Notifications
Clear all
Topic starter
21/08/2026 4:46 pm
TL;DR: Google Workspace does not give administrators a single global view of files shared as “Anyone with the link,” leaving public Drive content easy to miss and hard to govern, according to Strac. The control gap is not discovery alone but continuous monitoring, classification, and rapid remediation before sensitive data becomes broadly exposed.
NHIMG editorial — based on content published by Strac: How to Find Publicly Shared Files or Public Links in Google Drive?
By the numbers:
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
Questions worth separating out
Q: What breaks when organisations rely on manual review for public Drive links?
A: Manual review fails because public-link exposure changes continuously while review cycles are periodic.
Q: Why do public file links create an IAM issue as well as a data security issue?
A: A public link is still an access decision, even if it is not tied to a named user account.
Q: How do security teams know whether privacy controls are actually working?
A: Look for evidence that discovery, classification, DSR routing, and consent enforcement update when the environment changes.
Practitioner guidance
- Implement continuous public-link discovery Monitor Google Drive sharing states in real time so every new “Anyone with the link” or “Public on the web” event is detected immediately.
- Classify file content before triage Combine sharing-state alerts with content-aware detection for PII, credentials, and regulated documents so analysts can prioritise the highest-risk files first.
- Automate permission revocation workflows Use policy-driven remediation to remove public access or downgrade sharing permissions without waiting for manual cleanup or owner action.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step manual workflow using Google Workspace Reports API and Drive Audit Log for locating public links.
- Dashboard and remediation sequence for changing sharing permissions on risky files in one action.
- Configuration details for alerts when files switch to “Anyone with the link” or “Public on the web.”
- Content-aware scanning details for identifying PII, PCI, PHI, secrets, and other regulated data.
👉 Read Strac's guide to finding publicly shared Google Drive files →
Public Drive links: what data security teams need to fix?
Explore further
21/08/2026 5:06 pm
Public-link governance is an identity problem disguised as a file-sharing problem: when access is granted through a link, the control plane is still authorisation. That makes this issue relevant to IAM teams, even when it sits inside a data platform rather than a directory service. The practical lesson is that sharing state must be treated as part of the identity lifecycle for content access, not as a separate admin concern.
A question worth separating out:
Q: Who should own the decision to remove public access from shared files?
A: Ownership should sit with the teams that can act on both access and data sensitivity, usually a joint workflow between IAM, data security, and compliance. Without that shared ownership, public links remain an orphaned risk because no single team can both classify the file and close the exposure path.
👉 Read our full editorial: Public Google Drive links create a hidden exposure gap in data security
