Version 1.62
Version 1.62 gives your team sharper visibility and faster control across File Security, OAuth investigations, and email threats. See how file issues are resolved, focus OAuth reviews on the accounts with the most at stake, and manage Trusted Entities with less effort.
This release also extends calendar remediation to delegated Google calendars and expands built-in email threat coverage.
🎉 New
See how your file issues get resolved
The File Security report has a new File issue resolution section that shows how file issues were handled over the date range you've selected: which ones were resolved, which were ignored, and which are still open.
The rest of the report tells you where your exposure is. This section tells you what your team did about it, so you can see whether your file issues are actually getting worked or just accumulating.
✨ Enhancements
OAuth apps and accounts
Risk context on an app's Accounts tab
When you open an OAuth app and view the Accounts tab, you can now see what each account has at stake, without leaving the app to look it up. Four new columns are available:
Sensitive Email Redaction
Sensitive Emails
Sensitive Files
VIP
Sensitive Email Redaction also works as a filter, so you can narrow the tab to the accounts that aren't covered. All four columns come through in the CSV export, so you can pull an account list with its risk context attached. Sensitive Emails and Sensitive Files count everything the account holds, rather than only what this app can reach.
The Revoked at column is now folded into App status: a revoked account shows its revoke date on the status badge itself, so the tab holds more information in less width.
Trusted Entity changes revalidate Drive file issues
When you add a domain to Trusted Entities, remove one, or change one in a way that affects how Drive shares are judged, Material re-analyzes the Google Drive files that domain affects and updates the file issues accordingly.
Previously, trusting an organization you'd already decided was safe left the issues for its shares sitting open. Now they close on their own.
This works in both directions, so narrowing trust brings back the issues that should be open again. Two things to know:
It applies to Trusted Entities added as a domain, and to Google Drive files
Changing a setting that only affects email handling doesn't trigger a Drive re-analysis
Trusted entities
Update trusted entity settings in bulk
From a Trusted Entity's detail view, use ⌘K to open the command menu. The menu has an Update settings group, so you can change how an entity is treated without walking through each setting one at a time:
Email threat handling: don't trust messages, trust messages and create Safe issues, or trust messages and don't create issues
Email authentication when trusting: required or not required
File detection: treat as internal or treat as external
Subdomains: included or not included
Clearer Trusted Entity and sensitive category controls
The trusted entity details view drops the long introductory paragraphs in favor of a toggle, Trust messages from this entity, with the choices that depend on it nested underneath. Each option carries a one-line description of what it does, so you can tell what you're changing before you change it.
The sensitive category details page picks up the same dropdown styling for Email Response, File Response, and Severity, so the three controls now read as one set.
File Security
Start a file detection response with a grace period
A file detection's remediation response can now open with a grace period, before any email notification goes out. That gives the file owner a window to fix the sharing themselves, rather than having Material act first and explain afterward.
Editing a response also works the same way everywhere now. On file detection, OAuth app, and email threat issue detail views, your edits stay pending until you save them, with one save and cancel control in the same place on each view.
Email security and remediation
Calendar remediation reaches delegated Google calendars
When someone marks a malicious Google calendar invite for remediation, Material now removes the event from the calendar it actually targets, not just the mailbox the notification arrived in.
This matters when an assistant or delegate receives calendar notifications for someone else. Previously the invite could stay on the owner's calendar because Material only looked at the recipient's own. Now the event comes off the owner's calendar.
A caution note on email bomb notifications
The notification an end user receives when Email Bomb Protection holds their mail now warns them that attackers may follow the flood with a direct approach by phone, Slack, Teams, or email, posing as IT support, and tells them not to engage or share information.
An email bomb is often cover for a second move against the same person. The notification now says so at the moment they're most likely to be targeted.
Detections
Clearer descriptions on insecure-MFA detections
The detections that fire when a sign-in completes with a factor that isn't phishing-resistant now describe what they actually caught. The previous wording read as though MFA wasn't configured at all, which sent teams looking for the wrong problem: MFA may well be on, just not in a form that resists phishing. The updated descriptions explain that distinction and point toward security keys and passkeys.
Two specific situations are now labeled plainly rather than left to interpretation:
A challenge from a location the account has used before, which isn't an unusual-location alert
Access with only a password and no second factor
This applies to both the Google and Microsoft insecure-factor detections, which share the same guidance.
Issues and investigation
A quieter activity timeline
The activity timeline on Email Threat issues no longer lists message locked and unlocked entries. Those fired on every tracked message, including ones with nothing to report, and buried the events worth reading. Retrieval events still appear.
One detail view, however you get there
Opening an issue, detection, investigation, account, group, tenant, message, file, or category from a saved link or a notification now brings up the same view you get by clicking the row in the list. Previously those links could load an older, different-looking version of the same page.
Existing bookmarks and notification links keep working. If you copy a link from one of these views, the URL may look different than it used to.
Expanded email threat detection coverage
Material expands built-in email threat detections with no configuration required. New coverage includes:
Business email compromise lures that impersonate a file-share notification, plus broader coverage of malicious links in business email compromise messages
Business email compromise links hidden inside HTML markup
Phishing pages hosted on developer platforms and decentralized storage networks
Suspicious file-sharing links that don't impersonate a particular brand
DocuSign impersonation paired with a lure, and Facebook impersonation
Material also scans more attachment types for these threats, including calendar invite files and additional image formats, so image-based invoice and callback lures are caught more often.
Existing coverage was tuned to reduce false positives on legitimate marketing and service notification mail, so fewer safe messages reach your queue.
🐛 Fixes
Detections and File Security
Custom Google Drive detections that reference a trusted entity now evaluate correctly instead of failing with an error, so those detections run as written.
Files owned by accounts on a shared instance are now scoped to the right tenant, so an admin limited to specific tenants no longer sees internal Google Drive file owners labeled as external.
When you disable or archive a detection, Material asks what to do with the issues it already created: Leave as-is, Mark as ignored, or Mark as resolved. That choice is now applied reliably, working through the issues in batches and picking up where it left off, so even a large backlog finishes.
Issues and investigation
The Analysis filter now applies on grouped issue lists, such as the Data Security page and severity-grouped views. Previously a grouped view returned every issue regardless of the value you'd selected.
Opening a message group that contains an issue you don't have access to no longer fails. The issues you can't see are left out of the group instead.
The Assign to batch action now opens the assignee picker instead of closing straight away.
With a detail view open over a list, batch commands now apply only to the record you're looking at, rather than to everything still selected in the list behind it.
In Explorer, choosing Select all and then scrolling to load more results keeps you in bulk selection mode, with the newly loaded rows included.
User-reported email threat issues built from an internal reporting mailbox now show the reported message itself, with its own sender, subject, date, body, and attachments, rather than the wrapper the reporting tool added around it.
OAuth apps and accounts
A revoke tokens for all users response now also covers users who grant the app after the response is in place, so a newly granted app doesn't keep access indefinitely.
Platform and administration
Connecting an AI client to the Material MCP server over OAuth no longer loops between the consent screen and the client, or ends on an unexpected "authorization request has expired" message.
API calls to list simulations no longer return a 403 error.
The organization profile footer in Settings > Org Profile now saves when it contains an ampersand, so you can add links that carry query parameters.
Settings now shows a single, accurate license tier on dedicated instances that have more than one tier active.
Phishing simulation results no longer count clicks from automated scanners and other clients that don't render the page as participant clicks, so your campaign numbers reflect real people.
The Material logo renders correctly in remediated attachment stubs, including in Outlook's preview, and branding is consistent across the stubs, notifications, and branded pages end users see.
UI polish: classification and detection dropdowns in the command menu use consistent colors, and the Created By column on the API tokens table matches the Actor column on the audit log.
🗑️ Removed
Account sent an email to a personal account
The Account sent an email to a personal account detection has been retired. It no longer creates issues and no longer appears in your detections list. Issues it created in the past stay intact and searchable, and any that were still open or snoozed are closed automatically.
Account sent a sensitive email to a personal account remains active, so you keep coverage on the mail that carries sensitive content, which is where the risk actually sits.
📚 New and Updated Documentation
New
Calendar Invite Attacks: New page on how attackers use calendar invitations, what Material removes when it remediates the message behind an invite, and the Google Workspace or Microsoft 365 setting that closes the path where an invite lands on a calendar with no message at all.
Updated
API v1: Refreshed overview of what you can do across the v1 API and the MCP tools.
Hello World: Adds worked v1 API examples for the accounts, groups, roles, and OAuth app endpoints.
Authentication and Errors and Troubleshooting: Clarify how to authenticate to the v1 API and expand the error reference.
Material MCP Server: Documents the tools for accounts, groups, roles, and OAuth apps, and expands the connection instructions.
Last updated
Was this helpful?