Work
Giving a security agent the right amount of control I lead design for ADÉ, Sublime’s agent that writes detection rules to address missed threats.
When 2025 to now
Role Staff Product Designer
Team 1 PM, engineers, 2 designers
Outcome New rule in under 2 hours, not days Agents ADÉ Action required: payroll profile verification Action required: payroll profile verification
Job ID: 019f3d5a-ff42-7706-b615-a83297b00479 ADÉ Recommended Rule
99% match in a 14-day hunt, with 40 malicious matches and 2 possible false positives.
Accept Reject
Rule Name Credential phishing: payroll QR code lure with newly registered domain
Severity High Severity
Description Detects inbound payroll-themed messages that contain QR-code links to newly registered credential-harvesting domains.
Labels Credential Phishing QR code Social engineering
Rule MQL 1 type .inbound 2 and any (attachments ,3 .file_extension in~ ("png" , "jpg" , "jpeg" , "pdf" ) 4 and any (file.explode (.), 5 .scan.qr.type == "url" 6 and ml.link_analysis (.scan.qr.data ).credphish.disposition == "phishing" 7 ) 8 ) 9 and any (ml.nlu_classifier (body.current_thread.text ).intents ,10 .name in ("payroll" , "credential_theft" ) 11 and .confidence in ("medium" , "high" ) 12 ) 13 and network.whois (sender.email.domain ).days_old <= 45
ADÉ hunted across 14 days and found 0 message groups (0 total messages)
Recommended Rule is a 0% 0 malicious matches and may introduce 0 false positives (Benign). 0 Malicious0 Spam0 BenignSubject Sender Received ASA Verdict
Action required: payroll profile verification payroll-security@adp-verify.com Jul 2 New direct deposit document shared with you hr-notify@payroll-docs.co Jul 1 Reminder: update your payroll information benefits@company-payroll-support.net Jun 29 Showing 3 of 43 message groups
ADÉ worked for 48m
Patrick Morgan triggered ADÉ at Jul 3, 2026, 2:12 PM
Subject Action required: payroll profile verification Sender payroll-verify@employee-benefits.co Recipient alex.morgan@acme.com ASA Verdict ADÉ writes a rule your team can read Each missed threat needed a new rule An engineer wrote and tested each rule by hand, so a fix took days or weeks.
User Reports Action required: payroll profile verification Action required: payroll profile verification
From Payroll Operations <payroll-verify@employee-benefits.co>To alex.morgan@acme.com
Executive Summary This message impersonates Payroll Operations and urges the recipient to verify their payroll profile through an unfamiliar domain. The sender fails DMARC, does not align with the organization’s trusted HR infrastructure, and uses credential-harvesting language under the pretext of an upcoming pay cycle.
Matched Detection Rules (0)
No Detection Rules matched this message group.
Message Content
User View Text View HTML View EML View
CAUTION: This message originated outside of your organization.
From: Payroll Operations <payroll-verify@employee-benefits.co>
Action required
Your payroll profile requires verification before the next pay cycle. Review and confirm your direct deposit details to avoid a delay in payment.
Review Status
Review Status ⚠ Unreviewed
ASA marks the message malicious, and no rule caught it The agent writes rules that people can read and change Other vendors update a central model. ADÉ writes a rule each team can read, edit and turn off.
Agents ADÉ Action required: payroll profile verification Action required: payroll profile verification
Job ID: 019f3d5a-ff42-7706-b615-a83297b00479 Patrick Morgan accepted and activated the recommended ruleJul 3, 2026, 3:00 PM
Rule Detail Credential phishing: payroll QR code lure with newly registered domain Flagged Message View Flagged Messages ADÉ Recommended Rule
99% match in a 14-day hunt, with 40 malicious matches and 2 possible false positives.
Accept Reject
Rule Name Credential phishing: payroll QR code lure with newly registered domain
Severity High Severity
Description Detects inbound payroll-themed messages that contain QR-code links to newly registered credential-harvesting domains.
Labels Credential Phishing QR code Social engineering
Rule MQL 1 type .inbound 2 and any (attachments ,3 .file_extension in~ ("png" , "jpg" , "jpeg" , "pdf" ) 4 and any (file.explode (.), 5 .scan.qr.type == "url" 6 and ml.link_analysis (.scan.qr.data ).credphish.disposition == "phishing" 7 ) 8 ) 9 and any (ml.nlu_classifier (body.current_thread.text ).intents ,10 .name in ("payroll" , "credential_theft" ) 11 and .confidence in ("medium" , "high" ) 12 ) 13 and network.whois (sender.email.domain ).days_old <= 45
ADÉ hunted across 14 days and found 0 message groups (0 total messages)
Recommended Rule is a 0% 0 malicious matches and may introduce 0 false positives (Benign). 0 Malicious0 Spam0 BenignSubject Sender Received ASA Verdict
Action required: payroll profile verification payroll-security@adp-verify.com Jul 2 New direct deposit document shared with you hr-notify@payroll-docs.co Jul 1 Reminder: update your payroll information benefits@company-payroll-support.net Jun 29 Showing 3 of 43 message groups
ADÉ worked for 48m
Patrick Morgan triggered ADÉ at Jul 3, 2026, 2:12 PM
Subject Action required: payroll profile verification Sender payroll-verify@employee-benefits.co Recipient alex.morgan@acme.com ASA Verdict Accept Recommendation
This will create the recommended detection rule and apply an Auto-Quarantine action. You’ll be able to edit the Rule at any time after it’s created.
Leave a comment (optional) Comment
Cancel Accept & Activate Rule
ADÉ recommends a rule, with the hunt that tested it The agent starts where the team finds the threat One click beside the verdict starts a job, and the job page shows each step ADÉ does.
User Reports Action required: payroll profile verification Action required: payroll profile verification
From Payroll Operations <payroll-verify@employee-benefits.co>To alex.morgan@acme.com
Executive Summary This message impersonates Payroll Operations and urges the recipient to verify their payroll profile through an unfamiliar domain. The sender fails DMARC, does not align with the organization’s trusted HR infrastructure, and uses credential-harvesting language under the pretext of an upcoming pay cycle.
Matched Detection Rules (0)
No Detection Rules matched this message group.
Message Content
User View Text View HTML View EML View
CAUTION: This message originated outside of your organization.
From: Payroll Operations <payroll-verify@employee-benefits.co>
Action required
Your payroll profile requires verification before the next pay cycle. Review and confirm your direct deposit details to avoid a delay in payment.
Review Status
Review Status ⚠ Unreviewed
ADÉ (Autonomous Detection Engineer)
ADÉ recommends new Detection Rules for malicious, spam, or graymail messages that do not match any Detection Rules. One click starts ADÉ
View Report ADÉ waits on the same page as the verdict Each rule shows what it would catch before it goes live ADÉ runs each rule on the last 14 days of email and shows what it catches and wrongly blocks.
Agents ADÉ Action required: payroll profile verification Action required: payroll profile verification
Job ID: 019f3d5a-ff42-7706-b615-a83297b00479 ADÉ auto-accepted and activated the recommended ruleJul 3, 2026, 3:00 PM
Rule Detail Credential phishing: payroll QR code lure with newly registered domain Flagged Message View Flagged Messages ADÉ Recommended Rule
99% match in a 14-day hunt, with 40 malicious matches and 2 possible false positives.
Accept Reject
Rule Name Credential phishing: payroll QR code lure with newly registered domain
Severity High Severity
Description Detects inbound payroll-themed messages that contain QR-code links to newly registered credential-harvesting domains.
Labels Credential Phishing QR code Social engineering
Rule MQL 1 type .inbound 2 and any (attachments ,3 .file_extension in~ ("png" , "jpg" , "jpeg" , "pdf" ) 4 and any (file.explode (.), 5 .scan.qr.type == "url" 6 and ml.link_analysis (.scan.qr.data ).credphish.disposition == "phishing" 7 ) 8 ) 9 and any (ml.nlu_classifier (body.current_thread.text ).intents ,10 .name in ("payroll" , "credential_theft" ) 11 and .confidence in ("medium" , "high" ) 12 ) 13 and network.whois (sender.email.domain ).days_old <= 45
ADÉ hunted across 14 days and found 0 message groups (0 total messages)
Recommended Rule is a 0% 0 malicious matches and may introduce 0 false positives (Benign). 0 Malicious0 Spam0 BenignSubject Sender Received ASA Verdict
Action required: payroll profile verification payroll-security@adp-verify.com Jul 2 New direct deposit document shared with you hr-notify@payroll-docs.co Jul 1 Reminder: update your payroll information benefits@company-payroll-support.net Jun 29 Showing 3 of 43 message groups
ADÉ worked for 48m
Patrick Morgan triggered ADÉ at Jul 3, 2026, 2:12 PM
Subject Action required: payroll profile verification Sender payroll-verify@employee-benefits.co Recipient alex.morgan@acme.com ASA Verdict With automation on, the rule arrives with its hunt result Each team decides how much the agent does alone A team sets when ADÉ starts a job and the test score a rule needs to go live.
Agents ADÉ ADÉ Automation ADÉ Automation
Automatically run ADÉ and accept generated rules when validation meets your threshold.
Author Sublime Security
Status Configure ADÉ Jobs
Choose, by verdict, when ADÉ starts on its own and when it accepts the rule it writes.
Verdict Auto-start ADÉ job Alerts Rule auto-acceptance threshold
No Alert Require review No Alert Require review No Alert Require review At first, ADÉ runs only when someone starts it Missed threats now get a rule in under 2 hours A fix that took an engineer days or weeks now arrives as a rule ready to accept.
Agents ADÉ ADÉ (Autonomous Detection Engineer)
Creates detections tailored to your environment.
Go to Settings Performance (Last 30 days)
Jobs
All recommendation statuses Message Subject ASA Verdict Started By Started Report Status Recommendation Status
Invoice payment confirmation required today ADÉ 9h ago — Benefits enrollment form from rare sender ADÉ 18h ago DocuSign: updated employee handbook signature request AJ Williams 1d ago Action required: payroll profile verification ADÉ 1d ago Calendar invite with external benefits link AJ Williams 1d ago Urgent wire transfer details for review ADÉ 2d ago Shared voicemail transcript is ready Fatima Al-Sayed 12d ago Payroll QR credential harvest report ADÉ 15d ago ADÉ’s page: the time to cover a missed threat, and the jobs behind it 
Sublime Security