Workspace Protection
on an Email Security
Budget

Stop attacks, secure sensitive data, manage connected apps, and strengthen security posture across Google Workspace & Microsoft 365.

Essentials

Best for teams that need to automate email security plus understand and fix file sharing, connected app inventory, and risky account settings.

$4 Per user/month,
billed annually

Plus fee based on Shared Drive size

Get started

Wrap your arms around cloud workspace security:

  • Automated inbound email threat detection and response
  • Automated agent for user-reported phishing
  • Inventory of connected OAuth apps
  • Detect, monitor, and control files in Shared Drives (metadata)
  • Posture management and vulnerability reduction across the cloud workspace

Advanced

Best for teams that need email security, scaling connected app security, while also locating and protecting sensitive content across the cloud workspace.

$6 Per user/month,
billed annually

Plus fee based on Shared Drive size

Get started

Everything in Essentials, plus:

  • Automated agent to investigate, classify, and remediate OAuth grants
  • Detect, monitor, and control sensitive content in Shared Drives and email
  • Find and fix anomalous behavior related to sensitive content in files and emails
  • Enhanced identity risk and threat detections

ATO Resilience

Enhance your security with advanced features that reduce the impact of account takeovers and speed investigation and reporting. This functionality is available as an add-on or a stand-alone license.

+$3 Per user/month,
billed annually

$5/user/month as a stand-alone

Get started

Comprehensive coverage purpose-built for one of the most common threats to your organization:

  • Contain the blast radius of ATOs with message-level controls for sensitive content, password resets, and more
  • Prevent lateral movement by identifying and protecting password reset emails and magic links
  • Accelerate incident response with auto-generated audit logs

Enterprise

Discounts available at scale

Talk to Sales

Built for your workspace.
Priced for your team.

Capability
Essentials$4 /month
Get started
Advanced$6 /month
Get started
Stop sophisticated email attacks (Phishing, BEC, Impersonation, Fraud, etc.)
Remediate email attacks with flexible remediations (banners, link/attachment speedbumps, marking spam and deletion)
Automate user-reported phishing response
Detect and remediate email bomb and harassment campaigns
Hunt for email threats and build custom detections
Train employees to recognize the latest email attack types (speedbumps, simulations, reporter acknowledgement)
Reporting (trends, detections, user reports)
Dynamic inventory of OAuth grants, including scopes and users
Agentic investigation of new OAuth grants
Agentic remediation of malicious OAuth grants
Automatically notify users of suspicious and malicious OAuth grants
Recurring audit and re-investigation of OAuth grants
Sync files from MyDrives and Shared Drives and ingest Google Drive labelsMetadata onlyMetadata and
Content
Detect files with risky or improper sharing
Detect external applications with excessive file access
Detect orphaned file sharing from offboarded accounts
Remediate file issues with user notifications, permissions updates, and label assignments
Detect and monitor sensitive data types in file content
Define custom sensitive data types
Detect auto-forwarding rules and manual forwarding to internal, external and personal accounts
Detect external applications with excessive email access
Create custom detections to monitor email traffic
Detect and monitor built-in and custom sensitive data types in email
Detect anomalous and high volume sensitive content sharing via email
Identify areas of risk (MFA gaps/bypasses, inactive accounts, mail forwarding, account/admin activity)
Detect and mitigate account takeovers (ATO) based on account activity
Detect credential sprawl and unsanctioned app signups
Detect SSO gaps and email-based password resets
RBAC
Event Subscriptions and API
MCP Server
Capability
ATO Resilience+$3 /month
Get started
Prevent post-breach data loss with message-level MFA for accessing historical sensitive email
Prevent post-breach lateral movement with message-level MFA for accessing password reset and other identity verification emails
Categorize all sensitive data at rest in mailboxes
Detect credential sprawl and unsanctioned app signups
Detect suspicious mail forwarding rules
Detect and mitigate account takeovers (ATO) based on account activity
Detect account takeovers (ATO) based on sensitive content honeypots
Detect and audit historical sensitive emails
Detect and monitor sensitive data types in email
Ingest custom sensitive data types from Microsoft Purview
Detect MFA coverage gaps including use of non phishing-resistant MFA
Detect and remediate IMAP/POP, ASPs, and other forms of MFA bypass
Detect leaked credentials in public data breaches
Detect SSO gaps and email-based password resets
Email content retentionUnlimited
Search across metadata and content for email and files
Follow investigations across accounts, groups, and tenants
Reports and dashboards
RBAC
Event Subscriptions and API
MCP Server

Trusted by today's most innovative companies

Mars NBCUniversal MassMutual Reddit OpenAI Anthropic xAI Omada Health Duolingo
Figma Datadog GitLab Sierra Surge AI Twilio Robinhood Lyft Oscar Health

Frequently Asked Questions

Find answers to common questions and get the details you need.

A "user" is any mailbox or account synced into Material for protection. In practice, every Google Workspace or Microsoft 365 seat you configure Material to cover. Contact sales to learn about pricing for service, shared, student, and other types of mailboxes.

Yes, AI-driven detection is included at every tier. Both Essentials and Advanced include automated, AI-powered email threat detection and response, plus an automated agent that triages user-reported phishing. The OAuth Remediation Agent's autonomous capabilities, including agentic investigation and remediation of risky OAuth grants, automatic user notifications, and recurring re-audits, are included in Advanced and are not part of Essentials.

Essentials includes core email threat detection and response, automated phishing-report triage, visibility into connected OAuth apps, metadata-level file-sharing risk detection in Shared Drives, and baseline account risk detection such as MFA gaps and forwarding rules. Advanced includes everything in Essentials plus agentic investigation and remediation of OAuth grants, sensitive-content detection across both file and email content (not just metadata), the ability to define custom sensitive data types, and detection of credential sprawl and SSO gaps.

Essentials starts at $4 per user/month, billed annually, plus a fee based on Shared Drive size. Advanced is $6 per user/month, billed annually, plus the same Shared Drive fee. ATO Resilience can be added to either plan for an additional $3 per user/month, or purchased as a standalone license for $5 per user/month. Enterprise customers receive volume discounts, contact sales for a quote.

Material charges a minimum annual fee that covers up to 1TB of Shared Drive storage. Beyond that, the Material team works directly with each customer to assess actual Shared Drive size and calculate the associated cost, so pricing scales with real usage rather than a flat estimate.

Material offers both shared (multi-tenant) and dedicated (single-tenant) deployment. Shared architecture is the default option for most organizations: cost-effective, scalable, and centrally managed. Dedicated architecture provides a fully isolated, single-tenant environment within its own cloud project, with options for semi- or customer-managed configurations, and is best suited for organizations handling very large volumes of sensitive data or operating under strict regulatory requirements.

Yes, Material offers two support tiers. Base Support, designed for growing companies, includes 24/7 technical support via Slack, Teams, Email, and the Customer Portal, with an initial response time under 60 minutes, backed by self-service resources and pooled technical staff. Premium Support, designed for enterprise scale, includes the same 24/7 coverage and response times, plus an assigned Customer Engineer, fully supported deployment, recurring success syncs, and quarterly business reviews.

Yes. Larger deployments receive volume-based discounts that scale with total user count and multi-year commitments can reduce pricing further.

Material does offer a self-serve free trial. Qualified prospects can request a sales-led proof-of-concept where Material stands up a dedicated evaluation environment and works with your team over a defined evaluation period to validate detection and response against your own Google Workspace or Microsoft 365 environment before you commit to a contract. Contact sales to scope a proof-of-concept for your organization.

Because Material unifies email threat detection, file and data security, and identity threat detection in a single per-user price, customers consolidating from point solutions typically replace several separate subscriptions — and the overhead of managing them — with one platform and one bill.

Yes. Shared mailbox accounts are billed at the standard per-user rate. Service accounts (identity-only, non-mailbox accounts) are included at no additional cost. Low-volume accounts (mailboxes with minimal email activity) are billed at a reduced rate. Contact sales to confirm how this applies to your specific environment.

Get a demo

See the Material difference for yourself

Book a demo
New