Settings
Change links and attachments behavior
Material can rewrite links and attachments to warn (speedbump) or block users. Speed-bumping links and attachments post-delivery introduces a new way to balance security and end-user productivity while reducing response time.
From the drop down, choose either a:
Speedbump to require the user to confirm they trust the sender when accessing a link or attachment, or
Block to disable access to links or attachments
Optionally, include a custom message to explain next steps, thank the user for reporting, or educate on why this email was detected. This message appears on the page that your user is redirected to. If you don't include one, they'll see the default message.
This is an example of what the users will see after they click on a speedbumped link. 
Resolve issues after applying remediation
After you apply remediations, you can configure the issue resolve in the same flow. If you choose this option, any matching or similar messages will create new issues.
There are two ways to add this to an issue:
Add Resolve issue after applying remediation to your default Email Threat responses:
Update the response in an individual issue to include Resolve issue after applying remediation. This manually resolves the issue immediately.
Response for unreviewed messages with default remediation
Templates you apply here will send a reply to reporters as soon as they report a suspicious email before it's been classified (classification displays as none).
As soon as the case is classified, new reporters of the same message or a similar one will receive one of the messages defined below. Learn more in banner & template best practices.
The original reporter will not receive one of these other messages by default, but if you want them to receive subsequent messages after you classify a case, from the case detail reporter response check the option to Also send to previous reporters:
You choose the default response for each detection category. The chosen behavior applies to all issues in that detection category when the issue is created.
You can then analyze any issue and manually update the response specific to that issue if needed. For example, if a user reports a suspicious email that you want to add more context to, you can update your response message on the issue level and that will overwrite your more generic, default message that is created by default for all user reports.
Choose Default Responses
Response Types
For Material Detections, User Reporting, Custom Detections, and Email Provider alerts you can set these defaults:
High-confidence malicious (malware, phishing kit, known bad domain, spoofed internal)
Block
Threat is clear and severe; there is no legitimate need for the user to ever see or interact with the message.
Malicious
Suspicious but possibly legitimate (lookalike domain, odd request, gift card requests)
Speedbump
Risky but ambiguous; user business context may validate it. You want to slow them down and add friction, not fully block.
Unknown
Legitimate but misconfigured or unusual (partner using personal email, broken auth, strange but plausible)
Speedbump
You expect some legitimate traffic in this pattern but want users to double-check before acting.
Unknown
Clearly unwanted bulk or marketing (low-value promos, repeated cold outreach, obvious-but-harmless spam)
Move to Spam
Not harmful, just inbox noise. Let users still retrieve it from Spam if needed, but keep it out of the primary mailbox.
Malicious, Spam
Useless, confusing, or system noise (bounces, broken auto-replies, content-free messages to shared boxes)
Delete
No security threat and no business value. Removing it entirely reduces clutter and user confusion.
--
Known good / normal traffic
No Response
No meaningful risk indicators; user experience should remain uninterrupted.
Safe
Update Response Defaults
For Material Detection, User Reporting, Custom Detections, and Email Provider alerts you can set these defaults:
To begin, navigate to the settings for the defaults you want to set. For Material detections, from the left navigation expand Email Threats, expand Settings, then click Material Detection. For email provider alerts, click Email Provider Alerts instead. For user reporting, expand User Reports, then click Settings. Custom detection responses are set on each detection. Consider the use cases above, then review the following for more detail:
Change links and attachments behavior
Material can rewrite links and attachments to warn (speedbump) or block users. Speed-bumping links and attachments post-delivery introduces a new way to balance security and end-user productivity while reducing response time.
From the drop down, choose either a:
Speedbump to require the user to confirm they trust the sender when accessing a link or attachment, or
Block to disable access to links or attachments
Optionally, include a custom message to explain next steps, thank the user for reporting, or educate on why this email was detected. This message appears on the page that your user is redirected to. If you don't include one, they'll see the default message.
This is an example of what the users will see after they click on a speedbumped link.
Resolve issues after applying remediation
After you apply remediations, you can configure the issue resolve in the same flow. If you choose this option, any matching or similar messages will create new issues.
There are two ways to add this to an issue:
Add Resolve issue after applying remediation to your default Email Threat responses:
Update the response in an individual issue to include Resolve issue after applying remediation. This manually resolves the issue immediately.
User Reporting Reporter Acknowledgements
Sending a follow-up message ensures users are informed of actions taken, reinforces security awareness, and confirms that their report was valued. It also provides guidance on any additional steps they should take, fostering a proactive security culture and improving response to future incidents.
To navigate to user reporting default settings, from the left navigation expand User Reports, then click Settings.
In the Reporter Acknowledgement settings, leverage templates to quickly and consistently respond. You can also use variables to further customize responses:
This is an example of a report acknowledgement, auto-sent in response to a user report:
If you don't write anything custom, we send the header/footer and base template.
Response for unreviewed messages with default remediation
Templates you apply here will send a reply to reporters as soon as they report a suspicious email before it's been classified (classification displays as none).
As soon as the case is classified, new reporters of the same message or a similar one will receive one of the messages defined below. Learn more in banner & template best practices.
The original reporter will not receive one of these other messages by default, but if you want them to receive subsequent messages after you classify a case, from the case detail reporter response check the option to Also send to previous reporters:
Last updated
Was this helpful?