety of our detection engine, including our machine learning models, behavioral enrichments, and anything else you can think of.
After a couple years of building hand-in-hand with a few incredible design partners, we publicly launched Sublime in February 2023 — 14 months ago.
We open-sourced our core detections and made Sublime free and self-hostable so that the community, for the first time, had a common framework and language they could use to collaborate against email threats.
The Present
Today, there are hundreds of Core and Enterprise Sublime deployments running around the world, and we’ve prevented millions of email-borne attacks for our customers and the broader community.
Since launch we’ve open sourced hundreds of detections for new attack techniques, from QR code phishing to Pikabot to BEC. We’ve released many new ML models, all transparently exposed and controllable via our detection engine, from Attack Score to LogoDetect to Natural Language Understanding (NLU). And we’ve shipped thousands of product improvements to make the platform more usable than ever.
We’ve done this all with a very small, but veteran team (~20 humans at the start of 2024) and without a single cold sales email.
Having spent my career in infosec, I wanted to build a different kind of security company. One that didn’t resort to shady sales tactics and selling snake oil. One that showed its work and proved its value.
Our Analyzer and our open source detections are how we show our work, and how many folks initially hear about us. Our open detection engine gives people a level of control, visibility, and transparency they’ve never had before over their email environment. And since MQL is interoperable across Microsoft and Google, it’s enabled the broader community to collaborate against emerging threats using detection-as-code.
For folks who don’t actually care about any of those things, it’s just really good at detecting bad stuff.
The ability to automate remediations with high confidence and minimize manual reviews unlocks a new level of efficiency in our SOC. It’s hard to imagine going back to life before Sublime.
- JJ Agha, CISO, FanDuel
Why? Well, when we started off as a black box, we encountered 3 fundamental challenges that all black boxes run into:
- The vendor bottleneck problem. When there’s a misclassification, the only way it’s addressed is if the vendor pushes an updated model.
- The one-size-fits-all problem. Email environments are highly unique across verticals and companies, so globally trained models must work for everyone. There’s always false positives or false negatives in environments that don’t look like the average.
- The all-or-nothing problem. You’re either running the models, or you’re not. There’s not much else you can do as a user if you run into false positives.
We set out to address these by making Sublime:
- Rapidly adaptable. Organizations and the broader community can side step the vendor to address issues. The Sublime Team is never the bottleneck while our ML and Detection teams work on improving our models the same as every other email security company.
- Tailored. Org-specific signals are unique to each environment, and detections and response actions can be customized further.
- Granular. Individual detections can be turned on or off when there are false positives, or instantly mitigated using rule-level exclusions.
This leads to a more effective solution over time. And we can automate more of this over time, too. Our goal is a balance between automation (machine learning) and customizability (rules) that can address a range of user’s needs.
At first, Sublime was only really usable by sophisticated organizations capable of using MQL, like Fortune 500s or highly technical security teams. Today, that’s no longer the case. Even one-person IT teams with tens of thousands of mailboxes are using Sublime today, who never look at or care about our detections, because it “just works” and saves them time.
There’s still a lot of work to do, but it’s been pretty awesome to see the diversity of adoption as the product has matured.
The Future
We will continue building the best possible email security product and growing the incredible Sublime community.
This means we'll double down on investing in both our free (Core) and paid (Enterprise) offerings.
We’re often asked why we give so much away for free with Sublime Core, or what the catch is. There are many reasons I could give you, but the best one to actually convince you is quite simple: it’s good business. The more people running Sublime, the more detections are shared, the more valuable Sublime is for everyone.
So we’ll continue to make Core really valuable and hope everyone, everywhere is running Sublime one day.
As we look ahead, the email threat landscape will continue to evolve as it always has. Generative AI lowers the barrier even further while increasing campaign sophistication and reach. We’ve started to see these convincing attacks in the wild: completely fabricated message threads with perfect English, discussing a chain of events that never took place, asking for a "missing payment" for the Gala that never happened.
Most new technologies eventually find their way into the hands of attackers, and AI is no different.
Sublime was built for this future.
It’s just the beginning for us.
It’s day 1.
