The Centralized Detection Model and Its Limits · Blog · Sublime Security

This analysis argues that most email security products follow a Centralized Detection Model (CDM) that forces uniform, vendor-controlled detection logic across customers, producing predictable limits: a detection sensitivity ceiling, blunt global allowlisting causing new blind spots, long Mean Time to Coverage (MTTC) for new techniques, and lack of auditable decision provenance. The authors contend these structural constraints compound over time, favor attackers, and that resolving them requires a Distributed Detection Model (DDM) that enables per-organization, composable, and auditable detection logic.