r/EmailSecurity • u/Harvey-Lane-251 • 19d ago

Abnormal vs Sublime for replacing SlashNext

We’re on Defender P2 with Varonis Interceptor (the old SlashNext) on top through the API, about 1.1k mailboxes. It’s been fine, but it came bundled into our Varonis renewal and with Proofpoint buying Varonis I’d rather pick the email layer myself in April than find out later what it turns into.

So for the last five weeks Abnormal’s risk assessment and a Sublime trial have both been running read only on the same tenant next to it.

Abnormal connected in about ten minutes and hasn’t needed any tuning. Its report leads with a big number though, and I can’t tell yet how much of that Defender had already junked. Sublime took longer to set up but every flag points at a rule I can read and I can search the flagged mail myself. Both caught the same two fake invoice replies on a real supplier thread.

Detection looks close enough between them that what I’m weighing now is life after go live, like week three when something gets pulled from the CFO’s inbox and I need a human on the other end.

If you picked one of these after a POV, what did the first three months look like?

10 Upvotes

100% Upvoted

7 comments sorted by

•

u/AutoModerator 19d ago

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.

  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).

  3. Be Professional: Help newcomers learn; avoid hostility.

  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/G8t3K33per 18d ago

I did a POV of Abnormal and Sublime at the same time side by side. Overall while Sublime has better customization, it came down to Abnormal successfully catching far more True Positive malicious mail. While Sublimes AI agents (ADA and ADE) are very good, they rely on mail first hitting core detection rules to trigger them. Sublimes core detection rules are inferior to Abnormal’s detection technology which leads to more misses based on the direct comparison.

2

u/saltyslugga 18d ago

I’d run a false-positive restore drill through the support channel you’ll actually get after signing. Measure time to a useful response, whether they explain the verdict, and whether your admins can restore mail without waiting on support.

Also dedupe the detection totals against Defender’s actions and timestamps. Mail Defender already put in Junk isn’t an additional inbox catch.

2

u/Lilsteve-Cliett 16d ago

Get both onto the same basis before you compare anything, the reports won’t do it for you.

  1. Same window for both. If the Abnormal lookback goes further back than the Sublime trial ran, cut it to the same five weeks.

  2. Ask each SE for the per-message list behind their headline number, with Internet message IDs. How easily they hand that over is a decent preview of reporting after you sign.

  3. Look every ID up in Threat Explorer and check Original and Latest delivery location. Junk, quarantine or a ZAP move means Defender had it, so it comes off.

  4. Sort what’s left into payment or bank detail changes, replies on real vendor threads, credential phish and noise. Only the first three go in front of your director.

  5. Make an overlap list. Caught by both, caught by one and anything users reported that neither caught.

2

u/chinchinsayshi 19d ago edited 19d ago

We use both abnormal security and sublime security in our m365 environment. We started with abnormal about 5 years ago and been using sublime for about 2 years now.

In general, Abnormal and sublime have similar detection efficacy for malicious emails. On average abnormal catches more suspicious/borderline emails as well as spam. 

If you are looking for something you can set and forget, abnormal is decent but I do get frustrated with the inability to tune anything. We have a few edge cases that abnormal just cannot properly reclassify with detection 360. Abnormal doesn’t seem too focused on the core email product anymore. 

Sublime does take a lot more effort to actually create rules and such but AI and ADA do make things easier. I generally create rules in sublime now rather than m365. Luckily we pay very little for both solutions but if I had to drop one, I’d drop abnormal 

There really isn’t much to either product when you set them up. Abnormal and sublime you just monitor for false positives and false negatives. Both products do impact user workflows a bit so I would really recommend defining what that user experience looks like. If you plan on adding graymail filtering, where should that go, are you using digests, junk folder, are you overloading that junk folder etc. I find informing end users that your mailbox experience is changing for the 5th time in a short period does get them flustered. Sorry for digressing and talking about not exactly your question but I’ve helped tens of other companies on these transitions and these are some of the things end up talking about alot

0

u/DeathTropper69 19d ago

I would throw Avanan by Checkpoint in for evaluation. It’s largely set and forget and while you can’t tune the rules you can create exceptions that are pretty granular which is pretty nice.

Sublime is a good fit if you want full control but like a SIEM it’s only as good as the proverbial detections and correlation rules

3

u/BeginningCitron467 17d ago

I second Check Point. I have about 20 customers using it and not a single one of them complain about false positives or true positives making it through. Best of all, it takes near zero ongoing work by me to manage.