Gmail Users Get 2-Minute Account Security Review
Google's Security Checkup, an existing tool, lets account holders review devices, recovery methods, and connected apps amid elevated password-spray activity.
Updated on Nov. 1, 2026 in Cybersecurity
Live Poll
Have you checked which apps and devices can access your email account recently?
Google is urging Gmail users to run its Security Checkup tool, which it says takes about 2 minutes and reviews signed-in devices, recent security events, recovery methods, and third-party apps with account access. The tool is a shipped, existing feature that Google has offered for years, not a new capability.
Why it matters
Google is framing the checkup as preventive maintenance rather than a response to a specific new vulnerability, which signals that account hygiene is being pushed as a routine habit. The timing lands as state-aligned actors are running large-scale password attacks, making unreviewed third-party access a more visible risk for ordinary account holders.
The evidence consists of Google's own product guidance and a threat-intelligence account of a password-spray campaign against Microsoft 365 tenants, with the checkup itself taking about 2 minutes to complete. The campaign's attempt rate of 2,900 sign-ins per minute against more than 2,250 tenants is reported, but the source does not say whether any Gmail accounts were affected or how many users have acted on the guidance.
The players
Alphabet's search and cloud company, whose Gmail, Google Account, and Workspace products make it the operator of the Security Checkup tool.
Storm-0940
A state-aligned threat actor based in China that used an AI agent framework to run password-spray attacks against Microsoft 365 tenants.
The details
Security Checkup is a single screen in Google's account settings that consolidates several protections: it lists devices currently signed in, recent security events, the sign-in and recovery methods tied to the account, and every third-party app or service that can read account data. Users can revoke an app's access from that screen, and the same controls are available under 'Apps with account access' at myaccount.google.com. The source also flags a separate gap: Gmail's delegation feature grants another person direct access to a user's inbox, and that access does not expire when the password changes or when two-factor authentication is turned on.
Timeline
October 30, 2026: Google published a blog post promoting Security Checkup.
November 1, 2026: GCN published an article covering Google's Security Checkup push.
The Tech Race
Google's push positions Security Checkup as a standing account-review tool alongside the connected-app controls at myaccount.google.com, a set of protections the company has offered for years. The competitive contrast is with Microsoft 365 tenants, which were the targets of the Storm-0940 campaign, so the race here is between platform providers hardening account access against AI-assisted credential attacks.
The checkup is available now to any Google account holder through myaccount.google.com or by searching 'Security Checkup' while signed in, with no extra hardware or subscription required. The most practical change is revoking third-party apps that still hold access and reviewing Gmail delegation settings, which the source notes persist regardless of password changes or two-factor authentication.
The takeaway
Running the checkup takes about 2 minutes and can surface devices, recovery methods, and apps you no longer use. Watch whether Google follows this push with a published count of users who revoke third-party access in the weeks ahead.
Further reading
For more on how account protections are evolving, see the Cybersecurity section.
More information
Run the Google Security Checkup and connected app access tool from your Google account settings.
Live Poll
Have you checked which apps and devices can access your email account recently?
