Google Workspace email security for small teams

Audit-log blind spots, filter and forwarding risk, lookalikes, what standard Workspace already gives you, and how InboxGuards reads supported audit events — without pretending to replace Google.

Audit-log blind spots on Google Workspace

Google Workspace can record useful security activity — suspicious sign-ins, app grants, forwarding, and some administrative changes — but those records only help if someone is actually reviewing them on a schedule. Most small teams do not open the Admin console every morning to hunt for a quiet compromise.

A compromised Google Workspace account may be used for suspicious sign-ins, malicious app consent, forwarding, or impersonation. Google records some relevant activity, subject to edition, configuration, retention, and API coverage. InboxGuards does not replace Google Admin, Google own security products, or your administrator. It is an alarm layered on supported audit events you authorize it to read.

Filter and forwarding risk

Forwarding to an external address and mailbox delegation can keep an attacker in the conversation after a password reset. InboxGuards checks supported forwarding and related records when Google exposes the required fields. User-created Gmail filter changes — for example delete anything containing invoice — are outside the audit data InboxGuards currently uses. That is a real blind spot we document on purpose. Owners still need a manual filter review in Gmail settings; a monitoring product that pretends every filter is visible is inventing coverage. See also the Gmail filter blind spot.

Lookalikes and domain spoofing are a different layer

Lookalike domains and weak SPF, DKIM, and DMARC make it easier for strangers to impersonate your company without ever logging into a real mailbox. InboxGuards can surface lookalike and DMARC-related signals as part of broader monitoring where configured, and the free spoofing check grades public DNS records without a signup. Neither a DNS scan nor an audit-log alarm replaces verifying payment changes out-of-band with vendors and customers.

What standard Workspace already gives you

Standard Google Workspace plans already include admin tools, audit views, and security settings that matter: 2-Step Verification enforcement options, admin roles, app access controls, and reporting. InboxGuards does not claim to replace those controls. It reads supported audit events so a small team gets plain-English alerts instead of relying on someone remembering to scroll logs. Edition, configuration, retention, and API limits still decide what is available. Google ingestion delays apply.

How InboxGuards reads supported audit events

InboxGuards connects with read-only access to supported Google Workspace audit records and checks them at the fastest cadence available on standard plans — no premium security licensing required. When a configured account-takeover rule matches, you get an alert with available evidence and general response guidance. Your administrator remains responsible for tenant changes.

• Suspicious sign-ins flagged by Google, or logins from unapproved countries
• New third-party apps granted access to Gmail or Drive
• Email forwarding or delegation set up to an external address
• New super-admin roles or security setting changes
• Two-step verification being disabled on any account
• Gmail mailbox delegation changes and app passwords being created
• Daily 2-Step Verification coverage check for users still not enrolled
• Impossible travel, dormant accounts waking up, and risky after-hours changes
• Departure Watch for accounts marked as leaving

Price and boundary — alarm, not a Google replacement

Monitoring is $2 per user per month with no minimum and a 30-day money-back guarantee. Hands-on remediation is not included; an optional $199 flat-fee remediation can be separately authorized. InboxGuards supplies alerts and general response steps; it does not administer your Workspace tenant for you and does not claim to replace Google security. Start monitoring.

Daily dark-web check stays in the alarm lane

Once a day InboxGuards reads user email addresses from your Workspace directory with the same read-only directory scope used for 2-Step Verification coverage and checks each one against Have I Been Pwned and LeakCheck, including info-stealer malware logs. New findings become alerts graded by what was exposed; leaked values themselves are never stored or shown. That daily check helps surface reused passwords before the next takeover attempt. It does not mean InboxGuards is watching every message or replacing Google Workspace security administration.