Security consulting

Google Workspace and Google Cloud security consulting

Most security incidents stem from simple configuration mistakes: an admin account with two-step verification turned off, a publicly open folder, or a missing DMARC record. We systematically review and fix your Google environment.

Get a quote Email security check

Last updated: 18 September 2026

Assessment scope

Identity and access

Admin accounts, two-step verification, password policy, service accounts.

Email security

SPF, DKIM, DMARC, phishing protection, and external forwarding rules.

Data sharing

Publicly open files, external sharing, and shared drive settings.

Third-party applications

Reviewing applications granted access to accounts.

Google Cloud configuration

IAM roles, open storage buckets, firewall rules, and logs.

KVKK technical measures

Reviewing access logs, authority limits, and encryption practices.

Process

01
Read-only review
Admin consoles and configurations are reviewed without making changes.
02
Prioritized report
Findings are ranked as critical, high, medium, and low. A remediation step is written for each.
03
Remediation
With your approval, fixes are applied in an order that does not disrupt users.

Situations we see often

A departing employee's account stays active, someone clicks a phishing email, or a shared drive gets opened up to everyone by mistake. All three usually come down to a simple configuration gap, and all three are foreseeable.

Alerts and security reports in the admin console pile up unnoticed when nobody reviews them regularly.
An admin account without two-step verification can put the whole environment at risk from a single leaked password.
A shared drive open to external sharing can be seen by anyone with the link.
Broad permissions granted to service accounts can stay active for years without anyone noticing.

Typical assessment scope and timeline

Timelines vary with your user count and the size of your Google Cloud footprint.

Assessment type	Scope	Typical timeline
Quick assessment	Workspace only, up to 100 users	Usually 1 week
Comprehensive assessment	Workspace and Google Cloud together	Usually 2-4 weeks
Remediation	Closing prioritized findings from the report	Usually 2-6 weeks, depending on the number of findings

These timelines are realistic ranges, not commitments. Exact scope and timeline are confirmed in the proposal based on the size of your environment.

SSS

Frequently asked questions

Do we need to grant access to our systems for the assessment?

Yes, but read-only access. Admin consoles and configurations are reviewed without any changes. Fixes are applied as a separate step, with your approval.

Is this service a penetration test?

No. This service is a configuration and permissions review. If you need a penetration test, that is planned as a separate engagement.

How often should we run a security assessment?

As a general rule, once a year, and after any significant change such as a new system, a merger, or major staff turnover. For managed support customers, some checks are monitored continuously.

Is the KVKK technical measures report an official compliance certificate?

No. The report contains technical findings and recommendations; it is not an official certificate or compliance document. A legal compliance assessment should be done together with your institution's legal counsel.

What gets reviewed on the Google Cloud side?

IAM roles, publicly open storage buckets, firewall rules, and logging settings fall within the assessment scope. Code security or application testing is not part of this service.

Can we share the report with IT, legal, and leadership?

Yes. The report includes both the technical remediation steps for your IT team and a prioritized summary for leadership to act on. You don't need separate permission to share it with whichever teams you choose.

Email security checkScore your SPF, DKIM, and DMARC records in 10 seconds.Security and backupTwo-step verification, DLP, device management, and real backup.Google Cloud securityCloud risk management, security operations, and threat intelligence.Türkiye region and KVKKThe status of the Türkiye region, the Turkcell partnership, and transfer abroad under KVKK.Managed supportOngoing, contracted support in Turkish for Workspace and Google Cloud.Cloud IdentityIdentity, SSO, two-step verification, and device management without Workspace.

Contact

Let's plan a security assessment

Share the size of your environment. We will determine the assessment scope and timeline together.

Get a quote Try the free email test first