Skip to main content

Technical Architecture & Overview

Material Security connects to Google Workspace and Microsoft 365 over API and applies controls across messages, identity, and data. Detection covers BEC and credential phishing, while containment features remove delivered threats, restrict mailbox rules, and govern OAuth application grants. The platform also supports step-up authentication for risky actions such as payroll changes.

Targeted Technical Use Cases

Organizations that want mailbox-level controls and account-takeover containment rather than a traditional gateway.

Evaluation & Trade-offs

Core Strengths

  • +Controls reach beyond message filtering into identity and OAuth governance.
  • +Retroactive remediation of delivered mail.
  • +Deployment works with both major cloud suites.

Trade-Offs & Limitations

  • -Dependent on the cloud email provider APIs.
  • -Enterprise-oriented pricing.

Defensive Security Application

Containing account takeover and removing delivered phishing before users interact with it.

Frequently Asked Questions

What is Material Security?

Material Security connects to Google Workspace and Microsoft 365 over API and applies controls across messages, identity, and data. Detection covers BEC and credential phishing, while containment features remove delivered threats, restrict mailbox rules, and govern OAuth application grants. The platform also supports step-up authentication for risky actions such as payroll changes.

What is Material Security used for?

Organizations that want mailbox-level controls and account-takeover containment rather than a traditional gateway.

What are the strengths of Material Security?
  • +Controls reach beyond message filtering into identity and OAuth governance.
  • +Retroactive remediation of delivered mail.
  • +Deployment works with both major cloud suites.
What are the limitations of Material Security?
  • +Dependent on the cloud email provider APIs.
  • +Enterprise-oriented pricing.
How is Material Security used defensively?

Containing account takeover and removing delivered phishing before users interact with it.