Google says none of its 85,000+ employees have been successfully phished since early 2017, when it required use of physical Security Keys in place of passwords
Brian Krebs / Krebs on Security :
Context & Ripple Effects
The scale of the problem Google solved internally is documented in its own credential-theft study with UC Berkeley: over one year, 788K credentials were stolen via keyloggers and 12M via phishing. Requiring physical security keys for all 85,000+ employees starting early 2017 was the response, and Brian Krebs' report is the first public accounting of the result: zero successful phishing attacks since.
First-order effects
- Google's own workforce becomes the proof case for phishing-resistant authentication, and the company immediately moves to productize it — unveiling the Titan Security Key, a Yubico-style device now available to Google Cloud customers and soon to everyone.
Second-order effects
- Yubico faces a direct competitor in the hardware-key market it effectively defined, while enterprise buyers gain a big-cloud vendor validating mandatory hardware 2FA as deployable at 85,000-employee scale rather than an executive-only perk.
Third-order effects
- The internal mandate becomes the template for consumer-scale deprecation of passwords: Google later reports 400M+ accounts using passkeys and lets Advanced Protection users enroll with a single biometric passkey instead of two physical keys — the same phishing-resistance goal, minus the hardware.
The trend: Authentication is migrating from phishable passwords to phishing-resistant factors — hardware keys proving the model inside enterprises before passkeys carry it to consumers.