Area: Email
Google Workspace
With your Google Workspace connected (read-only): who has two-step verification, how many super administrators there are, forgotten accounts and sign-ins Google flagged as suspicious.
What it can report
Open each one to see what it means and how to fix it.
Workspace admins without two-step verification
What it means
Some administrator accounts of your Google Workspace sign in with just a password, without two-step verification. An administrator can read anyone's email, create accounts and change every setting.
What could happen
It's the most valuable account in the company. If its password is stolen through phishing or a breach, the intruder takes over the whole account: email, documents and users. It is critical.
How an attacker would use it
An administrator receives a fake “Google security alert” and types their password into a copy of the sign-in page. With nothing else to stop them, the attacker signs in as administrator and creates their own hidden account.
How to fix it
- Ask each administrator in the list to turn on two-step verification in their Google account today.
- For administrators, use a security key or the Google prompt rather than SMS codes.Security keys can't be phished; SMS codes can be intercepted.
- In the Google Admin console (admin.google.com), make two-step verification mandatory for administrators.
- Check that no administrator account is shared between several people.
How to check it's fixed
Ward reads your Workspace again at each scan. The finding disappears when every administrator has two-step verification turned on.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.
Workspace accounts without two-step verification
What it means
These people in your Google Workspace sign in with just their password. Two-step verification adds a second check, usually a prompt on their phone, so a password alone isn't enough.
What could happen
Passwords get stolen all the time, through phishing emails or other services' breaches. Without a second step, whoever has the password reads that person's email and can write to customers and suppliers from it.
How an attacker would use it
A password reused on another website leaks in a breach. Someone tries it on the company email, gets in, and sends customers an invoice with a new bank account from a genuine company address.
How to fix it
- Tell the people in the list why it matters and ask them to turn on two-step verification in their Google account.
- Recommend the Google prompt on the phone: it's the easiest option for most people.
- In the Google Admin console (admin.google.com), make two-step verification mandatory, giving everyone a few days to enrol.
How to check it's fixed
Ward reads your Workspace again at each scan. The finding disappears when everyone in the list has two-step verification turned on.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.
Two-step verification not enforced
What it means
In your Google Workspace, two-step verification is optional for these people: they can switch it off, or never turn it on, and new accounts start without it.
What could happen
Whatever is optional ends up undone. Today everyone may have it, but the next person who joins, or someone who switches it off, is left with just a password. Making it mandatory keeps the protection by default.
How an attacker would use it
A new employee starts and never turns on two-step verification because nothing requires it. Months later their password leaks and nobody notices the account was the only one left without protection.
How to fix it
- In the Google Admin console (admin.google.com), go to Security → Authentication → 2-step verification.
- Turn on enforcement, setting a start date a few days ahead so people can enrol.
- Give new employees a short period to enrol from their first day.
How to check it's fixed
Ward reads your Workspace again at each scan. The finding disappears when two-step verification is mandatory for everyone.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.
Too many super administrators
What it means
Your Google Workspace has more super administrators than it needs. Each one can do everything: read any email, delete accounts, change security settings.
What could happen
Every super administrator is another master key. The more there are, the more chances one of them is stolen, and the harder it is to know who changed what. Most people only need a narrower admin role, or none.
How an attacker would use it
One of several super administrators, who barely uses the admin console, falls for a phishing email. The intruder now has full control without having had to target the person who actually manages the account.
How to fix it
- Decide who really needs to be a super administrator: two or three people are usually enough.
- In the Google Admin console (admin.google.com), remove the super administrator role from the rest.
- Give those who still manage something a narrower admin role, such as user management or help desk.
- Make sure the remaining super administrators have two-step verification with a security key.
How to check it's fixed
Ward reads your Workspace again at each scan. The finding disappears when there are three super administrators or fewer.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.
Forgotten Workspace accounts
What it means
These Google Workspace accounts are still active but nobody has signed in to them for months. They are often former employees, interns or test accounts that were never closed.
What could happen
An account nobody uses still has a password and access to email and documents. If that password leaks, an intruder can use it without anyone noticing, because nobody is looking at that account.
How an attacker would use it
A former employee's password appears in a breach. Someone signs in to their still-active work account, reads old emails with customers, and uses them to send a convincing fake invoice.
How to fix it
- Check each account in the list: is it a former employee, a test account or someone on leave?
- In the Google Admin console (admin.google.com), suspend the accounts you no longer need.Suspending keeps their email and files; you can also transfer them to someone else first.
- For the accounts you keep, reset the password and turn on two-step verification.
- Add closing work accounts to your process for when someone leaves the company.
How to check it's fixed
Ward reads your Workspace again at each scan. The finding disappears when no active account has gone unused for more than 90 days.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.
Suspicious sign-ins flagged by Google
What it means
In the last 30 days Google has flagged sign-ins on these accounts as suspicious: from an unusual country or device, or in a way that looks automated.
What could happen
It may be the person travelling or using a new phone, but it's also the typical sign that someone else has their password. If it wasn't them, the intruder may already have read their email.
How an attacker would use it
Someone with a stolen password signs in from another country. Google flags it, but if nobody checks, the intruder sets up an email rule to hide replies and starts writing to customers from that account.
How to fix it
- Ask each person in the list whether they signed in from somewhere new recently.
- If it wasn't them, reset their password from a clean device and sign them out of all sessions.Do it in the Admin console: Users → the person → Security.
- Turn on two-step verification on those accounts if they don't have it.
- Check their email for forwarding rules or filters they didn't create.
How to check it's fixed
Ward reads Google's sign-in reports again at each scan. The finding disappears when there have been no suspicious sign-ins in the last 30 days.
Who usually fixes it
Your IT person
Example with sample data. In your dashboard, the explanation uses your own domain and details.