Material Google Drive Security Agent
Material Security · Material Google Drive Security Agent: AI Agent That Investigates Sensitive Drive Files and Fixes Oversharing in Google Workspace
Material's Google Drive Security Agent investigates every Google Drive file flagged as sensitive, judges whether its sharing makes sense for the file's purpose and audience, returns a verdict (Cleared, Contained, Exposed or Overexposed), and can notify the owner, revoke access or change sharing settings according to rules the admin sets. It is for security teams at companies on Google Workspace that are drowning in DLP-style file alerts; it comes with Material's Advanced plan rather than as a separate product.
Best for
Security and IT teams at Google Workspace companies with large, long-lived Drive estates who want sensitive files reviewed and permissions tightened automatically, especially ahead of rolling out Gemini or other AI tools that read Drive
Not ideal for
Microsoft 365-only shops (no OneDrive or SharePoint agent is documented), teams that only want Material's cheaper Essentials tier, and organizations that need an on-premises data security tool
Who it's for
Security, IT and data protection teams at organizations that run Google Workspace and store sensitive data in Google Drive
Capabilities
- Scans new and existing Google Drive files (My Drive and Shared Drives) for sensitive content such as PII, PHI, financial information and company secrets, and labels matches by sensitive category
- Investigates each sensitive file: summarizes its content and purpose, rates its sensitivity, and checks how many collaborators have access and what roles they hold in the organization
- Decides whether the sharing pattern fits the file's inferred purpose and audience and the organization's norms, and explains what it found
- Four verdicts: Cleared (false positive, auto-resolved), Contained (sensitive but justified sharing), Exposed (reach exceeds what the content warrants) and Overexposed (broadly or publicly reachable with weak controls)
- Verdict-based remediation the admin configures: notify the file owner, wait out a grace period, revoke access or change sharing settings
- Runs with a human approving its decisions or as a fully automated background workflow, according to Material
- Search, sort and filter across all files with sensitive content when a case needs human review
- Correlates file activity with Material's email, account and OAuth signals, for example a phishing click followed by a bulk download
- Builds on Material's existing file controls: custom sensitive data types, Google Drive label assignment, external-sharing and public-link detections, and offboarded-account detections
- Connects through the Google API with no software installed on endpoints; Material's platform also exposes an API and an MCP server
Limitations
- Not sold separately: the Drive Agent is listed only in Material's Advanced plan, and the Essentials plan covers file sharing metadata only, without content scanning or the agent
- Covers Google Drive only; Material's Microsoft 365 coverage is described around email and accounts, and no OneDrive or SharePoint equivalent of the agent is documented
- Pricing adds a fee based on Shared Drive size on top of the per-user price; a minimum annual fee covers up to 1 TB and larger estates are quoted individually
- Material's public documentation describes rule-based file detections and remediation workflows but, at launch, no setup guide for the agent's verdicts and responses
- Material's documented file remediation changes permissions on the matched file only, not permissions inherited from a parent folder or shared drive
- Verdicts rest on the agent's inference of a file's purpose and audience; Material publishes no accuracy figures, so validate verdicts before switching to fully automatic revocation
- Cloud service only: shared multi-tenant by default, or a dedicated single-tenant environment in its own cloud project (with semi- or customer-managed options); no on-premises deployment is documented
Use cases
- Working through years of overshared sensitive Drive files before rolling out Gemini or another AI assistant that inherits users' permissions
- Revoking access at once to a customer list shared with hundreds of external freemail addresses, then notifying the owner
- Emailing the owner of a customer list shared with the whole company, giving a grace period, and revoking access only if nothing changes
- Auto-closing sensitive-content alerts where a trusted partner's access matches its role, to cut DLP noise
- Cleaning up files still shared externally by employees who have left, using Material's offboarded-account detection alongside the agent
- Giving a lean security team a verdict and explanation per file instead of a spreadsheet of alerts to forward to department heads
Our take
The Drive Agent is aimed at the step where Google Drive security projects usually stall: the scan finds thousands of sensitive files and nobody has the context or time to decide which shares are wrong. Letting an agent make that call per file, close false positives itself and escalate by severity is the useful idea, and severity-based responses (warn and wait for Exposed, revoke for Overexposed) are a sensible default. It is only an option if you run Google Workspace and are willing to adopt Material's Advanced plan, and the agent's own configuration was not yet documented publicly at launch. Start in notify-only or approval mode, compare its verdicts with what your team would have decided on a sample of files, and turn on automatic revocation for the Overexposed tier first.
Who should use it
Google Workspace organizations whose security team cannot keep up with sensitive-file alerts, that want oversharing cleaned up before rolling out AI assistants, and that are open to Material's broader email, OAuth and account security platform.
Who should skip it
Microsoft 365-only organizations, teams that want a standalone Drive tool without buying into a wider platform, and organizations that require on-premises data security tooling.
Strengths
- Does the per-file review that DLP tools usually push onto data owners, and explains each verdict
- Cleared verdicts close false positives automatically, which cuts sensitive-content alert noise
- Remediation is tied to severity: owner notice and grace period for Exposed files, immediate revocation for Overexposed ones
- Published per-user pricing and a free 7-day trial in your own workspace
- Shares context with Material's email, account and OAuth protections on the same platform
- API-based connection with nothing to install on endpoints
Weaknesses
- Google Drive only; no equivalent agent for OneDrive or SharePoint is documented
- Requires the Advanced plan plus a Shared Drive size fee, so you buy into Material's wider platform
- Documentation for the agent's own configuration was not yet published at launch
- Automatic revocation based on inferred purpose needs tuning and validation before it runs unattended
Material Google Drive Security Agent pricing
Essentials
$4/user/month
Billed annual
- Does not include the Drive Agent
- Email threat detection and response, automated triage of user-reported phishing
- File sharing detection and remediation on metadata only (no content scanning)
- Plus a fee based on Shared Drive size
Advanced
$6/user/month
Billed annual
- Drive Agent investigates sensitive files and automatically remediates overshared documents
- Sensitive content detection in file and email content, custom sensitive data types
- Agentic investigation and remediation of OAuth grants
- Plus a fee based on Shared Drive size
Enterprise
Contact sales
- Volume discounts that scale with total user count
- Further reductions for multi-year commitments
Free tier limits: No free plan. Material offers a free 7-day trial in your own workspace (it does not say whether the Drive Agent is included) and sales-led proofs of concept for qualified prospects.
Note: Prices are per user (any mailbox or account synced into Material), billed annually. Both plans add a Shared Drive fee: a minimum annual fee covers up to 1 TB of Shared Drive storage, and Material assesses larger estates individually. ATO Resilience is a separate add-on at $3 per user per month ($5 as a standalone license). Shared multi-tenant deployment is the default; a dedicated single-tenant environment is also offered.
Where Material Google Drive Security Agent excels
Pre-Gemini Drive cleanup
AI assistants inherit the permissions of the user running them, so overshared files become answers in AI search. The agent reviews sensitive files and narrows access before the rollout instead of after an incident.
Severity-based oversharing response
An Exposed file gets an owner email and a grace period, while an Overexposed file, such as a customer list shared with hundreds of external freemail addresses, has access revoked immediately and the owner is told afterwards.
Cutting false-positive file alerts
When a trusted external party's access matches its role, the agent returns a Cleared verdict and closes the issue, so the queue holds only files that need action.
How Material Google Drive Security Agent fits alongside other tools
Material Google Drive Security Agent and Purple AI
Purple AI investigates SOC alerts from endpoint, cloud and identity telemetry inside SentinelOne Singularity and returns a verdict. Material's Drive Agent investigates sensitive files in Google Drive and fixes who can reach them. A team can run both: one for detections across the security stack, the other for data exposure inside Google Workspace.
Material Google Drive Security Agent and Axonius AI Workforce
Axonius AI Workforce works on an inventory of devices, users, software and vulnerabilities and triages exposures across the IT estate. Material's Drive Agent works at the level of individual Google Drive files and their sharing permissions. They address different layers of exposure.
Frequently asked questions
What does Material's Google Drive Security Agent do?
It reviews Google Drive files that Material has flagged as containing sensitive data. For each file it summarizes the content and purpose, rates its sensitivity, checks who has access, and decides whether that sharing fits the file's likely audience. It then returns a verdict (Cleared, Contained, Exposed or Overexposed) with an explanation and can apply the remediation you configured for that verdict, such as notifying the owner, waiting a grace period, revoking access or changing sharing settings.
How much does the Material Drive Agent cost?
The agent is not priced on its own. Material's pricing page lists it in the Advanced plan at $6 per user per month, billed annually, plus a fee based on Shared Drive size; a minimum annual fee covers up to 1 TB of Shared Drive storage and larger estates are quoted individually. The $4 Essentials plan does not include it. Enterprise volume discounts are available through sales.
Can the agent change file permissions on its own?
Yes, if you allow it. Admins configure responses per verdict, and Material says the agent can run with a human approving its decisions or as a fully automated workflow. Material's launch example revokes access immediately for an Overexposed file and notifies the owner afterwards, while an Exposed file gets an owner notification and a grace period before access is revoked.
Does it work with Microsoft 365, OneDrive or SharePoint?
The Drive Agent is documented for Google Drive only. Material's platform also supports Microsoft 365, but its Microsoft 365 page describes email security, sensitive data in inboxes and account takeover containment, not an equivalent agent for OneDrive or SharePoint files.
How is it different from DLP or DSPM tools?
Material positions it against tools that find sensitive files and then leave a long list of alerts for the security team or data owners to work through. The agent adds business context to each file, decides whether its sharing makes sense, closes false positives itself, and right-sizes permissions automatically. Search and filtering across sensitive files remain available for cases that need a person.
Is there a free trial?
Material offers a free 7-day trial in your own workspace: after you sign up and grant access, Material ingests and analyzes your data over one to three days, a security engineer walks you through the findings, and automated remediations can be switched on if you put the platform into write mode. Qualified prospects can also request a sales-led proof of concept. Material does not say whether the trial includes the Drive Agent, so confirm that when you sign up.
Integrations & fit
About Material Google Drive Security Agent
Material Security sells a cloud workspace security platform for Google Workspace and Microsoft 365 that covers email threats, OAuth app access, account takeover and file security, connected through the providers' APIs with nothing installed on endpoints. The Google Drive Security Agent, launched on October 22, 2026 (Material's launch post also calls it the Drive Agent and the Drive Management Agent), is the agentic layer on the file side. Material first scans My Drive and Shared Drive files for sensitive content such as PII, PHI, financial data and company secrets and labels what it finds. For each sensitive file the agent then summarizes the content and infers its purpose, rates how sensitive it is, looks at how many collaborators have access and what roles they hold, and decides whether that sharing pattern fits the file's inferred audience and the organization's norms. The result is one of four verdicts with an explanation: Cleared (a false positive, closed automatically), Contained (sensitive but sensibly scoped), Exposed (reach exceeds what the content warrants) or Overexposed (broadly or publicly reachable with weak controls). Admins attach responses to verdicts, for example emailing the owner of an Exposed customer list and revoking access after a grace period, or revoking access to an Overexposed file at once and notifying the owner afterwards; Material says the agent can run with a human approving its decisions or as a fully automated workflow. The pitch is the gap between legacy DLP or DSPM, which surfaces thousands of sensitive-file alerts and pushes the review onto data owners, and an agent that does the review itself and right-sizes permissions. Material ties the launch to AI adoption: assistants such as Gemini inherit users' permissions, so an overshared file becomes an AI exposure too, and a Material study of 159 organizations reported that third-party AI tools with OAuth access could reach more than 475 million Drive files containing sensitive data. The tradeoffs: the agent covers Google Drive only (Material's Microsoft 365 coverage centers on email and accounts), it requires the Advanced plan rather than the cheaper Essentials tier, Material's public documentation still describes rule-based file detections and remediation workflows rather than the agent's verdict settings, and how well its inferences about a file's purpose hold up in your environment is something to test during a trial or proof of concept.
Updates from Material Google Drive Security Agent
Material Security launched its Google Drive Security Agent, which investigates Drive files with sensitive content, renders a Cleared, Contained, Exposed or Overexposed verdict based on the file's inferred purpose, sensitivity and exposure, and applies admin-configured remediation such as owner notifications, grace periods and access revocation. Material's pricing page lists the agent in its Advanced plan.
Are you the founder? Claim this listing →