Useful baseline already in your bill; not a security program.
Identity/email-centric; not a full security or compliance program
Built-in security depends heavily on plan level and admin configuration.
Google Workspace / M365 Security is strongest in its core category. If the goal is audit-ready evidence, supplier risk, backup proof or cross-tool remediation, pair it with a separate evidence workflow rather than expecting this tool to cover the whole compliance program.
Evidence, remediation and reporting layer when this tool needs to support audits.