If you manage a Google Ads account and have recently received an email from Google warning you about scams and urging you to create a passkey, you are not alone — and you should not dismiss it. In March 2026, Google began rolling out proactive security notices to advertisers and account users, flagging the ongoing threat of account fraud and directing users toward stronger login methods. The messages are genuine. The threat they reference is real and growing.
This article explains exactly what those emails are, what they are responding to, and what every advertiser, agency, and account manager needs to do right now to protect their Google Ads account from the wave of phishing attacks, MCC hijacks, and credential theft campaigns that have accelerated sharply over the past 12 months.
What Google’s Scam Warning Emails to Advertisers Actually Say
The email Google is currently sending out contains a security notice with a clear message: scammers are actively targeting Google Ads account holders. The notice warns users to be cautious about unusual account activity, to avoid sharing login credentials, and to be wary of unsolicited communications claiming to be from Google. The central recommendation in the notice is for advertisers to create a passkey — a passwordless, phishing-resistant login method — for their Google Account.
The message is part of a broader, platform-wide effort that Google has been building toward for over a year. It is not a legal notice. It is not a suspension warning. It is a proactive alert, designed to reach advertisers before their accounts are compromised rather than after.
Google’s official position is straightforward: “Google will never send an unsolicited message asking you to provide your password or other sensitive information by email or through a link.” Any message doing exactly that is a scam. The irony is not lost on security researchers: scammers have become so effective at impersonating Google’s own email communications that Google now sends real warnings to alert users about the fake ones.
The email directs recipients toward Google’s passkey setup process, which is currently in a limited pilot for advertisers who manage sensitive account actions like user access changes and account linking. Understanding why this specific moment prompted the warning requires looking at what has happened to Google Ads security over the past 18 months.
The Scale of the Threat: Numbers from Google’s 2024 Ads Safety Report
The security environment that prompted these warnings is documented in Google’s own published data. Google’s 2024 Ads Safety Report — released in early 2025 — provides a detailed picture of the enforcement actions the company took over the course of 2024, and the numbers are striking.
In 2024, Google suspended 39.2 million advertiser accounts for fraudulent activities. That compares to 12.7 million in 2023, meaning account suspensions tripled in a single year. Of those, over 5 million accounts were suspended specifically for violations of policies most closely associated with scams.
During the same period, Google:
- Blocked or removed 5.1 billion ads (compared to 5.5 billion in 2023, a figure that reflects AI-driven improvements in earlier detection rather than a decrease in attempts)
- Restricted a further 9.1 billion ads
- Took action against over 1.3 billion publisher pages and more than 220,000 publisher sites
- Blocked or removed 415 million ads specifically tied to scam-related policy violations
These figures represent the volume of harmful content that Google’s systems caught before it reached users. They do not represent the full scale of what is being attempted. Threat intelligence researchers have documented the campaigns that slip through, and the impact on individual advertisers can be severe.
Beyond the platform itself, the human context matters. According to a 2025 study commissioned by Google in partnership with Morning Consult, approximately 4 in 5 consumers globally express worry about losing access to all of their online accounts through a hack. Separately, nearly 60% of people worldwide report having encountered a scam in the previous 12 months. These are not marginal risks. They describe the baseline experience for most internet users and, by extension, most advertisers operating Google Ads accounts.
How Attackers Are Targeting Google Ads Advertisers: Three Active Threat Vectors
Understanding the warning Google sent requires understanding the specific attack methods being used against advertisers right now. There are three primary vectors currently in active use.
1. Phishing Emails Designed to Look Like Google Communications
The most common attack begins with an email. The email looks exactly like a message from Google — same formatting, same brand colors, same tone. It typically presents as one of the following:
- An account suspension warning requiring immediate action
- A billing alert requiring payment confirmation
- A policy violation notice requiring a login to resolve
- A partner verification request or access invitation
The message creates a sense of urgency without crossing into obvious alarm. “Confirm access to keep your ads running” is a typical phrasing. Nothing in the message reads as overtly suspicious, because the attackers have studied legitimate Google Ads communications and replicated them closely.
The link in the message leads to a page that mimics Google’s login interface. In many cases — and this is what makes detection so difficult — the landing page is actually hosted on Google Sites. Because Google Sites uses the root domain sites.google.com, and Google’s own ad policies require the display URL and final URL to share the same root domain, these phishing pages technically pass Google’s own verification checks. The attacker exploits a platform rule designed to prevent fraud in order to commit it.
Once the advertiser enters their credentials, the phishing kit collects the login information along with session cookies, unique identifiers, and a detailed fingerprint of the user’s device and browser. That data is sent to the attacker’s server in real time, and account takeover can begin within minutes.
2. Malvertising: Fake Google Ads That Target Advertisers Through Google Ads
In late 2024 and early 2025, cybersecurity firm Malwarebytes documented a campaign that took this approach one step further. Attackers were purchasing fraudulent Google Ads that appeared when users searched for “Google Ads” itself. The ads were indistinguishable from legitimate Google promotional content and directed victims through a redirection chain to sophisticated phishing pages — again, hosted on Google Sites to appear authentic.
This creates a circular attack pattern: scammers steal advertiser credentials via fake Google ads, use the compromised accounts to run more fake ads targeting new victims, and so on. Malwarebytes analysts traced the campaign to operators distributing the stolen accounts across cybercriminal networks, where hijacked Google Ads accounts represent high-value commodities used to push further scams, malware downloads, and disinformation campaigns.
The attackers use JavaScript-based browser fingerprinting to profile each visitor before presenting the phishing interface, filtering out security researchers and bot traffic to ensure only real advertisers reach the credential-harvesting stage.
3. MCC Account Hijacks via OAuth and Access Invitation Exploits
The third attack vector targets Google Ads Manager Accounts (MCCs) — the administrative structure that agencies and large advertisers use to manage multiple ad accounts from a single login. An MCC account is an extremely valuable target because compromising it grants instant access to every client account underneath it.
Search Engine Land reported a significant surge in MCC takeovers through late 2025, with agencies across LinkedIn, Reddit, and Google’s own community forums documenting active attacks. One agency reported that attackers racked up tens of thousands of dollars in fraudulent ad spend within 24 hours of gaining access.
What distinguishes MCC hijacks from simple password theft is that many of them do not involve stolen passwords at all. Instead, attackers send emails that appear to be standard Google Ads access invitations or OAuth app authorization requests. The user clicks through, signs in to what appears to be a legitimate Google login page, and approves access for what seems to be a routine app or admin user. No password is shared. No obvious red flag is triggered.
From Google’s perspective, the account owner made an authorized change. The attackers then add additional administrators as backup access points, modify billing profiles, restructure the MCC hierarchy to complicate recovery, and begin running fraudulent campaigns — all within the normal operational framework of Google Ads account management. Detection typically happens only when a team member notices unusual performance data or finance flags an unexpected charge, by which time hours of ad spend have already been lost.
Why MCC Accounts Carry Disproportionate Risk
The structural design of an MCC account creates a concentration of access that amplifies the impact of any successful attack. A single manager login controls campaigns, billing, user permissions, and third-party integrations across every client account linked to it. For an agency running dozens or hundreds of client accounts, a single compromised MCC login is the equivalent of handing over every client’s budget simultaneously.
Several conditions common to agency environments make MCC attacks particularly effective:
Multiple administrators with overlapping permissions. Large teams often grant admin rights broadly to ensure operational flexibility. Each admin account is a potential attack surface.
Shared inboxes and high-volume email traffic. Teams that process large volumes of Google notifications are more likely to process a malicious one without scrutiny. When every day brings dozens of legitimate Google Ads emails, one more barely registers.
Frequent access changes during high-pressure periods. Onboarding new clients, adding team members, and approving integrations are routine operations. Attackers time their campaigns to coincide with periods when teams are most likely to process requests quickly and without verification.
Speed as a cultural priority. Agencies are built for responsiveness. The same workflows that make teams efficient — fast approvals, shared logins, minimal friction — create blind spots that attackers exploit systematically.
The uncomfortable truth, documented by security researchers and practitioners who have analyzed these attacks, is that experience does not protect against them. Several agencies that fell victim reported they would have caught the attempt only if they had noticed a minor discrepancy in the sender domain or URL — details that are easy to miss in a fast-moving workflow.
What Happens After a Google Ads Account Is Compromised
When attackers gain access to a Google Ads account, the damage unfolds quickly and follows a predictable pattern.
Within the first hours, the attacker adds additional admin users and often creates new MCC layers above the original account structure, making recovery significantly more complicated. Existing campaigns may be duplicated with modified landing pages, or entirely new campaigns are created targeting arbitrage keywords or scam destinations. Budget caps are typically removed or raised substantially, and daily spend accelerates rapidly.
The downstream consequences extend well beyond the immediate financial loss:
Financial damage. Ad spend is the most immediate impact. Fraudulent campaigns can drain thousands of dollars per day, and Google’s support process for compromised accounts — while improved — is not instantaneous. Even with Google’s AI-accelerated appeal system resolving 99% of cases within 24 hours, budget lost during that window is typically unrecoverable.
Account trust damage. Google’s systems flag accounts associated with invalid activity. Even after a compromised account is recovered, the performance history and account trust signals may be damaged, leading to reduced ad serving and approval difficulties in the months following the incident.
Client relationship damage. For agencies, an MCC hijack is not a private incident. Every client whose account was accessed through the compromised MCC is affected, and the disclosure of a security breach — even one caused by a sophisticated external attack — has consequences for client relationships and agency reputation.
Operational disruption. Agencies that lose MCC access lose visibility into every campaign under management simultaneously. Restoring access, auditing every account for unauthorized changes, and rebuilding trust with Google’s support systems can consume days of staff time.
Google’s Response: Passkeys, Platform Safety Features, and Enforcement Scale
Google’s scam warning emails and the push toward passkey adoption represent one layer of a broader set of security investments the company has made in response to the escalating threat environment.
What Passkeys Are and Why Google Is Pushing Them
A passkey is a digital credential tied to a specific user account and device. Unlike a password, a passkey cannot be typed, shared, written down, copied, or extracted from a phishing form. It uses cryptographic key pairs — a private key that stays on the user’s device and a public key registered with the service — to authenticate the user without transmitting any secret that could be intercepted.
In practical terms, signing in with a passkey means using the biometric authentication already on your device: Face ID, fingerprint recognition, or your device’s lock-screen PIN. The user never types a password, which means there is no password to steal.
For Google Ads, passkeys are now supported for sign-in and are specifically required for sensitive actions — including user access changes and account linking updates — as part of a limited pilot program. Advertisers who enroll in the pilot, or who are notified that their accounts require passkey authentication for sensitive actions, will receive an email and in-product notification. Google’s official help documentation specifies a 7-day security delay after a passkey is first created, during which sensitive actions cannot be completed, allowing time for identity verification before new credentials are trusted.
Supported devices for Google Ads passkeys include:
- Computers running Windows 10 or later, macOS Ventura or later, ChromeOS 109 or later
- Phones running iOS 16 or later (with iCloud Keychain enabled)
- Android devices using Android 9 or later
- Hardware security keys supporting the FIDO2 protocol
Bluetooth connectivity is required when using a phone as the passkey device alongside a computer, and both devices must be within approximately 1–2 meters of each other.
To set up a passkey for your Google Ads account:
- Navigate to the Passkeys and Security Keys page in your Google Account settings
- Select “Create a passkey”
- Follow the on-device verification steps
- Note the 7-day waiting period before the passkey can be used for sensitive actions
Google Messages and Broader Platform Protections
Outside of Google Ads specifically, Google has deployed additional security features across its platforms in response to the broader scam environment. As of October 2025, Google Messages now actively warns users when messages are suspected spam and blocks access to links within flagged messages unless the user explicitly marks the message as not spam. This feature is available globally to all Google Messages users.
Google also introduced Key Verifier for Android, which allows users to validate the identity of their messaging contacts through QR code scanning, adding a layer of authentication to end-to-end encrypted conversations.
Recovery Contacts, introduced in late 2025, allow users to designate trusted individuals who can assist with account recovery in the event of a lockout caused by forgotten credentials, lost devices, or account compromise. This feature adds a social recovery layer that functions even when standard recovery methods fail.
Google has additionally launched a “Be Scam Ready” interactive game based on inoculation theory — an educational format that exposes users to realistic scam scenarios in a safe, simulated environment to build pattern recognition before a real attack occurs. The company has also joined the Aspen Institute’s National Task Force on Scam and Fraud Prevention, contributing to the development of a proposed coordinated U.S. national strategy against scams and fraud, and co-founded the National Elder Fraud Coordination Center alongside AARP, Amazon, and Walmart.
A Complete Action Plan for Google Ads Advertisers and Agencies
The security warnings from Google are useful, but the response cannot stop at reading them. Protecting a Google Ads account or MCC in the current environment requires specific operational changes. The following steps reflect the recommendations of security researchers, Google’s official guidance, and the documented patterns of how successful attacks unfold.
Step 1: Set Up Passkeys Immediately
If you have not already enabled a passkey on your Google Account, do it now. Even if your account is not yet in the pilot program requiring passkeys for sensitive actions, having one established adds a meaningful layer of phishing resistance to your login process. The setup takes under five minutes on a supported device.
Do not create a passkey on a shared or public device. Passkeys are tied to the device they are created on, and setting one up on a shared machine creates access that others on that device may be able to use.
Step 2: Audit Every Admin User in Your Google Ads Account or MCC
Log in to your Google Ads or MCC account and navigate to the user management section. Review every listed administrator. If you see accounts you do not recognize, remove them immediately. If access was granted to a third-party app or vendor that is no longer active, revoke it. Dormant users and forgotten integrations are the silent entry points attackers look for.
This audit should not be a one-time task. Incorporate it into a recurring review — at minimum quarterly, and ideally monthly for large agencies with frequent access changes.
Step 3: Verify Every Access Invitation and OAuth Request Before Approving
The attacks that do not involve stolen passwords rely entirely on the target approving a request that appears routine. Build a verification step into your team’s workflow: any request to add a new admin user, authorize an OAuth application, or modify account access should be verified through a separate channel before approval.
Do not verify by replying to the same email that contained the request. Call the person who ostensibly sent it, send a separate message through a known communication channel, or confirm the request is visible and pending inside the actual Google Ads interface — not just in an email inbox.
Step 4: Enable Two-Factor Authentication Across All Team Accounts
Two-factor authentication (2FA) remains an essential baseline. While researchers have documented cases where attackers bypass 2FA through near-perfect phishing simulations, 2FA still stops the majority of credential-based attacks. All accounts with access to your Google Ads account or MCC — not just admin accounts — should have 2FA enforced.
Passkeys represent the next step beyond 2FA, but 2FA remains a necessary floor for any account that does not yet have a passkey configured.
Step 5: Never Click Links in Email to Access Your Google Ads Account
The consistent thread running through documented account takeovers is that the victim clicked a link in an email and entered credentials into the resulting page. The solution is to form an unbreakable habit: go directly to ads.google.com by typing the address into your browser or using a bookmarked link. Never sign in to Google Ads through a link in an email, regardless of how legitimate the email appears.
This rule applies to all team members who have access to the account. One person who breaks the rule under time pressure is sufficient for a full account compromise.
Step 6: Separate Billing and Admin Access from Day-to-Day Management
Accounts that carry billing authority and admin permissions should be separate from the accounts used for day-to-day campaign management and reporting. This limits the blast radius of any credential compromise. If the account a campaign manager uses daily is compromised, the attacker should gain access only to that account’s permissions — not to billing controls or the ability to add new admin users.
Step 7: Train Your Team on Current Phishing Tactics
The phishing emails currently circulating are polished. They use correct branding, professional language, and plausible pretexts. The old advice about watching for grammatical errors or strange email addresses is no longer sufficient. Teams need to be aware of the specific patterns in use: fake suspension warnings, billing alerts with links, partner verification requests, and access invitations.
Consider using Google’s Be Scam Ready educational tool as a starting point, and run periodic simulations if your organization’s size warrants it.
Step 8: Know What to Do If You Suspect Compromise
If you believe your account has been accessed without authorization, take the following steps in sequence:
- Change your Google Account password immediately from a device you trust
- Review the account’s recent activity and sign-in history in Google Account security settings
- Remove any admin users or OAuth apps you do not recognize
- Contact Google Ads support directly through the Help menu inside your verified account
- If your MCC has been compromised, contact Google Ads support at the highest escalation tier available — standard contact may not have sufficient access to assist with MCC-level incidents within the timeframe needed
Document every step you take, with timestamps. This documentation supports the recovery process and any financial claim you make related to fraudulent spend.
Google’s Enforcement Trajectory: What the Data Tells Us About 2026
Looking at the progression in Google’s enforcement data, the 2024 figures represent a significant inflection point. The jump from 12.7 million suspended advertiser accounts in 2023 to 39.2 million in 2024 reflects both a real increase in fraudulent activity and a substantial improvement in Google’s detection capabilities, driven largely by AI model updates. Google deployed over 50 model updates in 2024, and the resulting AI systems have reduced incorrect account suspensions by over 80%.
For 2025 and 2026, the trajectory continues in both directions simultaneously. The volume of attempted fraud is higher, and the capability of Google’s enforcement systems is also higher. The introduction of passkeys as an authentication requirement for sensitive actions, the acceleration of appeal resolution to 99% within 24 hours, and the proactive scam warning emails all reflect a company that is investing in prevention rather than only responding after the fact.
For advertisers and agencies, this means the environment is not getting simpler. The attackers are more sophisticated, their tools are more automated, and the scale of their operations is larger. Google’s enforcement systems are improving, but they catch what they catch after the fact. The ads that are blocked are blocked because they already attempted to run. The accounts that are suspended were already used. The warning emails being sent in March 2026 represent Google’s most direct acknowledgment that the safest outcome is for an attack never to begin — and that achieving that outcome requires the advertiser to take action, not just Google.
Frequently Asked Questions: Google Scam Warnings and Google Ads Account Security
Q: I received an email from Google warning me about scams and asking me to create a passkey. Is it real?
Yes, these emails are genuine. Google began distributing scam warning notices to advertisers and account users in March 2026 as part of a proactive security initiative. The email warns about account compromise threats and recommends creating a passkey for stronger authentication. However, treat any email claiming to be from Google with standard caution: verify the sender domain, do not click links to sign in, and go directly to myaccount.google.com to manage your security settings rather than using links in the email.
Q: What is a passkey and why is it more secure than a password?
A passkey is a cryptographic credential stored on your device that authenticates you without requiring a password. It uses a private key that never leaves your device and a corresponding public key registered with the service. Because no password is transmitted, there is nothing for a phishing site to steal. Passkeys cannot be shared, written down, or intercepted. They are phishing-resistant by design. Google now supports passkeys for Google Ads sign-in and, for some accounts, requires them to authorize sensitive actions like user access changes.
Q: How do I set up a passkey for my Google Ads account?
Go to the Passkeys and Security Keys page in your Google Account settings (myaccount.google.com). Select “Create a passkey” and follow your device’s on-screen prompts, which will typically use biometric verification (fingerprint or face recognition) or your device PIN. Note that after creation, there is a 7-day security delay before the passkey can be used to authorize sensitive actions in Google Ads. Do not create a passkey on a shared device.
Q: What does a Google Ads account takeover actually look like? How will I know if it’s happened?
Early signs include budget spikes you didn’t authorize, new campaigns or ad groups appearing in your account, unfamiliar landing pages in active ads, billing changes or new payment methods, and unexpected new admin users appearing in your user management panel. In many cases, teams notice the problem first through unusual performance data or an unexpected charge flagged by finance. By the time these signals appear, hours of fraudulent spend may have already occurred.
Q: Can attackers bypass two-factor authentication (2FA)?
Yes, in some cases. The most advanced phishing attacks target 2FA through real-time credential relay: the attacker’s server immediately uses stolen credentials and 2FA codes before they expire. Additionally, MCC-level attacks often bypass 2FA entirely by using OAuth authorization flows rather than password theft — the user signs in legitimately, then grants access to a malicious application or user. This is why passkeys represent an improvement over 2FA: because passkeys are tied to the physical device and use cryptographic authentication rather than shared secrets, they resist relay attacks.
Q: How does Google respond when an account is compromised?
Google’s current process resolves 99% of account appeals within 24 hours, thanks to AI-driven review systems that have accelerated response times by approximately 70%. However, accounts are now frozen upon suspension — since June 2024, Google no longer allows changes within a suspended account — which means the recovery process requires contacting Google support and working through an escalation process. Budget spent during the compromise period is typically not recoverable, which makes prevention significantly more valuable than recovery.
Q: Are small businesses and individual advertisers targeted, or just large agencies?
Both. The attackers behind these campaigns operate at scale using automated systems that target all Google Ads account holders, regardless of spend level or account size. Small businesses are, in some ways, more vulnerable because they are less likely to have dedicated security processes or team-level verification workflows. The economics of attacking a smaller advertiser may be less attractive per account, but the automated nature of these campaigns means volume compensates for individual account value.
Q: What should I do if I get an email that looks like it’s from Google asking me to log in or verify my account?
Do not click any link in the email. Open a new browser tab and go directly to ads.google.com or myaccount.google.com by typing the address. If there is a genuine issue requiring your attention, it will be visible when you log in directly. If you are unsure whether an email is legitimate, forward it to phishing@google.com for review, or contact Google Ads support through the Help menu inside your account.
Q: What exactly are MCC account hijacks and how do they differ from regular phishing?
An MCC (Manager Account) hijack targets the top-level administrative account that agencies use to manage multiple client ad accounts. Because one MCC login controls access to every account beneath it, compromising an MCC has a multiplier effect that individual account phishing does not. The method is also different: most MCC hijacks do not require stealing a password. Instead, attackers use fake access invitation emails or OAuth authorization requests to get an authorized user to approve access for a new user or app. Google’s systems register this as a legitimate authorized change, because from a technical standpoint, it is — the account owner approved it.
Q: How many Google Ads accounts did Google suspend for fraud in 2024?
Google suspended 39.2 million advertiser accounts in 2024, according to its 2024 Ads Safety Report. This compares to 12.7 million in 2023, representing a more than threefold increase. Of those suspended accounts, over 5 million were specifically flagged for scam-related policy violations. Google also blocked or removed 5.1 billion ads and restricted a further 9.1 billion during the same period.
Q: What is Google doing beyond sending warning emails?
Google’s current platform-level security investments include: passkey support for Google Ads with required passkey authentication for sensitive actions in a limited pilot, AI-driven account review that resolves 99% of appeals within 24 hours, Safer Links warnings in Google Messages, Key Verifier for Android messaging, Recovery Contacts for account access restoration, and an educational scam awareness tool called Be Scam Ready. Google has also joined the Aspen Institute’s National Task Force on Scam and Fraud Prevention and co-founded the National Elder Fraud Coordination Center.
Q: If I’m an agency managing client accounts, what is the single highest-impact security change I can make right now?
Audit your MCC user management and OAuth app access immediately. Remove every admin user or integrated application that is not actively needed. Restrict admin permissions to the smallest number of users who genuinely require that access level. Set up passkeys for all admin accounts. Establish a team protocol that requires verification through a separate communication channel before any new user, app, or billing change is approved — regardless of how routine the request appears. These steps address the specific attack vector responsible for the majority of high-impact account compromises currently documented.
The pattern is clear even without a formal conclusion: Google’s scam warning emails are not a routine notification to file away. They are a signal that the threat environment for advertisers has reached a level where Google itself has decided that proactive direct communication with account holders is necessary. The attacks are sophisticated, the scale is large, and the financial consequences for individual advertisers and agencies can be severe. Passkeys, audited access controls, and disciplined verification workflows are not optional security hygiene at this point — they are the operational baseline for any team that cannot afford to have their ad spend hijacked or their client accounts compromised.
Whether you manage a single small-business Google Ads account or an MCC covering hundreds of clients, the actions described in this article take a fraction of the time that recovering from an account compromise requires. The time to take them is now, before Google’s warning email becomes relevant in a more urgent way.
About ALM Corp
ALM Corp is an award-winning white-label digital marketing solutions provider that has been supporting agencies and businesses worldwide since 2006. With over 30,000 satisfied clients and partnerships with more than 1,000 ad agencies globally, ALM Corp delivers integrated services across PPC management, SEO, Conversion Rate Optimization, social media marketing, and web development.
The security of Google Ads accounts is not a peripheral concern at ALM Corp — it is central to how the company manages paid search on behalf of clients and agency partners. Every Google Ads account under management is subject to structured access controls, regular permission audits, and team protocols aligned with the best practices described in this article. As Google continues to evolve its security requirements, including the rollout of passkey authentication for sensitive account actions, ALM Corp stays ahead of those changes so that the agencies and businesses it serves are not caught off guard.
For agencies looking to scale their paid media offerings without the overhead and risk of managing Google Ads infrastructure in-house, or for businesses seeking a Google Ads partner with documented security practices and a track record across thousands of client campaigns, ALM Corp’s PPC management services offer a professionally managed alternative built for the current threat environment.
