Check ID: compute_network_default_in_use
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: trust-boundaries
Resource type: compute.googleapis.com/Network

​
What this check verifies

Projects are assessed for a VPC network named default (the pre-created, auto-mode network).

​
Risk

Using the default VPC can weaken segmentation and expose services via permissive firewall rules (e.g., broad internal trust or public admin ports). This increases likelihood of unauthorized access, lateral movement, and data exfiltration, impacting confidentiality and integrity.

​
Recommendation

Prefer custom VPCs over default. Remove unused default networks and apply least privilege with explicit firewall rules, private connectivity, and workload-based segmentation. Enforce creation controls (e.g., org policy to skip default network) and use defense in depth with logging and monitoring.

​
Remediation

gcloud compute networks delete default —quiet

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_network_default_in_use. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks