- Google Workspace now feeds two threat signals into Mimecast's Human Risk Command Center: Gmail's phishing/post-delivery reclassification alerts (raising a user's Actual Phishing score) and Google's identity risk signals like suspicious logins and leaked credentials (raising Attack Factor)—kept as separate scores rather than one blurry number.
- This addition brings the Command Center to 21 integrated signal sources and extends coverage across both dominant email platforms, Microsoft 365 and Google Workspace, addressing two accelerating threats: phishing and OAuth consent abuse.
- Watchlist Manager segments high-risk users in real time, which can tighten email security policy, trigger targeted Engage nudges, or feed a SIEM/SOAR via the Human Risk Public API—with no new tooling or added cost for existing customers.
Blog
Human Risk Command Center now connects to Google Workspace for phishing and identity
Two of the biggest threats to Google Workspace—phishing and identity abuse—now feed directly into the Human Risk Command Center, giving security teams one connected view of user exposure and the ability to act on it in real time
By The Mimecast Cyber Insights Blog Team
Key Points
The Anti-Phishing Working Group (APWG) — the world's leading coalition of industry, law enforcement, and government organizations combating phishing and cybercrime — tracks which sectors phishing attacks target most. In its 2025 Q4 report, SaaS and webmail platforms, including Google Workspace, tied for the most-targeted sector industry-wide, each accounting for 20.3% of all phishing attacks.
Google's own H1 2026 Threat Horizons Report adds a second, separate data point: consent-based OAuth abuse targeting Workspace accounts spiked roughly 2,000% over a recent six-month window. Two different threats, one shared home — both live inside Google Workspace, and until now, neither had a clean path into a unified view of human risk that lives alongside other critical security signals.
Google Workspace seamlessly integrates with the Human Risk Command Center
Google Workspace generates rich, native detection data across both threats: phishing messages Gmail reclassifies after delivery, users who self-report suspicious mail, logins flagged as suspicious, credentials detected as leaked. Now Google Workspace: Mail feeds Gmail's own phishing and post-delivery reclassification alerts directly into a user's Actual Phishing score. Google Workspace: Identity elevates a user's Attack Factor based on Google's own identity risk signals — suspicious logins, leaked credentials, and account suspensions. Keeping these separate isn't a technicality; it's the model working as designed. A phishing click and a leaked credential are different exposures, and the Mimecast Human Risk Command Center scores them that way rather than flattening both into one number.
This also extends the Command Center's ecosystem coverage in a meaningful way. With these two additions, the Command Center now integrates with 21 signal sources — four first-party and seventeen third-party — spanning phishing, identity, malware, sensitive data handling, and simulated phishing. Google Workspace's addition means that coverage now spans the two dominant email and productivity platforms in the market: Microsoft 365 and Google Workspace.
And if you're already running Mimecast alongside Google Workspace, this adds another layer rather than replacing one: native Google signal now runs right alongside Mimecast's own detection, giving your team two independent, connected vantage points on the same inbox.
Related Tags
- Human Risk
