Your Google Workspace tenant holds email, files, and identities — and a single open Drive link or risky app grant can expose all three. ThreeShield reviews your whole tenant — identity, Gmail, Drive sharing, apps, logging, and recovery — tells you in plain language what is exposed and what to fix first, and can watch it continuously through Lavawall®. Independent of your MSP and internal IT.
Workspace is quick to set up and easy to leave open. Link sharing defaults to "anyone with the link," 2-step verification is offered but not enforced, users grant third-party apps access to their mail and Drive, and forwarding rules quietly send copies elsewhere. None of it looks like an alarm — which is exactly why attackers and departing employees rely on it.
2-step verification coverage and enforcement, context-aware access, session controls, and risky or dormant accounts.
Who holds super-admin and other high privileges, whether roles are least-privilege, and whether recovery and break-glass access is protected.
The third-party and marketplace apps users have granted to your mail and Drive — a common and overlooked path to data theft — and your API and domain-wide delegation settings.
Your DNS and domain records — SPF, DKIM, and DMARC — set so your legitimate mail reaches inboxes instead of a prospect's or client's junk folder and no one can spoof your domain, plus spam and phishing controls and the routing and forwarding rules used to quietly exfiltrate mail.
External and "anyone with the link" sharing, guest access, and files exposed far beyond who should see them.
Whether admin and login audit logs are retained and exported, whether the alert center is put to use, and whether you can actually recover mail and Drive data.
We comb the login, admin, and Drive audit logs for signs of a compromise that already happened. Because Google keeps much of this history only about six months by default, we reach past that window wherever longer history exists — Lavawall® retained logs and backups — so an intrusion from months ago does not stay hidden.
Who is downloading, externally sharing, or mass-exporting from Drive and Shared Drives — the pattern that catches a departing employee taking data, or a mass-deletion event.
Whether changes in the Admin console — sharing settings, OAuth grants, roles, and directory edits — are captured and reviewable, so a risky change is caught rather than discovered months later.
The unsanctioned apps and AI tools your staff have signed up for, surfaced from Google Workspace sign-up and OAuth signals, so sensitive data is not quietly walking into an unvetted tool.
Whoever set up and runs your tenant cannot objectively grade their own configuration. ThreeShield reviews it at arm's length, so a board, an insurer, an auditor, or a client gets an honest second opinion. We are glad to work with your provider to close the gaps we find.
| Area | What we check against | What you receive |
|---|---|---|
| Identity & access | 2-step verification, context-aware access, least-privilege admin | Prioritized findings with the exact settings to change |
| Gmail & Drive | SPF/DKIM/DMARC, sharing, forwarding rules | A fix-first list your admin or ours can action |
| Benchmark & compliance | CIS Google Workspace Foundations Benchmark | A mapping you can hand an auditor or insurer |
| Ongoing | Lavawall® continuous monitoring | Optional watch on the tenant so drift is caught early |
An assessment tells you where you stand today. Because ThreeShield builds and runs Lavawall®, we can keep watching afterward — risky sign-ins, new OAuth grants, sharing and permission changes, and admin activity — so the tenant does not quietly slide back out of shape between reviews.
Also on Microsoft 365? See our Microsoft 365 security assessment, or fold both into a full cybersecurity audit.
Most assessments end with a PDF and a handshake. We can leave you set up in Lavawall® (the same GRC, Google Workspace monitoring, and external scanning we build ourselves) so you, or the MSP who referred you, can watch the fixes land and catch the next problem without waiting for the next review.
Track each finding through to closed, with the evidence recorded as you go, instead of taking our word for it.
Risky sign-ins, new app grants, sharing and permission changes, and admin activity keep surfacing after we leave, not just on assessment day.
Access is tenant-scoped and least-privilege, you decide who has it, and Lavawall® is month-to-month with no lock-in.
The assessment tells you where you stand. The tools tell you whether you are staying there.
If you run an MSP, there are two ways to bring us in, and we are glad to do either.
| Model | How it works | Best when |
|---|---|---|
| Arm's-length | We run the assessment and hand you an independent, ThreeShield-attributed report to give your client. | Your client, their board, or their insurer wants an outside opinion that carries weight. |
| White-label subcontract | We deliver as your Tier 3, under your brand, so you can offer Google Workspace assessments without hiring a CISSP/CISA team. | You want to widen your menu and own the client relationship end to end. |
One honest line on independence: where a client needs a genuinely independent opinion of IT that you manage, we keep the attribution clear about who did the work. An assessment cannot be both white-labelled by the team that runs the systems and independent of it. Either way, our rules of engagement are written down, and we never go around a partner to their client.
MSP or agency? See the referral and white-label options for partners, laid out from your side of the table.
It is a structured review of how your Google Workspace tenant is configured and defended: 2-step verification and context-aware access, super-admin roles, the third-party apps users have granted access to, Gmail routing and forwarding, how files are shared in Drive, what is being logged, and whether you can recover data. You get a prioritized report of what is exposed and exactly what to change first.
The review itself runs on read-only access — a reader or auditor-style role, or a delegated look at your settings alongside your admin — and we never need to see user passwords. There is one exception at setup: connecting the tenant to Lavawall® for the assessment needs a super administrator to approve it once, a standard authorization step, after which nothing we do can change your tenant. We tell you exactly what we need and why before you grant anything.
Google's own checklist and security dashboard are a useful start, but they are generic and leave the judgement to you. A ThreeShield assessment is done by a person who knows how Workspace tenants actually get breached — stolen sessions, risky OAuth grants, open Drive links, weak 2-step enforcement — and tells you which few changes remove the most real risk for your organization.
No. The review reads configuration and logs; it does not change your tenant or interrupt mail. If you ask us to remediate afterward, every change is planned with you and made in a controlled way, starting with the ones that carry no user impact.
Yes. We map findings to the CIS Google Workspace Foundations Benchmark and to the controls behind SOC 2, HIPAA, and cyber-insurance questionnaires — 2-step verification everywhere, least-privilege admin, logging and retention, and email authentication. You get evidence you can hand an auditor or insurer.
Yes. ThreeShield reviews the tenant at arm's length from whoever manages it, so the findings are an honest second opinion. We are glad to work with your MSP to fix what we find, but we report to you.
Yes. Many organizations run both, and Lavawall® watches both from one console. We can assess each and give you a single, consistent picture of your cloud identity and data risk across the two.
Yes. We can set you or your referring MSP up in Lavawall® (GRC, Google Workspace monitoring, and external scanning) so you keep watching progress after we leave. Access is tenant-scoped and least-privilege, you decide who has it, and it is month-to-month with no lock-in. You get continuous visibility and evidence, not a one-time snapshot.
Yes. MSPs can bring us in at arm's length for an independent, ThreeShield-attributed report, or white-label us as Tier 3 to offer Google Workspace assessments under your own brand. Where a client needs an independent opinion of IT you manage, we keep the attribution honest about who did the work. Our rules of engagement are public, and we never go around a partner.
Often, yes. Beyond checking configuration, we hunt the logs for the fingerprints of an account takeover: risky sign-ins, a forwarding rule quietly copying mail, a new OAuth grant, or admin changes no one remembers making. Account compromise usually leaves exactly these traces, and they are what we look for.
Yes. From Google Workspace sign-up and OAuth-grant signals we surface the SaaS and AI tools staff have adopted on their own, so you can sanction, block, or govern them before sensitive data ends up in an unvetted model.
In Canada. The Lavawall® platform we use for the assessment is hosted in Canada, and data is kept against your own tenant rather than comingled with anyone else's. For Canadian organizations with data-residency obligations, that matters.
We will scope a fixed-price Google Workspace assessment, run it independently of your IT team, and hand you a prioritized report you can act on and share — with the option to keep the tenant watched by Lavawall®.
Get an Assessment QuoteRead-only · Independent · CIS Benchmark-mapped