Finding that attackers have penetrated Google Workspace marks the start, not the conclusion, of a security incident. The actions taken by defenders immediately afterward can significantly influence the extent of harm an adversary inflicts.
BleepingComputer will present a live webinar on September 23, 2026 called "Breach autopsy: How fast-growing companies are breached through Google Workspace" in partnership with Material Security. The session will bring together Rajan Kapoor, Vice President of Security at Material Security, and Rick Fitzgerald, President of Fireside Consulting LLC, to analyze documented Google Workspace breaches and the choices made by organizations during the opening phase of an incident.
Several of the incidents to be discussed involved threat actors leveraging social engineering paired with rogue OAuth applications to compromise Google Workspace systems. However, determining entry points represents only a portion of effective breach response.
Upon detecting unauthorized activity, security teams must establish what systems were accessed, which users and information face exposure, whether the intruder maintains active access, and what containment measures are required. Organizations with smaller security staffs face particular difficulty executing these decisions rapidly while simultaneously investigating the attack and preventing escalation.
The decisions made after a breach matter
When Google Workspace compromise surfaces, defenders frequently operate with incomplete knowledge regarding initial access methods, scope of access, and persistent presence. Simultaneously, responders must act on decisions carrying direct consequences for incident scope and severity.
This window becomes critical as teams trace initial compromise, pinpoint potentially exposed accounts and information, and execute containment while avoiding overlooked attack vectors. Rather than presenting standard incident-response procedures, the webinar will use actual breaches to demonstrate how these scenarios developed and which decisions proved consequential.
Webinar topics
- What happens during the first hours of a Google Workspace breach
- How attackers can combine social engineering and malicious OAuth applications to gain access
- Which early response decisions can limit or worsen the impact of an incident
- Commonly overlooked weaknesses that can leave users, data, and connected applications exposed
- Which security controls provide the greatest value for fast-growing companies with limited security resources
Participants will observe how actual Google Workspace breaches progressed and gain insight into the lessons security teams can draw from decisions made when incidents are most critical.