Scanner Overview (Non-Technical)

This explains how the Google Workspace scanner works and what it checks. The scanner turns connected data into security findings inside InsiderShield.

What The Scanner Does

When you connect Google Workspace and click Sync Now (or when the scheduled sync runs), InsiderShield:

1. Connects securely to Google Workspace using the permission you approved.
2. Collects a list of users and admin accounts.
3. Checks each account against a set of security rules.
4. Creates findings in the InsiderShield dashboard.
5. Marks older findings as resolved if they are no longer present.

What It Checks

• MFA status for all users
• Missing recovery email or phone
• Super admin accounts without MFA
• Too many super admin accounts
• Suspended user accounts

What A Finding Looks Like

Each issue becomes a finding with:

• A short title and description
• A severity level (low, medium, high, critical)
• The affected user or resource
• A recommendation for how to fix it

How The Scanner Stays Accurate

• It runs a fresh scan each time you click Sync Now.
• It also runs on a schedule, so your data stays current.
• If an issue is fixed in Google Workspace, it will be marked resolved on the next scan.