How It Works: Google Workspace Security by GetBulwark

5

Cyber Essentials controls every piece of work maps to. No exceptions.

2 wks

Written, risk-rated assessment report delivered. Fixed price, agreed up front.

2–3 wks

Typical hardening project. Findings resolved. Documented before and after.

1 owner

Same specialist. Assessment, fixes, monthly review. No hand-offs, ever.

Why This Matters

Your Google Workspace is probably running with open doors right now.

None of them visible in day-to-day operations. None of them tripping any alarms. All of them exploitable, by a former employee, a phishing campaign, or a ransomware group that scanned your domain this morning. The damage does not announce itself until after it has already happened.

Finding 01

An ex-employee who still has full access.

The average UK SMB takes over three weeks to fully revoke a departing employee's access. During that window, their Google account, email history, Drive files, shared documents, client data, remains live and accessible.

They may have already forwarded things. You probably cannot name every account still active without checking right now.

Most businesses discover this when the leaver mentions it, not when they catch it themselves.

Finding 02

A domain anyone can spoof to target your clients.

Without DMARC set to reject, anyone can send email that appears to come from your domain. Your clients, suppliers, and staff would have no technical way to distinguish the real thing from fraud.

Spoofed invoices, fake payment instruction changes, credential phishing, all using your name and your brand.

DMARC misconfiguration is the most common assessment finding. It is also the most preventable.

Finding 03

A "backup" that shares the same point of failure.

Google Drive is not a backup. If your Workspace account is compromised, ransomware encrypted, or an admin accidentally deletes a Shared Drive, the "cloud" and the recovery copy are the same thing.

AFI backs up at item level, outside Google's infrastructure, with independent credentials. Google's Vault does not replace it.

Businesses that rely on Google's defaults discover the gap when they need to recover something specific.

The Process

From inherited mess to a controlled, documented baseline.

Four steps. A clear scope at each stage. No ambiguity about what happens next, what it costs, or who is doing it.

Step 01

Discovery call: map your environment.

A structured 15-minute call. What platform you are on, how your team is set up, and where the most significant gaps are likely to sit. You leave with a plain-English summary and a fixed price for the next step. If the work sits outside the Google Workspace lane, you will hear that directly.

15 min · No preparation · Honest about fit · Fixed price confirmed before any commitment

Step 02

Security assessment: document where you stand.

A structured review of your Google Workspace against the five Cyber Essentials controls. Every setting, account, and device in scope is checked. You receive a written report: every gap found, the risk each one carries, and a clear remediation roadmap.

Fixed price · Two weeks · Written risk-rated report · Yours to keep

Step 03

Hardening project: close every gap.

The findings become a fixed worklist. Every critical gap is closed: MFA enforced, DMARC corrected, leavers removed, monitoring deployed, backup configured. The project ends with a written before-and-after document and a Cyber Essentials posture summary.

2–3 weeks · Fixed scope · Fixed price · Before-and-after in writing

Step 04

Managed monthly, maintained, not just set-up.

The environment does not go quiet after the project. Every month: security controls re-checked, new starters onboarded, leavers revoked, a written security review delivered. You get visibility and proof, not just a recurring bill.

Full stack included · Written monthly review · Same specialist throughout · One fixed per-user price

The First 30 Days

What actually changes in month one.

Assessment findings do not sit in a report. They become a sequenced worklist, starting with the highest-risk items. By the end of the hardening project, the environment has a documented before-and-after and a clean baseline for managed monthly to build on. A typical project month looks like this.

WEEK 01

Access and scoping

The assessment findings become a fixed worklist. Delegated admin access is set up and the order of changes is agreed before anything is touched.

Delegated admin access set
Tenant and user count confirmed
Hardening scope locked
Risk priority agreed

WEEK 02

Identity and email

The highest-risk items move first: MFA, admin roles, leavers, and email authentication.

MFA enforced across all users
Admin roles reduced to minimum
Leaver access checked and revoked
SPF, DKIM, DMARC corrected

WEEK 03

Devices and backup

Endpoint monitoring and backup are deployed so the environment is not relying on Google defaults alone.

Huntress deployed to managed devices
AFI backup configured and verified
Device posture reviewed
Screen lock and wipe policies checked

WEEK 04

Verification and handover

Every finding is re-checked against the five Cyber Essentials controls, the before-and-after is documented, and the environment moves into managed monthly.

Every finding re-checked and verified
Before-and-after issued in writing
Monthly review cadence confirmed
User lifecycle process live

What Changes For You

What this feels like from your side of the desk.

The technical changes matter. The reduction in uncertainty matters more. By the end of month one, someone knows exactly what your environment looks like, and can prove it.

Before

– You're not sure who still has access to what. Leavers may still be active. You would have to check manually.
– Security feels like someone else's problem, until the moment it very clearly is not.
– You know DMARC, MFA, and backup matter. Nobody owns them. They exist in some partial, unverified state.
– If a breach or incident happened tonight, you don't have a documented plan, evidence to point to, or a specialist on speed dial.
– You're carrying the uncertainty. It surfaces in moments, a leaver, a phishing email, a client asking about your security posture.

After

✓ You know exactly where you stand against the five Cyber Essentials controls, updated monthly in a written report you can keep and share.
✓ One person owns the environment. You know exactly who that is and what they are responsible for.
✓ Controls are enforced, not just recommended. MFA is on. DMARC rejects spoofed email. Leavers are revoked same day.
✓ If something happens, there is a documented baseline, a specialist who knows the environment, and a response that starts in minutes, not days.
✓ You can show clients, insurers, and regulators that the work is being done. A written review every month, not a verbal assurance.

The Commitment

No hand-offs. No helpdesk. One person owns your account.

Most IT providers sell you the senior consultant in the pitch meeting and deliver the junior helpdesk three weeks later. GetBulwark works differently, not as a policy, but because the model does not have that problem.

The person you talk to is the person who does the work.

The specialist who runs your assessment writes the report, manages the hardening project, owns the monthly review, and answers the phone when something needs attention. That does not change over time. There is no account manager between you and the work.

At this scale, the service works because it is personal. You always know who is responsible. There is no ambiguity about whose job it is when something needs attention, and no situation where "I'll escalate that" is the answer.

Callum Fraser

Founder · GetBulwark

Promise 01

Every engagement is scoped and priced before anything starts.

Every engagement begins with a structured 15-minute discovery call. The scope and fixed price for any work that follows are confirmed in writing before anything starts. There are no add-ons, no scope creep, and no surprises.

Promise 02

If the hardening project does not fix what was found, we fix it at no additional cost.

Every hardening project ends with a written before-and-after document. If a finding identified in the assessment is not resolved, the fix is included at no extra charge. The deliverable is a measurably improved security posture, not just a list of completed tasks.

Promise 03

If GetBulwark is not the right fit, you will hear that directly.

If the work sits outside the Google Workspace lane, or a different specialist would serve you better, you will be told plainly and pointed somewhere useful. No pressure, no pivot to a watered-down version of the service.

The Stack

What "properly secured" actually means.

GetBulwark uses a fixed stack, the same tools for every managed client. Not because it is convenient, but because these are the right tools for the job and the consistency means they are configured correctly every time.

Endpoint Protection

24/7 monitoring on every managed device.

Huntress monitors every managed device around the clock. If something suspicious happens, malware, an intrusion attempt, a compromised account being used at 3am, a real human analyst at the SOC investigates and contains it. Not an automated alert. A person.

Average containment time: 8 minutes. Purpose-built for SMBs, not a scaled-down enterprise tool.

Huntress, Managed EDR + SOC

Cloud Backup

A real backup, outside Google's infrastructure.

AFI backs up Drive, Gmail, and Shared Drives to independent storage with independent credentials. Item-level recovery means you can restore a single email or a specific file, not just an all-or-nothing account restore.

If the Google account is compromised, the backup is not. That separation is the point.

AFI, Workspace Backup

Email Authentication

Your domain, locked to you.

SPF, DKIM, and DMARC configured to reject. Once this is set correctly, nobody can send email that appears to come from your domain, no spoofed invoices, no fake payment instructions, no phishing campaigns wearing your brand.

DMARC at reject is the standard. Monitoring is included. Most businesses are on "none" or "quarantine", neither stops spoofing.

SPF · DKIM · DMARC, Reject policy

See the full fixed stack and why each tool was chosen →

Go Deeper

Everything that supports the process.

Sample Output

The process is simple. The gaps it closes are not.