When a credential is compromised, the attacker looks identical to a legitimate user. Material detects anomalous session behavior like bulk reads, unusual forwarding, and access to concentrated PHI, and can restrict access to sensitive mail without fully locking the account. Critical workflows stay intact. Attacker access is contained.