Headway Scales Google Workspace Security with Material

Headway is dedicated to helping people find the mental healthcare they need. With such a timely mission, their rapid growth is no surprise. But as Headway continued to help more and more people, their security team felt the responsibility to make sure the company’s Google Workspace environment was as secure as possible in order to protect the private information of its customers. 

With  a lean team and a critical mission to keep their organization’s environment secure, the security team needed a solution that could streamline their security approach without sacrificing coverage. Material Security emerged as the perfect partner, offering a seamless solution that addressed Headway's needs to comprehensively secure Google Workspace.

The Challenge: Maturing Google Workspace Security on a Compressed Timeline

Frank Wang was the first security hire at the company, and was tasked with managing the company's Google Workspace security. Initially, Frank relied on manual processes using Google’s native controls. He made significant improvements with this approach, but knew it wasn’t sustainable over time.

As Headway grew, they knew their security capabilities would need to scale with them because relying solely on native security controls would pose problems in the future. Phishing and email attacks tend to follow a company’s growth curve: as startups have more success and gain visibility, they become a greater target.

"We were relying on two things: Google Workspace's native security functionality and tooling and using an ad hoc Google Workspace auditor," Frank recalled. "But we knew this wouldn't scale as our company got bigger."

Despite Headway never having an incident, Frank wanted to get ahead of the curve by proactively improving phishing defense. He wanted a solution that would detect and stop phishing attacks that made it through Google’s protections, and that would simplify user reporting: both for Headway’s employees and the security team.

Google Workspace isn’t limited to Gmail, and Headway also knew they needed more visibility into the company’s Google Drive use. Headway has strict policies around sensitive data in shared files, but they wanted a tool that allowed them to enforce those policies at scale as the company grew. Manually reviewing and managing sharing behavior through Google’s built-in features wouldn’t cut it.

Underlying all the security requirements, Headway needed a tool that could be effective quickly with a minimal implementation effort. “When I was looking at vendors, I needed a tool that would work right out of the box, so that I could set it and forget it," said Frank.

Finding the Solution: Material Security's Scalable Comprehensive Protection 

Material Security provided one solution with all the pieces to Headway’s puzzle. It helped Frank solve Headway’s immediate asks across email and data security, but also delivered the power and flexibility to scale quickly along with the company.

“As I started evaluating tools, colleagues told me that I should definitely have Material on my list. They said it was great for scaling startups, with the right blend of automation and flexibility for engineers like me who want to customize things to my specific use case." 

Because of the need for a modern, easy-to-implement tool, an API-based solution was a must. "We wanted an API-based solution because of the ease of setup. We didn't have to set up DNS records and so it was much easier to implement than setting up an email gateway."

Material Security's API-based approach and comprehensive Google Workspace protection capabilities provided Headway with the ideal solution to address their security challenges.

The Results: Improved Security Posture, Reduced Triage Time, and Increased User Satisfaction

Since implementing Material Security, Headway has realized significant improvements not only in their baseline email and data security, but they’ve realized significant improvements in its security posture and operational efficiency. 

• Automated user report response: Material Security automates the response to user-reported phishing emails, freeing up valuable time for the security team and improving user satisfaction.
• Drastically reduced phishing triage time: Material Security's automated triage capabilities have significantly reduced the time spent investigating and remediating phishing incidents.
• Enhanced visibility and control: Material Security's comprehensive visibility into Drive files has enabled Headway to better manage access controls and protect sensitive data.
• Automation with Customization and flexibility: The ability to customize responses to different types of phishing emails and risky sharing behavior has allowed Headway to tailor and adjust the platform as they’ve grown.

Material Security's user-friendly interface and intuitive design have made it easy for Headway's security team to manage and operate the platform.

"Material's UI is very straightforward. It’s basic–in the best way possible–and easy to use. I didn't have to look for anything," Frank says.

Zach Morris joined Frank as a security engineer as Headway has grown. “The new Material UI is amazing, incorporating email security with the broader collaboration suite. It’s been a great force multiplier,” said Zach, explaining how it’s helped boost his productivity. “Things that previously would have taken me a few hours to piece together a vault search for, now I can spend a few minutes building a detection in Material and then that's easy to reuse and run." 

"It definitely saved time triaging phishing investigations," Frank says. "Before, people would report phishing to us, and we would manually have to respond and handle each phishing email. It was also time consuming to find the same email in others' inboxes and remove them. Material automated all of that."

Not only has Material made it easier for the security team to manage user reports, it’s encouraged their employers to be more proactive. “I’ve gotten feedback from employees saying that they appreciate getting the acknowledgement from a user report because it feels like their reporting isn’t going into a black hole,” said Frank. “They are more encouraged to report in the future.”  

Overall, Material’s helped Headway’s application of its security program match its security policies. "Material is great because it provides us visibility and technical enforcement together,” explained Zach. “We set written policies at the top level, and Material provides us the technical capability to reinforce those written policies in practice."

It’s not just the product that’s made things easier for Headway: Frank praised Material Security's support and integration with the way he and Zach work.

"The Material team is awesome. They’re very responsive. They set up a Slack channel, and response is very quick. It’s just been a very, very seamless experience to get the basics up and running," Frank says.

Material Security's commitment to customer success and continuous improvement has made them a valuable partner for Headway.

Material Security Helps Headway to Secure the Future of Work

Material Security has empowered Headway to securely embrace their mission, enabling their team by providing a comprehensive, flexible, and user-friendly platform for managing Google Workspace security. With Material, Headway can focus on helping its customers–while ensuring its data and employees remain protected.

By bridging the gaps in Google Workspace's native security features, Material Security has enabled Headway to:

• Improve their security posture with real-time phishing detection, visibility and control of file sharing, and automated remediations that allow Headway’s team to focus on mission-critical tasks as their security program grows.
• Reduce the time spent triaging security incidents, freeing up valuable resources for other tasks.
• Enhance visibility and control over sensitive data stored in Google Drive.
• Empower employees to actively participate in security through easy phishing reporting mechanisms.

With Material Security keeping watch over their critical infrastructure, Headway is well-equipped to navigate the evolving threat landscape and maintain a safe and productive Google Workspace environment, and continue securely delivering their critical services for their customers.