Google Workspace Attack Surface

This publication surveys Google Workspace as an enterprise attack surface, covering administration and OUs, IAM (including service accounts and SAML/SSO), developer interfaces (Apps Script and REST APIs), and core apps (Gmail, Drive, Docs, Sheets), and explains how threat actors commonly exploit these capabilities (phishing, credential and OAuth/API abuse, email collection, and web-service C2) with ATT&CK references; it also reviews native logging, reporting, and rules to strengthen detection and governance, urging organizations to enforce least privilege, monitor audit logs, and take ownership of GW configuration and visibility.