Discovering that an attacker has gained access to Google Workspace is only the beginning of an incident. What security teams do next can determine how much damage the attacker is able to cause.
On September 23, 2026, BleepingComputer will host a live webinar titled “Breach autopsy: How fast-growing companies are breached through Google Workspace” with Material Security.
The webinar will feature Rajan Kapoor, Vice President of Security at Material Security, and Rick Fitzgerald, President of Fireside Consulting LLC, examining real, publicly documented Google Workspace breaches and the decisions organizations made during the critical first hours of an incident.
In two of the attacks examined during the webinar, threat actors combined social engineering with malicious OAuth applications to gain access to Google Workspace environments.
But understanding how an attacker got in is only one part of responding to a breach.
Once suspicious access is discovered, security teams must determine what was compromised, what users and data may have been exposed, whether the attacker still has access, and what actions are needed to contain the incident.
For fast-growing companies with lean security teams, making these decisions quickly can be particularly challenging as responders work to understand an attack while simultaneously trying to prevent it from spreading or causing further damage.
The webinar will examine what happened during the earliest stages of real Google Workspace breaches, which response decisions helped limit their impact, and which actions could potentially make an incident worse.
Attendees will also hear which security controls the speakers believe provide the greatest value and what they would build differently if designing a Google Workspace security program from scratch.
The decisions made after a breach matter
When a Google Workspace compromise is discovered, security teams may have incomplete information about how the attacker gained access, what they accessed, and whether they still have a foothold in the environment.
At the same time, defenders must make decisions that can directly affect the scope and impact of the incident.
This makes the first hours particularly important, as teams investigate the initial access, identify potentially exposed users and data, and determine how to contain the attacker without overlooking other avenues of access.
Rather than offering a lengthy incident-response checklist, this webinar will use real breaches to examine how these situations actually unfolded and which decisions mattered most.
The upcoming webinar will cover:
- What happens during the first hours of a Google Workspace breach
- How attackers can combine social engineering and malicious OAuth applications to gain access
- Which early response decisions can limit or worsen the impact of an incident
- Commonly overlooked weaknesses that can leave users, data, and connected applications exposed
- Which security controls provide the greatest value for fast-growing companies with limited security resources
Join us to see how real Google Workspace breaches unfold and what security teams can learn from the decisions made during the critical first hours of an incident.
