Saporo, Order in chaos

GOOGLE WORKSPACE & GCP EXPOSURE

Reduce identity exposure across Google Workspace & GCP

Uncover excessive permissions, misconfigurations, and attack opportunities across Google Workspace and Google Cloud.

Saporo connects users, groups, admin roles, service accounts, and cloud resources in one graph to reveal how attackers could reach critical assets and which changes reduce the most exposure. Analyze either environment independently or connect both for a broader view.

Book a demoFree assessment
Google WorkspaceGoogle Cloud
  • Users & groups
  • Projects
  • Admin roles
  • Service accounts
  • IAM roles
  • Resources

83% of investigated incidents in major cloud and SaaS environments involved threat actors exploiting identity issues for initial access.

Source: Google Cloud Threat Horizons Report, H1 2026

INSIDE THE PLATFORM

See Google Workspace and GCP exposure in Saporo

Map Google identities and access

Bring Workspace users, groups, admin roles, and devices together with Google Cloud organizations, folders, projects, service accounts, and supported resources. Connect identities, role assignments, and inherited permissions across either environment or both to understand who can reach critical resources.

Saporo Inventory for Google showing Google Workspace counts for workspace, users, groups, devices, roles, drives, and mail, and Google Cloud Platform counts for organizations, projects, service accounts, roles, folders, buckets, instances, and Cloud SQL instances in an example environment

Discover and remediate exposure

Uncover misconfigurations, excessive IAM privileges, service account impersonation paths, and flagged log events across your Google environment. Prioritize attack opportunities by their reach to critical assets, then follow guided fixes. With Enterprise, automate supported changes, with approval steps for sensitive actions.

Saporo Node ID Card for a high-value Google Workspace user, with an Explore graph of attack paths to High Value Targets: the user holds an admin role through GWorkspaceHasRole, and that role can reset the passwords of four other high-value users through GWorkspaceResetPassword, in an example environment
1 / 4

Measure your security progress

Track resolved Google findings, attack paths removed, and access to critical assets. Combine Resistance Score and Attack Paths Score trends with applicable Workspace and GCP framework results and tiering views to show how hardening reduces exposure over time.

Saporo Overview with a Medium Resistance Score of 69.6%, down 8.2 points over the last 30 days, an Increase your score action, the rating scale from Critical to Very High, and a Resistance Score over time chart with the Attack Paths score at 88.8% (75% weight) and Compliance at 12.0% (25% weight), in an example environment
1 / 4

Data sources

GOOGLE WORKSPACE & GCP Q&A

What security teams ask about Google identity exposure

Workspace identities and groups can shape access into Google Cloud. Connecting both environments helps reveal cross-service relationships and privilege paths that separate reviews may miss.

Saporo can connect Workspace users, groups, memberships, role assignments, managed devices, and Drive ownership context with the wider identity graph.

Saporo inventories organizations, folders, projects, service accounts, and supported resources, including Compute Engine instances, Cloud SQL instances, and Cloud Storage buckets. It connects these objects through supported IAM policy bindings and inherited access relationships.

Yes. Saporo identifies supported permissions that allow an identity to impersonate a Google Cloud service account and connects them to that account’s access. This reveals how a compromised identity could gain additional privileges and reach critical resources.

Saporo prioritizes exposure using reachability, privilege propagation, impact on critical assets, and the amount of attack surface a change can remove. This helps teams focus on the misconfigurations, excessive permissions, and risky relationships where remediation reduces the most exposure.

Yes. Google Workspace and Google Cloud collection can be enabled separately. Analyze either environment on its own, or connect both to reveal how Workspace users, groups, and administrative privileges relate to Google Cloud access.

Reduce identity exposure before it becomes an attack

Book a demo