Introducing Material's Google Drive Agent. The agent investigates sensitive files, synthesizes the findings, and automatically remediates over-permissioned files.
Most efforts to secure Google Drive fail because the scope of work is instantly unmanageable. In a world where AI can search, read, and expose the years of sensitive documents in your Google Workspace, risks can turn into incidents at machine speed. To solve the problem, you connect a new DSPM or DLP tool to Google Drive, and suddenly thousands upon thousands of sensitive documents are revealed: mountains of PII, years of financial reports, and every customer contract in the history of the company. It’s all categorized as sensitive, but it’s not all actionable.
Instead of adding a helpful tool to manage Drive sprawl, the team has unleashed an alert cannon. Worse yet, the security team lacks context about what to actually do with the file issues that get surfaced. That means turning the alert cannon on leaders in the departments that own the data and hoping they’ll shoulder the burden of prioritizing and executing the clean-up work.
It’s hardly an approach that wins hearts and minds.
To succeed, tools addressing Google Drive security need to take on the investigative and permission management role. That means not just alerting and pushing the work down across the organization, but owning the work that can’t be done by security due to lack of context and removing the work that would be done by the busy team leads who are data owners.
Material is taking a new approach to Google Drive security with the launch of the Drive Management Agent. Where DLP and DSPM tools give teams blunt, manual tools like filtering and sorting lists of thousands of file-related issues, the Drive Agent adds business context and determines whether the sharing pattern makes sense given the file’s inferred purpose and audience. The agent investigates files containing sensitive content across multiple dimensions, synthesizes the findings, and automatically remediates over-permissioned files.
The agent looks at the file and makes a determination based on several factors:
- File Summary and Purpose: When sensitive content is detected in Google Drive, the agent will first summarize the content and determine its purpose.
- Content Sensitivity: It will assess the sensitivity of the contents to determine what level of remediation is needed (if any).
- Exposure: Next, the agent will look at the number of collaborators that have access to the file and the roles of those accounts at the organization.
After going through these assessments, the agent will make a determination on whether the sharing pattern makes sense given the file’s inferred purpose and audience and whether or not the patterns fall within expected norms at the organization. The agent will then render a verdict:
- Cleared → When a sensitive content detection is triggered but determined to be a false positive, the issue will be automatically resolved.
- Contained → This verdict is returned if content is sensitive, but sharing is genuinely scoped and justified.
- Exposed → A document is considered exposed if its reach exceeds what the content warrants, but does not pose a clear and present risk.
- Overexposed → This verdict is rendered if sensitive content is broadly or publicly reachable, with weak access controls that present clear risk.
Admins can configure flexible remediations depending on the verdict. For example, a customer list shared with the entire company would get flagged as Exposed and may trigger a notification to the document owner to remediate the file themselves, followed by a grace period before access is revoked. That same customer list would be flagged as Overexposed if it was shared with 300 external freemail addresses and may trigger an immediate revocation of access followed by a notification to the document owner.
Meanwhile, a verdict of Cleared will automatically resolve any false positives that might be generated by a sensitive content detection. So if a trusted external entity has access to information that makes sense for their role, Material automatically closes the issue and reduces the noise.
Issues can still arise that require human eyes, which is why you’ll still have the ability to search, sort, and filter the universe of documents with sensitive information during investigations. The Drive Agent helpfully works in the background, taking on the work of managing Google Drive so security doesn’t own the burden of endless alerts.
Ready to see how Material can help you manage Google Workspace security? Book a demo today.
