The remainder are procedural controls—things like documented policies and periodic reviews—that no API can observe. We track them too, and let you attest to them with evidence rather than pretending a machine checked.
One connection, read-only by default. Nothing is changed without your explicit approval.
Every account, role and privilege—including delegated admins, super-admin count, and the separate-admin-account practice Google recommends and almost nobody follows.
Who's enrolled, who's enforced, and which administrators are one reused password away from owning your domain.
Accounts nobody has signed into for months still hold licences, data and tokens. We flag them with last-activity evidence.
Every third-party app your team has authorised, the scopes it holds, how many people granted it, and a risk rating derived from what it can actually reach. Revoke with one click.
External sharing defaults, link sharing, attachment and spoofing protections, and the Drive settings that quietly make documents public.
SPF, DKIM and DMARC checked live over DNS—the three records that decide whether anyone can send mail as your domain.
Safe Browsing, download restrictions, incognito, forced relaunch and ChromeOS auto-update, read through the Chrome Policy API.
Google Alert Center incidents—suspicious logins, targeted attacks, data loss—pulled in as findings you can act on, not another console to remember to open.
Every scan is diffed against the last one. Fixed, new, still open—and, critically, regressed: a control that was passing yesterday and is failing today. That's someone changing a setting, and it reaches Slack or your webhook within the hour rather than in next month's report.
&Secure starts read-only. Turn on remediation and a set of safe Chrome and sharing controls become one-click fixes: we show the exact change, you approve, we apply it and re-verify on the next scan. Every action is attributed and logged. Anything riskier stays a written instruction, because a scanner that silently changes production is a worse problem than the finding.
See the whole platform →