Material Security

No entries match these filters. Clear filters

1. announced seen Oct 28, 2026 · issue 123

   Material Security adds OAuth auto-classification GA, blast radius cards, investigation sourcing, and rebuilt ATOR reports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable automated OAuth classification so the agent immediately remediates newly-connected malicious apps without analyst queuing.
   📍In the Material console, go to OAuth Agent settings and enable Auto-classify OAuth apps. After saving, Material surfaces a count of apps still holding Suggested classifications — click through and resolve them. Going forward, filter the OAuth apps list by Classification State = Suggested to surface any app awaiting a human decision.
   Quantify the exact data exposure a risky OAuth app has before deciding whether to revoke its tokens.
   📍Open the OAuth app's detail view and review the Blast radius card, which shows the count of sensitive files and messages reachable by the app's connected accounts. Click either count to open the Explorer view and inspect the specific content at risk.
   Produce a leadership-ready PDF summary of Email Identity Protection coverage and held-message outcomes.
   📍In the Material console, open the Email Identity Protection report, verify the service matrix reflects the intended per-service setting (Protect / Block / Detect Only / Disabled) for each mail type, then click Export to PDF.
   • Adds Auto-classify OAuth apps setting (off by default) that automatically applies the OAuth Agent's recommended classification to new and audited app connections and triggers configured remediations without manual review, adds a Classification State filter and column (values: Suggested or Applied) to the OAuth apps list and CSV exports for tracking auto-classification progress, and adds a new OAuth Agent activity report summarising how apps have been classified, which have been remediated, and which require further investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Blast radius card on each OAuth app's detail view showing how much sensitive content (files and messages) the app's connected accounts can reach, with links into the Explorer view
   • OAuth app investigations now show the web searches and sources the OAuth Agent used to reach its verdict, with every claim linking back to its source
   • Adds Vendor Trust Level and Scope Risk Level columns to the OAuth Security Issues view for sorting and filtering apps by reputation and permission breadth
   • Rebuilds the Email Identity Protection report to place every message into exactly one of three mutually exclusive outcomes — delivered without verification, held before delivery, or blocked — with a secondary breakdown of held-message outcomes (retrieved, reported unrequested, failed verification, never attempted, verification outstanding), separates activity by message type (password resets, verification codes, account activations, account access messages), includes a service matrix showing each service's setting (Protect, Block, Detect Only, or Disabled), and adds PDF export for leadership reviews.

   +1 more show less

   • Replaces the previous Email Redaction and Sensitive Content reports with a unified Email Redaction report that includes an estimate of currently redacted messages with a weekly trend, histograms of access requests and retrieved-message age, and a chart of access requests over time
   • Adds Auto-classify OAuth apps setting (off by default) that automatically applies the OAuth Agent's recommended classification to new and audited app connections and triggers configured remediations without manual review, adds a Classification State filter and column (values: Suggested or Applied) to the OAuth apps list and CSV exports for tracking auto-classification progress, and adds a new OAuth Agent activity report summarising how apps have been classified, which have been remediated, and which require further investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Blast radius card on each OAuth app's detail view showing how much sensitive content (files and messages) the app's connected accounts can reach, with links into the Explorer view

   4 more in Everything

2. announced seen Oct 25, 2026 · issue 120

   Material launches a Google Drive Management Agent that investigates sensitive files, assigns verdicts, and automatically remediates over-permissioned sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces the Drive Management Agent, which investigates sensitive Google Drive files across content summary, sensitivity, and collaborator exposure, then assigns one of four verdicts — Cleared, Contained, Exposed, or Overexposed — to determine automated remediation actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports configurable, verdict-based remediations: for example, Exposed files can trigger an owner notification followed by a grace period before access revocation, while Overexposed files can trigger immediate access revocation.
   • Retains manual search, sort, and filter across the full universe of flagged Drive documents for investigations that require human review.
   • Introduces the Drive Management Agent, which investigates sensitive Google Drive files across content summary, sensitivity, and collaborator exposure, then assigns one of four verdicts — Cleared, Contained, Exposed, or Overexposed — to determine automated remediation actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports configurable, verdict-based remediations: for example, Exposed files can trigger an owner notification followed by a grace period before access revocation, while Overexposed files can trigger immediate access revocation.

   1 more in Everything

3. announced Sep 1, 2026 · issue 089

   Material Security expands its Issues API and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server to cover Issues, Messages, Accounts, Groups, Roles, OAuth Apps, and Trusted Entities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Expands the Issues API to cover Issues, Messages, Accounts, Groups, Roles, OAuth Apps, and Trusted Entities as addressable resources for programmatic access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Broadens MCP server tools to work across issues, messages, accounts, and OAuth apps — including updating Trusted Entities (allowlist management) without touching the UI.
   • Overhauled the detection explanation experience on the Issue Details page to give analysts specific technical evidence for why a detection fired.
   • Expands the Issues API to cover Issues, Messages, Accounts, Groups, Roles, OAuth Apps, and Trusted Entities as addressable resources for programmatic access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

4. announced seen Aug 31, 2026 · issue 060

   Material Security adds granular Drive detections, natural-language detection creation, flexible remediation flows, and a file audit log

   • Separates previously combined sensitive-content detections into distinct categories — passwords, payroll information, and social security numbers each now produce their own individual detection — giving analysts a clearer, more actionable risk view
   • Extends natural language search to detection creation, so analysts can describe what they want to detect in plain English and activate it as a live detection without writing MQLMQLA query language created by Microsoft for hunting across telemetry in Microsoft 365 Defender, letting cyber tools express complex behavioral detections in a structured, readable syntax. or building a structured query
   • Introduces configurable remediation flow options for overpermissioned files, letting security teams set the order of notifications, grace periods, and remediation actions to match organizational sharing policies
   • Adds manual remediation actions directly on file issue pages and file detail pages, removing the need to navigate to the detection page to fix over-sharing
   • Introduces a per-file audit log showing every security action taken on a file and when, with forthcoming support for analyst comments on the audit timeline and clearer error messages when an automated remediation step fails

   5 details in Everything

5. announced seen Aug 28, 2026 · issue 058

   Material Security launches an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server exposing list_issues, get_issue, patch_issue, and get_message tools for AI-agent-driven email security triage

   └──▷ HOW TO FIND IT
   Enable the MCP server for your tenant so AI agents can connect to Material's email security tools.
   📍In the Material UI, go to Settings › MCP Server and toggle MCP Server on, then copy the one-click connection snippet for your AI agent harness (e.g. Cursor, Claude, or ChatGPT).
   • Adds an MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) server, enabled via an MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. toggle in settings (defaults to off), exposing four tools to AI agents: list_issues, get_issue, patch_issue, and get_message.
   • Adds new API v1 endpoints underlying the MCP tools, with guaranteed schema parity between the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and the MCP interface — anything callable via MCP can also be called through the REST API.
   • Adds OAuth integration (rolled out in v1.60) so agents authenticate via the existing Material SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./Google/Microsoft login instead of long-lived API tokens; supported agent harnessesagent harnessesThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked. include Cursor, Claude, ChatGPT, Codex, and Grok.
   • Enforces tool-level permissions per authenticated user: patch_issue is hidden from users who lack write access, and get_message is gated by existing message-read permissions; permissions are re-checked at execution time, not just at tool discovery.
   • MCP is gated at the tenant level: if a user has access to multiple tenants, the server is available only when every tenant has explicitly opted in.

   +2 more show less

   • Rate-limits MCP requests per tenant via Redis with fail-fast behavior — a runaway agent receives a clear error immediately rather than queuing silently.
   • Logs every MCP tool call (tool name, parameters, caller identity, success/error, and for patch_issue: status, classification, and remediation changes) to Material's audit log alongside regular API and UI activity.

   7 details in Everything

6. Map Sensitive File Sharing in Drive and Simplify Customization in Material seen Jul 31, 2026 · issue 031

   Material Security adds a Drive sensitive file sharing dashboard, AI-powered file search, and a unified custom detections modal.

   └──▷ HOW TO FIND IT
   Use the Drive sensitive file sharing dashboard to quickly check whether source code or confidential M&A documents are being shared outside the company.
   📍In the Material console, navigate to the Drive sensitive file sharing dashboard, select your content category (e.g., Source Code or Confidential), and review files shared publicly or externally.
   During an employee offboarding, use AI Prompt File Search to locate specific sensitive files the departing employee may still have access to.
   📍In the Material console, open AI Prompt File Search and enter a plain-English description such as "spreadsheet with social media logins shared with [employee name]" to retrieve matching files for remediation.
   Rapidly deploy a new custom detection for a targeted threat without navigating multiple screens.
   📍In the Material console, go to Custom Detections, click New Detection, and use the single modal to define detection criteria and response actions across email and files, then save and deploy.
   • New Drive sensitive file sharing dashboard maps how sensitive files are shared publicly, externally, company-wide, and with trusted external parties, with drill-down by content category.
   • New AI Prompt File Search lets users describe files in plain English to locate sensitive documents in Drive without building structured queries.
   • New Quick File Search provides structured fields to filter Drive files across public, external, and trusted external shares.
   • Redesigned custom detections UX consolidates creation and editing of detections and responses for email and files into a single modal.

   4 details in Everything