Google Cloud has unveiled new artificial intelligence-powered two-factor authentication security features for Google Workspace, scheduled for implementation in 2025. The enhancements build upon Google’s existing security infrastructure and mandatory two-factor authentication requirements for Google Cloud customers, coming at a time when password-based attacks have increased by 61 percent according to recent Google security data.
The rollout introduces two major security innovations. The first is passkeys, which are cryptographic digital credentials uniquely linked to users’ devices. These passkeys use FIDO2 technology, the same standard employed in hardware security keys like Google’s Titan Security Key. Unlike traditional passwords, passkeys cannot be guessed, stolen, or forgotten, and they use devices users already possess, such as Android phones or Windows laptops. The feature is now available to all 11 million Google Workspace organizations and Google’s consumer user base.
The second key innovation is Device Bound Session Credentials (DBSC), developed through collaboration with the broader security community. DBSC enhances account security by tethering session credentials to specific devices, creating an additional barrier against token theft and session hijacking attempts. The feature supplements existing two-factor authentication methods with an extra layer of protection, addressing vulnerabilities that were recently exploited in sophisticated phishing attacks targeting Gmail users.
“We highly recommend that all Workspace customers, especially those with high-value users such as IT administrators and business leaders, implement these controls,” said Andy Wen, Google Cloud’s Chief Information Security Officer, to defend against increasing identity-based attacks.
The new security measures demonstrate Google Cloud’s response to evolving cybersecurity challenges and match broader industry trends. Enterprise adoption of passkeys has surged in recent months, with major technology companies including Microsoft similarly announcing plans to phase out traditional password support in favor of passkey authentication by 2025.
The features are currently accessible to all Workspace customers, with full implementation expected by mid-2025. Google has not specified direct pricing details for these new security enhancements. The transition comes as part of a coordinated effort across the technology industry to move beyond vulnerable password-based systems, with research indicating a 20 percent adoption rate of passkeys among enterprises already.
Sources: Cloud CISO Perspectives
