Material Security

Material Security is an enterprise software company that secures cloud productivity suites, aiming to stop attacks and reduce risk across Microsoft 365 and Google Workspace. Its single product spans inbound email security, file exposure and data protection, OAuth/third-party app and AI-agent governance, account-takeover containment, and tenant configuration posture, and is deployed entirely through platform APIs rather than by rerouting mail flow.

The company frames the problem as a "workspace attack chain" in which an attack begins with credential phishing, social engineering or business email compromise, escalates to account takeover through forwarding rules, OAuth grants and legacy authentication, then leads to bulk data exfiltration from mail and files and lateral movement via password resets, verification codes and exposed secrets. Rather than defending only the point of entry, Material adds controls further along that chain: its inbound email security detects and remediates attacks missed by native and legacy gateway defenses and automates triage of user-reported messages; an OAuth Remediation Agent surfaces real-time activity logs for authorized third-party apps and AI agents in Google Workspace and allows instant revocation; file security locates PHI, PII and other sensitive documents shared too broadly in Drive and remediates in bulk by restricting links and revoking access; and account-takeover containment redacts sensitive messages before an attacker can read them, applies message-level access controls to block password resets, and gives investigators a view of what an intruder accessed.

Founding story

Ryan Noon, Abhishek Agrawal and Chris Park founded the company in 2017. Noon and Agrawal met at Dropbox after Dropbox acquired Noon's prior startup Parastructure in 2014, and Park had been Parastructure's first engineer. Noon left Dropbox in 2016 and moved to Berlin; the 2016 U.S. election email hacks, and his realization that anyone could read a former White House official's personal email, sparked the idea that became Material. The founders prioritized assembling the team over choosing a product, structuring their search like a software testing lifecycle with defined goals, durations and exit criteria for a "discussion phase." They tracked 25 opportunities in a "spaces and opportunities" spreadsheet, eliminated ideas that did not interest all three, appeared commercially unviable, or did not fit their agreed B2B model, and narrowed to four software ideas — two in security and one in people analytics — writing "flight plans" to validate each. When angel investors wrote the first check in July 2017, the trio were still pitching four ideas and had not built an MVP, and they used a pre-selling technique to identify the winning one. The stated motto is that it takes at least as much creativity to make a technology safe as it does to invent it.

Business model

Material sells a business-to-business enterprise software product to organizations running Google Workspace or Microsoft 365. Prospective customers request a demo, and the platform is deployed via API integrations with the two cloud productivity suites. The founders agreed at the outset to pursue a B2B business model.

Material sells its workspace security platform to enterprise organizations as a B2B software product; specific pricing terms are not disclosed publicly.

Traction

The company reports wall-to-wall adoption by dozens of well-known companies and leading security teams following its 2020 launch, with business growth fueled by referrals and advocacy from the security community, and says it is trusted by household-name customers and companies working on the frontier of AI.

Latest developments

Recent company communications emphasize that AI-driven attacks and AI agents are entering the workspace and that workspace security underpins AI security. Material has introduced an OAuth Remediation Agent for governing third-party apps and AI agents in Google Workspace, published an open Model Context Protocol server linking AI agents to its email detection and remediation capabilities, described a behavioral, spectrum-based approach to sender reputation, and treats its interactive, machine-readable documentation as a core product feature. It also argues in published content that the email security battlefront has shifted to the cloud workspace, OAuth tokens and sensitive files.