Abstract: A system, method, and computer-program product includes transmitting, to an autonomous artificial intelligence (AI) agent, message data of an electronic message that evaded a set of threat detection instructions provided by a threat detection and response service, detecting, based on the autonomous AI agent assessing the message data of the electronic message, a message signature associated with the electronic message, determining, based on the autonomous AI agent assessing the message signature against the set of threat detection instructions, a detection gap resolution operation to resolve a detection gap identified within the threat detection and response service, generating, using a language model associated with the autonomous AI agent and in accordance with the detection gap resolution operation, a candidate threat detection instruction, and iteratively modifying, by the autonomous AI agent, the candidate threat detection instruction over a plurality of iterations to generate a production-ready threat d
Type:
Application
Filed:
June 15, 2026
Publication date:
October 1, 2026
Applicant:
Sublime Security, Inc.
Inventors:
Joshua Kamdjou, Ian Thiel, Ross Wolf, Anna Bertiger, Bobby Filar, Aryan Luthra, Stefano Meschiari, Aiden Mitchell, Sam Scholten, Vivek Sharath
Abstract: A system, method, and computer-program product includes detecting an electronic communication transmitted to a message storage repository monitored by a threat detection and response service, retrieving unstructured message data of the electronic communication in response to detecting the transmission of the electronic communication to the message storage repository, transforming the unstructured message data of the electronic communication into a structured message data object interpretable by the threat detection and response service, assessing the structured message data object that corresponds to the electronic communication against a set of subscriber-agnostic threat detection instructions provided by the threat detection and response service and a set of subscriber-composable enrichments that include subscriber-composed threat detection instructions, automatically detecting the electronic communication as malicious based on the assessment, and executing a threat mitigation action that mitigates a securi
Abstract: A system, method, and computer-program product includes detecting an electronic communication transmitted to a message storage repository monitored by a threat detection and response service, retrieving unstructured message data of the electronic communication in response to detecting the transmission of the electronic communication to the message storage repository, transforming the unstructured message data of the electronic communication into a structured message data object interpretable by the threat detection and response service, assessing the structured message data object that corresponds to the electronic communication against a set of subscriber-agnostic threat detection instructions provided by the threat detection and response service and a set of subscriber-composable enrichments that include subscriber-composed threat detection instructions, automatically detecting the electronic communication as malicious based on the assessment, and executing a threat mitigation action that mitigates a securi
Abstract: A system, method, and computer-program product includes detecting an electronic communication transmitted to a message storage repository monitored by a threat detection and response service, retrieving unstructured message data of the electronic communication in response to detecting the transmission of the electronic communication to the message storage repository, transforming the unstructured message data of the electronic communication into a structured message data object interpretable by the threat detection and response service, assessing the structured message data object that corresponds to the electronic communication against a set of subscriber-agnostic threat detection instructions provided by the threat detection and response service and a set of subscriber-composable enrichments that include subscriber-composed threat detection instructions, automatically detecting the electronic communication as malicious based on the assessment, and executing a threat mitigation action that mitigates a securi