Google's Advanced Protection Program is a stricter account mode for people at elevated risk of targeted attacks. It requires a passkey or FIDO security key to sign in, scans downloads more strictly, limits app installs to verified stores and restricts which third party apps can reach your account data.
What Google says it is
Google describes the program as its strongest account security option, designed for users with high visibility or sensitive information. New protections are added as threats change. CISA's guidance for highly targeted individuals tells Gmail users to enroll.
What it requires
You must sign in with a passkey or a FIDO-compliant security key. That blocks sign-in even when an attacker knows your username and password, and it resists phishing because the key checks the site it is talking to.
What it adds
Per Google's page:
- Phishing resistance through the required key or passkey.
- Stricter download checks. Files are scanned more rigorously, and potentially harmful files can be flagged or blocked. App installs are limited to verified stores such as Google Play and the device maker's store.
- Controlled data access. Only Google apps and verified third party apps can access your account data, with your explicit permission.
The cost side
Stricter modes break things. Based on the restrictions above, expect some unverified apps and sideloaded software to stop working, and expect some third party tools that used to read your mail or files to lose access. Check the program page for the current list of limits before you enroll, because we did not verify every restriction.
You also take on a recovery duty. With keys as your sign-in, losing them without a backup plan is a real lockout risk. Register more than one key or passkey, and store them in separate places. See our post on why two security keys beats one.
Who should enroll
Good candidates:
- Executives, board members and their assistants whose email holds deal or financial information
- Anyone who has been a target of repeated phishing or account takeover attempts
- Public figures, journalists, campaign staff and advisers
Reasonable to skip for now:
- People who depend on a lot of third party tools tied to the Google account and have not yet planned replacements
- Anyone who cannot yet manage physical keys reliably
For many people, a passkey on a recent phone plus a spare key in a drawer is a workable middle path.
Rollout steps
- List the apps and services that use "Sign in with Google" or read your mail and files.
- Register at least two keys or passkeys.
- Store recovery details in your password manager.
- Enroll through Google's program page.
- Review the apps that stop working and replace them with verified options.
Quick check
Does the program work with only a password?
No. It requires a passkey or FIDO security key to sign in.
Is it only for Gmail users?
It protects the Google Account. CISA specifically recommends it for Gmail users in its guidance for highly targeted individuals.
Sources
- Google, Advanced Protection Program
- CISA, Mobile Communications Best Practice Guidance, version 2.0 PDF
Last reviewed: 19 October 2026.
