Message Analysis
Use Message Analysis to identify the signals, behaviors, and message traits that caused Material to flag a message. In the issue detail view, Message Analysis summarizes the evidence behind the detection.
Use this guide to examine how Material evaluates messages.
Review how:
Background
Security is not one size fits all, and neither is our detection system. At Material, we recognize that modern email threats are diverse, fast evolving and highly contextual. A signal detection technique is insufficient to reliably protect organizations against sophisticated attacks. We intentionally designed our system to be multi-layered and multi-approach to maximize accuracy and coverage.
Our detection stack integrates:
Expert-driven heuristics that our threat detection team continuously develops and refines
Signal-based ML models trained on large-scale, real-world email data
AI analysis that detects behavioral, linguistic, and structural threat patterns
Signal-based AI models
These models predict whether an incoming email is malicious. Material evaluates each email across 2,000+ signals, including:
Sender characteristics: authentication results, proprietary sender reputation, and infrastructure patterns
Content signals: language usage, intent indicators, semantic anomalies, and social engineering cues
Structural features: HTML structure, links, attachments, and formatting patterns
Behavioral context: historical sender-recipient interactions, organizational norms, and anomalies
These signals are aggregated and evaluated by machine learning models that estimate the likelihood of malicious intent that goes beyond simple keyword matching or static rules.
Material AI Message Analyzer
Material also uses Large Language Model (LLM)-based analysis to interpret emails at a semantic and contextual level. This helps detect intent, tone, and social engineering tactics that signal-based models may miss.
Model Training and Validation Methodology
Sustained detection performance requires continuous training, validation, and monitoring. Material employs a rigorous end‑to‑end methodology to ensure models remain accurate, stable, and trustworthy over time.
Data Collection and Labeling
Material’s in‑house data labeling team continuously collects and labels email data. This process ensures that training data reflects current threat landscapes and diverse customer environments.
Labeled data includes:
Confirmed malicious and benign emails
Edge cases, mistakes, and ambiguous samples
Newly emerging attack techniques
Continuous Evaluation and Monitoring
Model performance is continuously monitored across key metrics such as precision, recall, and false positive rates. The ML team closely tracks:
False positives (FPs): Legitimate emails incorrectly flagged as malicious
False negatives (FNs): Malicious emails that evade detection
F1 Score: A key machine learning metric that represents a balance of precision and recall
Shared customer cases and internal reviews are used to identify patterns, root causes, and opportunities for improvement.
Feedback Loops and Iteration
Insights from monitoring, customer feedback, and threat research feed directly back into:
Model retraining cycles
Signal engineering improvements
Heuristic updates
This closed‑loop system enables Material to rapidly adapt while maintaining consistent protection and minimizing user disruption.
Last updated
Was this helpful?