From Hours to Seconds: The Unreasonable Effectiveness of a Well-Built Search

Search is the plumbing of the internet: it’s so fundamental that we only notice it when it breaks. Whether we’re using a search engine, an AI chatbot, or an enterprise search tool, our expectation is the same: we type, we find, we move on. But for a security team investigating an urgent issue, that simple expectation–that it just works–isn't nearly enough. When an analyst is chasing down an active threat, search isn't just a feature: it's a stopwatch. And every second counts.

Platforms like Google Vault and Microsoft Purview are built for large-scale data retention and legal discovery. They are designed to be deliberate, comprehensive, and defensible in a court of law.

For that purpose, they excel. But for incident response, that same deliberate design creates friction. Removing that friction is where Material’s search excels.

The cost of a search built for lawyers, not analysts

Security investigations run on a vastly different clock than legal discovery. An analyst needs to know what’s happening right now, not what happened last quarter. They need speed, context, the ability to pivot instantly, and be able to act on the information they find. The design philosophy of eDiscovery tools, however, often creates roadblocks:

• Indexing Delays: Data often isn’t searchable the moment it arrives. This creates a critical blind spot during the first few minutes or hours of an incident, which are often the most important.
• Complex Queries: Building a precise search can require a specialized query language that feels more like coding than searching, slowing down the process and creating a barrier for less experienced team members.
• Waiting for Results: Even after a query is perfected, the search itself can take hours to execute across a large environment, leaving teams waiting for data while an attacker moves freely.
• Lack of Context: Results are often delivered as a flat list of items, divorced from the surrounding conversation or context, forcing analysts to manually piece together the narrative.

This friction isn't just an inconvenience; it's a security risk. It turns what should be a simple data-gathering exercise into a multi-hour or even multi-day project. 

"Before Material, if we saw a threat and tried to run a search within a few minutes, we had to wait for indexing before we could even run an investigation. We’d see it, wait, then run a soft delete. Is this an incident? Do we need to log? What was the magnitude? This became a full time job.” – Chris Cook, SVP of Technology

When your primary investigation tool forces you to wait, it dictates the pace of your response. The stopwatch is in control, not the analyst.

Designing for the analyst under pressure

Material approached search from a different perspective. The goal wasn’t to try to build a better eDiscovery tool. The objective was to build the fastest and most intuitive investigation tool for security teams using the cloud workspace.

This required a complete shift in design philosophy, centered on the analyst's workflow during a high-pressure situation. The goal is to provide the right information, with the right context, as close to instantly as possible.

“Material accelerated our incident response and investigations... With Material, searching for suspicious messages is so straightforward and easy—it takes 20 seconds; not hours. It previews everything right there, with the ability to hunt, peck and pivot right at your fingertips.” – Matt Pecorelli, Director - Cybersecurity Operations

This transformation from hours to seconds isn't magic. It's the result of deliberate design choices:

• Built for Speed: Material indexes data in near real-time. A suspicious email that lands in an inbox is searchable moments later. We architected our entire system to ensure that when you search, you get results immediately.
• Intuitive Interface: The structured search system is powerful and usable, with a compilable language that ensures every query is validated and executed correctly, and typehead suggestions that teaches users how to search effectively. This empowers the entire security team to investigate, not just a few power users.
• Context is King: Search results aren't just a list of messages. They are presented with conversational context, previews, and header information, allowing an analyst to immediately understand the scope and nature of a threat without leaving the page.
• Actionability is Everything: Finding a malicious message is only the first step. Material allows teams to take direct action—like quarantining or deleting messages for every user who received them—from the search interface itself.

“Material’s message search saves time without sacrificing security and privacy. Our team can find what we need and take action.” – JR Babauta, Security Program Manager, Gusto

From hours of work to a reusable detection

This focus on the analyst workflow doesn't just accelerate one-off investigations; it changes how teams operate. A search for a novel threat can be easily saved and converted into a proactive detection that runs automatically.

The tedious, manual work of piecing together a complex search query in a native tool becomes a one-time investment in Material that pays dividends continuously.

"Things that previously would have taken me a few hours to piece together a vault search for, now I can spend a few minutes building a detection in Material and then that's easy to reuse and run." – Zach Morris

Search may seem like a basic utility, but its implementation has a profound impact on a security program's effectiveness. By providing a tool that is purpose-built for the speed and complexity of modern incident response, you don't just find things faster: you shorten the lifecycle of an attack, reduce risk, and free up your team's time and attention to focus on what's next.