Triage at Speed: Easier Investigation and Hands-Off Remediation

Security operations usually suffer from one of two problems: not enough information or way too much of it. Most legacy tools, and even the native dashboards in your cloud workspace, tend to lean toward the latter, burying the why under a mountain of what.

At Material, we spend a lot of time thinking about the analyst's workflow. If you have to click five times to understand why a message was flagged, we’ve failed you. Our latest updates are focused on removing that friction, giving you better visual context, and finally letting you automate the "paperwork" of closing resolved issues.

Defining trust without the headache

Managing "trusted entities" shouldn’t feel like configuring a firewall in 1998. Whether you’re dealing with a persistent phishing campaign or just trying to ensure a specific file-sharing service doesn’t trigger a false positive, the interface should be intuitive.

We’ve overhauled the Trusted Entities UI to make it easier to understand and even easier to configure. We’ve streamlined how you define these entities across both phishing and file-related issues, ensuring that your team spends less time tweaking settings and more time actually investigating real threats.

A clearer view of the "why"

The Analysis Card is the heart of an investigation in Material. It’s where you go to see why we flagged something and decide what to do about it. We’ve given this entire experience a facelift to improve "scannability."

• Explainability improvements: We’ve made it much more obvious why an issue was created. No more hunting for the specific signal that triggered the detection.
• Above the fold IA: We’ve reorganized the information architecture so the most critical details and actions are visible immediately. You shouldn’t have to scroll to find the "remediate" button.
• Similarity Matching rebrand: We’ve renamed this feature to be more descriptive. It does exactly what it says on the tin—finds things that look like the threat you're looking at.
• UI fit and finish: General polish to make the workspace feel faster and more cohesive.

The goal here is simple: see the full story, understand the context, and make a decision. Fast.

Visualizing the attack timeline

Phishing attacks are rarely isolated events. They have a sequence—a beginning, a middle, and (hopefully) a quick end.

Our updated Timeline view for phishing issues provides a robust, chronological look at detections and system actions. This makes it significantly easier for analysts to understand the scope of an attack and see exactly how it unfolded across your cloud office. When you can see the sequence of events visually, the blast radius becomes much easier to define.

Closing the loop (automatically)

For a long time, Material kept resolved issues open for 30 days. We did this for the sake of visibility—we wanted to make sure you saw that the platform was doing its job.

But as our customers have grown to trust our automations, that 30-day window started to feel like a chore. It’s mental overhead that high-velocity teams don't need.

You can now add "automatically close issue" as a final remediation step. Once Material resolves the threat, the issue closes itself. This keeps your queue clean and allows your team to focus exclusively on the critical, open issues that actually require a human pair of eyes. It turns out that when you trust the math, you don't need to double-check the homework every single time.

Want to see these improvements live? Reach out for a demo to see how we’re simplifying security for the cloud workspace.