Google Workspace security: are your controls keeping up?

TL;DR: Google Workspace can reduce phishing, malware and data leakage through Gmail scanning, Security Checkup, Passkeys and Advanced Protection, according to At-Bay, but only if teams actively review configuration drift and third-party access. The real control problem is not feature availability, but whether identity, access and content checks are continuously governed.

Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “The Cybersecurity Tools Hidden in Google Workspace”.

By the numbers:

• 55% of AI inputs now contain sensitive information.

Key questions

Q: How should organisations govern Google Workspace security settings over time?

A: Treat the platform as a living control environment, not a one-time setup.

Q: Why do built-in email and account controls still need human oversight?

A: Because malware filtering, Safe Browsing and passkey checks reduce risk but do not eliminate changed business context, stale permissions or compromised integrations.

Q: What are the signs that a cloud collaboration platform has drifted out of compliance?

A: Look for unexplained security events, unfamiliar devices, excessive third-party app permissions, stale recovery details and repeated login patterns outside normal user behaviour.

Practitioner guidance

• Review third-party app grants on a fixed cadence Inventory which external applications can access Gmail, Drive and related Workspace services, then remove any app that is unnecessary, stale or inconsistent with policy.
• Adopt Passkeys for business accounts Replace SMS-based MFA where possible and require device-bound authentication for accounts that carry sensitive business data or administrative access.
• Use Security Checkup as a recurring audit Schedule monthly or quarterly reviews of login events, recovery settings, device access and recent security changes so drift is caught before it becomes exposure.

Bottom line: Built-in Workspace protections can reduce phishing, malware and leakage, but only when organisations treat them as continuously managed controls.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →