Material Security growth playbook

Publish the Microsoft 365 twins of the strongest Google guides first: "A pragmatic guide to Microsoft 365 email security", "Microsoft 365 account takeover protection", "OneDrive and SharePoint oversharing", "Microsoft 365 security settings to turn on first" and "OAuth and app consents in Entra ID". Tag them Microsoft 365, link them from the Microsoft 365 provider page and the homepage button, and give each a short answer-first summary and FAQ that AI search can quote.

The new content lead owns web content and answer-engine optimization, and the mid-market AE sells to 251-2,500 employee companies, many of which run Microsoft 365. Matching guides put Material in front of the half of the market the hub currently skips, at almost no cost beyond writing.

[ ] Pragmatic guide to Microsoft 365 email security
[ ] Microsoft 365 account takeover protection
[ ] OneDrive and SharePoint oversharing
[ ] Microsoft 365 settings to turn on first
[ ] App consents and OAuth in Entra ID
[ ] Each tagged Microsoft 365 on the hub
[ ] Linked from /providers/microsoft-365
[ ] FAQ structured data and a dated "last reviewed" line

• Thin, generic guides

  Each guide needs one engineer interview and one real example.

• Microsoft changes admin screens often

  Date every guide and review it each quarter.

• Your websiteWorkspace Resources hub (checked October 22, 2026): the intro promises guidance for "Microsoft 365 and Google Workspace environments" and the filter has a Microsoft 365 category, but of the 55 posts listed, 15 are tagged Google Workspace and none Microsoft 365. Guides include "A Pragmatic Guide to Gmail Security", Google account security, Google account takeover protection and Google Drive DLP; even "How to choose an email security solution" names Google Workspace or Gmail about 60 times and Microsoft 365 twice. Three titles still carry "2025".Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source
• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source
• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source
• Your websiteCustomers: 25 case studies including Lyft, Figma, PagerDuty, Gusto, HackerOne, Mars, Quora, Oportun, Mariner Wealth Advisors and Collective Health; the Microsoft 365 page leads with one story (Cabinetworks). Support is 24/7 through Slack, Teams, email and a portal.Source

Publish a /research page with each finding as its own short, dated section: the number, the sample, the method and a chart. Link every tooltip to its section, add Dataset structured data, and list the page in llms.txt.

Citation share is one of the content lead's three success measures. A traceable number is the easiest thing for a journalist, analyst or AI answer to quote, and each quote names Material.

• Small samples invite criticism

  State the sample plainly and keep claims within it.

• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source
• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source
• Your websiteSitemap (398 URLs, October 22, 2026): 201 /resources posts, 56 /workspace-resources guides, 35 use cases, 25 case studies; comparison pages against Proofpoint, Abnormal AI, Sublime Security, Mimecast, Check Point, SEGs and "Google native controls", but none against Microsoft's own email security; about 30 campaign landing pages (healthcare, banks, insurance, investor portfolios, review-site traffic) and no industry hub; an /oauth-risk-report page and an llms.txt file.Source

Make the H1 render with the first paint: preload the heading font or use font-display: swap, remove any opacity or reveal animation from the hero, and defer the logo carousel, videos and chat until after load. Re-test in PageSpeed and watch the field number over 28 days.

Security buyers arrive from ads, review sites and AI answers with little patience, and the content lead is about to send more traffic to the site. A slow first view costs every one of those visits.

• Design team resists losing the animation

  Keep it below the fold.

• Google PageSpeedReal Chrome users (Chrome UX Report): homepage Largest Contentful Paint at the 75th percentile is 4.9 seconds, in the "poor" band (good is under 2.5 seconds) and 272% slower than the previous period; interaction (118 ms) and layout shift (0.02) are good. The mobile lab test measured 25.4 seconds, with the H1 text as the largest element.Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source
• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source

Choose the term, write a one-sentence definition, and apply it to the homepage title and description, llms.txt, the About page, the product pages and LinkedIn. Publish a short "What is workspace security?" page that owns the definition.

A category only exists when other people use the same words; consistency on your own pages is step one.

• Search demand is for the old terms

  Keep "email security" in body copy; change the category name only.

• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source
• Your websiteSitemap (398 URLs, October 22, 2026): 201 /resources posts, 56 /workspace-resources guides, 35 use cases, 25 case studies; comparison pages against Proofpoint, Abnormal AI, Sublime Security, Mimecast, Check Point, SEGs and "Google native controls", but none against Microsoft's own email security; about 30 campaign landing pages (healthcare, banks, insurance, investor portfolios, review-site traffic) and no industry hub; an /oauth-risk-report page and an llms.txt file.Source

Write 50 buyer prompts (for example "best email security for Google Workspace", "how to stop OAuth app risk", "Abnormal alternative") and run them monthly in the major assistants. Record whether Material, Abnormal, Sublime, Proofpoint, Mimecast and Check Point appear and which pages are cited.

A monthly baseline turns answer-engine optimization into a number the team can manage and report next to pipeline.

• Answers vary run to run

  Run each prompt three times and average.

• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source
• Competitor researchRivals' own homepages: Abnormal AI, "a behavioral AI security platform that protects email, identity, and AI ... Trusted by 5,000 organizations"; Mimecast, "Human Risk Management & Advanced Email Security"; Check Point email security (formerly Avanan), "AI-powered protection against phishing, malware, and BEC for Microsoft 365, Gmail, and more"; Proofpoint protects "people, data and brands" across email, web and cloud.See the research Source
• Your websiteSitemap (398 URLs, October 22, 2026): 201 /resources posts, 56 /workspace-resources guides, 35 use cases, 25 case studies; comparison pages against Proofpoint, Abnormal AI, Sublime Security, Mimecast, Check Point, SEGs and "Google native controls", but none against Microsoft's own email security; about 30 campaign landing pages (healthcare, banks, insurance, investor portfolios, review-site traffic) and no industry hub; an /oauth-risk-report page and an llms.txt file.Source

Add a calculator: employees, plan, ATO add-on and Shared Drive size, giving an annual estimate and the comparison with a typical gateway. Publish the Shared Drive bands, and pass the estimate to the demo form.

Mid-market IT teams of 251-2,500 people need a number for their budget request; giving it on the page shortens the cycle the new AE is measured on.

• Buyers anchor on the estimate

  Show it as a range with volume discounts.

• Your websitePricing: Essentials "$4 Per user/month, billed annually", Advanced "$6", ATO Resilience "+$3" as an add-on or "$5 /user/month as a stand-alone"; Essentials and Advanced add a "fee based on Shared Drive size" that the page does not state; Enterprise is "Talk to Sales". "MCP Server" and "Event Subscriptions and API" are listed under Integrations and Admin; the MCP server is explained only in blog posts such as "Why we built an MCP server".Source
• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source

Update each guide for 2026 (new Google and Microsoft features, AI agents, OAuth risk), retitle it without a year or with 2026, redirect the old URL, and add a "last reviewed" date.

Updated evergreen guides keep their rankings and links, and the refresh is a few days of work.

• Losing rankings on redirect

  Keep the content and headings close.

• Your websiteWorkspace Resources hub (checked October 22, 2026): the intro promises guidance for "Microsoft 365 and Google Workspace environments" and the filter has a Microsoft 365 category, but of the 55 posts listed, 15 are tagged Google Workspace and none Microsoft 365. Guides include "A Pragmatic Guide to Gmail Security", Google account security, Google account takeover protection and Google Drive DLP; even "How to choose an email security solution" names Google Workspace or Gmail about 60 times and Microsoft 365 twice. Three titles still carry "2025".Source
• Your websiteSitemap (398 URLs, October 22, 2026): 201 /resources posts, 56 /workspace-resources guides, 35 use cases, 25 case studies; comparison pages against Proofpoint, Abnormal AI, Sublime Security, Mimecast, Check Point, SEGs and "Google native controls", but none against Microsoft's own email security; about 30 campaign landing pages (healthcare, banks, insurance, investor portfolios, review-site traffic) and no industry hub; an /oauth-risk-report page and an llms.txt file.Source

Build the Microsoft 365 twin (Entra ID sign-in, mailbox rules, app consents, OneDrive and SharePoint sharing, Defender settings), ask the platform as the first question, and route the report to the AE with the low-scoring areas highlighted.

It doubles the audience for a proven asset and gives AEs a specific opening for every Microsoft 365 lead.

• Questions go out of date

  Review quarterly.

• #1 Fill the empty Microsoft 365 half of the Workspace Resources hub

• Your websiteThe free Workspace Security Scorecard is titled "Google Workspace Evaluation": "Our free, 25-question evaluation assesses your security posture across Accounts, Data, Email, and Configurations" with questions on Drive and "Google's Security Center". There is no Microsoft 365 version, although the /love page promotes it as a "5 Minute Workspace Evaluation".Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source
• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source

Publish a fair "Material vs Microsoft native controls" page in the same format as the Google one: what Microsoft covers, where it stops (data at rest, account takeover containment, OAuth), and how they work together.

"Do I need more than what Microsoft gives me?" is the first objection in every Microsoft 365 deal; a page answers it before the call.

• Microsoft licensing confuses readers

  Explain the tiers in one table.

• Your websiteSitemap (398 URLs, October 22, 2026): 201 /resources posts, 56 /workspace-resources guides, 35 use cases, 25 case studies; comparison pages against Proofpoint, Abnormal AI, Sublime Security, Mimecast, Check Point, SEGs and "Google native controls", but none against Microsoft's own email security; about 30 campaign landing pages (healthcare, banks, insurance, investor portfolios, review-site traffic) and no industry hub; an /oauth-risk-report page and an llms.txt file.Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source
• Competitor researchRivals' own homepages: Abnormal AI, "a behavioral AI security platform that protects email, identity, and AI ... Trusted by 5,000 organizations"; Mimecast, "Human Risk Management & Advanced Email Security"; Check Point email security (formerly Avanan), "AI-powered protection against phishing, malware, and BEC for Microsoft 365, Gmail, and more"; Proofpoint protects "people, data and brands" across email, web and cloud.See the research Source

Build a mid-market page: deploy in minutes by API, the automation that replaces manual triage, a price at their size, and two case studies from companies in the band. Use it as the destination for the AE's outbound and partner referrals.

Buyers trust peers of their own size, and the AE needs a page to send.

• Too similar to existing pages

  Lead with team size, not features.

• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source
• Your websiteSitemap (398 URLs, October 22, 2026): 201 /resources posts, 56 /workspace-resources guides, 35 use cases, 25 case studies; comparison pages against Proofpoint, Abnormal AI, Sublime Security, Mimecast, Check Point, SEGs and "Google native controls", but none against Microsoft's own email security; about 30 campaign landing pages (healthcare, banks, insurance, investor portfolios, review-site traffic) and no industry hub; an /oauth-risk-report page and an llms.txt file.Source
• Your websiteCustomers: 25 case studies including Lyft, Figma, PagerDuty, Gusto, HackerOne, Mars, Quora, Oportun, Mariner Wealth Advisors and Collective Health; the Microsoft 365 page leads with one story (Cabinetworks). Support is 24/7 through Slack, Teams, email and a portal.Source
• Your websitePricing: Essentials "$4 Per user/month, billed annually", Advanced "$6", ATO Resilience "+$3" as an add-on or "$5 /user/month as a stand-alone"; Essentials and Advanced add a "fee based on Shared Drive size" that the page does not state; Enterprise is "Talk to Sales". "MCP Server" and "Event Subscriptions and API" are listed under Integrations and Admin; the MCP server is explained only in blog posts such as "Why we built an MCP server".Source

Tag each case study with platform, employee band, industry and outcome metric, add filters to /customers, and show the matching three on each provider, industry and pricing page.

Relevant proof at the moment of evaluation lifts demo rates more than more logos.

• Customers decline new stories

  Offer anonymous versions.

• Your websiteCustomers: 25 case studies including Lyft, Figma, PagerDuty, Gusto, HackerOne, Mars, Quora, Oportun, Mariner Wealth Advisors and Collective Health; the Microsoft 365 page leads with one story (Cabinetworks). Support is 24/7 through Slack, Teams, email and a portal.Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source

Send a short monthly bulletin: three anonymized attacks caught, how they worked and the setting that would have stopped them. Publish it on the blog, send it through HubSpot, and give customers a version with their own counts.

Practitioners subscribe to useful threat news; it keeps Material top of mind between buying cycles and feeds the research franchise.

• Revealing customer data

  Security review before every issue.

• Your websiteThe OAuth & Google Workspace Risk Report: "Across 20 production Google Workspace environments, we found thousands of OAuth grants"; "91% of AI apps appeared in the last 16 months"; "24.5% of grants reach" restricted scopes; a "Caught in the wild" section of dangerous grants; the full report sits behind "Get the report".Source
• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source
• News coverageOctober 2026: "Material Security Announces New Google Drive Security Agent to Help Businesses Manage Risks Within Google Drive"; about 40 news mentions in the last 30 days. The homepage says the Drive Agent "finds and investigates PHI, PII, and sensitive documents shared too broadly in Drive" and remediates in bulk.Source

Build a sequence for Google Workspace companies of 251-2,500 people: one finding, one question ("Do you know which AI apps can read your Drive?"), and an offer of the read-only trial to see their own number.

Research-led outreach gets replies from security teams that ignore vendor pitches, and the trial makes the claim checkable.

• Spam complaints

  Small, well-targeted batches.

• Your websiteThe OAuth & Google Workspace Risk Report: "Across 20 production Google Workspace environments, we found thousands of OAuth grants"; "91% of AI apps appeared in the last 16 months"; "24.5% of grants reach" restricted scopes; a "Caught in the wild" section of dangerous grants; the full report sits behind "Get the report".Source
• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source
• Your websiteFree trial: "Skip the sales call and try Material". After the form comes a welcome email, then "within 2 business days" a link to grant permissions, then 1-3 days of analysis and a call with a security engineer, then "7 days to review the risk reports"; Material runs read-only unless remediations are enabled.Source

Show the permission link on the thank-you page for verified work domains, start analysis immediately, and book the findings call in the same flow. Keep manual review only for very large tenants.

Every day between form and first findings loses trials; the read-only model already removes the main risk.

• Unqualified trials

  Require a work domain and tenant size.

• Your websiteFree trial: "Skip the sales call and try Material". After the form comes a welcome email, then "within 2 business days" a link to grant permissions, then 1-3 days of analysis and a call with a security engineer, then "7 days to review the risk reports"; Material runs read-only unless remediations are enabled.Source
• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source

For each event, invite target accounts in the region two weeks ahead to a 20-minute meeting or a small dinner, bring the scorecard on a tablet, and follow up within 48 hours with the attendee's score.

Pre-booked meetings convert far better than booth traffic, and the scorecard gives every follow-up a reason.

• Low acceptance

  Offer a dinner, not a pitch.

• Your websiteEvents: the "Security Theater" series of free film nights (Hackers, WarGames) in San Francisco (September 2025), New York (November 2025) and Austin (April 2026), with "live commentary" and prizes; the events page lists BSides NYC, ASCII Edge for MSPs in San Antonio, FutureCon San Diego (November 5) and the H-ISAC Fall Americas Summit (November 30).Source
• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source
• Your websiteThe free Workspace Security Scorecard is titled "Google Workspace Evaluation": "Our free, 25-question evaluation assesses your security posture across Accounts, Data, Email, and Configurations" with questions on Drive and "Google's Security Center". There is no Microsoft 365 version, although the /love page promotes it as a "5 Minute Workspace Evaluation".Source

Offer each partner a co-branded scorecard link and a short findings template. The partner runs it with the client, Material gets the lead with context, and the partner gets credit automatically.

A useful tool is easier to share than a vendor pitch, and tracked links make referral credit fair.

• Partners misuse the tool

  Simple terms and Material review of results.

• #8 A Microsoft 365 version of the free Workspace Security Scorecard

• Your websitePartners: a referral program for consultants and IT firms ("We run the evaluation and the sale ... and pay a referral fee when the deal closes", "no quota, and no certification"), plus MSP, reseller and technology integration programs and a Google partnership page.Source
• Your websiteThe free Workspace Security Scorecard is titled "Google Workspace Evaluation": "Our free, 25-question evaluation assesses your security posture across Accounts, Data, Email, and Configurations" with questions on Drive and "Google's Security Center". There is no Microsoft 365 version, although the /love page promotes it as a "5 Minute Workspace Evaluation".Source
• HiringMid-Market Account Executive (remote, posted August 26, 2026, $200,000-$225,000 OTE): sells to "companies in our commercial segment's (251 to 2,500 employees) IT & Security teams", must "Supplement inbound leads with self-generated outbound strategies", and work "with partner organizations to drive strategic growth opportunities".Source

Build /industries/healthcare and /industries/financial-services with regulations, the attack chain in that sector, relevant case studies and a demo path. Link the existing posts.

Regulated buyers search by industry and need sector proof; the content and customers already exist.

• Overstating compliance

  Describe support, not certification.

• Your websiteSitemap (398 URLs, October 22, 2026): 201 /resources posts, 56 /workspace-resources guides, 35 use cases, 25 case studies; comparison pages against Proofpoint, Abnormal AI, Sublime Security, Mimecast, Check Point, SEGs and "Google native controls", but none against Microsoft's own email security; about 30 campaign landing pages (healthcare, banks, insurance, investor portfolios, review-site traffic) and no industry hub; an /oauth-risk-report page and an llms.txt file.Source
• Your websiteCustomers: 25 case studies including Lyft, Figma, PagerDuty, Gusto, HackerOne, Mars, Quora, Oportun, Mariner Wealth Advisors and Collective Health; the Microsoft 365 page leads with one story (Cabinetworks). Support is 24/7 through Slack, Teams, email and a portal.Source
• Your websiteEvents: the "Security Theater" series of free film nights (Hackers, WarGames) in San Francisco (September 2025), New York (November 2025) and Austin (April 2026), with "live commentary" and prizes; the events page lists BSides NYC, ASCII Edge for MSPs in San Antonio, FutureCon San Diego (November 5) and the H-ISAC Fall Americas Summit (November 30).Source

Publish a product page and a two-minute video showing real questions answered through the MCP server, with setup steps in the docs. Mention it in the AI enablement messaging.

It turns a line in a table into a reason to choose Material for AI-native teams, and it fits the homepage's AI enablement message.

• Security concerns about AI access

  Explain permissions and read-only scope.

• Your websitePricing: Essentials "$4 Per user/month, billed annually", Advanced "$6", ATO Resilience "+$3" as an add-on or "$5 /user/month as a stand-alone"; Essentials and Advanced add a "fee based on Shared Drive size" that the page does not state; Enterprise is "Talk to Sales". "MCP Server" and "Event Subscriptions and API" are listed under Integrations and Admin; the MCP server is explained only in blog posts such as "Why we built an MCP server".Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source

Publish an annual report from anonymized telemetry across both platforms: attacks caught, OAuth and AI app growth, oversharing, account takeover patterns. Ungate the key findings page, gate the full PDF, and run a launch webinar and press briefing.

An annual report earns press, analyst and AI citations every year and gives sales a fresh reason to call.

• Data seen as biased

  Publish the method and sample.

• #2 Link the homepage's "Material Research, 2026" stats to a page AI engines can cite

• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source
• Your websiteThe OAuth & Google Workspace Risk Report: "Across 20 production Google Workspace environments, we found thousands of OAuth grants"; "91% of AI apps appeared in the last 16 months"; "24.5% of grants reach" restricted scopes; a "Caught in the wild" section of dangerous grants; the full report sits behind "Get the report".Source
• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source

Offer a free, read-only Drive check: connect, and within an hour see how many files with sensitive data are public or shared externally, with no file contents shown. Convert to a trial or a demo.

A fast, free measure of one painful risk opens deals and spreads by word of mouth among IT teams.

• Buyers wary of connecting

  Read-only, minimal scopes, clear deletion.

• News coverageOctober 2026: "Material Security Announces New Google Drive Security Agent to Help Businesses Manage Risks Within Google Drive"; about 40 news mentions in the last 30 days. The homepage says the Drive Agent "finds and investigates PHI, PII, and sensitive documents shared too broadly in Drive" and remediates in bulk.Source
• Your websiteFree trial: "Skip the sales call and try Material". After the form comes a welcome email, then "within 2 business days" a link to grant permissions, then 1-3 days of analysis and a call with a security engineer, then "7 days to review the risk reports"; Material runs read-only unless remediations are enabled.Source
• Your websiteThe free Workspace Security Scorecard is titled "Google Workspace Evaluation": "Our free, 25-question evaluation assesses your security posture across Accounts, Data, Email, and Configurations" with questions on Drive and "Google's Security Center". There is no Microsoft 365 version, although the /love page promotes it as a "5 Minute Workspace Evaluation".Source

Record the commentary as short episodes ("what this 1983 film gets right about social engineering"), publish them on YouTube and LinkedIn, and use them to fill the next city's seats.

Entertaining, credible content reaches practitioners who skip webinars and gives the brand a personality rivals lack.

• Film rights

  Use commentary only, no film footage.

• Your websiteEvents: the "Security Theater" series of free film nights (Hackers, WarGames) in San Francisco (September 2025), New York (November 2025) and Austin (April 2026), with "live commentary" and prizes; the events page lists BSides NYC, ASCII Edge for MSPs in San Antonio, FutureCon San Diego (November 5) and the H-ISAC Fall Americas Summit (November 30).Source
• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source

Publish a short monthly post by or with an engineer: one detection, the attack it catches and what to look for in your own logs.

Engineer-authored content earns trust and links from practitioners, and helps recruiting too.

• Revealing detection logic

  Explain the attack, not the rule.

• HiringSr. Manager, Content Marketing (remote, posted September 23, 2026): will "own the editorial engine" across "the blog, our web content, and our original research program", lead "the State of Workspace Security report franchise" with Threat Research, "Own the website's content layer and answer-engine optimization: structure our content so AI search engines cite Material, and track share of model against competitors", and make "workspace security" "the category the market repeats". Success is measured by "pipeline influence, citation share, and engagement".Source
• HiringAlso open in October 2026: a Sr. Enterprise Security Engineer and a Senior Site Reliability Engineer, both remote. Material is "a remote-first workplace with an office in San Francisco".Source

Build a calculator: employees, years of retention and industry give an estimate of sensitive messages at rest and what a takeover could expose, linked to the ATO Resilience add-on.

Personal numbers make an abstract risk concrete and are easy to share.

• Estimates seen as scare tactics

  Show the method.

• #2 Link the homepage's "Material Research, 2026" stats to a page AI engines can cite

• Your websiteHomepage: H1 "Workspace security is the cornerstone of AI enablement."; two entry buttons, "I need to protect Google Workspace" and "I need to protect Microsoft 365"; stat tiles whose sources sit in tooltips, two of them "Source: Material Research, 2026" ("7y Worth of sensitive data sitting in the average corporate mailbox", "39% of breaches involve credential abuse somewhere in the chain"), with no link to the research. The page title says "Security for Google Workspace and Microsoft 365"; llms.txt calls Material "a cloud workspace security platform".Source
• Your websitePricing: Essentials "$4 Per user/month, billed annually", Advanced "$6", ATO Resilience "+$3" as an add-on or "$5 /user/month as a stand-alone"; Essentials and Advanced add a "fee based on Shared Drive size" that the page does not state; Enterprise is "Talk to Sales". "MCP Server" and "Event Subscriptions and API" are listed under Integrations and Admin; the MCP server is explained only in blog posts such as "Why we built an MCP server".Source