Quick Rollout: Essentials or Advanced + ATO Resilience

If you only purchased Account Takeover (ATO) Resilience as a stand-alone, use the ATO Resilience Templates instead.

In this scenario, you'll deploy all of Essentials or Advanced in one or just a couple of sessions.

Pros: Fewer comms, one moment of change for your end users to digest

Cons: Too much change can lead to end users not understanding all the changes because there is too much to process at once

Timing	Template Name
7 days prior to enabling Email Threat responses	1. Material Coming Soon + ATO Resilience
Deployment completion	2. Material is Here

All templates include customizable content including your organization's name. Be sure to update (or sometimes remove) any inline directions. They're included in brackets and highlighted <like this>.

---

1. Material Coming Soon + ATO Resilience

First, gather screenshots for your Material Coming Soon + ATO Resilience message:

You need seven screenshots for this template:

1. Screenshot A (User Report Response)
2. Screenshot B (Banner)
3. Screenshot C (Block)
4. Screenshot D (Speedbump)
5. Screenshot E (File Issue Response Email)
6. Screenshot F (Account Verification)
7. Screenshot G (Redacted email)

📸 How to Get Screenshots A-D (User Report Response, Banner, Block, and Speedbump)

1. Enable Email Threat remediation just for yourself.
2. Find an email in your inbox that includes embedded links; mark it as suspicious using the built in labels.
3. A User Report Response email should appear in your inbox momentarily (Screenshot A)
4. Return to Material.
5. Expand Issues, then click Email Threats.
6. Find the case for the email you marked suspicious, then open it.
7. Under Remediation, add a Block and a Banner (if not already there).
8. Click Save, but leave the case details open for a moment.
9. Return to your inbox and open the email you marked.
10. Take a screenshot of the banner on the email (screenshot B).
11. Click a link in the email.
12. Take a screenshot of the Block (Screenshot C)
13. Return to Material.
14. In the case details, change the Block to a Speedbump, then click Save.
15. Return to your inbox and open the email you marked.
16. Click a link in the email.
17. Take a screenshot of the Speedbump (Screenshot D).

📸 How to Get Screenshot E (File Issue Response Email)

1. In Material, click Detections.
2. Filter to Entity Type, File.
3. Scroll to the detection called File is publicly accessible, and open it.
4. Confirm Send Email is the first remediation step. If not, add it, then click Save.
5. Create a blank document in your drive. Update the Share settings to Anyone with the Link.
6. After a few moments, a File Issue Response Email appears in your inbox. Take a screenshot of that.

📸 How to Get Screenshot F (Account Verification Email)

1. Request a password reset on anything associated with your work email.
2. From your inbox, find the reset request.
3. Take a screenshot of the verification.

📸 How to Get Screenshot G (Redacted Email)

1. From your email inbox, open the Sensitive folder.
2. Take a screenshot of the secured, Retrieve Message email.

   If no emails are in your sensitive folder:

   1. From your email inbox, mark an email as Sensitive using the built-in labels.
   2. Wait the length of your Default Locking Grace Period.
   3. Open the email again (now in your Sensitive folder) and take a screenshot.

Second, fill out the Material Coming Soon + ATO Resilience template utilizing the screenshots you gathered:

Message Purpose: To inform your users about why you’re making changes and what to expect

Delivery Timing: 7 days prior to deployment

We also have interactive tutorials about resetting passwords and unlocking emails that you can include in your communication here.

Material Coming Soon + ATO Resilience template

Message Subject:

Introducing <your company name>’s new information security provider, Material Security—and what it means for you

Message Body:

We’re pleased to announce that we’ve partnered with Material Security – an information security company – to protect <your company name> from key security risks. Material keeps connected accounts safe by protecting our company’s fundamental material—our emails, documents, and accounts —before, during, and after a breach.

This email outlines a number of changes to your email inbox, files, and password reset process you'll see soon:

Email Updates:

While many malicious messages will be deleted or moved out of your inbox automatically, others might remain accessible to you, but will look a little different:

• Links and attachments might first open a page asking you to verify you know the sender or simply block access to those links and attachments
• The message might include a banner to draw your attention to something suspicious about the message that you should notice before proceeding.

Examples of these situations are shown below. When you see these, please read them and follow the guidance. If you have questions, you can always reach us at <contact for the responsible team>

Include

• Screenshot B (Banner)
• Screenshot C (Block)
• Screenshot D (Speedbump)

You also have the power to report suspicious emails that have not been modified as described above or moved to Spam. To do this,

<alter these options to fit your needs>

• Label the email as Suspicious, or
• Forward the email to <the reporting address you included in Email Threat Settings>

You’ll get a thank you email in response and updates once we determine if the message is malicious or safe.

• Screenshot A (User Report Response)

Google Drive Updates: <omit if you don't use Google drive>

Google Drive Data Security identifies sensitive content (PII, financial data, legal documents, etc.) archived in your user mailboxes. On your end, you’ll get an email explaining the file issue, and sometimes access to the file will be automatically updated to comply with policy. The email you’ll receive looks something like this:

• Screenshot E: (File Issue Response Email)

Password Resets:

When you reset a password via email, you will first receive a verification email from Material. It looks something like this:

<Screenshot F: Account Verification>

• Follow the instructions in the email to verify your identity using <mfa provider>. Once your identity is verified, the original password reset email will be delivered to your inbox. This quick check with <mfa provider> allows us to make sure the verification message lands in the right hands.
• If you did not request a password reset, click I did not request to reset my account.

Sensitive Emails:

Material scans for content like credit card numbers or personally identifiable information in your email, then categorizes them as sensitive and redacts them for security. You can then access them via a seamless retrieval flow.

Every protected email is replaced with stub, showing you message properties and a link to retrieval the full message:

<Screenshot G: Email Redaction>

*******

<Variant A below: Google Drive instructions (delete if using Microsoft)>

To access the message, click the link in the email and then complete the authentication steps just like you normally do when signing in. Once you authenticate, this message will be put back in your inbox for <your default retrieval grace period time>. After that time has passed, you will need to authenticate again when prompted.

Once you retrieve one redacted email, you have <your default retrieval challenge session time> to open other redacted emails without authenticating.

*******

<Variant B below: Microsoft instructions (delete if using Google Drive)>

To access the message, click the link in the email and then complete the authentication steps just like you normally do when signing in. Once you authenticate, this message will be put back in your Retrieved Items folder for <your default retrieval grace period time>. After that time has passed, you will need to authenticate again when prompted.

Once you retrieve one redacted email, you have <your default retrieval challenge session time> to open other redacted emails without authenticating.

******* Thank you for your help and cooperation in protecting our organization! This completes our Material Security deployment. Any questions? Let us know here: <your preferred contact>.

---

2. Material is Here

Message Purpose: To inform your users that changes will be coming soon and why

Delivery Timing: At deployment completion, likely when you complete Identity Protection deployment

Material is Here + ATO Resilience template

Message Subject:

<Your company name>’s new information security provider, Material Security, is now live!

Message Body:

We’re pleased to announce that we finished deploying Material Security – an information security company – to protect <your company name> from key security risks. Material keeps connected accounts safe by protecting our company’s fundamental material—our emails, documents, and accounts —before, during, and after a breach.

With Material Security we can:

• Detect sophisticated email based attacks and take action fast through a variety of responses
• Detect potential risks related to files and attachments, including sharing of sensitive data
• Investigate issues quickly and improve our defenses to keep us safe even as attack methods change every day
• Protect sensitive information and related accounts in the event of a breach

Please refer to last week's email with directions on what to expect in your inbox and with your Google Drive workflow.

If you want to do a little more research on Material, feel free to take a look at their website here: https://material.security/

Thank you for your help and cooperation in protecting our organization! Any questions? Let us know here: <your preferred contact>