Version 1.60
Version 1.60 adds File Security reports for Google Drive, OAuth authentication for the Material MCP server, and speeds up OAuth app investigation. It also sharpens issue investigation and continues to expand built-in email threat coverage.
🎉 New
File Security reports
File Security reports give you a single place to see your file exposure at a glance. This new dashboard shows what sensitive content lives in Google Drive and how it's being shared. The Overview maps how many sensitive files are shared publicly, externally, and with your entire company, along with trusted external shares and files shared with only a subset of the company. Results from your custom detections appear alongside it.
The report gives you three ways to work with your file exposure:
Export to PDF: save the full report, including the Overview, sensitive files by category, and custom detections, as a PDF to share or archive
Date filtering and comparison: narrow the report to any date range, defaulting to the past month, then compare that range against the one before it to see whether your exposure is growing or shrinking.
Custom detections chart: each detection shows period-over-period comparison bars, with hover detail for the exact counts
Connect to the Material MCP server with OAuth
Customers on all plans can now connect their AI tools via OAuth to the Material MCP server, instead of creating and managing a long-lived API token by hand.
From the top toolbar click Integrations, expand API, then click Tokens and MCP Connections. Open the Connect to MCP dialog for setup instructions tailored to your client, then sign in to authorize the connection.
✨ Enhancements
OAuth Apps
See when a token was revoked
An app's Accounts tab now shows a Revoked at timestamp for each revoked account, and the app timeline records both the revoke and the end-user notification as events. You can line these up against alerts in your SIEM or EDR when you're piecing together an incident.
A clearer Accounts tab
The Remediation column is now hidden by default on an app's Accounts tab, so the view starts less cluttered. You can turn it back on from the table's display options. When an account's token can't be revoked, the tooltip now explains the reason.
More accurate app trust assessment
When Material assesses whether an OAuth app is trustworthy, it no longer counts a vendor's support-email domain against the app. Removing this means fewer legitimate apps get flagged.
Expanded detection coverage
Material's built-in email threat detections catch more real-world attacks, with no configuration required.
Material now automatically flags more attack types, including:
Credential phishing that pairs a newly registered sender domain with a look-alike sender and suspicious language
Open-redirect links that abuse Microsoft OAuth
Callback phishing hidden in DocuSign comment fields
Typosquatted, recently registered domains impersonating your trusted senders
Fake PDF invoices sent from newly registered domains
Apps and accounts
App risk at a glance in Blast Radius
The apps list in an account's Blast Radius panel now shows each app's classification and risk badge, so you can see which connected apps carry the most risk without leaving the panel.
Filter apps by when they first appeared
The apps list has a new First seen date-range filter, so you can focus on apps that first appeared in a window you choose, for example everything new in the past week.
Issues and investigation
Message analysis opens by default
The Message analysis section on an email threat issue now expands by default, so the detail and reasoning are in front of you as soon as you open the issue.
Triage custom message detections as Unknown
Custom message detections can now apply an Unknown classification, alongside Safe, Malicious, and Spam. This is useful when a detection should surface a message for review without asserting a verdict.
Issue Summary explains email threat issues in plain language
Every email threat issue now includes an Issue Summary: an LLM-generated, plain-language explanation of why the message was flagged, so you can see the risk at a glance instead of piecing it together from the raw signals.
Files
Scroll straight through file search results
File search results now load as you scroll, instead of moving through them one page at a time, so working through a large result set is smoother.
Administration
Timeline preferences stick. Your timeline sort order and date format now carry over across sessions and across the different pages that show a timeline, so you don't have to reset them each time.
Clearer acknowledgement emails. The default end-user acknowledgement email templates have been reworded to be clearer.
🐛 Fixes
Issues and investigation
The Issues list now updates right away when an issue's status changes to or from resolved, so what you see matches the issue's actual state.
The View on issues table link from a detection's details works again, so you can jump straight from a detection to the issues it created.
OAuth Apps
Account names on an app's detail view no longer disappear for accounts that don't have a display name.
Remediation and account security
Material now recognizes a Gmail filter that quietly sends all incoming mail to Trash as a sign of account compromise, including filters built with a catch-all search that older detection missed.
Revoking a user's Google sessions now works even when that account isn't a super admin.
Restoring a deleted Outlook calendar event no longer creates duplicate copies of it.
Platform and administration
Deep links, for example from a Slack notification, now survive SSO login on custom-domain instances instead of dropping you on the main dashboard.
Large Google Drive file searches, such as filtering for files shared externally, now return quickly instead of timing out.
Messages held by Email Bomb Protection are now findable via
message.status.is_surgein Outlook.Re-adding a trusted sender with different capitalization now saves correctly, instead of silently doing nothing.
CSV exports of message search results now handle true and false columns correctly.
In ATO Resilience, you can remove a lock exception once its grace period has been cleared.
Fixed a crash in Firefox and a related error-handling issue.
Fixed a crash when switching tabs in areas that share a tabbed layout.
UI polish: a consistent Spam badge color, a clearer Unsaved label in place of "Unstaged," and more consistent icon and accent colors.
📚 New and Updated Documentation
Updated
Detected and similar messages: Explains that Auto Threat Hunt runs automatically for both Material-detected and user-reported messages, and how that differs from a user report.
Issue Details: Clarifies the difference between sender reputation signals and the detection reasons that created an issue.
Last updated
Was this helpful?