Material Security
Material Security protects Google Workspace and Microsoft 365 email, files, OAuth apps, and accounts in one API-deployed platform.
Material covers more of the workspace attack chain than a secure email gateway does, and the OAuth work — real-time activity logs, agentic investigation and revocation, plus its 22,000-app OAuth Risk Report — is where it genuinely leads generic email security. The $4 and $6 per user/month rates are billed annually and carry a Shared Drive size fee that's the real pricing wildcard. Compare it against native Google and Microsoft controls plus a standalone SEG before you sign; skip it if your mail
Verified 9h ago · liveness 80/100 · cite: rightaichoice.com/tools/material-security
- Security teams running Google Workspace or Microsoft 365 as the core business platform
- Organizations consolidating off a legacy secure email gateway onto an API-deployed product
- Teams drowning in user-reported phishing tickets that need automated triage
- Security leaders who need visibility into shadow AI and third-party OAuth access
- On-premises or non-cloud email environments outside Google Workspace and Microsoft 365
- Small businesses that only need basic spam and phishing filtering at the lowest possible cost
- Organizations already satisfied with native Google or Microsoft controls and no appetite for another security platform
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Material Security if your mail isn't in Google Workspace or Microsoft 365, or if you only need gateway-style filtering and have no interest in OAuth governance or sensitive-content discovery in Drive.
Both Essentials and Advanced add a fee based on Shared Drive size on top of the per-user rate, so the headline $4 or $6 per user/month billed annually is not your final bill if your Drive estate is large.
Essentials at $4 per user/month billed annually is priced to undercut a legacy secure email gateway while adding file, OAuth, and posture coverage; Advanced at $6 per user/month billed annually is where content-level sensitive data detection lives. ATO Resilience adds $3 per user/month as an add-on or $5 per user/month stand-alone, both billed annually. Both base tiers also carry a Shared Drive size fee. Enterprise is custom with volume discounts. This sits below enterprise SaaS-security
In short
Material Security — Material Security protects Google Workspace and Microsoft 365 email, files, OAuth apps, and accounts in one API-deployed platform. Best for Security teams running Google Workspace or Microsoft 365 as the core business platform, Organizations consolidating off a legacy secure email gateway onto an API-deployed product, Teams drowning in user-reported phishing tickets that need automated triage. Plans from $3/user/mo.
No head-to-head comparison for Material Security yet — the alternatives below are the closest matches we list.
What's new in Material Security
Checked 7 days agoAcross the latest 2 updates: 1 feature update and 1 news mention.
The Access You Forgot You Granted: Material's OAuth Risk Report
Material analyzed 22,000+ OAuth apps and found AI adoption bypassing security and IT, thousands of active zombie tokens still holding scopes, and restricted scopes in circulation.
Material's MCP Server: Cloud Workspace Security for AI Agents and Agentic Workflows
Material introduced an MCP Server that lets AI agents autonomously manage cloud workspace security, triaging and remediating issues without custom integration code.
What people actually say about Material Security — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
20 mentions across 2 sources (Hacker News, Lemmy) · researched Oct 10, 2026.
Weighted by the 28 posts each of 2 sources contributed.
- +API-based deployment is genuinely fast — one case reports integration in about six minutes
- +Covers email, files, accounts, OAuth, and posture in one platform rather than bolted-on point tools
- +OAuth activity logs capture what apps do post-grant, not just grant events
- +Flexible email remediations — banners, link speedbumps, spam marking, or deletion
- +Automated triage of user-reported phishing kills a tedious manual analyst task
- −There is almost no independent community feedback to corroborate vendor claims
- −Pricing hides a Shared Drive size fee that can dwarf the per-user rate
- −Google and Microsoft native security keeps absorbing parts of this feature set
- −Aggressive auto-deletion and revocation risk breaking legitimate workflows
- −Coverage is limited to Google Workspace and Microsoft 365 tenants only
- • Shared Drive size fee means cost scales with storage, not just seats — a large tenant pays substantially more than the headline rate
- • Full value requires Advanced-tier pricing plus ATO Resilience if account takeover coverage is a requirement
- • Mixing email, file, and OAuth protection as a bundle means you cannot easily cherry-pick a single cheap module
- • Annual-only billing removes monthly flexibility and creates commitment risk for an unproven vendor
Viability Score
How well maintained and how widely used is Material Security? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →Key Features
- Inbound email threat detection and response for phishing, BEC, impersonation, and fraud
- Automated agent triage of user-reported phishing
- Flexible email remediations: banners, link and attachment speedbumps, spam marking, deletion
- Detection and remediation of email bomb and harassment campaigns
- Email threat hunting with custom detections
- Employee phishing simulations, speedbumps, and reporter acknowledgement
- OAuth app inventory with dynamic scopes and users
- Real-time OAuth activity logs, not just grant events
- OAuth Remediation Agent for agentic investigation, classification, and remediation of grants
- Recurring audit and re-investigation of OAuth grants with automatic user notification
- MCP Server for AI agents to triage and remediate workspace security autonomously
- File sync from MyDrives and Shared Drives with Google Drive label ingestion
- Metadata and content inspection to detect risky or improper file sharing
- Detection of orphaned file sharing from offboarded accounts
- Bulk file remediation via user notifications, permission updates, and label assignments
About Material Security
Material Security is a cloud workspace security platform for teams whose business runs inside Google Workspace or Microsoft 365. One product covers what the vendor calls the workspace attack chain: credential phishing and BEC in email, account takeover, sensitive-data exposure in Drive and Shared Drives, risky OAuth grants, and tenant misconfiguration. Deployment is API-based rather than through mail-flow changes — one customer on the vendor's site reports six minutes to integrate. On email, it detects phishing, impersonation, and fraud, then remediates with banners, link and attachment speedbumps, spam marking, or deletion. An automated agent triages user-reported phishing so analysts stop hand-copying headers, and it also detects email bomb and harassment campaigns. On the app side, the OAuth Remediation Agent tracks connected apps and AI agents with real-time activity logs — not just grant events — so you can see what each one is doing with its access and revoke it. File and identity coverage fills the rest: detecting PHI, PII, and broadly shared documents, bulk remediation by restricting links and revoking access, catching orphaned sharing from offboarded accounts, and flagging MFA gaps and unsanctioned app signups. Continuous posture management checks tenant settings against CIS, NIST, and Material-authored baselines. The newer MCP Server lets AI agents triage and remediate autonomously without custom glue code. Pricing runs $4/user/month on Essentials and $6/user/month on Advanced, both billed annually plus a fee based on Shared Drive size, with ATO Resilience at +$3/user/month as an add-on or $5/user/month stand-alone. It goes up against legacy secure email gateways and standalone SaaS security tools — Material's bet is that consolidating email, files, identity, and OAuth into one product beats stacking point tools on native controls.
Behind the Verdict
The pitch here is consolidation, and for a Google Workspace or Microsoft 365 shop it's a fair one. Most security teams we talk to are running a SEG for email, a separate SaaS security tool for OAuth, and a spreadsheet for tenant config. Material puts those in one API-deployed product and prices it at email-security budget — its own comparison page literally frames Essentials as "Workspace Protection on an Email Security Budget." Pick this when the cloud office is the center of your business and you want one vendor accountable for email, files, identity, and connected apps. The OAuth piece is the sharpest edge. Its OAuth Risk Report analyzed 22,000+ apps and found thousands of zombie tokens still holding live scopes, which is exactly the shadow-AI problem security leaders are being asked about in budget meetings right now. Real-time activity logs — not just grant events — are the difference between knowing an app is connected and knowing what it's doing. Pass if your mail is on-prem or outside Google and Microsoft. Pass too if you're a small shop that just needs spam filtering; $4/user/month plus a Shared Drive fee is not the cheapest way to get basic phishing protection, and a lighter tool will do. Watch the Shared Drive fee. Per-user pricing is predictable; size-based pricing is not, and teams with sprawling Drive estates should model that before committing. Ask for the number. Closest alternative depends on what hurts most. If email is the pain, compare a modern API-based SEG. If OAuth and SaaS governance is the pain, compare a standalone SSPM. Material's argument is that buying both separately costs more than buying one platform — worth testing with a trial rather than taking on faith. The MCP Server is the piece to watch. Letting AI agents triage and remediate
Researching Material Security? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Material Security actually fits — and what changes day-one when you adopt it.
Deploys Material via API against Workspace and Microsoft 365, then turns on inbound email detection to catch credential phishing that Google's native filters let through.
Outcome: Phishing that previously reached inboxes is caught and remediated automatically with banners, speedbumps, or deletion, and user-reported messages are triaged by Material's automated agent instead of the analyst queue.
Uses the OAuth app inventory and OAuth Remediation Agent to review every connected app and AI agent, reading real-time activity logs rather than only grant events.
Outcome: Zombie tokens holding live scopes are identified and revoked, and new grants are investigated agentically before they become a data path out of the workspace.
Enables file data security to find PHI and other sensitive documents shared too broadly in Shared Drives, using Metadata and Content inspection on the Advanced tier.
Outcome: Broadly shared PHI is found, and Material remediates in bulk by restricting links, updating permissions, and assigning labels without disrupting the people who need the files.
Use Cases
- Catch and auto-remediate phishing, BEC, and impersonation that Google and Microsoft filters miss
- Automate triage of user-reported phishing so analysts stop copying headers manually
- Inventory connected OAuth apps and see what each is actually doing with its access in real time
- Investigate, classify, and revoke malicious or zombie OAuth grants, including AI agent access
- Find PHI, PII, and broadly shared documents in Drive and remediate in bulk by restricting links and revoking access
- Contain account takeover by blocking stolen credentials from unlocking password resets and magic links
- Detect and remediate email bomb and harassment campaigns
- Let AI agents triage and remediate workspace security incidents through Material's MCP Server
Limitations
- Material operates exclusively on top of Google Workspace and Microsoft 365, so it is not an on-prem or hybrid email security product.
- Both published tiers (Essentials at $4 per user/month and Advanced at $6 per user/month, billed annually) carry an additional fee based on Shared Drive size, making total cost variable for large Shared Drive estates.
- Sensitive-content detection in Shared Drives and email is gated to the Advanced tier — Essentials scans file metadata only.
- Account takeover containment is a separate purchase ($3 per user/month as an add-on or $5 per user/month stand-alone, both billed annually), and enterprise terms are custom and require a conversation with sales.
as of 2026-10-01
Verification history
We have re-verified Material Security 20 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Showing the 6 most recent of 20 verification passes.
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published Material Security tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Essentials
$4/user/mo, billed annually
Ideal for
Security teams on Google Workspace or Microsoft 365 that need automated email security plus a first look at file sharing, connected app inventory, and risky account settings.
What this tier adds
Starting tier at $4 per user/month billed annually: automated inbound email detection and response, user-report phishing triage, OAuth app inventory, metadata-only file scanning, and posture management.
Advanced
$6/user/mo, billed annually
Ideal for
Teams that need OAuth security at scale and must locate and protect sensitive content inside files and email, not just monitor sharing metadata.
What this tier adds
Adds $2 per user/month over Essentials at $6 per user/month billed annually: agentic OAuth investigation/classification/remediation, sensitive content detection in Shared Drives and email, anomalous behavior detection, and enhanced identity risk detections.
ATO Resilience (add-on)
+$3/user/mo, billed annually
Ideal for
Organizations on Essentials or Advanced where account takeover is a named risk and post-breach lateral movement needs to be contained.
What this tier adds
Adds $3 per user/month billed annually on top of a base plan: message-level MFA for historical sensitive email and for password reset and identity verification emails, plus auto-generated audit logs.
ATO Resilience (stand-alone)
$5/user/mo, billed annually
Ideal for
Teams that want account takeover containment without buying the broader email, file, and OAuth platform.
What this tier adds
Same ATO Resilience functionality as a stand-alone license at $5 per user/month billed annually, rather than $3 per user/month as an add-on.
Enterprise
Custom
Ideal for
Large organizations rolling out across a big Workspace or Microsoft 365 estate that need scale-based discounts and negotiated deployment terms.
What this tier adds
Custom pricing with discounts available at scale; terms and deployment options come from a conversation with sales.
Where the pricing makes sense
The company stage and team size where Material Security's pricing actually pencils out — and where peers do it cheaper.
Essentials at $4 per user/month billed annually is priced to undercut a legacy secure email gateway while adding file, OAuth, and posture coverage; Advanced at $6 per user/month billed annually is where content-level sensitive data detection lives. ATO Resilience adds $3 per user/month as an add-on or $5 per user/month stand-alone, both billed annually. Both base tiers also carry a Shared Drive size fee. Enterprise is custom with volume discounts. This sits below enterprise SaaS-security
Setup time & first value
How long it actually takes to get something useful out of Material Security — broken out by persona, not the marketing-page minute.
Security engineers on Google Workspace or Microsoft 365 typically reach first value the same day: one published customer reports a roughly six-minute API integration. Full coverage — email remediation policies, OAuth agent review rules, file sensitivity detections, and posture baselines — takes longer to configure to your environment. Enterprise deployments with custom terms run on a
Switching to or from Material Security
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From a legacy secure email gateway: deploy Material via API alongside the gateway, run both on inbound mail until detections and remediation actions are tuned, then retire the gateway's mail-flow changes.
- →From native Google or Microsoft controls alone: connect Material by API to add detection and automated remediation on top of existing filters without touching MX records.
- →From standalone SaaS security posture tools: consolidate OAuth inventory, file exposure, and tenant configuration checks into Material rather than renewing separate consoles.
- ↗To native Google or Microsoft security controls: you would lose API-based automated remediation, OAuth activity logging, and sensitive-content detection in Drive, so most teams only do this if budget is cut entirely.
- ↗To a traditional secure email gateway: reverting means restoring mail-flow changes and giving up file, OAuth, and posture coverage that a gateway does not provide.
- ↗To a standalone OAuth governance or SaaS security tool: possible if you only need the app-permission half, but you would rebuild the email and file coverage elsewhere.
Integrations
Resources & Guides
Tutorials & Learning
Official links
Tools that pair well with Material Security
Common stack mates teams adopt alongside Material Security, with the specific reason each pairing earns its keep.
Coro
Coro unifies endpoint, email, cloud and network security into one AI-agent workspace platform that auto-remediates 95% of threats.
Microsoft Security Copilot
AI agents embedded in Microsoft Defender, Entra, Intune, Purview and Sentinel to speed up security work
Securiti
Securiti unifies DSPM, privacy automation, and AI security for enterprises on its DataAI Command Platform.
Alternatives to Material Security
View all
Coro
Coro unifies endpoint, email, cloud and network security into one AI-agent workspace platform that auto-remediates 95% of threats.
Microsoft Security Copilot
AI agents embedded in Microsoft Defender, Entra, Intune, Purview and Sentinel to speed up security work
Frequently Asked Questions
Used Material Security? Help shape our editorial sentiment research.