Josh Kamdjou

Hacking for the Department of Defense

His career started inside government. Sublime's about page says he began working for the Department of Defense in high school and spent 10 years on offensive cyber work and red teaming in the private sector. TechCrunch described him starting as a "white hat" hacker while still a teenager, which is where he learned how criminals used phishing emails.

Testing companies from the attacker's side left him unimpressed with email defenses. Most products worked as closed systems controlled by one vendor, so a new phishing trick stayed open until that vendor shipped an update. Attackers are constantly coming up with new ways of bypassing defenses, he told TechCrunch, adding: The vendor is the bottleneck. He would try a technique one month, return a month later, and the problem would still be there.

He calls himself a builder first. I'm a builder at heart, he said on the Secure Ventures podcast, explaining how a computer science degree and years of attacking networks came together: I'm going to build something that's going to stop me as an attacker and that was the beginning of Sublime.

Two Founders From Maryland

He worked on the idea on nights and weekends around 2017 and 2018, and spent about 18 months building a first version alone before deciding he needed a business partner, he told the podcast. That partner was Ian Thiel, who had been an early product and growth leader at Optimizely and later ran growth, marketing and partnerships at Alto, according to Sublime's about page. In the company's Series B post he wrote that Sublime really began in 2019 with 2 Maryland boys.

The first big customer came early. On the podcast he said Spotify was its first enterprise customer, and that for a time Sublime's website was a single page with a sign-up form for early access. When it launched publicly in February 2023 with $9.8 million led by Decibel, it was based in Washington, D.C., had spent more than a year in private beta and had a waiting list of 2,500 organizations, TechCrunch reported.

Rebuilding After a Bypass

The first design leaned on machine learning models that judged whether an email was good or bad, much like the rest of the industry. It worked until an attack got through. We got bypassed and we had to go heads down and like update our models, he said, and that experience convinced him the approach itself was the problem. Sublime rebuilt its engine around a domain-specific language, a rule language that describes attacker behavior and can be updated almost instantly instead of waiting for a model to be retrained. Our DSL wraps our models so there's full transparency in decision making and there's full control over how those decisions are made, he explained.

He has written that the rebuild cost the company a couple of years. In 2021, a lot of people thought we were crazy. Showing customers the rules, letting them run Sublime in their own cloud and giving it away free all drew skepticism. His case was that the defenders closest to the attacks should share what they learn. Defenders know their networks better than anyone, but we weren't arming them as a community, he told TechCrunch.

Growing Without Cold Calls

Sublime grew mostly by word of mouth. In December 2024 he wrote: We have yet to send a single cold sales email or phone call, or run a single paid ad. The same post said Sublime had protected the Harris presidential campaign from email threats that year, and that it had offered to help the Trump campaign but could not reach it. The free tier helped the spread. Sublime Core is free for organizations protecting fewer than 100 mailboxes, according to Sublime's plans page, and Fast Company credited the free tier with building word of mouth. He sees it as a matter of principle: It was really important to me, as a former practitioner, that we help the broadest set of organizations possible.

The company raised a $60 million Series B led by IVP in December 2024, taking its total to $93.8 million, and hired Colin Jones, previously chief revenue officer at Wiz, as president, according to the announcement. In October 2025 it raised a $150 million Series C led by Georgian, after launching two AI agents that triage reported emails and write new detections, and said annual recurring revenue had doubled in the first half of that year. Explaining the bet on agents, he said: Our adversaries have constraints, like budgets and time, just like defenders do. AI is changing this dynamic, enabling more sophisticated attacks with less effort at scale.

Off the Clock

He lives in Washington, D.C. Outside work he enjoys weight lifting and spending time with his family, according to Sublime's about page.