Snowflake reimagines email security with Sublime

Snowflake, a leading AI Data Cloud provider enabling thousands of global organizations to share data, build applications, and power their businesses with AI, is committed to constantly enhancing its cloud email security posture and using cutting edge solutions particularly to obtain greater visibility into email threats and avoid false positives.

After implementing Sublime, Snowflake observed a decrease in false positives and the overall time spent managing email security.

Sublime gives us the ability to use our email security solution across the organization in ways we previously couldn't. It is easy, effective, and evolves with the threat landscape.

Haider Dost

Head of Global Threat Detection and Threat Intelligence

Snowflake's prior email security solutions, while effective, took a one-size-fits-all approach that did not provide the flexibility that was desired for its sophisticated environment.

When it came to defense in depth controls, the team wanted the ability to customize banners, decode rewritten URLs, perform advanced attachment analysis, and more at the email level to align with the organization’s overall security strategy.

The security team faced growing requests from across their SOC, IT, Threat Intelligence, and Threat Detection teams for greater visibility into the types of email-based threats Snowflake was receiving. They wanted to fully automate their abuse mailbox process but found their previous solution lacked the flexibility and control necessary to achieve meaningful automation.

With Sublime, we're now working with our email security tool, not around it. Plus we're automating more around email security than we previously thought was possible.

Haider Dost

Head of Global Threat Detection and Threat Intelligence

With Sublime, the team has confidence in their overall email security posture as they are not having to work around their email security solution.  Sublime provides the team with advanced threat detection capabilities and the ability to integrate with existing workflows.

Adaptive, transparent, and effective detection from day one

Snowflake's rigorous selection criteria aimed at significantly improving email threat visibility, operational efficiency, and overall security posture.

The Snowflake team was hands-on with Sublime at the start of the proof of concept (POC), and immediately had historical production data to review Sublime's efficacy.

Phishing is still a top attack vector across the industry and there’s no silver bullet solution. To effectively combat the evolving threat landscape, you need a partner that can empower security teams to build tailored detections for your organization.

Haider Dost

Head of Global Threat Detection and Threat Intelligence

From a Threat Intelligence perspective, Sublime is offering us a whole new paradigm in detection opportunities and controls. Leveraging Sublime's API, we can push our collections of indicators to include domains, IPs, hashes, etc. to Sublime and have immediate enforcement and blocking in real time.

Haider Dost

Head of Global Threat Detection and Threat Intelligence

The Threat Intelligence team can now extract Indicators of Compromise (IOCs) from Sublime and feed them into other detections from other data sources.

Once deployed, the extensibility of the Sublime platform quickly became apparent. The Snowflake team found it straightforward to integrate Sublime with their existing security stack and workflows through open APIs that allowed them to utilize email insights for additional observability.

The relationship with Sublime has proven to be a true partnership. When the Snowflake team observes a new email threat, the Sublime team responds within hours, establishing a built-in feedback loop for continuous improvement.

Across our security organization we value technology and partnership equally. Sublime gives us the best of both worlds.

Haider Dost

Head of Global Threat Detection and Threat Intelligence

Looking ahead, the Snowflake team has high confidence that Sublime will continue to protect them from evolving email threats, allowing them to focus on other critical security priorities.