Material Security protects the cloud office. Its platform secures email, accounts and files in Google Workspace and Microsoft 365, covering phishing protection, account takeover prevention and email data loss prevention for security teams that run their business on those suites.
It connects to the workspace through native APIs rather than sitting in the mail flow as a gateway, and it also governs the third-party apps and AI agents that are given access to workspace data.
At A Glance
| Vendor | Material Security |
|---|---|
| Category | Cloud workspace security (email, accounts, data) |
| Identities covered | Workspace user accounts, OAuth apps and AI agents with workspace access |
| Deployment | API based; fully managed, semi-managed or customer managed; single-tenant option |
| Agentic AI | OAuth Remediation Agent, agentic triage of user reports |
| Customers | Lyft, Figma, Mars, Reddit, Duolingo |
| Certifications | SOC 2 Type II |
| Market classification | Data Security |
What Material Security Does
Email attacks, account compromise and data exposure tend to meet in the same place: the mailboxes, drives and accounts of a cloud workspace. Material Security treats them as one problem. It aims to catch the phishing and impersonation that native Google and Microsoft defences miss, contain an account takeover once it happens, and find sensitive files that are shared too widely.
The link between those areas is identity. The platform ties each user’s identity posture to the sensitivity of the data that account can reach, so sensitive information stays protected even when an attacker holds valid credentials. The same logic extends to AI: tools and agents inherit whatever access the workspace already grants, which is why Material calls workspace security “the cornerstone of AI enablement”.
Products
Email Security
Email Security stops VIP impersonation, business email compromise, vendor email compromise and phishing that gets past built-in filters. When staff report a suspicious message from any source, the module finds every variant across the organisation and deals with them together, and message-level controls protect historical email after an account is breached.
Account Security And ATO Containment
This module is for teams that need to spot a compromised account early and limit what an attacker can do with it.
- Behavioural analytics that treat authentication anomalies as high-confidence signs of compromise
- Monitoring of forwarding rules, mailbox rule changes, brute-force and credential-stuffing logins
- Redaction of sensitive messages and message-level access controls during a compromise
- Posture management that finds and fixes misconfigurations in Google Workspace and Microsoft 365
File Security (Google Drive)
File Security discovers and classifies sensitive data across Google Drive, including PHI and PII, and compares it with sharing permissions to find external or inappropriate sharing. It works with the file owner to fix or justify each exposure, supports bulk remediation and automates native Google labels. That clean-up also prepares Drive for enterprise AI search, so assistants do not surface files they should not.
OAuth Security
Third-party apps and AI agents often get broad, long-lived access through OAuth grants, which attackers also use to hold on to accounts. OAuth Security governs those apps and agents in Google Workspace, keeps real-time activity logs rather than recording only the grant, and can revoke access. The OAuth Remediation Agent uses those logs to work through risky grants and decide what to revoke, so unjustified access is removed without a manual review of every grant.
How It Works
| Component | What it does |
|---|---|
| API connection | The platform connects to Microsoft 365 and Google Workspace through native APIs in minutes, with no agents or end-user installs. Features are switched on in the admin console. |
| Deployment models | Fully Managed runs like conventional SaaS, operated by Material. Semi-managed shares the work, and in Customer Managed, Material only has access to deploy updates. Customers can move between models at any time. |
| Single-tenant instance | An isolated cloud instance keeps each customer’s data separate and owned by the customer. |
| Staged rollout | Rollouts can be staged by user or team, using groups synced from Active Directory, Google or an identity provider. |
| Admin and SOC access | Built-in admin roles, immutable audit logs of admin activity and application events, and SSO into the admin console. A REST API and event subscription model feed detections to SIEM and SOAR platforms. |
Identities And Systems Covered
| Human users | Workspace mailboxes and accounts, with identity posture linked to data sensitivity |
|---|---|
| OAuth apps | Third-party app grants in Google Workspace |
| AI agents | Agents connected to the workspace, controlling what they can read and act on |
| Platforms | Google Workspace (Gmail, Google Drive) and Microsoft 365 (Outlook); OAuth Security and File Security apply to Google Workspace |
Company Background
| Founded | 2017 |
|---|---|
| Headquarters | Redwood City, California |
| Leadership | Ryan Noon, co-founder and CEO |
| Funding | A $100 million Series C at a reported $1.1 billion valuation |
Note: This overview is compiled from Material Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.