Google has updated its Credential Provider for Windows to support physical security keys as a second login factor, giving businesses a stronger way to protect Windows devices tied to Google Workspace accounts.

• What it is: The Google Credential Provider for Windows (GCPW) now supports FIDO2-compliant physical security keys at the Windows login screen, not just within individual apps.
• Who is affected: Businesses using Google Workspace with GCPW to manage sign-in on Windows devices.
• What the risk is: Nothing changes if you take no action, this is an added option rather than a forced change. Businesses without strong second-factor authentication remain more exposed to phishing and credential theft.
• What action is needed: If your business uses Windows devices signed in via Google Workspace, consider rolling out hardware security keys for staff with access to sensitive data. This is one of the strongest defences available against phishing.

We recommend reviewing your current sign-in security settings and considering hardware keys for your higher-risk accounts.