> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/fundamentals/investigate/evidence/message-analysis.md).
# Message Analysis
Use Message Analysis to identify the signals, behaviors, and message traits that caused Material to flag a message. In the [issue detail view](/learn-more/risk-areas/email-threats/investigate/issue-details.md), Message Analysis summarizes the evidence behind the detection.
Message Analysis
Use this guide to examine how Material evaluates messages.
Review how:
* [Signal-based models score message attributes](#signal-based-ai-models)
* [AI analysis interprets context and intent](#material-ai-message-analyzer)
* [Validation methods measure detection accuracy over time](#model-training-and-validation-methodology)
## Background
Security is not one size fits all, and neither is our detection system. At Material, we recognize that modern email threats are diverse, fast evolving and highly contextual. A signal detection technique is insufficient to reliably protect organizations against sophisticated attacks. We intentionally designed our system to be multi-layered and multi-approach to maximize accuracy and coverage.
Detection stack
Our detection stack integrates:
* Expert-driven heuristics that our threat detection team continuously develops and refines
* Signal-based ML models trained on large-scale, real-world email data
* AI analysis that detects behavioral, linguistic, and structural threat patterns
### Signal-based AI models
These models predict whether an incoming email is malicious. Material evaluates each email across 2,000+ signals, including:
* **Sender characteristics:** authentication results, proprietary sender reputation, and infrastructure patterns
* **Content signals**: language usage, intent indicators, semantic anomalies, and social engineering cues
* **Structural features:** HTML structure, links, attachments, and formatting patterns
* **Behavioral context:** historical sender-recipient interactions, organizational norms, and anomalies
Signal-based AI models
These signals are aggregated and evaluated by machine learning models that estimate the likelihood of malicious intent that goes beyond simple keyword matching or static rules.
### Material AI Message Analyzer
Material also uses Large Language Model (LLM)-based analysis to interpret emails at a semantic and contextual level. This helps detect intent, tone, and social engineering tactics that signal-based models may miss.
***
## Model Training and Validation Methodology
Sustained detection performance requires continuous training, validation, and monitoring. Material employs a rigorous end‑to‑end methodology to ensure models remain accurate, stable, and trustworthy over time.
Training and validation workflow
***
## Data Collection and Labeling
Material’s in‑house data labeling team continuously collects and labels email data. This process ensures that training data reflects current threat landscapes and diverse customer environments.
Labeled data includes:
* Confirmed malicious and benign emails
* Edge cases, mistakes, and ambiguous samples
* Newly emerging attack techniques
### Continuous Evaluation and Monitoring
Model performance is continuously monitored across key metrics such as precision, recall, and false positive rates. The ML team closely tracks:
* **False positives (FPs)**: Legitimate emails incorrectly flagged as malicious
* **False negatives (FNs)**: Malicious emails that evade detection
* **F1 Score**: A key machine learning metric that represents a balance of precision and recall
Shared customer cases and internal reviews are used to identify patterns, root causes, and opportunities for improvement.
### Feedback Loops and Iteration
Insights from monitoring, customer feedback, and threat research feed directly back into:
* Model retraining cycles
* Signal engineering improvements
* Heuristic updates
This closed‑loop system enables Material to rapidly adapt while maintaining consistent protection and minimizing user disruption.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/getting-started/fundamentals/investigate/evidence/message-analysis.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.