If your organisation suffers a targeted phishing attack, you'll notice that alerts within your Security Centre don't trigger or fire very quickly. In fact, it might take several hours - which we found out a few weeks ago trying to monitor and test incident response on a VIP's account.

I've attempted to ask Google on this several times - as well as asking simply, "should I rely on Google's Security Alert Centre for Incident Response", to which they respond each time with:

---

Upon checking the following Help Center article [1], we can confirm that this is working as intended:

“Note: Gmail alert notifications may arrive up to 4 hours after an alert rule is triggered.” [1] https://support.google.com/a/answer/9104586?hl=en#zippy=%2Cuser-reported-phishing

Kindly note that I'm just an email away if you have any other questions about your matter.