ACCOUNT SECURITY
Your Google Ads account is too important to protect casually.
Your account drives your leads and revenue and contains confidential business data.
We protect it with layered access security aligned with NIST and CIS standards.
WHAT’S AT STAKE
Google Ads accounts are high-value targets.
A compromised account can redirect your ad spend, change your campaigns, add unauthorized users, and expose valuable business data. Worst of all, it can shut down a major source of leads and revenue while you work to get it back, which can take weeks.
$20.9B
in reported internet-crime losses in 2025, up 26% from 2024.
6.4M
detections linked to theft of Google Ads and Meta ad accounts over 4 years.
A 2026 agency manager-account breach compromised 230 client Google Ads accounts.
THE QUESTION TO ASK ANY AGENCY
Whoever manages your Google Ads account has privileged access to a critical business asset.
One compromised login can expose every Google Ads account connected to it. That makes the agency’s own security practices part of your account security.
Search Engine Land reported a dramatic rise in these takeovers in late 2025, including one agency that saw tens of thousands of dollars in fraudulent spend within 24 hours. Read the report
Ask any agency how they protect that access. A good one will welcome the question.
Here’s our answer
01
Recognized security standards
Aligned with NIST and CIS guidance and documented in writing.
02
Layered access protection
Four layers of access security from login to senior oversight.
03
Phishing-resistant authentication
Passkeys and hardware keys designed to resist credential phishing.
04
Secure account onboarding
Our side secured first, then your team’s access reviewed with you.
BUILT ON RECOGNIZED STANDARDS
Engineered, not improvised.
Most agencies say security matters. We show you the standards our approach is built on so you, or your IT team, can verify the details.
Andrew Percey is an MIT-trained engineer who began his career in Silicon Valley. When he designed how Prometheus protects client access, he started where engineers start: with published standards, not ad-hoc fixes.
ALIGNED WITH
NIST SP 800-63B-4
The Digital Identity Guidelines from the National Institute of Standards and Technology: the U.S. government’s standard for secure sign-in.
WHAT IT CALLS FOR
At assurance level AAL2, multi-factor sign-in with a phishing-resistant option must be offered. At AAL3, its highest level, a phishing-resistant authenticator whose key cannot be copied off the device must be used.
HOW WE MEET IT
- Phishing-resistant passkeys are required for every team sign-in, not just offered.
- Admin access is protected by hardware security keys.
- Weaker sign-in methods are not permitted, and account recovery is kept under admin control.
ALIGNED WITH
CIS v8.1, Controls 5 and 6
Account and Access Control Management, from the Center for Internet Security, an independent nonprofit whose controls are used worldwide.
WHAT IT CALLS FOR
Administrator rights kept in dedicated admin accounts, multi-factor authentication for administrative access, centralized sign-in, defined processes for granting and revoking access, and role-based permissions.
HOW WE MEET IT
- Admin rights live in dedicated admin accounts that sign in only with a hardware key.
- Approved tools have restricted access and use one centralized Google sign-in.
- Access is granted by role, reviewed quarterly, and revoked when no longer needed.
See it in writing.
Our written Account and Credential Management Policy is built on the Center for Internet Security’s own policy template for Controls 5 and 6. You’re welcome to review it, along with how we document our quarterly account and access reviews.
How Prometheus PPC Protects Client Access
A layered approach to account security.
Each layer closes a different way in so that no single slip opens the door.
1. Identity
Passkey-only Google authentication
Passkeys are required for all Google Access. Admin accounts use hardware security keys. Weaker sign-ins are not permitted.
2. Application Access
“Sign in with Google” for apps
Third-party systems use Sign in with Google, extending our phishing-resistant Google authentication to client-data access.
3. Devices
Managed browser & secured devices
Browser security enforced with managed Chrome profiles, on controlled devices with encryption and active malware protection.
4. Permissions
Controlled and reviewed
Only two people handle your account: a senior specialist and our founder. Access is limited to what’s truly needed.
Locks keep people out. Monitoring catches anything that gets through.
We watch for the warning signs of a takeover: access by unauthorized users, sudden jumps in spend, or changed billing details. A problem gets caught quickly, not discovered on next month’s invoice. Other checks flag broken conversion tracking or ad auction changes before they skew your performance.
Why Passkeys Matter
Credential phishing is your biggest digital risk. Passkeys shut it down.
Most account takeovers start with a convincing email and a fake sign-in page. Today’s phishing copies Google’s own messages closely enough to fool experienced advertisers, and it captures two-factor codes along with passwords. That’s why takeovers even hit teams using two-factor authentication.
A passkey only works with the real Google website, so a fake page has nothing to capture. Google now requires passkeys for sensitive Google Ads actions. We use them for all account access, and we’ll help your team do the same.
With a passkey
- No password to steal
- No one-time code to intercept
- No credential an attacker can reuse
- Nothing for a fake sign-in page to capture
Security Starts at Onboarding
Secure from the first connection.
Before we manage a single campaign, we make sure both sides of the connection are protected.
1
Our side is secured first
Our manager account is protected by every layer on this page before it is linked to your account.
2
We review your access
We check who has access to your Google Ads account and help you make the right adjustments.
3
We strengthen your sign-in
We help your team implement phishing-resistant passkeys where appropriate.
Have questions about how we’d secure your account? Ask Andrew directly in your first conversation.
Ready for a Higher Standard of Google Ads Management?
If Google Ads is critical to your business, let’s see if we can help.
Speak directly with founder Andrew Percey
