Google Publishes New Guide to Help Defenders Monitor Privileged Accounts

Google has published comprehensive guidance to help defenders monitor privileged accounts, emphasising that stolen credentials are a leading attack vector for modern organisations. The guidance notes that attackers increasingly exploit these “keys to the kingdom” to breach systems and steal data, with stolen credentials accounting for 16% of intrusions in 2024, according to recent threat intelligence.

It defines privilege as contextual to role and tier, covering not only domain administrators but also developers with cloud access and business users handling sensitive information, and it warns that many organisations overlook these accounts in security plans. Google advocates a defence-in-depth approach built on prevention, detection, and response, urging organisations to clearly define privileged accounts, enforce MFA across administrative pathways, and rotate credentials while recording sessions.

It also highlights the need for visibility into privileged activities, noting a global median dwell time of 11 days in 2024, and calls for rapid response capabilities, including tested break-glass procedures and security exercises. Finally, the guidance outlines four maturity stages for PAM programmes and cautions that deploying a PAM tool alone is insufficient without governance and regular permission audits. According to Google.