Security & Identity

New IDC study: The business value of Mandiant Consulting

Wed, 01 Jul 2026 16:00:00 +0000

Security leaders are now expected to protect business growth and clearly articulate security value to their board of directors, in addition to managing risk. While translating technical defense into measurable financial returns can be challenging, Mandiant Consulting can help you bridge the gap.

Organizations that engaged with Mandiant Consulting reported an average annual benefit of $4.3 million, driving a 268% three-year ROI, with a payback period of just 4.1 months, according to a new IDC Business Value White Paper commissioned by Mandiant. IDC based these findings on its standard ROI methodology and qualitative and quantitative interviews of current Mandiant customers, applying standard financial models. The interviewed organizations are large, highly-complex environments with an average of $17.3 billion in revenue and 74,000 employees.

At Google Cloud, we strongly believe that security is a strategic business enabler that can directly impact your bottom line.

One healthcare organization interviewed by IDC reported that its partnership with Mandiant completely changed the dynamic of its commercial conversations. "Mandiant has enabled us to engage more confidently with customers and position our security posture as a market differentiator, with security now consistently ranking among the top three reasons clients choose us. It has also contributed to reducing our insurance costs by $50,000 per year,” said the healthcare organization.

Frontline threat intelligence in action

CISOs consistently struggle with internal resource constraints and skill deficits, and internal security teams rarely have the time to track every emerging threat group. Mandiant addresses this by distilling findings and delivering frontline threat intelligence and guidance derived from over 500K hours of global incident investigations last year.

Instead of trying to monitor everything, resource-constrained teams can focus their limited hours on the specific threats that are most relevant to them and likely to target their specific industry and build specific targeted defenses. A retail organization highlighted how working with Mandiant experts allowed them to actively defend against targeted campaigns, like those from the Scattered Spider cybercrime group.

"One of the most significant accomplishments from using Mandiant has been their ability to help us create detection use cases specific to Scattered Spider based on their industry knowledge. This has enabled us to monitor, detect, and neutralize related attacks, which is a key reason we have avoided incidents,” the organization told IDC.

To ensure detections are built on solid foundations, many organizations also use Mandiant to run deep technical audits across their identity infrastructure — including Active Directory, privileged account management, and multi-factor authentication (MFA). This independent verification provides crucial reassurance to leadership, an energy-sector organization told IDC.

"Mandiant provides external assurance that our cyberprogram is thorough and validated from a risk management perspective. Their validation and recommendations have helped us reinforce that messaging to our board. They are highly professional, risk aligned, and among the most trusted,” they said.

Quantifying the business and operational impact

By synthesizing customer experiences, IDC quantified the broader operational advantages seen by customers who worked with Mandiant:

59% reported greater preparedness to successfully address cyberattacks.
45% reported overall improvement in cyber-resilience.
36% reported more efficient security analyst teams, allowing internal staff to focus on more strategic, growth-oriented initiatives.

To learn more about how security is a business enabler, register for our July customer webinar.

_{Source: IDC Business Value White Paper, Sponsored by Google, The Business Value of Mandiant Consulting (Doc #US54605426-BVWP, July 2026)}

Google Cloud confirmed to offer a safer choice for EU public sector organizations with Dutch DPIA approval

Wed, 01 Jul 2026 16:00:00 +0000

At Google Cloud, we are committed to providing public sector organizations around the globe with cloud technology that is highly flexible, scalable, and built with market-leading standards for data protection, sovereignty, and security. We understand that for public sector organizations in the European Union, confidence in data protection is not just a preference — it’s a prerequisite.

Today, we’re excited to announce a major milestone that reinforces this commitment for Google Cloud.

Dutch government DPIA confirms strong privacy foundation for Google Cloud

We have successfully collaborated with SLM Rijk, the Dutch government's strategic vendor management agency, who completed their rigorous data protection impact assessment (DPIA) of Google Cloud.

This engagement confirms Google Cloud’s strong commitment to strengthening trust in its privacy posture across the Dutch public sector. Given that all the key points raised during the DPIA have been successfully addressed (see SLM Rijk’s summary here), and that their DPIA concluded that there are no known high data protection risks when the recommended measures are implemented, the Dutch central public sector is now officially enabled to use Google Cloud with a clear path from a privacy-assessment perspective.

Accordingly, we encourage Dutch central public sector prospects and customers to engage with us to learn more about Google Cloud.

More broadly, we believe this outcome provides a strong foundation for public sector organisations across the Netherlands and beyond, to confidently evaluate and adopt Google Cloud, unlocking modernization and digital transformation securely.

This achievement builds upon our strong track record in the region, including the successful completion of the Dutch DPIA on Google Workspace. This previous success affirmed the safe use of Workspace across the Dutch public sector and educational institutions. Together, these assessments demonstrate Google's continued commitment to helping public sector organisations meet their privacy, security, and compliance requirements while benefiting from the innovation and scalability of Google Cloud.

Continued support for all customers on their compliance journeys

We welcome independent assessments that help strengthen trust, transparency, and accountability. The Dutch government's DPIA process represents an important example of constructive collaboration between public institutions, independent experts, and cloud providers to advance privacy protections.

Google Cloud remains committed to helping customers meet their compliance obligations while providing secure, transparent, and privacy-conscious cloud services.

We will continue investing in privacy-enhancing technologies, transparency initiatives, and customer controls to support organisations across Europe and around the world.

We know first-hand that conducting DPIAs can be a complex task, and we remain firmly committed to helping our customers navigate DPIAs with resources at our comprehensive DPIA Cloud Resource Center.

Cloud CISO Perspectives: How Google Cloud Security uses AI internally

Mon, 29 Jun 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for June 2026. Today, we’re discussing how we use AI to chart a path to autonomous software development lifecycle security.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f496ff8b250>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Cloud CISO Perspectives: Our path to autonomous SDLC security

By Chris Betz, CISO, and Ruchi Shah, senior director, Security Engineering, Google Cloud

Chris Betz, CISO, Google Cloud

AI has upended the economics of exploiting vulnerabilities, effectively erasing the traditional patching window. To survive this new reality, security requires an autonomous defense.

To counter machine-speed, AI-driven threats, we’ve worked hard to transition Google Cloud’s security posture to an autonomous, proactive model. By embedding specialized AI agents directly into our software development lifecycle (SDLC), we’ve created automated guardrails that protect code at a scale and speed unreachable by human teams — and we’re taking steps to make those same guardrails widely available.

Ruchi Shah, senior director, Security Engineering, Google Cloud

How we designed agentic, secure SDLC architecture

Google Cloud deploys modular, interconnected AI agents across every stage of the software lifecycle to continuously harden products from code ingestion to production.

1. Design, review, and gate

Historically, launch intakes and threat modeling were manual bottlenecks. Today, Google Cloud engineering teams route product launches through an agent-based security review pipeline.

Agents cross-reference designs against a continuous control catalog of more than 200 rigorous security requirements. High-risk indicators are automatically triaged and flagged for human engineering intervention, while a dynamic product dossier updates in real-time to replace static threat models.

Google Cloud has embedded agentic capabilities across the entire SDLC flow to continuously harden products end-to-end.

2. Centralized AI code scanning and the Mantis framework

Naive, decentralized AI code scanning suffers from sloppiness, frequently hallucinating bugs and yielding true-positive rates under 7%. To solve this, we built Mantis, our core multi-agent orchestration framework designed specifically for scalable, context-aware repository analysis.

The core skills at the heart of Mantis are now open source to demonstrate the fundamental concept. We have a more full-fledged version running internally and securing our customers.

Mantis eliminates brute-force code ingestion by constructing a hierarchical security summary tree. By condensing individual files into directory and root-level summaries, Mantis reduces token overhead by over 85% while preserving critical structural context across massive repositories.

The architecture relies on a highly-coordinated workflow across new agents and existing technologies:

Strategist agent: Evaluates the high-level code structure, threat models, and dependency graphs to isolate risky architectural patterns, establishing a prioritized global plan of targeted investigation tasks.
Research agents: Acting as specialized domain investigators, these agents use internal code searches to drill into raw source files, examining data tracking, control flows, and sanitization logic.
Deduplicator, reviewer, and critic agents: Sanitize findings to filter out noise and eliminate false positives.
Reproduction sandbox: Automatically runs AI-generated proof-of-concept exploits in an isolated, emulated environment to verify real-world exploitability before alerting developers.

3. Self-healing fuzz testing

While code scanning provides breadth, dynamic fuzz testing uncovers deep runtime vulnerabilities. However, writing and maintaining fuzz harnesses are often a significant engineering bottleneck.

Our autonomous, multi-agent engine eliminates manual intervention:

Context and Drafting agents synthesize product logic and existing unit tests to author initial fuzzing harnesses.
Building and Testing agents execute the code and feed real-time compiler and linker errors into a Hallucination Cleaner agent, which acts as an automated mechanic to repair broken dependencies and build configurations.
Quality Analyzer agents monitor runtime execution, actively adjusting inputs to bypass code blockers and penetrate deeper into complex, stateful APIs.

4. The unified AI patching pipeline

Finding thousands of vulnerabilities at scale can create a dangerous remediation backlog without proper planning. To close the exposure window, our discovery tools route findings directly into an autonomous remediation pipeline:

The Reproduce agent replicates the crash in the sandbox.
The Bug Context agent maps the failure execution path.
The Patch agent generates a targeted code fix.
The Evaluation agent runs a rigorous regression loop (that re-compiles code and executes tests) to ensure the patch is safe. Only fully-validated fixes are submitted to a human reviewer.

5. Autonomous and secure posture management

Post-launch, we maintain security integrity with an autonomous security posture management (ASPM) system. By converting our security standard catalog into programmable skills files, the ASPM system continuously checks production systems for configuration drift, automatically triggering agentic remediation when a violation occurs.

Continuous augmentation via self-reflection

Stateless AI systems repeatedly fall into the same logical traps, such as attempting to fix bugs inefficiently and hallucinating about non-existent code. Our framework solves this by introducing a post-hoc self-reflection loop. After a workflow concludes, a dedicated reflection agent analyzes execution logs, tool histories, and human feedback.

Successful trajectories and design patterns are permanented into a global knowledge store. When future agents spin up, this intelligence is injected directly into their context window, creating a compounding-interest effect on our security engineering. This approach has helped us to improve both the vulnerability fix success rate and efficiency.

Moving toward immune software

Google Cloud's internal journey demonstrates that protecting software at AI-scale requires a fundamental paradigm shift from human-dependent checklists to proactive multi-agent orchestration. By pairing open-source tooling like Mantis with autonomous, self-healing execution loops, we are pioneering a future of "immune" software development — where applications continuously discover, validate, and patch their own weaknesses in real-time.

You can learn more about how we use Mantis and other tools to find and fix vulnerabilities at machine-speed here.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f496ff8bb20>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=C1wEjzOHh7Y'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Verifiable trust in the AI era: What’s new in Confidential Computing: To help further strengthen verifiable privacy in cloud AI deployments, here’s our latest Confidential Computing innovations. Read more.
Choice, compliance, and collaboration: Europe’s path to open digital sovereignty: Our Sovereign Cloud solutions are designed to meet Europe's tiered compliance requirements at every level. Read more.
How AI Is rewriting the SecOps playbook: With adversaries operating at machine speed, defenders must prioritize speed, automation, and continuous decision-making. Read more.
Google named a Leader in IDC MarketScape SIEM 2026 Vendor Assessment: We are proud to announce that Google has been named a Leader in the 2026 IDC MarketScape for worldwide SIEM platforms. Read more.
Announcing the Wiz Runtime Sensor for Windows: Wiz pairs real-time threat detection with a memory-safe architecture that scales efficiently to protect your essential cloud infrastructure. Read more.
New VPC Service Controls updates can help secure agents: Designed for agentic workloads, new capabilities in VPC Service Controls can help establish a network-level, destination-based perimeter. Read more.
Bug hunting on Gemini Spark: Gemini Spark brings a persistent agent to the Gemini App. Learn how to approach security testing for this new paradigm and focus on high-impact bugs. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f496ff8b0d0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

China-nexus threat actor targets medical community for cross-sector research: Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting the North American academic, medical, and military research community, that went undetected for more than a year. Read more.
ShinyHunters targets education sector with Oracle PeopleSoft exploit: Mandiant and GTIG have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. Read more.
Zero-day exploitation in Cisco Catalyst SD-WAN Manager: Mandiant has identified a threat actor targeting a vulnerability in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: How Google Cloud uses LLMs to defend billions of users: Google Cloud CISO Chris Betz discusses AI Threat Defense, and emphasizes shifting security practices earlier in the development lifecycle through human-AI collaboration. Listen here.
Cloud Security Podcast: To couple or decouple SIEM: Alex Hurtado, director, Detection Engineering, Scanner, and Christopher Witter, DNR lead, Dropbox, debate the merits of centralized versus decentralized SIEM architectures. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Securing agentic AI with perimeter guardrails: What's new in VPC Service Controls

Fri, 26 Jun 2026 18:00:00 +0000

As enterprises scale autonomous AI agents into production, enabling safe innovation requires robust architectural guardrails. AI agents connect across tools and datasets, so it’s essential to establish clear network-level boundaries for comprehensive data protection.

To help organizations confidently deploy these workflows, we recommend VPC Service Controls (VPC-SC) to establish an essential network-level, destination-based perimeter. Today we’re announcing several new capabilities specifically designed for agentic workloads.

What's new in VPC Service Controls

Designed to enhance AI security, the new capabilities we’re announcing today strengthen boundaries enforced by VPC-SC.

The capability updates include:

Agent identity in directional rules: Enforcing least-privilege access requires treating agents as first-class identities. You can now add agentic identities directly to service perimeter ingress and egress rules using standard Identity and Access Management (IAM) principals.

A single principal maps to an individual agent, while a principalSet maps to a broader collection of agents. PrincipalSets lets administrators apply consistent, auditable access policies across agent fleets. If an agent is compromised, you can immediately revoke its access at the network perimeter.

Granular control with model context protocol (MCP) attributes: As MCP becomes the standard integration layer for agentic systems, the ability to enforce policy at the tool level is critical. VPC Service Controls now support conditional access rules based on specific MCP attributes, including mcp.toolName, mcp.method, and mcp.tool.isReadOnly.

For example, you can grant an agent read access to a Workspace MCP server while explicitly denying its ability to send emails.

Securing the Gemini Enterprise Agent Platform: The Gemini Enterprise Agent Platform provides a comprehensive foundation for production-grade agent deployments. VPC Service Controls is now natively integrated with Agent Platform. When you include Agent Platform as a protected service within a VPC-SC perimeter, the system automatically blocks all public internet access to the Agent Platform instance — enforcing a secure boundary without additional configuration overhead.

"At Mercado Libre, VPC Service Controls serve as an essential, foundational layer of our security architecture. By building a strong perimeter enforcement across hundreds of Google Cloud projects in our organization, we established robust network-level security controls with VPC-SC, ensuring all our data remains protected in our cloud environment," said Juan Pablo Boschi, project lead at Mercado Libre.

Defining a layered approach to enterprise AI security with VPC-SC

Securing an autonomous agent requires a layered approach. Identity, network, and resource controls each target a distinct threat vector.

Identity controls: IAM and Principal Access Boundaries (PAB) focus on "who" can access specific resources. By enforcing strict least-privilege principles for agent identities, you help ensure that autonomous workloads only have the permissions necessary for their specific objectives.
Network controls: Next-generation network firewalls and VPC Service Controls define a robust data perimeter on top of your infrastructure, governing the flow of information across boundaries and preventing data exfiltration.
Resource controls: Organization Policy and other resource-level guardrails set broad, immutable constraints on how resources can be configured and used, preventing risky configurations by default.

While identity and network controls effectively secure the front door, VPC Service Controls provide a critical destination-based defense. In the probabilistic world of autonomous agents, VPC-SC is the control that focuses on the "how” and "where" of the agent’s network and operations, in addition to the “who”.

Defending against the unique attack vectors

Unlike traditional applications, an AI agent's input can inadvertently prompt it to execute an unintended command or action. If an agent is successfully compromised — whether driven by malicious prompts, tool manipulation, or malicious insider commands — VPC Service Controls serves as a critical network safety net.

To illustrate how this network boundary defends against industry-standard risks as mapped by the OWASP Top 10 for LLM Applications, here are three real-world threat vectors where VPC Service Controls can help supplement identity-based controls to prevent data exfiltration.

Exfiltration prevention via indirect prompt injection (OWASP ASI01): A malicious actor could attempt to embed a hidden prompt asking an agent to summarize internal data and transmit it to an unauthorized user. If the hijacked agent has IAM permissions, IAM detects no anomaly.

However, when the agent tries to send that data to an external webhook, VPC-SC blocks the API-layer transfer because the destination is outside the defined perimeter.

Guardrail for tool misuse (OWASP ASI02, ASI08): Prompt hijacks can lead agents to chain tools maliciously, such as sending internal directory data to an external service. By enforcing a VPC-SC perimeter around sensitive assets, you prevent misbehaving agents from bridging data across isolated trust zones.
Neutralizing insider threats (OWASP AS103): Attackers can command a data-processing agent to perform a direct cloud-to-cloud copy from a BigQuery dataset to an unauthorized project. While network firewalls see legitimate HTTPS traffic to BigQuery, and IAM sees an authorized service account, VPC-SC evaluates the destination resource. Since the destination project is outside the enterprise perimeter, the system immediately denies the API request.

VPC Service Controls acts as a perimeter to block data exfiltration attempts from a compromised agent, even if the agent has valid IAM credentials.

Data protection for the autonomous agent world

Perimeter security has evolved from a recommended best practice in the deterministic application and workload centric age to an absolute requirement for the era of autonomous AI agents. VPC-SC provides the necessary control over data movement that IAM cannot address alone.

In an era where agents interpret prompts as code, VPC-SC becomes the mandatory safety net for enterprise data. Pairing the mapping capability of IAM with the rigid data perimeters of VPC-SC lets organizations securely build agentic innovation while maintaining an absolute guardrail against exfiltration.

To learn more, you can explore VPC-SC resources here.

Verifiable, private AI: Google Cloud expands Confidential Computing frontiers

Tue, 23 Jun 2026 16:00:00 +0000

Protecting sensitive data used with AI is a critical part of our commitment to providing advanced and secure cloud infrastructure. Confidential Computing cryptographically protects data in use in hardware-based Trusted Execution Environments (TEEs) with verifiable data integrity.

We are thrilled to share our latest Confidential Computing innovations across our hardware ecosystem that help further strengthen verifiable privacy in cloud AI deployments.

Confidential AI at global scale

By scaling our Confidential AI capabilities globally, we help ensure that AI inference and fine-tuning workloads can run with enforceable privacy guarantees.

Democratizing Confidential AI: Confidential G4 VMs with NVIDIA RTX PRO 6000 Blackwell GPUs in preview

We are excited to announce a landmark moment for accessible Confidential AI at global scale: Confidential VMs and Confidential GKE Nodes on the accelerator-optimized G4 machine series, featuring NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs.

What makes this a game-changer is its global scale and flexibility. Confidential G4 is available in every Google Cloud region that the standard G4 is available, across multiple consumption models including On Demand, Reservations, DWS Flex Start, and Spot/Preemptible.

"As organizations scale AI across multiple infrastructure environments, maintaining privacy and control over data and execution becomes increasingly challenging. Google Cloud Confidential G4 VMs powered by NVIDIA RTX PRO 6000 Blackwell GPUs are a meaningful addition to the expanding Confidential AI infrastructure ecosystem. As AI workflows now span agents, data sources, and infrastructure boundaries, Super Protocol provides a consistent Confidential AI operating model across Google Cloud Confidential VMs, other clouds, and on-premises environments — abstracting away confidential computing complexity and allowing teams to focus on AI outcomes," said Yulia Gontar, COO, Super Protocol.

Powered by 5th Generation AMD EPYC Turin CPUs leveraging AMD SEV, the G4 machine series with NVIDIA RTX PRO 6000 Blackwell GPUs activates robust hardware-based security. This architecture helps ensure that sensitive data is protected during processing inside the TEE, while also encrypting data as it travels between the CPU and GPU.

"GCP's Confidential G4 VM was the obvious choice for Vertebrae because privacy and security are non-negotiable for our customers. Our product processes sensitive work discussions, so we need to support hardware-signed attestation that both CPU and GPU are running in a trusted execution environment. Using confidential computing on Google Cloud lets us deliver the frontier of AI privacy in the cloud," said Andy Qin, CEO, Vertebrae.

With Confidential G4, you can unlock AI inference, fine-tuning, HPC, and use cases involving highly restricted data, sensitive models, or private prompts, all with minimal performance impact. Get started with Confidential G4 VMs and Confidential G4 GKE Nodes.

Enabling end-to-end private inference: Open-source Prompt Encryption SDKs

Even as we make Confidential AI accessible, we understand that protecting sensitive data in AI workloads goes beyond securing the model execution environment. The prompts and responses themselves can contain highly-confidential information. To provide cryptographic protection for the entire inference lifecycle, we are happy to announce the open-source launch of our Prompt Encryption SDKs, now available on GitHub.

This toolkit helps you establish an end-to-end secure channel for your AI inference workloads, ensuring that prompts are cryptographically protected from the moment they leave the client until they are processed in the TEE; model responses are similarly protected all the way back to the client.

Prompt and response encryption using Prompt Encryption SDK.

The Client SDK is integrated into the client application and works in tandem with the Server SDK integrated into the inference server running in the TEE. Once the SDKs have been used to establish an attested TLS session, the client can be confident that the server is running an authorized workload within a verified Confidential Computing environment.

The client app can then send encrypted prompts to the inference server, knowing that only this server will be able to decrypt and process it in the TEE. Once the server has a response ready, it sends it back via the same encrypted channel to the client app.

You can get started today with the GitHub repository and the Codelab.

Enabling Apple Private Cloud Compute on Google Cloud

Our commitment to privacy is deeply exemplified by our collaboration with Apple to expand Private Cloud Compute (PCC) on Google Cloud.

We are proud to collaborate with Apple to extend Apple’s privacy and security commitments to PCC on Google Cloud. Our platform supports Apple’s PCC privacy commitments with a layered security approach built upon Google Cloud’s infrastructure. This includes leveraging Google Cloud Confidential Computing with Intel TDX, NVIDIA Confidential Computing with NVIDIA Blackwell GPUs, our Titanium security architecture with the Titan chip, and a co-engineered open-source host stack to ensure verifiable transparency.

Together, these technologies help Apple PCC on Google Cloud meet stringent requirements for data protection and user privacy. To dive deeper into this collaboration, read our blog post: Powering the next era of Confidential AI.

Advancing confidential foundations

Google Cloud is committed to making Confidential Computing capabilities broadly available across our infrastructure. Our goal is to integrate hardware-based security features deeply into our foundational compute offerings, allowing customers to enhance data protection without compromising performance or operational flexibility.

Bringing Intel Trusted Domain Extensions (TDX) to the C4 machine series

Confidential VMs with Intel TDX on the C4 machine series will be available in preview soon.

Powered by the latest 6th Generation Intel Xeon processors, this integration offers a significant leap in compute density and performance for data-intensive workloads. By using Intel TDX, C4 instances create hardware-isolated Trust Domains (TDs) that protect sensitive applications and data from the underlying host and hypervisor.

This architecture provides confidentiality and privacy while enabling remote attestation so you can cryptographically verify the environment before processing sensitive data. Best of all, you can turn Confidential Computing on with a few clicks and no code changes.

Expanding Live Migration capabilities

Running mission-critical production environments requires high availability and continuous uptime, even during scheduled cloud maintenance.

Live Migration on C3D-based Confidential VMs is now generally available. This capability allows Google Cloud to perform planned hardware maintenance without interrupting workloads or exposing encrypted guest memory, ensuring seamless uptime for long-running confidential applications.

Enhancing trust and collaboration: Innovations in Confidential Space

Confidential Space is a Confidential Computing environment designed to enable secure multi-party computation and data sharing. It allows organizations to collaborate on sensitive data, such as for joint machine learning or data analytics, without revealing the data to each other or to Google Cloud.

“Google Cloud Confidential Space allows us to provide financial institutions with security guarantees similar to or better than an on-prem service," said Olivier Richaud, vice-president, Platforms and Site Reliability Engineering, Symphony. "Transitioning such security and privacy-sensitive customers to a cloud-based SaaS service would have been impossible without the power of Confidential Computing.”

A key design principle of Confidential Space is to remove the workload operator from the trust boundary, providing cryptographic assurance that only the authorized, attested workload can access the data.

“As AI systems increasingly act on behalf of consumers in financial services, trust in how data is processed becomes paramount. At Sahamati, we see Google Cloud Confidential Space as a foundational technology for enabling privacy-preserving AI in India’s Open Finance ecosystem, creating the trust needed for innovation while maintaining strong security and accountability guarantees,” said Kiran Gopinath, chief innovation officer, and Head, Sahamati Labs.

Our new advancements for Confidential Space provide greater flexibility and stronger assurances. Key updates include:

Independent Verification: Integration with Intel Trust Authority

We are pleased to announce that Intel Trust Authority (ITA) is now generally available as an independent attestation verifier service for Confidential Space.

This integration enables organizations to independently verify the integrity of the Confidential Space environment using Intel’s hardware-rooted attestation before encryption keys are released to workloads. By decoupling attestation verification from the cloud service provider, customers benefit from enhanced transparency, stronger assurance, and a more robust trust model.

"With Confidential Computing woven into our core infrastructure, Google Cloud and Intel are making hardware‑rooted security and independent attestation part of the default fabric of modern compute. From Intel TDX‑powered C4 Confidential VMs running production workloads, to Confidential Space with Intel Trust Authority — now generally available — enabling verifiable multi‑party collaboration, customers can now encrypt, verify, and scale their most sensitive AI and data workflows without rewriting applications or compromising performance, even in the most demanding regulatory environments,” said Anand Pashupathy, general manager and vice-president, Intel Product Assurance and Security (IPAS), Intel Corporation.

Accelerating secure collaboration: Confidential Space with H100 GPU support

To power secure multi-party AI and machine learning, Confidential Space support for NVIDIA Hopper GPUs is now generally available. This can help multiple parties pool their data for training and inference within a Confidential Space environment, using the power of Hopper GPUs, while ensuring that their individual data remains protected from other participants and from Google Cloud.

Confidential Space unlocks use cases like federated learning on sensitive datasets, and building joint models without centralizing data.

“Confidential GPU support in Google Cloud Confidential Space removes one of the biggest barriers to adopting secure AI: the tradeoff between protecting sensitive workloads and achieving production-grade performance," said Adi Hirschtein, VP Product, Duality. "For Duality customers in healthcare, financial services, and government, this enables federated learning, confidential AI, and encrypted RAG workflows to run on sensitive data at scale while keeping data and models protected throughout processing.”

Next steps

Confidential Computing is becoming an essential layer of cloud computing in the AI era. Explore our expanding portfolio of Confidential VMs, accelerated hardware, and open-source tools to see how you can enable secure collaboration and private AI innovation within your organization.

To learn more, join us at the Confidential Computing Summit on June 23 and 24, 2026.

Choice, compliance, and collaboration: Europe’s path to open digital sovereignty

Thu, 18 Jun 2026 07:00:00 +0000

The European Commission’s Tech Sovereignty Package comes at a defining moment for the continent's digital future. European competitiveness and security are top of the agenda for European business, institutions, and citizens, and a significant investment in European digital capacity is needed to deliver those goals. In that context, it is understandable that Europe is considering how to boost the European Union digital footprint from chips, to cloud adoption, to AI data infrastructure.

The European Commission’s strategy is to be grounded in "openness, partnership, and fair competition." Indeed, the package contains bold measures consistent with these principles on interoperability to address vendor lock-in and an open source strategy for the public sector, as well as on more rapid data center deployment.

We will work cooperatively with the EU institutions providing our best knowledge about how to achieve these stated objectives in practical terms. To that end, we believe certain elements of the Cloud and AI Development Act (CADA) should be changed to avoid unintended market isolation, ensuring that trusted global partners can continue to support Europe’s security and scaling goals under a framework of true openness.

Our approach to sovereignty, developed over many years, is grounded in delivering tangible, technical, and verifiable control and open choice, while investing in the growth and security of Europe’s digital infrastructure — consistent with what we understand to be the goals of this strategy.

We have engineered a comprehensive menu of Sovereign Cloud solutions, designed to meet Europe's tiered compliance requirements at every level. From standard public cloud configurations with strict European data boundaries to independently operated regional cloud services to fully air-gapped solutions for the most sensitive public-sector operations, we ensure that compliance never requires sacrificing technological excellence.

Through our deep “Made with Europe” collaborations with regional champions — including S3NS in France; Thales, the Schwarz Group, and T-Systems in Germany; PSN in Italy; Clarence in Luxembourg; and Telefónica in Spain — we are actively delivering the operational resilience and jurisdictional controls designed to meet the highest regulatory standards of existing sovereignty frameworks at national level.

Across our partner-led sovereign solutions, the S3NS offering in France has been qualified to meet SecNumCloud 3.2, Europe’s highest sovereignty regulatory bar. Our partners Clarence and S3NS, together with Mistral, offer services that have been approved by the EU Directorate-General for Digital Services (DIGIT) for use by EU Institutions who have sovereign cloud needs. We believe this is what constitutes a true trusted partnership and encourage the Commission to follow this existing path, which is already meeting sovereign expectations across Europe today.

1. Refining sovereign certification

A primary concern within the CADA proposal is the design of the Union Assurance Levels (UALs). While harmonizing sovereignty criteria across member states is a constructive step, criteria at each of the four UALs would limit or exclude global providers, regardless of the security mitigations they offer.

Regulations should create space for innovative and effective technology approaches to sovereign control, instead of rigid geographic criteria that sacrifice the potential to have control without undue disruption to global supply chains.

We understand and support the data sovereignty and extra-territorial risk-mitigation priorities of European policymakers. Through capabilities like Cloud External Key Manager (EKM), one of the tools within our suite of sovereign solutions, Google Cloud allows customers to maintain their encryption keys outside of Google's infrastructure. This control creates a technical barrier to unauthorized access to unencrypted data by third parties without the explicit consent and awareness of the customer.

The EU has already designed an alternative, more balanced model in the proposed Industrial Accelerator Act. This framework has the potential to successfully maintain collaboration with trusted non-EU partners under a default presumption that trusted partners can operate as EU origin, underpinned by robust global trade rules and strong back-stop powers. We urge co-legislators to apply a similar philosophy to CADA.

2. Promoting interoperability, combating vendor lock-in, and reforming procurement

Sovereignty must empower end-users with more choice, not less. A healthy European digital ecosystem requires open foundations that prevent vendor lock-in, restrict choice, and drive up costs.

We strongly support CADA's goal to foster an open, interoperable cloud ecosystem. To make this meaningful, we believe that the policy must align with a commitment to openness across every level of the digital stack — infrastructure, models, and applications.

Our own approach is built on this foundation: We offer open, portable infrastructure with no data transfer exit fees, we champion open AI models like Gemma, and we support open-standards applications. Our stack-wide open approach is designed to help European enterprises build, migrate, and scale without friction.

Yet organizations can’t maximize the benefits of an open approach because restrictive licensing practices lock customers into a single ecosystem. To restore true choice, we advocate for three straightforward reforms: allowing users to move their software licenses freely, ensuring fair pricing for legacy software, and guaranteeing that software runs equally well on any cloud platform.

3. Building sustainable, open infrastructure for Europe's AI future

Physical compute infrastructure is the bedrock of digital sovereignty. While we support the ambitions of the Chips Act 2.0 to invest €30 billion in European semiconductor research and development, we believe that this investment is just as important as establishing regulatory rules that attract large scale investments in compute infrastructure.

To help achieve that goal, we recommend the measures outlined below. As a long-standing investor in European data infrastructure, operating 13 European cloud regions and deepening that commitment with recent investments in Germany, Belgium and Sweden, we hope to see a policy that leverages the pace and scale of committed global investors like us.

We welcome the introduction of "special project" status to streamline permitting, grid access, and power purchase agreements (PPAs) in designated zones. To ensure these measures succeed, we support:

Prioritizing fast-track permitting benefits for highly sustainable infrastructure projects.
Aligning national sustainability criteria with the upcoming EU-wide rating scheme, ensuring it does not penalize energy-efficient technologies like water cooling.
Ensuring that these acceleration zones do not artificially constrain the geographic location of new sites, and extending supportive grid connection measures to viable data centers operating outside of designated zones.

The path forward: Made with Europe

As ministers prepare to gather for the upcoming Council Summit, Europe has a historic opportunity to build a resilient, competitive, and truly open digital future.

By championing open-source software — from our contributions to Kubernetes, Chromium, Android, TensorFlow, and open AI models like Gemma — and by co-engineering solutions with Europe's industrial leaders, we are proving that global innovation and European values can be furthered together.

We look forward to collaborating with Member States, European policymakers and our regional partners to ensure that the final Tech Sovereignty Package fosters local economic growth, safeguards national security, and keeps Europe at the cutting edge of global AI innovation.

From AI potential to agentic reality: Driving the UK’s next chapter

Wed, 17 Jun 2026 08:00:00 +0000

The United Kingdom, and London in particular, continues to be one of the great hubs for AI development in Europe and the world. We’re home to Google DeepMind, of course, as well as significant AI unicorns — and Google Cloud customers — like Ineffable Intelligence, which is today announcing an important partnership with us.

A year ago, we joined you for the London Summit to showcase the vast potential of generative AI, including a major investment in upskilling the UK civil service. Today, as we welcome our partners once again to the historic vaults of Tobacco Dock, that potential has become an industrial-scale reality. In my conversations with leaders across both Whitehall and The City, the focus has moved from chatbots and media experiments to full-production execution. This is the moment of the agentic enterprise, where we shift from systems that simply chat with us to systems that can reason, plan, and execute multi-step workflows.

This transition is the cornerstone of the UK’s projected £400 billion economic boost from AI by 2030. At Google Cloud, we are the only provider offering the full integrated stack — custom silicon, frontier models, and planet-scale infrastructure — required to turn the Agentic Enterprise into a reality.

The new frontier of British enterprise and research

The banking sector is a key proving ground for this shift. And HSBC, one of the largest and most important financial institutions in the world, is showing the way. Today, we’re announcing a multi-year transformational partnership with HSBC to accelerate AI adoption across HSBC’s products and services globally. This new collaboration will further accelerate the shift towards AI-enabled ways of working across HSBC’s global operations.

HSBC will work with Google Cloud and Google DeepMind engineering teams to collaborate on new AI-powered tools and programmes, with access to Google’s latest agentic AI capabilities – including Gemini models and the Gemini Enterprise Agent Platform. The initial delivery focus on three areas: hyper‑personalised wealth management support, stronger financial crime risk management, and AI tools to enhance frontline/relationship manager client service

UK startups also continue to break new ground with technology, and AI in particular, as demonstrated by the work of frontier labs like Ineffable Intelligence. The company, which launched earlier this year, has chosen Google Cloud as its preferred cloud partner, utilizing Google’s full stack of AI-optimized hardware and tools to build and train Ineffable’s first generation of foundational models.

Led by David Silver, a former Google DeepMind researcher who was instrumental in the AlphaGo project, Ineffable Intelligence is taking a unique approach to AI development. The team are building systems that learn primarily through their own experience through reinforcement learning, instead of relying on the large-scale human-generated datasets behind language models. The ambition is to create a “superlearner” that develops knowledge through trial and error. This year, Ineffable Intelligence set a record for a European seed funding round of $1.1 billion, and now Ineffable Intelligence will support its training work by deploying one of the largest clusters of A5X, powered by the NVIDIA Vera Rubin NVL72 platform on Google Cloud, delivering massive computational scale.

To move from experimentation to true industrial production, businesses need more than just models; they need a roadmap. To help show them the way, we’re expanding our partnership with Deloitte, which will open a new AI Studio at its London campus. Developed in collaboration with Google Cloud, the studio will help British organisations move beyond AI experimentation to deploy autonomous, action-oriented AI systems at scale.

Deloitte is also committing to upskill 1,000 members of its UK AI and data workforce on Gemini Enterprise. This certification program will ensure that Deloitte’s AI and data engineers’ are equipped with the technical expertise to implement Google’s most advanced agentic architecture, providing UK clients with one of the largest pools of certified AI talent in the region.

Building a future-ready public sector

The blueprint for a modern digital government requires moving away from rigid legacy contracts toward agile, AI-driven public services. In collaboration with the Ministry of Housing, Communities and Local Government (MHCLG), the i.AI incubator, Google Deepmind, and Faculty, we are delivering tangible public sector reform and tools for reinvention that directly support the national goal to "get Britain building."

Agencies like MHCLG are already using a tool called Extract which was built using Google technology to help transform planning processes by reducing document processing times from two hours to just two minutes. Simultaneously, we are supporting trials of an AI planning tool — co-created with local planning authorities in Barnet, Dorset, and Camden — which aims to cut decision times for everyday applications by 50%. Furthermore, the Department for Transport (DfT) is utilizing Gemini to streamline public consultation analysis, a move projected to save £4 million annually.

Innovation on this scale also requires a secure, sovereign foundation. That is why Google Cloud is working to strengthen our UK data residency commitments, including measures like making Gemini 3.5 Flash, which features in-country AI processing, available by late June 2026 for sensitive sovereign use cases. We are giving British organizations the confidence to innovate within strict compliance boundaries.

To help keep businesses safe from the challenges posed by bad actors using AI and other digital threats, we also recently announced a comprehensive AI-powered cybersecurity platform — Google AI Threat Defense — which combines Wiz, Mandiant, Gemini & CodeMender to find, fix, and protect our customers from vulnerabilities.

Proven impact from the high street to public service

Autonomous agents are no longer a future prospect; they are delivering value across the UK economy today. Our work with THG Ingenuity, an ecommerce solutions provider, has delivered an 8x higher conversion rate via its AI Shopping Assistant. Starling is similarly empowering customers with "spending intelligence" tools for instant habit analysis around purchases and expenses. And Rightmove, has launched a beta version of an AI-powered conversational property search, built with Google’s Gemini models, enabling users to search for homes in their own words.

The breadth of this impact is visible across every sector: Kingfisher is pioneering retail-specific agentic applications; Openreach is driving field service optimization in telecommunications; andUnilever is using AI at scale across the entire value chain to drive growth and build desirable brands in the new era of consumer goods.

Meanwhile, VMO2 is streamlining complex data operations; Vodafone is executing a $1 billion partnership to redefine network performance; and WPP is integrating Gemini across creative workflows, whether that's generating high-fidelity campaign assets at speed and scale, powering AI agents, or training robotic camera operators.

Empowering the engine of growth for small to medium businesses and startups

The true measure of Britain’s AI success lies in its small and medium enterprises and startup ecosystem. Our AI Works research highlights a pivotal moment: AI has the potential to boost productivity for small and medium enterprises by 20% and unlock £198 billion in output for the UK economy. With 56% of smaller firms already seeking guidance, we have launched the AI Works for Britain upskilling initiative to ensure no business is left behind.

We also continue to foster the next generation of British unicorn startups through our ongoing partnership with Tech Nation at the London AI Hub. This sustained commitment ensures founders have the resources and community needed to scale, and this September, we will further this mission by hosting the Gemini Startup Forum: Cybersecurity in London to help startups build secure-by-design AI applications.

The Model Garden at Platform 37

Our belief in the UK’s potential is reflected in our physical footprint, too. We are continuing to invest in the UK's digital infrastructure to support growing demand: Our state-of-the-art data center in Waltham Cross launched in September 2025, a key part of our two-year, £5 billion investment to help power the UK's AI economy. And earlier this year, we opened our new office in London in Kings Cross, Platform 37, along with plans for The AI Exchange, a new public space dedicated to deepening understanding of AI.

Building on this momentum, we are excited to introduce The Model Garden at Platform 37, launching in the fourth quarter of 2026. This London-based hub is far more than a physical space; it serves as a strategic investment designed to fundamentally elevate how we engage with our most important customers. Blending the timeless aesthetics of a classic English garden with immersive, high-tech innovation — from living digital walls to a three-story atrium — The Model Garden acts as a physical marketplace for our best ideas.

The blueprint for the agentic enterprise

For UK businesses, civic leaders, and organizations to continue to lead in the AI moment, they must not only rethink the technology they use but also fundamental aspects of how we work. As we support thousands of organizations and millions of teams here and around the globe, we see three core strategies helping achieve success with AI:

Culture: We must reimagine our organizations for the future. True transformation means getting teams excited, enabled, and equipped to work with AI agents in completely new ways. It is about human-AI collaboration, not just automation.
Responsibility: We must build with safety and security in mind from day one. Protecting your users, your customers, and your brand is paramount. Our frontier models are built on a foundation of rigorous AI principles and secure-by-design infrastructure.
Sustainability: In an era of rising compute demands, we must scale in a way that is both financially viable and positive for our planet. At Google, we are committed to carbon-free energy 24/7, ensuring that the UK’s AI growth does not come at the cost of our climate goals.

Architecting the future together

Google Cloud is the primary partner for the UK’s agentic transition. We are moving beyond the hype of experimentation into the rigor of production. From the research labs of King's Cross to the diverse enterprises powering the high street, we are architecting a resilient, sovereign, and prosperous future for the United Kingdom.

Thank you to everyone who’s joining us in London — yesterday, today, and into the future. This year we’ve packaged up an exclusive on-demand experience, allowing you to stream the defining London Summit moments, available anywhere, anytime.

Google named a Leader in IDC MarketScape SIEM 2026 Vendor Assessment

Tue, 16 Jun 2026 17:30:00 +0000

Security operations teams are under immense pressure to defend against adversaries who use AI to act with unprecedented speed, scale, and sophistication. To navigate these moments, secure mission-critical workloads, and build confident defense programs, organizations rely on modern security information and event management (SIEM) systems as the backbone of their security operations.

We are proud to announce that Google has been named a Leader in the 2026 IDC MarketScape for Worldwide SIEM Vendor Assessment (#US54126826, June 2026). We believe this recognition reflects our sustained investment and innovation in Google Security Operations, bringing together Mandiant's frontline expertise, comprehensive automation, and advanced AI agents to empower defenders.

According to the report, Google was recognized for several key strengths, including:

The Alert Triage and Investigation agent collects evidence, runs correlated searches, and produces a transparent verdict, reducing the security analyst workload. The additional agents announced at Google Cloud Next extend agentic workflows beyond triage into proactive hunting and rule generation.
Google designs the silicon, runs the infrastructure, develops the Gemini foundation models through DeepMind, and encodes its internal security expertise into agent evaluation loops. Vertical AI integration supports unit economics that would be difficult to achieve through third-party model APIs and gives Google tighter control over the iteration cycle that improves agent accuracy on security-specific tasks.
Curated detection content authored by Mandiant analysts is mapped to MITRE ATT&CK and refreshed on a regular cadence. Customers report that the higher-tier curated rule sets deliver useful detections out of the box.
Search performance over large data volumes is a consistently cited technical strength. The unified data lake, combined with all-time UDM search and multistage search with cross joins, allows analysts to query the full retention period without the performance degradation common on legacy on-premises platforms.

IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of technology and service suppliers in a given market.  The research methodology utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each vendor’s position within a given market. The Capabilities score measures vendor product, go-to-market and business execution in the short-term. The Strategy score measures alignment of vendor strategies with customer requirements in a 3-5-year timeframe. Vendor market share is represented by the size of the circles. Vendor year-over-year growth rate relative to the given market is indicated by a plus, neutral or minus next to the vendor name.

Google Security Operations, powered by AI

Speed and accuracy are crucial in threat detection and incident response. Google continues to drive security operations innovation to help defenders work smarter, not harder. By deeply embedding Gemini in Google Security Operations, we enable analysts to perform complex natural language searches across vast amounts of security telemetry. We have also added agents such as the Triage and Investigation agent that enhance analyst productivity by accelerating event summarization, dynamically generating detection rules, and building automated response playbooks in seconds instead of hours.

“With Google Security Operations, we’re able to take in large volumes of telemetry, introduce AI into our workflows, and we saw a 97% reduction in alerts,” Daniel Peterpaul, VP, Information Security, Sunrun.

Unparalleled access to threat intelligence

A modern SIEM must go beyond data aggregation; it requires context. Google Threat Intelligence combines Mandiant's frontline expertise, the global reach of the VirusTotal community, and the unparalleled visibility of Google's services and devices into Google Security Operations.

Our applied threat intelligence capability enables security teams to spend less time on manual monitoring and more time contextualizing alerts for better decision-making. Through services like Mandiant Hunt, we integrate our proactive experts directly into Google Security Operations to help defenders search for undetected attacks and adversary tactics, techniques, and procedures (TTPs) before they escalate.

Ensuring operational resilience for global enterprises

Organizations around the globe are making significant leaps in both the technology they use and the way they think about security operations by partnering with Google. The ability to stitch together security telemetry and threat intelligence gives organizations visibility to full-service recovery and holistic security transformation.

“Our engineers in the SOC are working on high fidelity, true positives only. So, you've got a high fidelity true positive that's fired, and frankly, you want that alarm then to be enriched with as much contextual information as possible, that's the shift that Gemini in SecOps will allow us to get to. We want AI to work in service of our people, and then we want people to use their human brilliance, creativity, big picture problem-solving to think about attack paths and predicting them, and really making our environment a hard target,” Matt Rowe, chief security officer, Lloyds Banking Group.

Take the next step in advancing your cyber defenses

Organizations that seek to work with a globally capable security leader with strong threat intelligence capabilities and a holistic approach to security operations should consider Google. To learn more about our capabilities and why Google has been named a Leader, read a complimentary excerpt of the 2026 IDC MarketScape for Worldwide SIEM Vendor Assessment here.

Cloud CISO Perspectives: The 4 lessons that guided AI Threat Defense

Mon, 15 Jun 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for June 2026. Today, we introduce Chris Betz as the new CISO of Google Cloud. For his first Cloud CISO Perspectives, Chris shares four key lessons we learned about using AI to the defender’s advantage while building AI Threat Defense.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f496e55c190>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Cloud CISO Perspectives: The 4 lessons that guided AI Threat Defense

By Chris Betz, CISO, Google Cloud

Chris Betz, CISO, Google Cloud

Just a year ago, it would take months or even years for a good application security team to find thousands of vulnerabilities. Today, a team equipped with multiple AI models can find the same number in hours — or even minutes.

AI is rewriting the rules of cybersecurity. It’s true that AI has boosted adversaries, introducing new threat actors, techniques, and surfaces to defend against, all operating with unprecedented scale, speed, and sophistication. AI-powered attackers are developing zero-day exploits by analyzing more than just source code: Configuration vulnerabilities, binaries, and firmware are all in their crosshairs.

However, AI has also created a significant advantage for defenders. Not only are these same capabilities in our hands, adding to our defense, but we have the added advantage of the full business context that adversaries lack. Software security, and especially vulnerability finding and fixing, is being revolutionized.

Security is changing rapidly, demanding that we all innovate in response. Here is how we are approaching this work today, and some of the lessons we learned along the way.

It’s clear that the AI benefits for security are rapidly evolving, and we can no longer rely on legacy, manual defenses. The new imperative for CISOs and business leaders is to transform vulnerability management by combating machine-speed threats with a defensive strategy that’s AI native, agentic, and open.

We’ve been preparing for this moment for years: From Project Naptime, an internal project to automate vulnerability hunting (so security researchers can take regular naps), to Big Sleep, our autonomous zero-day hunter, to CodeMender, our automated AI-patching agent, we’ve innovated to advance using AI to improve security for all.

Across our products and services, we’ve found that a unified approach helps us protect Google at Google scale. Based on this approach, we recently introduced AI Threat Defense as a pathway to achieve the threat-readiness transformation that you need to defend against AI threats with AI.

The framework is straightforward, and you’ll find that it’s ultimately about two key points:

Using rapidly-advancing AI to protect ourselves.
Shifting the way we develop from the ground up.

Security is changing rapidly, demanding that we all innovate in response. Here is how we are approaching this work today, and some of the lessons we learned along the way.

Four key lessons

Our work is built on a four-step framework, structured directly on what we learned:

Prepare: How Google started the journey — hardening our foundation and operationalizing the framework.
Scan and prioritize: How we identified vulnerabilities — conduct deep-dive analysis and posture validation.
Remediate: What we learned from remediation — implement workflows to autonomously verify and patch vulnerabilities quickly.
Monitor: How we evolved monitoring with AI agents — transition to continuous detection and active response playbooks.

1. Prepare: A modern enterprise runs on an enormous amount of software, and at Google that amount is even greater. We needed focus in order to move at speed, so our first lesson was to reduce our attack surface. That let us narrow our focus, reduce complexity, and use insights we have on our software supply chain and dependencies to prioritize and protect our external interfaces.

Second, we invested in the operational framework supporting the vulnerability work. Early experimentation quickly showed us how valuable a scaling framework is that applies our knowledge of the environment, protects and allocates resources for scanning, and allows new capabilities to be iterated on and used by multiple teams. The amplifying power of good information, code access, dependency graphs, token budgets, and infrastructure are key friction reducers.

Third, we planned engineering work alongside security work: Your engineering partners are critical, especially for aligning with your resiliency and deployment processes.

How Google Cloud CISO Chris Betz Uses LLMs to Defend Billions of Users from Vulnerablities

Key lessons include:

Tagging components with the model, harness, and issues found when scanning.
Allocating hardware and token budgets for finding, developing fixes, build and test.
Managing change volume (and engineer hours) while simultaneously focusing on more, smaller updates, where possible, with good rollout plans to de-risk the change.

2. Scan and prioritize: We continuously scan our code across products — Search, Ads, Android, Chrome, and Google Cloud — managing tens of thousands of packages.

First, we kicked off scanning and centrally tracked our progress, integrating the same tools into our pipelines. We learned early on that the best scanning results come from a combination of an expert in the specific product plus the harness plus the AI model. The combination is crucial, because results will be markedly different without all three.

It’s worth noting that if you can only pick two, we recommend expertise and harness. A less capable model with a good harness and good expert is more powerful than the best model without a good harness or good experts. We also advise using more than one model.

It’s important to track and iterate the data. Since the technology is evolving fast, your data is critical to revise and refine your processes.

Second, look carefully at your software supply chain, and engage your key suppliers. Reachability remains a key criteria for fixes, as does streamlining and simplifying the areas you work on.

Third, because there are so many vulnerabilities that can show up, it’s important to have the right methodology to prioritize them. Normally, when you’re rolling out a change you prioritize the smallest blast radius to make incremental change. Here, we recommend flipping that model: Begin with foundational code with the biggest blast radius to tackle the hardest problems first.

AI models can do a good job of developing proof-of-concepts to rapidly test accuracy. Harness and models play a significant role in reducing false positive rate. Adapting your harness to do validation and using a different agent or model to validate results are both very valuable.

Another key to AI-powered triage is to use your harness and tools to state vulnerability confidence as well as severity. Of course, developing a patch is only part of the problem.

3. Remediate: Fixing vulnerabilities at Google scale required a fundamental shift in strategy. We developed a new approach centered on three lessons.

First, how you roll out patches matters. We adopted a risk-based approach that prioritized code reachable from the outside and had the largest blast radius, such as critical applications like BoringSSL and gVisor. We also learned that providing the model with context was the key to faster, more trusted remediation.

Second, we learned you cannot fix what you cannot track. To manage remediation at scale, we built a central system to track every vulnerability, from discovery to resolution, with every finding labeled in a central repository. This single source of truth allowed us to enforce service-level objectives (SLOs) for patching, and enabled us to deploy constant autonomous patching with human review. Coupled with robust roll-back capabilities, our teams got better at fixing things quickly and safely.

Finally, we learned to build resilience directly into the system. The ultimate goal was to create an inherently-resilient system that can also patch vulnerabilities, not the other way around. We don't just fix the code; we harden the entire system around it.

These changes helped us rethink our approach to securing open-source software with a three-R’s strategy: Refresh, remove, and rewrite.

First, we refresh what is foundational — finding and fixing vulnerabilities in the code. This is about being good network citizens and protecting the core.
Second, we remove what is peripheral. We are removing dependencies and replacing them with custom code. This is about both efficiency and reducing the attack surface, moving from a broad base of trust to a narrow, controlled one.
Third, we rewrite what is critical. For everything in between, we are transitioning legacy logic and critical capabilities into modern, memory-safe languages using AI to automate the transition to eliminate entire classes of vulnerabilities from that software.

This evolution is a deliberate approach to reduce complexity, shrinking the attack surface, and building a more resilient, autonomous, and secure-by-design foundation for everything we do.

4. Monitor: Our work doesn’t stop there, and neither should yours. The security landscape is always changing, and the monitor phase is where our approach comes alive by creating a perpetual feedback loop to ensure we stay secure — and get stronger over time.

We had three key lessons in this phase. First, security demands a constant feedback loop. We created a feedback loop to monitor the entire ecosystem for two things: system strain and vulnerability hotspots.

Second, we invested in tracking our long-term remediation health. You can only improve what you measure. We built a comprehensive asset inventory to track our overall security posture and the completeness of our remediation efforts. Here’s where we hold ourselves accountable to product-level SLOs for vulnerability management.

This system allows us to deploy rolling patches that can update even our data center hardware continuously and use AI agents to verify patch efficacy at a scale no human team could manage.

Third, we planned for the future by using AI agents for both coding and monitoring. You have to assume that at some point, the attackers' models will become more advanced. We need to evolve our operating model and build for that reality.

We use AI agents to automate and standardize our response playbooks, enabling instantaneous containment when an issue is found. We move beyond just finding bugs by feeding key libraries into Gemini to improve its pattern recognition, creating security-aware coding agents. Meanwhile, our AI-assisted red teamers are continuously stress-testing our core infrastructure, ensuring our defenses are always evolving.

The outcome of this constant monitoring is a living, measured program that we can trust.

This is how we protect billions of users every day, and it provides a framework that any team can use to build a defense that learns, adapts, and hardens itself against the threats of tomorrow.

To learn more about AI Threat Defense, you can watch our recent Security Talks online event.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f496ff4b5b0>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=blh0hhHJ4pI'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Detecting and containing AI-powered threats with Google Security Operations agents: Learn how Google Security Operations works in concert with AI Threat Defense to monitor, detect, and respond to threats, particularly from code you do not own or can not patch. Read more.
How to stop AI voice clones from bypassing your security perimeter: The traditional, relatively stable network perimeter has been replaced by one far more malleable: Identity, driven by vishing attacks. Here’s how to defend against them. Read more.
5 lessons from red teaming AI applications: Distilled from Mandiant’s hands-on red team experiences, check out our clear, concise guidance to help customers securely develop and deploy AI apps. Read more.
Introducing Wiz Cloud Cost: Powering cost management and optimization with context: Wiz unifies cloud and AI cost visibility to help teams eliminate waste and improve spend efficiency across their AWS, Azure, and Google Cloud environments. Read more.
Bringing AI agents to Chrome Enterprise security management: We're launching an open-source model context protocol (MCP) server that connects AI agents directly to Chrome Enterprise APIs, helping IT and security teams manage browser security more efficiently. Read more.
How Google Does It: An inside look at cybersecurity: Learn how Google approaches some of today's most pressing security topics, challenges and concerns, straight from Google experts. View the collection.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f496ff4bfd0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Seeking counsel: Ongoing targeted campaign against U.S. law firms: Mandiant Consulting details a financially-motivated data theft extortion campaign executed by the threat cluster UNC3753, highlighting tactics like physical office targeting, and provides actionable recommendations to safeguard endpoints and infrastructure. Read more.
Welcome to BlackFile: Inside a vishing extortion operation: Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. Read more.
2 PhaaS 2 Furious: The evolution of Chinese-language phishing services: While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Within this ecosystem, GTIG has observed a fundamental move away from static password harvesting towards real-time interception and tokenization. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Deceiving adversaries at scale: Kevin Conley from Riot Games discusses how modern organizations can use deception technology to gain a home-field advantage against adversaries by proactively monitoring their environments. Listen here.
Cloud Security Podcast: Hyperscaling cloud security with Wiz: Yinon Costica, co-founder and VP of product, Wiz, discusses how the company used a product-led approach and a unique security graph model to scale rapidly within the competitive cloud security market. Listen here.
Behind the Binary: When AI features create zero-click exploits: Google Project Zero’s Seth Jenkins joins the podcast to dissect a full two-bug, zero-click exploitation chain targeting the Pixel 9. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Powering the next era of Confidential AI

Thu, 11 Jun 2026 19:30:00 +0000

At Google Cloud, we’re committed to providing the most advanced, secure, and private infrastructure for the most demanding AI workloads, and partnering with a broad and diverse range of organizations to help them meet their AI workload needs.

We are thrilled to collaborate with Apple on its expanded Private Cloud Compute (PCC) systems announced this week at WWDC 2026. Working closely together, Apple and Google have built a serving platform on Google Cloud that meets the rigorous security, confidentiality, and transparency goals that Apple has for PCC. This achievement is a testament to the strong collaboration between our teams, as well as with Intel and NVIDIA.

Our commitment to privacy with Confidential Computing

Our collaboration with Apple is built on a foundation of deep commitment to privacy that leverages Google Cloud's security and privacy technologies. At the heart of this collaboration is our Confidential Computing portfolio and our Titanium security architecture.

Titanium architecture, featuring our custom-designed Titan chip, provides a hardware root of trust that underpins the security and integrity of Google's infrastructure and services. Confidential Computing builds on this secure foundation by helping ensure data is protected throughout the lifecycle, encrypted at rest, in transit, and crucially in use within hardware-based Trusted Execution Environments (TEEs).

By protecting data in use, Confidential Computing becomes a fundamental and foundational element for building trust in AI systems, providing verifiable integrity and isolation for sensitive workloads. Confidential Computing helps prevent unauthorized access because data remains encrypted and isolated.

Enabling Apple Private Cloud Compute on Google Cloud

We are proud to collaborate with Apple to extend the privacy and security properties of PCC infrastructure to Google Cloud. Our platform supports Apple’s PCC privacy commitments with a layered security approach built upon Google Cloud’s infrastructure, including:

Google Cloud Confidential Computing: Our core Confidential Computing platform provides the hardware-based TEEs necessary for PCC. By leveraging Intel TDX (Trust Domain Extensions) and NVIDIA Confidential Computing, we provide hardware-based isolation for virtual machines, designed to create a highly secure and private environment where workloads can run with cryptographic assurances.
Google Titanium security architecture and Titan chip: Google Titan chips are a key component in powering security and transparency posture for PCC infrastructure on Google Cloud. Deployed across our fleet, Titan establishes a strong hardware root of trust, helping to ensure the integrity of the boot process and the hardware platform itself.
Intel TDX and NVIDIA Confidential Computing: Google Cloud leverages the security features on Intel CPUs and NVIDIA Blackwell GPUs to protect data-in-use during high-performance AI inference, helping ensure that the entire compute path – from CPU to GPU – is protected.
Open-source transparency: With our commitment to verifiable security, Apple and Google have collaborated in engineering an open-source host stack specifically to support PCC's transparency, enabling independent inspection and verification of the system's security properties.

Together, these technologies help ensure that Apple PCC on Google Cloud meets requirements with enforceable protections, no privileged runtime access, and verifiable transparency.

Building the future of private AI infrastructure

Our collaboration with Apple represents a significant milestone in further strengthening a secure cloud for AI by building on technologies and standards from Apple, Google Cloud, Intel, and NVIDIA. By ensuring that every layer of the stack — both hardware and software — contributes to a verifiable and secure system, we’ve created an advanced platform that is designed to uphold the stringent standards of user privacy and data security that PCC architecture demands.

The advancements built through this collaboration will benefit all Google Cloud customers. We are committed to continuous improvement and offering more transparent, secure, resilient platforms for all types of workloads, especially those handling AI and sensitive data.

You can learn more about Confidential Computing here.

Detecting and containing AI-powered threats with Google Security Operations agents

Tue, 09 Jun 2026 09:00:00 +0000

To defend against the growing range of AI-accelerated threat actors, organizations need to be able to respond faster to outpace the adversary.

Recently, we announced Google AI Threat Defense, an automated security system designed to help you continuously monitor for and stop AI-powered threats before they can impact your business. Based on Google’s own approach to today’s threats and vulnerability management, it’s centered on a four-step framework: Prepare, scan and prioritize, remediate, and monitor.

Today, we’re sharing more details on how Google Security Operations works in concert with AI Threat Defense to monitor, detect, and respond to threats, particularly from code you do not own or can not patch. The remediation gap represents a critical vulnerability.

According to M-Trends 2026, the exploitation of vulnerabilities has become the most common initial infection vector. Notably, the report also indicates that the mean time to exploit has dropped to an estimated minus seven days, meaning exploitation frequently occurs even before a patch is officially released. Google Security Operations delivers vital operational fabric to autonomously contain active attacks across your entire environment.

Google Security Operations supports AI Threat Defense to monitor, detect, and respond to threats.

Engineered around a comprehensive approach that uses compensating controls with proactive security to strengthen operational resilience, Google Security Operations is built on a strategic, three-part approach to cross-environment visibility across your entire attack surface:

Continuous and autonomous coverage analysis and detection generation
Autonomous investigation, containment, and response
Retroactive hunting

Designed to help you see and respond to threats faster than ever before, we deliver these capabilities at machine-scale and machine-speed. Together with Google AI Threat Defense, we’re able to provide the autonomous platform you need to outpace AI-driven attacks.

1. Continuous and autonomous coverage analysis and detection generation

While proactive defense can identify vulnerabilities before they can be exploited, there will be applications that you can not patch, as well as potential gaps in the time it takes to remediate vulnerabilities.

The 2026 Verizon Data Breach Investigations Report underscores the magnitude of this challenge. In a study encompassing over 13,000 organizations, only 26% of vulnerabilities identified on the CISA Known Exploited Vulnerabilities (KEV) list had been fully remediated. Moreover, the median duration required to achieve full patching after detection stands at 43 days. Clearly, you still need continuous monitoring to detect threats in your environments.

Detection Engineering agent. Results for illustrative purposes.

The Detection Engineering agent in Google Security Operations can automatically translate new exploitation patterns of unpatched vulnerabilities into custom detections for your specific environment. Available in preview, it analyzes a diverse array of input sources to quickly and effectively recognize malicious activity, so you can uncover novel attack patterns evolving from new and unpatched vulnerabilities.

The agent’s sources include Google Threat Intelligence (such as emerging threat intelligence, new attack patterns curated by Mandiant, offensive tool repositories, red and purple team reports, autonomous malware analysis, open-source detection repositories and blogs), and internal security telemetry.

The workflow of the Detection Engineering agent.

To automatically find and fill coverage gaps tailored to your environment, the agent proactively builds new rules and validates them with synthetic events to help ensure your environment is covered before an exploit hits.

2. Autonomous investigation, containment, and response

If a threat is detected, you need to immediately and autonomously assess and respond to protect your environment. By bringing together visibility from cloud and enterprise assets, including endpoints, on-premises firewall, identity, network, and custom application logs, your security operations center (SOC) can gain the full context of an attack, and unify disparate signals into a complete, actionable narrative the moment an adversary strikes.

The Triage and Investigation agent in Google Security Operations, generally available, helps analysts drastically reduce time to respond by autonomously investigating alerts, gathering evidence for analysis, and providing verdicts with comprehensive explanations. It can help security analysts automate decision-making, alert closure, and remediation flows, allowing them to spend more time prioritizing high-priority threats instead of false positives.

The agent has already investigated over 5 million alerts, reducing a typical 30-minute manual analysis to 60 seconds with Gemini.

While identifying threats is critical, the ultimate goal is rapid remediation. Agentic automation, available in preview, can help contain attacks by combining dynamic AI agents — which autonomously gather evidence and reason through complex alerts — with deterministic enterprise playbooks.

This hybrid approach ensures that analysts remain in absolute control of critical, high-impact actions while using AI to safely automate decision-making and remediation workflows.

3. Retroactive hunting

Even with autonomous detections and rapid-response handling of active threats, stealthy adversaries and zero-day exploits can sometimes bypass frontline controls. To achieve operational resilience, security teams must also look backward through their data to uncover hidden compromises.

Strong, effective defensive strategies rely on more than just reacting to alerts. The Threat Hunting agent, available in preview, can help teams proactively hunt for novel attack patterns and stealthy adversary behaviors that bypass traditional defenses.

By scouring petabytes of enterprise telemetry (including historical logs) for subtle anomalies the agent fundamentally shifts the SOC posture from reactive to deeply proactive.

Auditing the Axios supply chain attack

When adversaries can generate unique exploits and command-and-control (C2) infrastructure at zero marginal cost, static indicators like hashes and IPs decay instantly. Defenders must instead detect the behavioral tactics, techniques, and procedures (TTPs) of the attack.

We had the Detection Engineering agent audit our coverage against the recent Axios supply chain attack (UNC1069). The agent mapped the campaign intelligence into behavioral threat detection opportunities (TDOs), simulated the attack chain using high-fidelity synthetic UDM logs, and ran them against active rules.

Google Detection Engineering agent output.

We successfully flagged the execution phases in the middle (renamed PowerShell and macOS background shells), but were blind at the initial entry point (NPM postinstall dropper) and the final C2 exit point.

By exposing these blind spots, the agent helped us proactively engineer custom YARA-L rules to close the loop at the first and final steps of the kill chain. You can sign up for the Google Security Operations Detection Engineering agent preview today.

Next steps

By integrating Google Security Operations Gemini-native specialized agents into your workflow, you can autonomously generate detections, orchestrate containment, and hunt for stealthy threats at machine speed. This allows you to maintain a resilient defense even when primary controls fail, ultimately driving a 70% reduction in both breach risks and costs.

Google AI Threat Defense working alongside Google Security Operations can help you consistently outpace automated adversaries. To learn more about how Google AI Threat Defense and Google Security Operations can help you fight AI with AI, check out our Security Talks online event on June 10.

Cloud CISO Perspectives: How to build an AI-ready security program for the public sector

Fri, 29 May 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for May 2026. Today, Usman Chaudhary, Field CISO, Google Public Sector, offers a guide for CISOs protecting government agencies and critical infrastructure on how to get started — and get the most out of — defending with AI.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f498ca32af0>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How to build an AI-ready security program for the public sector

By Usman Chaudhary, Field CISO, Google Public Sector

Usman Chaudhary, Field CISO, Google Public Sector

Deciphering actionable signals from deafening noise can be hard for CISOs, even with AI — and especially for those guiding government agencies, critical manufacturing plants, or in a foundational industry.

From industrial control systems to decades-old municipal databases, you’re securing complex, deeply entrenched systems, and the sudden mandate to adopt AI can feel less like an evolution and more like a breaking point.

While it’s true that you face a monumental challenge, we know that from our conversations with CISOs and customers that we can offer concrete, actionable steps on how to build an adaptable, AI-augmented defense while managing the operational load on your staff.

The urgency created by machine-speed exploits means you can not rely solely on reactive measures. Once the immediate administrative toil has been reduced, you should aggressively shift your focus toward posture elevation, proactive hunting, and structural integration in the next six to 12 months.

Importantly, executing this vision does not mean developing everything from scratch. This roadmap relies on a strategic combination of building custom internal workflows (like Gemini Gems), buying established commercial AI capabilities, and integrating them into your existing security stack.

Google's Gemini for Government delivers agentic AI for more than three million federal civilian and military personnel on a platform accredited at FedRAMP High and DOW Impact Level 5.

To help you prioritize resources, we have structured the necessary AI initiatives across five core CISO workload domains, highlighting your team's immediate quick wins in the first 90 days alongside tactical goals in the first six months, and strategic goals in the six-to-12-month horizon.

Your tactical execution plan: Months zero to six

Building an AI-ready security program is a journey. We’re focusing strictly on high-value use cases you can deploy immediately and in the next six months.

1. Executive alignment and business justification: The goal is to stop defending your budget with technical jargon and start explaining resilience in terms of financial risk and operational efficiency.

AI-driven board reporting (Immediate): Translate complex technical data into clear business impact. Pipe your metrics into a secure enterprise workspace (like Gemini for Workspace). Prompt the model to synthesize the raw data into a concise, two-page risk narrative that includes highlights such as containment metrics, potential impact on citizen services, and production uptime for critical assembly lines.
Vendor and spend optimization (Immediate): Upload vendor capability matrices and contracts to an isolated AI agent (like NotebookLM). Have it identify feature redundancies across your stack, suggesting clear paths for tool consolidation and budget optimization. Be sure to ground these insights with third-party validation from reputable sources like Gartner or Forrester.

2. Process optimization and toil reduction: The goal is to treat AI as a muse, not an oracle. Do not trust it to make final administrative decisions, but do use it to drastically reduce cognitive fatigue.

Automated context gathering and SOC triage (Immediate): Level 1 analysts spend a lot of time manually gathering context across logs, correlating IP reputations, and triaging ambiguous alerts. Integrate a specialized large-language model (LLM) workflow or use built-in capabilities in your SIEM and SOAR (like Google Security Operations) to consolidate this data automatically and provide instant, clear triage verdicts to investigate further or ignore.
Threat intelligence analysis (within six months): Automate a daily pipeline where an LLM ingests industry advisories and distills the noise into prioritized summaries relevant to your sector. Translating that raw text into functional detection rules is a complex engineering challenge. Instead of building this pipeline internally, use security platforms that natively automate indicators of compromise (IOC) extraction and rule engineering.
SOP mapping and agent creation (within six months): Churn and burnout are significant operational risks. Ingest your historical incident resolution notes and standard operating protocols (SOP) into an AI to build a knowledge-base agent. Identify the top five most frequent manual processes, and task an analyst with using a coding agent to document and automate them.

3. Talent upleveling and augmentation: The goal is to empower your practitioners to become AI builders rather than viewing technology as a threat to their expertise.

Natural language to query generation (within six months): Bridge the skills gap inside your SOC. Provide analysts with a secure conversational AI assistant or chatbot to translate plain English hypotheses into executing SIEM queries.
AI-driven security training (within six months): As manual processes are increasingly automated, use that reclaimed time to run capture the flag (CTF) exercises and community contests for your security team. Use an LLM to generate unique, one-shot red team test cases and training scripts that map specifically to your environment's architecture, helping train analysts through hyper-realistic, hands-on learning in simulated environments.

Your strategic horizon: Months six to 12

4. Posture elevation and threat hunting: The goal is to transition your team from a purely reactive posture into a state of continuous defense.

Contextual vulnerability prioritization: Deploy an AI agent to correlate scanner output with your internal architecture context and active threat intelligence, scoring vulnerabilities against actual environment exposure.
AI-assisted architectural threat modeling: Paste proposed system architecture diagrams into an AI assistant during the design phase — before your developers write a single line of application code — to generate a prioritized risk backlog, highlighting business logic flaws and data egress risks early.
Proactive threat hunting: Use AI as a hunting advisor. Have it generate hypotheses aligned with MITRE ATT&CK, suggest the necessary log sources to prove or disprove the hypothesis, and help pivot investigations when a human analyst hits a dead end. Eventually, you want to move to a fully-automated hunting agent which initiates a hunt upon detecting a new IOC and proactively selects the appropriate data, searches through it, and provides findings.
Continuous red team agents: Deploy autonomous or semi-autonomous red team agents to continuously probe your defenses. The active findings and attack paths generated by these agents create a continuous feedback loop — feeding directly into your threat intelligence analysis, SOC playbooks, and contextual vulnerability prioritization.

5. Advanced governance and incident response: The goal is to build structural guardrails for an environment where AI generates code, while preparing for high-stress incidents.

Policy and compliance gap analysis: Rapidly check if new operational proposals or cloud architectures conflict with internal policies or strict regulatory frameworks (like FedRAMP and NIST guidelines). Use an isolated agent preloaded with your governance documentation to review new project proposals and highlight violations.
Interactive incident response (IR) playbooks: Standard tabletops and static PDF playbooks often fail during a real breach. Train an internal agent on your organization’s historical IR tickets and SOPs. During a live crisis, this agent can act as an interactive guide, providing step-by-step containment instructions that actively adapt to the specific details and telemetry of the ongoing incident.
Secure code review at the pull request: The proliferation of AI coding assistants means your developers are generating code — and potential vulnerabilities — faster than ever. Manual security reviews can no longer keep up. You must turn AI inward on your own pipelines. Integrate advanced LLM-powered auditors directly into your CI/CD pipeline as a mandatory security gate to catch AI-generated vulnerabilities and automatically block insecure commits before they merge into production.
Autonomous defense for collapsed exploit windows: The rapid advancement of AI capabilities has effectively collapsed the time-to-exploit window, and to be faster than the adversary you should use AI to actively find and patch vulnerabilities. This approach requires a continuous, multi-step workflow to map and prioritize your codebase, deploy AI to deeply scan the highest-risk code, autonomously verify and implement patches, and continuously monitor the runtime environment.

Because these sophisticated workflows are incredibly difficult to build and maintain internally, it is highly practical to use leading solutions — such as Google AI Threat Defense — to help you predict attack paths and deploy fixes at machine speed.

Moving forward with confidence

The transition to an AI-augmented security program can feel intimidating, but the technological barrier to entry is lower than it has ever been. By shifting your focus from reactive alert management to internal context, structured automation, and rapid governance, you can effectively outpace modern threats while also alleviating the operational burden on your workforce.

Start small. Pick one quick win from the roadmap this week — such as automating your alert triage or mapping your top five SOPs — and begin building the muscle memory your team needs to stay resilient for the era ahead.

To learn more, check out our Security Talks online event on June 10.

aside_block: <ListValue: [StructValue([('title', 'Fact of the month'), ('body', <wagtail.rich_text.RichText object at 0x7f498ca32a90>), ('btn_text', 'Learn more'), ('href', 'https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Introducing Google AI Threat Defense to help you outpace the adversary: AI Threat Defense is a comprehensive AI-powered cybersecurity solution, an always-on security platform to outpace AI-driven attacks. Read more.
State of SDLC Security 2026: How risk scales in modern development: Wiz researchers share their latest insights from real-world environments into how code, developer tooling, automation, and AI are reshaping application security. Read more.
Claude Enterprise meets the Wiz Security Graph: Security and compliance teams can now monitor Claude activity directly in Wiz, extending to AI the workflows they already rely on. Read more.
How Fraud Defense uses AI to protect the internet: Google Cloud Fraud Defense (formerly reCAPTCHA) now supports agents as first-class users in the browser, has extensively revamped our detection stack with advanced predictive machine learning to model user and bot behavior, and can adapt continuously to new bots and threat vectors. Read more.
What’s new in Android security and privacy in 2026: Android elevates mobile security with new AI-powered protections and advanced safeguards to help keep you safe. Read more.
Defending at machine-speed: Building AI threat readiness with Wiz: Learn how Wiz can help organizations adopt an AI-driven operating model for AI threat readiness. Read more.
Introducing Runtime Threat Detection for Google Cloud Run: Wiz Runtime Sensor support for Google Cloud Run Containers is now generally available, giving teams real-time threat detection and response for their serverless container workloads. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f498ca32b80>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Welcome to BlackFile: Inside a vishing extortion operation: Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. Read more.
2 PhaaS 2 Furious: The evolution of Chinese-language phishing services: While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Within this ecosystem, GTIG has observed a fundamental move away from static password harvesting towards real-time interception and tokenization. Read more.
Exploitation of KnowledgeDeliver via ViewState deserialization vulnerability: In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver, a learning management system (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated remote code execution (RCE), stemming from the use of identical pre-shared ASP.NET machine keys across customer deployments. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Is ‘good enough’ the same as winning: Gal Ordo, co-founder and chief product officer, Native, debates native controls and what happens when a customer needs a feature that a cloud provider hasn't built yet. Listen here.
Cloud Security Podcast: What agentic SOCs should measure: So far this year, what are we measuring for success in agentic SOCs? Matt Gregson, principal, PwC Cyber Security, talks about the state of the agentic SOC. Listen here.
Cloud Security Podcast: CISO as CFO: From Citi to celery, it's all about the cabbage: Most people do not associate grocery wholesale and retail with cutting edge technology and threat models. Arvin Bansal, CISO, C&S Wholesale Grocers, explains why there’s more here than just dry goods. Listen here.
Cyber-Savvy Boardroom: From CISO checklists to CEO strategy: Dom Cussatt discusses the importance of mapping security and risk directly to business objectives. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Introducing Google AI Threat Defense to help you outpace the adversary

Wed, 27 May 2026 12:00:00 +0000

aside_block: <ListValue: [StructValue([('title', 'Summary of today’s news'), ('body', <wagtail.rich_text.RichText object at 0x7f496e1f79d0>), ('btn_text', ''), ('href', ''), ('image', None)])]>

AI-powered cyber threats have been receiving a lot of attention lately. AI has changed the threat landscape; cybercriminals are using it to find security cracks faster than cybersecurity teams can manually fix them. Attacks that used to take weeks to carry out can now happen in mere hours or days. Organizations need to be able to keep pace and protect themselves against AI agent-driven, high-speed attacks — but they can no longer rely on legacy, manual methods.

To defend against this range of threats, organizations need more than one model or agent. No single model will catch everything, you want to use a collection of models for multiple passes. And you need a solution that can analyze your systems, prioritize the most significant threats, patch vulnerabilities quickly, and continuously monitor for new attacks.

That’s why we’re launching Google AI Threat Defense — an automated security system designed to help you continuously monitor for and stop AI-powered threats before they can impact your business.

Built on a decade of security leadership

Security isn’t just a layer of Google’s tech stack; it’s the part of the foundation. Our secure-by-default architecture automatically blocks 10 million spam emails every minute, and protects billions of users and customers across our broad portfolio.

But protecting the modern enterprise requires constant evolution. When we needed an architecture built on trust, we pioneered Zero Trust. To secure hardware, we built Titan chips. And to help enterprises manage an avalanche of threat data, we created Google Security Operations.

Now, AI is rewriting the rules of cybersecurity. By combining the expertise of Mandiant and Wiz with the advanced reasoning and code-generation capabilities of Gemini, we’re automating defense at scale for customers. We’re deploying LLM-powered analysis to help autonomously discover software flaws, and AI agents across Wiz and CodeMender to validate risk, generate fixes, and support remediation workflows before vulnerabilities can be exploited. Unlike other model providers that simply hand security teams a massive, unprioritized list of AI-generated alerts, we deliver prioritized fixes to accelerate remediation and secure the Defender’s Advantage.

Introducing Google AI Threat Defense

Google AI Threat Defense fuses the reasoning power of Gemini and other frontier models, the contextual risk prioritization of Wiz, the code remediation capabilities of Gemini and CodeMender, and the frontline expertise of Mandiant.

By connecting real-world exposure directly to autonomously creating and prioritizing patching, AI Threat Defense helps organizations actively predict attack paths, prioritize the most significant threats, and deploy verified fixes faster than adversaries can exploit them.

AI Threat Defense is based on Google’s own approach to combating today’s threats and transforming vulnerability management across a four-step framework:

Prepare: Harden your foundation, and operationalize your framework for machine-speed prioritization and response.
Scan and prioritize: Conduct deep-dive analysis and AI-driven posture validation.
Remediate: Implement a workflow to autonomously verify and accelerate the patching of vulnerabilities.
Monitor: Transition to continuous detection and rehearsed, active response playbooks.

Google AI Threat Defense can help transform vulnerability identification and remediation.

Prepare: Harden the foundation for machine-speed response

As more vulnerabilities are discovered and exploitation accelerates, the first priority is to reduce unnecessary exposure. Sensitive assets should not be reachable from the internet or exposed through untrusted paths, regardless of patch status. The goal is not only to fix known critical issues, but to reduce what is reachable, validate what can actually be exploited, and make sure new risk does not depend on manual triage.

From there, organizations need to understand how quickly they can patch and respond across exposed technologies. As common vulnerabilities and exposure (CVE) volume grows and exploitation windows shrink, teams need clear ownership, prioritization, and execution paths before the next urgent vulnerability appears. Any exposed application, service, or technology should be prioritized based on reachability, exploitability, and business impact, with a fast process to route the issue to the right owner and drive remediation.

Finally, organizations need to scan every exposure with AI. This cannot be limited to code scanning, because not every vulnerability lives in code. Many real attack paths emerge from how applications, APIs, identities, configurations, permissions, and business logic interact in a live environment. Traditional attack surface management helps identify what is exposed, but organizations now need an AI penetration tester that can continuously analyze every exposure, determine whether it can actually be exploited, and understand what it would enable an attacker to do before attackers do the same.

AI Threat Defense operationalizes this process through Wiz. Wiz continuously discovers exposed applications, infrastructure, APIs, identities, and runtime environments, creating a live exposure map so teams can reduce unnecessary reachability. Wiz’s AI, context-aware, pen-testing agent simulates attacks to identify and validate complex exploitable paths, including application-layer and identity-driven risks traditional testing often misses.

Learn how Wiz continuously scans code repositories, CI/CD pipelines, AI platforms and models, hybrid clouds, and more to surface AI-native risks.

Scan and prioritize: Conduct deep-dive analysis, AI-driven adversarial testing and exploitability validation

Strategic defense requires multiple levels of environmental scanning — moving from superficial checks to deep, AI-driven code analysis.

Frontier models can uncover complex logic flaws, risky trust boundaries, vulnerable dependencies, exposed APIs, and chains of lower-severity issues that combine into exploitable paths. But these deeper scans are more expensive, slower, and harder to run continuously across every asset.

That’s why organizations need to prioritize deep scanning for internet-facing applications, customer-facing services, sensitive data flows, authentication and authorization logic, privileged services, and other business-critical systems.

Using multiple models and multiple passes can improve coverage, because model performance varies by cybersecurity task. Some models may be stronger at application logic, others at cloud configuration, binary analysis, exploitability validation, or remediation guidance. No single model finds the superset of vulnerabilities that other models find — organizations need to use a collection of models to find a broad range of vulnerabilities with optimal cost per token.

Our multi-AI strategy creates a more cost-effective scanning strategy: Use lighter-weight, faster models for broad, continuous coverage, and reserve frontier models for the highest-risk applications and findings. With Wiz, those priorities are guided by real risk context — exposure, vulnerabilities, identity, sensitive data access, and runtime signals — so the highest-risk assets are scanned deeply not just once, but continuously as risk changes.

AI Threat Defense operationalizes this process by deploying AI security agents to help you actively hunt for deep vulnerabilities. These agents draw on multiple industry-leading frontier models via the Gemini Enterprise Agent Platform — where customers will be testing CodeMender — helping organizations choose the best model for the job, without sacrificing strict enterprise privacy, security, or data governance.

This demo showcases how developers can easily secure their applications using CodeMender's command-line interface (CLI).

Once a code flaw is discovered, AI Threat Defense instantly enriches and validates findings with live architectural and runtime context from Wiz. This capability transforms a raw list of model findings into a prioritized map of real business risk, filtering out the noise to focus exclusively on what is reachable. This visibility enables developers to look at the dependencies across source code libraries and binaries to understand the changes that may need to be made in concert — for example, if the signature or behavior of specific libraries needs to be altered.

Translating deep analysis into effective action, AI Threat Defense incorporates Mandiant’s expertise to create actionable response plans. This strategic guidance helps organizations manage sudden surges in critical issues, create strategies for safely retiring legacy products, and assist with rolling out AI-generated patches without overwhelming engineering teams.

Remediate: Accelerate resolution with immediate fixes

After identifying vulnerabilities, the goal is to shrink the time to remediate from weeks to minutes. AI Threat Defense achieves that velocity by driving a high-speed, autonomous workflow that provides and prioritizes fixes without placing a heavy implementation burden on your development teams.

To ensure your security keeps pace with deployment, the platform proactively generates vulnerability fixes directly in a developer’s IDE or CLI as they build. Harnessing the full reasoning power of Gemini, CodeMender works seamlessly with Antigravity and Wiz to empower engineering teams to replace vulnerable code, re-write older code to modern, memory-safe languages, and to analyze library dependencies to coordinate seamless rollouts. In parallel, it automates triage and prioritizes remediation across applications and cloud infrastructure.

Before any patch goes live, the platform automatically generates tests to verify every fix. Once remediated, libraries are tagged across both source control and production environments, providing complete end-to-end tracking to allow the organization to see which model was used to generate what patches and when.

As part of your overall risk posture, you need to understand where vulnerable systems can access sensitive data, since these paths increase exfiltration risk. By consolidating visibility across your data estate, you can identify sensitive data services that are reachable from risky workloads, and prioritize encryption, identity, network controls, exfiltration monitoring, and more.

In addition, consolidating visibility over your software development lifecycle gives you control over how software and configuration changes are being deployed.

Ultimately, our approach delivers autonomy under human supervision — empowering teams to burn down security backlogs and harden the software development lifecycle without sacrificing speed or strategic control.

CodeMender can find and fix deep vulnerabilities in your codebase.

Monitor: Establish machine-speed detection and rehearsed, active response

Even with a hardened foundation, true resilience requires constant vigilance in runtime. While code-level scanning pipelines are excellent at catching flaws before deployment, they cannot block an active exploit. AI Threat Defense shifts operations from manual oversight to machine-speed detection and real-time defense.

As exposure cycles accelerate, AI Threat Defense builds resilience by establishing a consistent operational framework — informed by Mandiant’s frontline expertise — where ownership is defined and outcomes are tracked.

To support active defense against automated adversaries, AI Threat Defense leverages autonomous agents, enabling teams to rapidly hunt for hidden threats, investigate suspicious activity, and respond to live attacks in real time. Together with AI Threat Defense, agentic security operations center (SOC) capabilities from Google Security Operations further enable automated detections, triage and investigation, and hunting of emerging anomalies across your network, identity, and application telemetry. This provides an ongoing monitoring capability to help you discover vulnerabilities before your adversaries do.

Finally, the platform secures the environment from the ground up, minimizing the attack surface right from the start using hardened container images built, signed, and verified daily.

How our partners use AI Threat Defense

To realize the full potential of autonomous defense, our customers are increasingly teaming up with trusted strategic advisors to guide their cloud security journey. Our ecosystem partners, including Accenture, Deloitte, Netenrich, PwC, and TENEX.AI, bring the critical expertise needed to assess your unique cloud architecture and embed AI-driven security capabilities into your existing development pipelines.

Beyond initial deployment of AI Threat Defense, these partners will deliver continuous management, custom harness building, and tailored security workflows. Together, we will help ensure that threats are being identified at machine speed and being automatically remediated, aligning with your organization's specific operational and compliance requirements.

The path forward: Outpacing the adversary with AI

The collapse of the exploit window has made one thing clear: Human-speed vulnerability management is no longer a viable strategy for enterprise risk. The era of machine-speed attacks demands an autonomous, continuous defense.

By combining the contextual risk prioritization of Wiz, the code remediation capabilities of CodeMender, the intelligence of Gemini, and the frontline expertise of Mandiant, we provide the architecture needed to match the speed of the adversary. AI Threat Defense also uses a variety of models to enable organizations to find the largest collection of vulnerabilities while managing costs enabling you to scan, remediate, and maintain your software assets on an ongoing basis.

A key part of our approach is the Google Cloud CISO Community, our close partnership with an important, growing community of industry leaders. This group includes executives from companies including Morgan Stanley, MSCI, TELUS, and Thales. Together, we are building real-time ideas into solutions and shaping the future of AI defense.

To ensure that your enterprise doesn't just keep pace with automated adversaries, but consistently outpaces them, learn more about how Google AI Threat Defense can help you fight AI with AI.

Cloud CISO Perspectives: How Google + Wiz changes multicloud strategy for CISOs

Thu, 14 May 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for May 2026. Today, Vinod D’Souza, director, Office of the CISO, shares highlights from his RSA Conference fireside chat with Anthony Belfiore, chief strategy officer, Wiz.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f496f8860a0>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How Google + Wiz changes multicloud strategy for CISOs

By Vinod D’Souza, director, Office of the CISO, and Anthony Belfiore, chief strategy officer, Wiz

Vinod D’Souza, Director, Office of the CISO

The cybersecurity landscape is undergoing a massive paradigm shift that is being driven by increasingly complicated cloud infrastructure and the ongoing, rapid rise of AI. While threat actors have seen gains from the adversarial misuse of AI, Google and Wiz are tackling these challenges head-on by combining Wiz's deep cloud telemetry with Google's world-class AI and quantum research to help CISOs and their organizations meet the needs of the agentic enterprise era.

As the world becomes increasingly multicloud and multi-AI, we believe that successful CISOs will use AI to analyze code and infrastructure holistically. Developers are building autonomous, agentic systems that can bridge resource gaps and enable real-time infrastructure healing. We should pair that incredible advancement with human oversight of automated fixes.

Anthony Belfiore, Chief Strategy Officer, Wiz

Building towards near real-time defense with AI

The exponential growth of AI means that we can expect technology to leap as much in the next five years as it did in the previous 30. To combat AI-driven threats, security responses will have to become near real-time, if not even faster. By tapping into the innovative minds at Google — specifically integrating with Gemini and Google DeepMind logic — Wiz aims to eventually enable hyper-resilient, self-healing code and infrastructure.

Bridging the gap by centering developers

Wiz has revolutionized vulnerability management by giving organizations an intuitive graph that analyzes cloud environments and ranks threat priorities in 15 minutes or less, turning a weeks-long process into minutes. However, simply giving security teams faster alerts led to a signal tsunami, where teams were chasing developers day and night just to treat symptoms rather than curing the core problem.

The solution was centering developers at the heart of the security strategy. By shifting security left — into the code — and providing context-aware tools, over 50% of Wiz’s daily active users are developers, not security practitioners, leading to a significant increase in security resolution.

In 2026, developers are the ultimate code-watchers because they hold the keys to both innovation and preservation. As vital watchers on the wall, enabling them is no longer an optional strategy if organizations want to stay ahead of modern threats.

Through innovations like Wiz Code, developers get granular data linking production issues directly back to their repositories, empowering them to fix vulnerabilities right where the code is written. In 2026, developers are the ultimate code-watchers because they hold the keys to both innovation and preservation. As vital watchers on the wall, enabling them is no longer an optional strategy if organizations want to stay ahead of modern threats.

Supercharging the agentic SOC future with data and automation

Data is the lifeblood of AI and cloud security. Wiz currently sits on a trove of sanitized data that captures the characteristics of highly secure, resilient, and compliant multicloud environments. When you meld Wiz's specialized cloud telemetry with Google's massive global data access — which includes 90% of the world's browsers and 25% of fiber data — the resulting correlation will profoundly improve threat detection and efficacy.

While this combined intelligence can improve alerts, it can do much more than that. We expect that it will make human security operations center (SOC) operators exponentially more efficient, allowing them to manage the incoming wave of AI-driven threats through automated, agentic interactions. Wiz’s Red, Blue, and Green agents, and Google Security Operations’ Threat Hunting, Detection Engineering, and Third-Party Context agents, can help you develop the human-above-the-loop approach that empowers security teams to rapidly scale up.

However, fully autonomous fixing (where AI automatically changes code and configurations) is not yet ready for prime time. Because automated fixes could accidentally trigger denial-of-service and other outages, human-in-the-loop workflows remain critical.

Bridging the hybrid gap

In order to support as many of you as possible, including major legacy enterprises and institutions, Wiz developed sensors for Linux, vSphere, and Windows environments to enable a unified security approach for hybrid and cloud-native infrastructure. This gives CISOs a vital seat belt, a single pane of glass to protect their organizations as they safely drag and drop applications into the cloud.

Looking ahead

It’s crucial that your 2026 roadmap supports developers, but doing so doesn’t magically make a clean cloud transformation happen. To bridge this gap, the fusion of Wiz and Google focuses on three pillars of developer enablement:

Protection: Providing a sensor for on-premises and private cloud (Linux, vSphere, Windows) is the virtual seat belt that these organizations need to support a consistent security experience during hybrid migration.
Data provision: Delivering high-fidelity, contextualized alerts directly into existing workflows (such as GitHub and images) can help eliminate the noise of the signal tsunami.
Risk management: Using Wiz Code to provide the exact line-of-code traceability, organizations can fix risks at the source before they ever reach production.

The future of the watchers on the wall

The era of chasing mythical beasts in production through manual spreadsheets is ending. As we move toward a world of self-healing code and agentic SOCs, executives should be boldly moving on from treating security symptoms, and instead empowering developers who hold the keys to future resilience.

To learn more about the Google and Wiz approach to securing AI, check out Wiz’s State of AI in the Cloud 2026 report, and Google Cloud’s newest update on the adversarial misuse of AI.

aside_block: <ListValue: [StructValue([('title', 'Fact of the month'), ('body', <wagtail.rich_text.RichText object at 0x7f496f886940>), ('btn_text', 'Learn more'), ('href', 'https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Why AI-powered cyber fraud is winning — and how we fight back: Fraud costs are staggering. At Google, we offer AI-driven tools that span our cloud, browser, and mobile ecosystems to help you build resilient fraud defense. Read more.
The files AI coding agents trust — and attackers exploit: As AI coding agents become embedded in developer workflows, defenders must rethink how to protect against malicious files. Here’s what you need to know. Read more.
What's new in IAM: Security, governance, and runtime defense: We’ve introduced a new security and governance paradigm for managing agent identity and access. Here’s what you need to know. Read more.
Google named a Leader in the 2026 Gartner Magic Quadrant for Cyberthreat Intelligence Technologies: We are proud to announce that Gartner has named Google a Leader in the 2026 Magic Quadrant for Cyberthreat Intelligence Technologies. Here’s what that means. Read more.
Why cloud infrastructure is the foundation for digital health in 2026: As SaMD moves from reactive diagnostics to proactive learning systems, cloud has become a superior foundation for regulated medical software. Read more.
Introducing Agent Gateway ISV ecosystem for security and governance: Google Cloud is partnering with leading identity and AI security solutions to integrate with Agent Gateway and help ensure that your security posture remains as flexible as the agents you’re building. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f496f886dc0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

GTIG AI Threat Tracker: Adversaries leverage AI for vulnerability exploitation, augmented operations, and initial access: Google Threat Intelligence Group (GTIG) continues to track a maturing transition in the adversarial use of AI. In this report, we update you on AI-augmented vulnerability discovery and exploit generation, defense evasion, autonomous malware operations, research and information operations, intentionally obfuscated LLM access, and supply chain attacks. Read more.
Defending your enterprise when AI models can find vulnerabilities faster than ever: Now is the time to strengthen playbooks, reduce exposure, and incorporate AI into security programs. Here’s an overview of the evolving attack lifecycle, how threat actors will weaponize these capabilities, and a roadmap for modernizing enterprise defensive strategies. Read more.
German cyber criminal Überfall and shifts in Europe's data leak landscape: Germany has reclaimed its position as a primary focus for cyber extortion in Europe. While data leak site posts rose almost 50% globally in 2025, Google Threat Intelligence (GTI) data shows that the surge is hitting German infrastructure harder and faster than its regional neighbors. Read more.
How UNC6692 employed social engineering to deploy a custom malware suite: Google Threat Intelligence Group (GTIG) has identified a multistage intrusion campaign by a newly-tracked threat group, UNC6692, that used persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

What the law says about AI governance meeting its agentic future: James Sherer, partner, BakerHostetler, joins host Anton Chuvakin and guest co-host Marina Kaganovich, enterprise trust lead, Office of the CISO, to discuss the legal ramifications of emerging technologies (like AI) that are rapidly changing (also like AI.) Listen here.
Revisiting Google Cloud Next: What does the “ragged edge of AI adoption” mean for security? Why do people want agents in their SOC? Hosts Anton and Tim Peacock chat about the most notable and fun announcements from Next ‘26. Listen here.
Defender’s Advantage: Google's Disruption Mission: Host Luke McNamara is joined by Charley Snyder to explore how Google is building a coordinated approach to disrupting adversary cyber operations. Listen here.
Behind the Binary: What happens when botnet operators show up in court: Host Josh Stroschein is joined by Xusheng Li, a debugger architect and reverse engineering expert, to explore the evolution of Time Travel Debugging (TTD) a new way to debug by recording and replaying execution traces. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

The new era of SaMD: Why cloud infrastructure is the foundation for digital health in 2026

Wed, 13 May 2026 16:00:00 +0000

In the healthcare and life sciences industries, speed saves lives, but meeting regulatory requirements and other administrative burdens often pumps the brakes for manufacturers of software as a medical device (SaMD). These devices include AI image analysis for cancer detection, diagnostic mobile apps for viewing MRIs, and software that can calculate insulin dosages.

Today, the medical device industry stands at an inflection point. We’re moving from reactive diagnostics to proactive, prognostic learning systems. Modern SaMD is a composite system where clinical functionality emerges from the interaction of embedded firmware, mobile apps, and cloud-resident services.

This shift requires a fundamental reimagining of how we demonstrate a state of control. More than just an alternative to on-premises servers, cloud infrastructure has become a superior foundation for regulated medical software.

The regulatory landscape of 2026: FDA QMSR and the EU AI Act

The regulatory environment in early 2026 is defined by a shift toward international harmonization and risk-based oversight. For organizations operating globally, two major milestones dominate the compliance roadmap.

The FDA QMSR Transition
The FDA aligned the Quality Management System Regulation (QMSR) 21 CFR Part 820 with ISO 13485:2016 earlier this year, reinforcing the value of cloud-native patterns that automate document control and change management.

Under the new Inspection of Medical Device Manufacturers Compliance Program, the FDA has moved away from the old Quality System Inspection Technique (QSIT) subsystems in favor of a risk-based strategy that prioritizes areas including change control and outsourcing. In this model, digital retention and automated audit trails are now recognized as primary objective evidence, reducing the industry's reliance on manual paperwork.

The EU AI Act Applicability
As of August 2, the European Union AI Act enters the full applicability phase for high-risk obligations in AI systems. For SaMD manufacturers, these requirements introduce rigorous data governance, transparency, and human oversight for medical devices.

The shift to Compliance as Code

We believe that in a world of continuously updated device platforms, the manual administrative control model doesn’t scale. Instead, we should embrace Compliance as Code (CaC). Five years ago, CaC was a competitive advantage, but today it’s a regulatory necessity.

In this model, compliance is expressed programmatically and enforced declaratively in the system. Because controls are implemented as platform policies, change control can be enforced at the pipeline gate, and evidence is generated operationally as a continuous byproduct of how the system runs. Since the system can’t operate outside its defined controls, we’re able to produce a persistent, defensible record for regulators.

The technical blueprint: The three-plane model

To achieve this state of continuous audit readiness, we organize our architecture into three distinct planes. This separation clarifies the distinction between technical enforcement and regulatory accountability.

1. The data plane covers how clinical or device data moves through the system to deliver its medical purpose — whether that is physiological telemetry from a wearable or medical images for diagnostic analysis. In Google Cloud, this plane handles functional boundaries and ensures data integrity through encryption at rest and in transit. We use Customer Managed Encryption Keys (CMEK) and Key Access Justifications to ensure the manufacturer retains ultimate control over decryption events, a critical requirement for HIPAA and GDPR compliance.

2. The control plane is the governance layer. It defines identity, network boundaries, and configuration constraints. In the 2026 architecture, the control plane uses Zero Trust principles. Instead of relying on a network perimeter, access is granted through Identity Aware Proxy (IAP) after evaluating the user's identity, device security posture, and context. We also use the Organization Policy Service to programmatically prevent non-compliant configurations, such as the accidental creation of public data buckets.

3. The evidence plane is where technical operations meet regulatory proof. It captures immutable audit trails, build attestations, and monitoring history. By using tools like Binary Authorization and Artifact Registry, we can mathematically prove that only code that has passed all security and validation gates is allowed into production. This plane generates the software bill of materials (SBOM) and provenance metadata required by the FDA.

Scaling for the agentic enterprise

As AI matures from answering questions to reasoning and taking action, AI agents can assist with autonomous compliance monitoring, replacing weeks of manual review with continuous oversight while providing human-in-the-loop triggers for final quality sign-off.

Google's AI-optimized infrastructure provides the backbone for innovation, where nodes and pods start up faster and models load quicker, helping to ensure that SaMD agents are ready the moment a clinician or patient engages with the system. This responsiveness is essential for clinical scenarios where latency can affect patient outcomes.

Managing risk in the cloud

Adopting cloud infrastructure does not remove a manufacturer's responsibility for safety and performance. However, it changes the implementation model from shared responsibility to shared fate — where the cloud provider provides the technical primitives (like Assured Workloads for data residency) while the manufacturer configures them to implement their specific quality system.

As we detail in our new whitepaper, Building Software as a Medical Device (SaMD) on Cloud Infrastructure, shared fate provides a superior model to address common SaMD risks:

Policy drift: Enforcing organizational policies to prevent disallowed regions or weak IAM settings.
Audit visibility: Implementing non-repudiable Data Access Logs and Key Access Justifications (KAJ) to ensure every interaction with sensitive clinical data is captured as immutable evidence for long-term retention.
Supply chain integrity: Using cryptographically signed attestations to prevent unverified artifacts from reaching production.

You can read the full report here.

Beyond source code: The files AI coding agents trust — and attackers exploit

Tue, 12 May 2026 16:00:00 +0000

As AI coding agents become deeply embedded in developer workflows, defenders must evolve their definition of malicious files and rethink how to protect against them.

Autonomous AI agents operate across integrated development environments (IDEs), editors, terminals, and extension runtimes, and they often have access to local files, command execution, and external services. As a result, the attack surface of the modern developer environments now extends well beyond source code. Repository files, agent instructions, runtime settings, and extension packages can all influence what the agent trusts, what it executes, and what it can reach.

Defending this new attack surface requires moving towards semantic analysis to understand the actual instructions, logic, and context being fed to the AI. Powered by VirusTotal Code Insight, our agentic threat intelligence capability in Google Threat Intelligence extracts the true operational intent behind agent-facing files at scale, allowing security teams to expose configurations that override guardrails and mask supply-chain risks.

By integrating agentic capabilities into Google Threat Intelligence, we’re able to link these invisible artifacts to broader threat campaigns. This powerful capability can help ensure that as attackers exploit what AI agents trust, defenders are equipped with the resources to read between the lines.

To help security analysts understand how the developer threat landscape has quickly expanded, we suggest an approach that groups the attack surface into four categories: what executes, what instructs, what connects, and what extends.

Examples of common file types that expand the developer threat landscape.

Attack surface: What executes

Just as developers rely on project configuration to automate setup, debugging, and routine tasks, AI coding agents and modern developer tools also inherit execution paths from repository files. These artifacts can trigger commands, bootstrap environments, and chain execution through normal workflows.

Opening a project, trusting a workspace, starting a debugger, rebuilding a container, or running a standard setup command may therefore execute attacker-controlled logic under the appearance of legitimate project automation.

Attack surface: What instructs

AI coding agents also consume persistent instruction files that shape how they behave inside a project. These files can influence what the agent prioritizes, what it ignores, which tools it uses, which files it trusts, and which actions it takes automatically.

These files do not need to contain exploit code to be security-relevant. Reusing them across repositories introduces a supply-chain risk, because malicious instructions can be presented as harmless guidance while steering otherwise legitimate agent workflows toward unsafe behavior.

Unlike traditional IDEs that require a human to click run, an agent may parse these instructions and execute them as a prerequisite to a task without the developer ever reviewing the specific instruction block.

Attack surface: What connects

Beyond instructions, coding agents also depend on runtime definitions that determine how they interact with tools, hooks, external services, and local execution contexts. These files define permissions, tool connectivity, external endpoints, and execution paths.

This is where repository-level influence becomes operational control. A malicious or unsafe runtime configuration can expose local commands, remote services, sensitive data, and untrusted model context protocol (MCP) servers to the agent, turning configuration abuse into controlled execution.

Attack surface: What extends

Extensions add another layer of inherited trust and introduce third-party code into editor and browser runtimes, often with broad access to local files, credentials, and developer workflows. This inherited trust can create a supply-chain problem similar to malicious project configurations: Compromised extensions, poisoned update paths, and hijacked publisher accounts can introduce attacker-controlled logic through components that otherwise appear to be standard tooling.

Applying VirusTotal Code Insight in agentic threat intelligence

This taxonomy highlights a fundamental shift in the threat landscape: The risk is no longer just in the syntax of code, but in the semantics of intent.

Traditional security tools are effectively blind to natural language instructions that tell an AI to ignore guardrails or redirect data. The operational questions are then: How can defenders identify these risks systematically? How can they detect the danger before a developer or an agent automatically follows a valid instruction file to a malicious conclusion?

To bridge this gap, we use VirusTotal Code Insight and agentic threat intelligence to perform large-scale semantic analysis. Because malicious repository settings and instruction files are often syntactically correct, they frequently return zero detections from signature-based scanners.

Code Insight solves this problem by using AI to analyze the file’s actual logic and read between the lines, surfacing behavioral risks that are invisible to legacy tooling. This context is further enriched within agentic threat intelligence, where security teams can pivot from a single semantic red flag to investigate broader threat infrastructure and associated campaign activity.

Example 1: A Weaponized tasks.json

One representative example is a file distributed under the path coding-challenge/coding-challenge/.cursor/tasks.json. The sample was first submitted to VirusTotal on March 19, and remained undetected by security engines for several days.

VirusTotal Code Insight flagged it as a risk based on the behaviour implied by the configuration itself. The sample has also been verified as malicious by a Mandiant analyst and marked as associated with a tracked threat actor by Google Threat Intelligence.

Screenshot of tasks.json sample.

The Code Insights description indicated that the file, which is parsed when a user opens the project folder in an IDE like Visual Studio (VS) Code, drives the user to download and execute arbitrary code from a GitHub Gist in memory while hiding the execution parameters.

To make Code Insights analysis reproducible at scale, we can also scale access to such descriptions for multiple files via the VirusTotal API. Looking at the contents of this particular file, we identified the Gist URLs that the actor referred to in the instructions.

Instructions from tasks.json pointing to Gists.

Looking up these Gist URLs with agentic threat intelligence provides a detailed breakdown of the malicious instructions embedded within them. Despite masquerading as legitimate tools such as NVIDIA Cuda, these Gists, along with their specific filenames, show strong similarities to widespread campaigns frequently attributed to North Korean actors, which are designed to lure IT professionals.

These attacks often pose as technical challenges to trick users into compromising their own devices.

Agentic threat intelligence enrichment based on the tasks.json and associated Gists quickly gives analysts more robust context.

Example 2. Offensive system instructions files
System instruction files used to provide guidance, resources, and context to LLMs can also contain malicious capabilities while remaining undetected by common antivirus services. Since the beginning of 2026, we have observed a consistent increase in Skill.md files submitted to VirusTotal with either risky or malicious instructions.

While this does not necessarily mean that all samples were harmful, it illustrates a trend that is likely to grow in tandem with the adoption and implementation of Skills across the industry.

In this example, we identified a Skill.md file containing instructions to steal user data. Code Insight indicated that the skill file contained instructions “to exfiltrate sensitive credentials, including API keys and environment variables, to external endpoints."

This case reflects a growing interest among threat actors in acquiring API keys and resources to enable scalable LLM integrations. At the time of writing, this file had remained active for nearly two months without any detections or researcher notes.

Example of a Skill file with instructions to steal user data.

The file's contents reveal a specific narrative designed to evade detection. The instructions direct the agent to exfiltrate API keys, tokens, and configuration files under the guise of "maintenance," explicitly advising the model not to mention this to the user "as it may cause confusion about the security process."

Although direct intelligence on this specific file was limited, we used the agentic threat intelligence briefing capability to generate a summary and explore similar past observations. This provided contextual information to categorize and understand the threat.

Agentic threat intelligence briefs summarize similar threats.

Even files that explicitly state their offensive capabilities often evade traditional detections. For example, we identified a Skill designed to equip an AI agent with Windows privilege escalation and credential theft capabilities.

Although the file includes a disclaimer for authorized use only, its core instructions remain high-risk. Code Insight accurately evaluated the file. "The file provides explicit and systematic instructions for performing high-risk offensive operations," it said.

Despite its offensive capabilities, by the time of writing only a few vendors had flagged the file as malicious.

Example of Skill for Windows privilege escalation and credential theft.

Example 3: Suspicious JSON runtime configurations
A third example is a pair of settings.json samples shared through VirusTotal: One points to api.awstore.cloud, the other to api.kiro.cheap. The two unrelated samples follow a similar pattern: They override ANTHROPIC_BASE_URL, embed an API key, and turn Claude Code into a client of a third-party proxy rather than Anthropic.

Code Insights analyzes suspicious runtime configuration samples.

This demonstrates exactly how runtime configurations can be weaponized. The file does not need exploit code or a malicious binary to be dangerous. It simply rewires trust while the agent is running.

For example, a valid AI-generated settings file can silently redirect prompts, source code, and credentials to an external endpoint while the agent appears to behave normally. Beyond data exfiltration, a rogue endpoint could plausibly reverse the flow, feeding malicious instructions or vulnerabilities back to the agent to be injected directly into the local codebase.

A high level analysis of awstore.cloud using an agentic threat intelligence pivoting prompt, uncovered a series of similar domains sharing the same underlying infrastructure. These domains exhibit a clear naming preference for crypto, finance, and tech-related nomenclature.

While the organization’s public sites currently lack formal malicious detections, OSINT lookups reveal several red flags: a lack of a verifiable legal entity, limited contact options restricted to Discord and Telegram, and a payment model that exclusively accepts cryptocurrency via third-party marketplaces like plati.market.

The settings profile reinforces this pattern. Beyond changing the endpoint, the configuration suppresses telemetry, error reporting, and cost warnings, stripping away the guardrails that would otherwise alert a user. The intent is seemingly to maintain a facade of normal operation while silently redirecting traffic to an opaque third-party service.

While these are technically valid configuration artifacts, their ability to hijack trust and exfiltrate sensitive data is indistinguishable from traditional malware.

Example 4. A Sabotaged Extension Payload
Another low key example we recently identified was that of a VS Code extension for User-centric Use cases Validator (UUV) end-to-end tests submitted to VirusTotal in March. More than one week later, the sample continued to have zero detections, but VirusTotal Code Insights identified suspicious behavior.

The analysis indicated that this specific sample included a well-known protestware payload known as peacenotwar which upon activation writes a blank file named WITH-LOVE-FROM-AMERICA.txt and logs a heart in the console.

Sample of VS Code extension containing malware used to spread political messages.

To bridge the gap between a suspicious file and actionable intelligence, we generated an agentic threat intelligence brief. By feeding the semantic context from Code Insight into the prompt, the agent pivoted across historical data, instantly linking this 'benign' extension to the 2022 cyber activist sabotage of the node-ipc library in response to the invasion of Ukraine.

While this specific event may have limited impact today, it highlights a critical, overlooked weakness in how agents handle configurations. Code Insight bridges this gap by identifying samples that, while technically benign to traditional scanners, harbor clear malicious intent.

In another example, we identified this version of a public AI coding assistant which, according to the feature’s analysis, ‘silently reads the user’s system clipboard contents and transmits this data to a remote server.’ Regardless of the likely benign nature of the sample, the analysis points out a risk for users to consider when using the extension.

Example of public coding assistance that reads the user’s system clipboard contents and transmits data to a remote server.

Rethinking detection for the agentic era

Today, a JSON file or plain-text markdown instructions can compromise environments just as effectively as compiled malware. This shift fundamentally redefines what malicious looks like, as the danger now resides in the semantic intent of common text files that AI agents are designed to trust.

These artifacts do not need to contain exploit code to be high-risk, they simply need to provide instructions that steer an agent’s autonomous actions toward unsafe behavior, data exfiltration, and the silencing of security guardrails.

Securing this new frontier requires expanding beyond traditional syntax-based scanning toward a model of semantic analysis, treating plain-text artifacts with the same rigor as compiled malware.

Organizations can formalize this approach by implementing repository-level security policies that strictly define permitted agent-facing files and ideally mandate that they undergo automated peer reviews before being merged. We also recommend that large-scale teams enforce least-privilege access for coding agents to local files and external services, limiting the potential impact of hijacked configurations and sabotaged extensions.

Ultimately, we recommend that defenders use agentic threat intelligence tools — including VirusTotal AI, the VirusTotal Code Insights API endpoint, and our agentic platform — to supervise the operational intent of these files in real-time.

Google named a Leader in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies

Wed, 06 May 2026 16:00:00 +0000

At Google, we see firsthand how cyber threats can outpace traditional defense mechanisms — and how agentic threat intelligence can help bridge the gap. We have a vision for agentic defense where autonomous AI agents, powered by Gemini and fed by our unmatched threat visibility, can reason through complex malware and preemptively neutralize threats at scale. This evolution can help security teams shift from anticipating risks to autonomously disrupting attack chains in real-time, effectively out-maneuvering adversaries before they can strike.

We are proud to announce that Gartner has named Google a Leader in the 2026 Magic Quadrant for Cyberthreat Intelligence Technologies. We believe this recognition validates our unique ability to unify Mandiant’s unparalleled incident response, VirusTotal’s massive, crowd-sourced threat repository, Google’s infrastructure visibility, and Gemini integration into a unified operational ecosystem.

Given the scale of the aforementioned platforms and operations, and being at every stage of the kill chain - from early deep dark web chatter to IR breach investigations - allows us to provide agents with a distinctive knowledge substrate to autonomously pre-empt threats.

Google a Leader in the 2026 Magic Quadrant for Cyberthreat Intelligence Technologies based its Completeness of Vision and Ability to Execute.

Built for enterprises and organizations that require large-scale visibility, Google Threat Intelligence can help transform how teams operationalize insights. Gemini can help analysts synthesize vast amounts of intelligence so they can take decisive action.

By protecting billions of devices and mailboxes daily, spending over 500,000 hours investigating incidents in 2025, and leveraging insights from hundreds of global threat experts, Google provides a level of breadth and depth in threat visibility that helps organizations stay ahead of even the most sophisticated global actors. Our multisignal approach provides early warning on both broad and targeted attack techniques.

We are also bringing dark web intelligence into the AI era by using the latest Gemini models to dramatically increase accuracy by forgoing keyword lists that are often a source of chronic toil, induced by as much as 90% false positives.

Conversely, our internal tests show Google Threat Intelligence can analyze millions of daily external events – with 98% accuracy. This high accuracy rating helps ensure that security teams are alerted to the most relevant threats and drastically reduces the noise of false positives.

To empower security teams exactly where they work, we have turnkey integration with Google Security Operations to enable automated rule generation and closed-loop policy enforcement. We maintain an open architecture with a vast ecosystem of partners to ensure that every organization can uplift its security operations regardless of its existing tech stack. This includes robust integrations with hundreds of security vendors enabling you to take action quickly on active and potential threats.

To complement our technology, we provide the human expertise needed to navigate the complex threat landscape. For organizations facing more challenging scenarios, Mandiant Threat Intelligence services help security teams navigate complex scenarios through direct collaboration with our global experts. This expertise is also codified in-product into off-the-shelf prompts, no-code agents and a native agentic skills layer. This combination of automated intelligence and human expertise allows organizations to have confidence in the intelligence they are using and the actions they are taking.

Delivering measurable value for security teams

Google Threat Intelligence delivers a measurable impact on the speed and scale of modern defense. Customers have identified 139% more threats proactively and made their CTI teams 46% more efficient. These gains enable teams to move beyond manual triage and focus on high-value investigations.

By accelerating detection engineering, Google Threat Intelligence identifies malicious infrastructure before it is used in campaigns. This transition allows defenders to anticipate adversary maneuvers and disrupt attack chains earlier, reducing threat dwell time and organizational risk.

Executing on our vision

We are very pleased that Gartner recognized us as a Leader in cyberthreat intelligence technologies. We feel we continue to push the boundaries of what is possible in threat research such as being the first ones to bring malware analysis to the AI era, the first ones to bring dark web to the agentic era and we continue to deliver the autonomous decision advantage to preemptively neutralize the right threats with the right action and the right context.

To learn more about Google’s position as a Leader, you can download the full 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies here.

_{Source: The 2026 Gartner® Magic Quadrant™ for Cyber Threat Intelligence Technologies, Jonathan Nunez, May 4th, 2026 G00839252}

_{GARTNER® is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved. This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Google. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.}

What's new in IAM: Security, governance, and runtime defense

Wed, 06 May 2026 16:00:00 +0000

The AI era demands a fundamental shift in security, and that includes identity and access management (IAM). Traditional controls simply aren’t built for autonomous AI agents that interact with sensitive data at machine speed, a reality we address with our new IAM advancements for the agentic enterprise era.

Engineered as built-in Google Cloud capabilities to secure the rapidly-expanding world of AI agents, at Google Cloud Next we introduced a new security and governance paradigm for managing agent identity and access. This comprehensive framework focuses on foundational Agent Identity and an Agent Gateway with Identity-Aware Proxy, while integrating robust agent access management, agent guardrails, and runtime defense to enable a secure cloud environment for your organization.

Security and governance for agents.

Agent Identity

AI agents require verifiable identities to operate securely and with accountability. Agents on Google Cloud can now receive a dedicated Agent Identity: a new, first-class principal type distinct from human identities or generic service accounts.

Built on the open Secure Production Identity Framework For Everyone (SPIFFE) standard, these identities are cryptographically protected, strongly attested, and automatically provisioned. Agent Identity allows you to recognize agents whether they are operating autonomously or on behalf of a user.

With Agent Identity, agents are recognized as an independent identity type, allowing you establish strong governance and agent-specific authorization rules.

To support this, we are announcing the following updates:

Agent Identity for Agent Runtime is now generally available, and Agent Identity for Gemini Enterprise Agent Platform is in preview, granting first-class identity to agents across these platforms.
Agent Identity Auth Manager is in preview, streamlining complex OAuth flows for agents acting on behalf of users by securely handling credentials and tokens.
Certificate Manager support for Agent Identity certificates is also in preview, providing a single pane of glass for managing all agent-related certificates.

Agent Gateway

Agent Gateway enables policy enforcement for all agent-to-agent and agent-to-tool connections. Because AI agents behave non-deterministically, all agent traffic on Google Cloud can now be routed through the Agent Gateway. This centralized flow allows you to enforce strict policies that prevent agents from accessing unauthorized or undesired third-party endpoints.

To extend Zero Trust enforcement to agents and AI systems, the following capabilities are also available in preview:

Identity-Aware Proxy (IAP) for Agents: IAP integrates with Agent Gateway, providing default-on, identity-centric security. It enforces granular access control policies using IAM, based on agent identities and rich contextual attributes derived from the model context protocol (MCP).
Context-Aware Access (CAA) for Agents: CAA evaluates contextual signals such as device health, IP address, and location for agent identities before granting access to resources.

Agent access management

Managing agent access and the operations they can perform is critical to address dormant permissions. Our defense-in-depth approach to agent access management ensures agents only have the privileges they need. To help enforce least privilege access, Agent Identity is now fully supported across Google Cloud's policy, monitoring, and governance solutions.

IAM Allow and Deny policies for Agent Identity are now generally available, letting you control which agents can access specific resources.
Principal Access Boundary (PAB) for Agent Identity is now in preview. PAB acts as a protective additional layer, setting hard limits on the resources a specific agent or group of agents can never access, regardless of other permissions they might inherit.
Unified Access Policy (UAP) for Agent Identity is coming soon. These new access policies act as a rulebook for AI agents, allowing granular control over agent access to tools, APIs, and resources. Policies can be based on the Agent Identity, the effect (allow or deny), the operation, and specific conditions. They can even mandate human-in-the-loop (HITL) approvals for sensitive actions, ensuring critical decisions have human oversight.

All these policy types support the new Agent Identity nomenclature, including hierarchy-aware constructs built on SPIFFE's trust domain and namespace model. This means you can govern agents individually or as groups using the same familiar policy mechanisms already in use for human and service account identities.

Agent guardrails

Beyond providing strong access management capabilities, we must also ensure that AI agents can not exfiltrate data at runtime or pull in unauthorized external data. VPC Service Controls (VPC-SC) support for Agent Identity as first-class principals in ingress and egress rules is now in preview, allowing you to prevent data exfiltration and letting you control the data traversing in and out of your perimeter.

Additional enterprise-wide guardrails are available to enforce that only specific resource configurations are allowed in your cloud environment:

Organization Policies: Administrators can enforce constraints, such as restricting agent creation to specific regions or preventing agents from creating public IP addresses.
Custom Organization Policies: Cloud administrators can tailor constraints to unique agent behaviors and compliance requirements.

To help enterprises continuously monitor and secure AI agents, our new Agent Security dashboard for Agent Platform, in preview, offers agentless discovery, vulnerability scanning, runtime threat detection, and graph-based risk discovery.

Key capabilities of this platform include:

Agent security posture: Provides secure-by-design templates and Google-recommended controls for building agentic applications.
Agent vulnerability scanning: Identifies weaknesses in agent packages and skills, catching flaws before deployment.
Agent asset discovery: Delivers an organization-wide inventory of all AI agents and their associated assets. The inventory process will soon differentiate between shadow AI agents and sanctioned AI agents in your organization.

Collectively, these capabilities help to ensure that agents are secure by design and continuously monitored.

Runtime defense

While agent access management and guardrails can help you manage permissions and prevent data exfiltration, runtime defense controls can provide an additional protection layer addressing runtime security risks and ensuring AI agents function as intended.

Model Armor provides real-time protection for user, model, and agent interactions to protect against runtime risks such as prompt injection, tool poisoning, and sensitive data leakage across Google Cloud services and Gemini Enterprise Agent Platform. It now provides inline protection for Agent Gateway, Agent Runtime, Google Cloud MCP servers, Langchain (in preview) and Firebase (generally available) to help developers add runtime guardrails and sanitization of agent traffic and interactions without the need to change code.

These integrations expand Model Armor's existing inline protections for Agent Platform models, Gemini Enterprise, Apigee, Google Kubernetes Engine inference gateway and load balancers, as well as API interfaces.

Beyond agents: Additional IAM capabilities announced at Next '26

We’re rolling out a comprehensive suite of new capabilities to manage identity, access, and governance at scale. We’re simplifying user provisioning with SCIM support for Workforce Identity Federation, streamlining Gemini Enterprise onboarding, and ensuring strong machine identities with Managed Workload Identity.

We’re also making access management smarter and more secure with the general availability of Gemini-powered IAM Role Picker, Fine-Grained Access Control for BigQuery, and enhanced Privileged Access Manager insights. To mitigate access risks and further strengthen security, we have introduced a VPC Service Controls violation analyser, integrated Identity-Aware Proxy with Cloud Run, mandated multi-factor authentication for specific cohorts, and extended Context-Aware Access to service accounts.

To help you organize and centralize control over your expanding cloud footprint, Custom Organization Policy now supports over 130 Google Cloud products and services.

Learn more

These updates represent a significant leap in how we help you manage your agentic cloud ecosystem, but what hasn’t changed is our commitment to building a secure foundation for your organization. We continue to fortify Google Cloud’s security platform, ensuring that you have a robust and trustworthy environment for all your workloads, including those powered by AI.

By centralizing control and automating identity governance, you can scale your AI initiatives with the confidence that your most critical data remains protected.To learn more, view the Next '26 session recording for an overview of these announcements. For a closer look at how to implement these security best practices in your own organization, please check out our documentation.

Introducing Agent Gateway ISV ecosystem for security and governance

Tue, 05 May 2026 16:00:00 +0000

Managing agents and their actions can quickly grow in complexity and introduce security risks unique to AI. To address these challenges, at Google Cloud Next we announced Agent Gateway to provide simple, secure, and governed connectivity across all user-to-agent, agent-to-agent, and agent-to-tools interactions.

As part of Gemini Enterprise Agent Platform, Agent Gateway provides a programmable data plane for your AI agents. It connects easily with a wide array of security providers, giving your team the flexibility to inject custom logic and third-party security controls directly into the request path.

To support the agentic enterprise in today’s multicloud and multi-AI world, we’re partnering with leading identity and AI security providers to integrate with Agent Gateway and help ensure that your security posture remains as flexible as the agents you’re building.

Agent Gateway partner ecosystem for agent security and governance.

Broadcom: Agentic AI introduces high-speed, autonomous data exchanges across LLMs, tools, and other agents, dramatically expanding the risk of data exfiltration through new, unmonitored leakage points. To counter this, Symantec and Google Cloud are partnering to integrate Symantec Data Loss Prevention (DLP) scanning as a service extension for the Agent Gateway, which serves as the network-level enforcement point for all agent traffic. This integration enables real-time inspection and enforcement of existing DLP policies across agent communications — including LLM inference requests and MCP tool calls — without requiring any changes to application code.
Check Point: Securing your AI transformation across both employee adoption and runtime innovation, Check Point’s AI Defense Plane can discover and govern sanctioned and unsanctioned, shadow AI usage. AI Defense Plane’s runtime protections integrate with Agent Gateway to provide low-latency inspection of prompts, responses, and tool interactions — preventing agent manipulation, sensitive data leakage, and tool misuse, so organizations can confidently scale AI.
Cisco: Integrating Cisco AI Defense with Agent Gateway can help enforce runtime protections for every AI interaction, including those that use model context protocol (MCP). These guardrails can help mitigate threats like prompt injection and data exfiltration, and agent-specific risks like tool exploitation and misuse.
CrowdStrike: Extending the AI-native CrowdStrike Falcon platform into the Agent Platform including Agent Gateway ecosystem can help CrowdStrike deliver guardrails, visibility, and control as agentic AI systems move from experimentation into production. Integrations including CrowdStrike Falcon AI Detection and Response (AIDR) and CrowdStrike Falcon Shield can provide secure operation of agents across the ecosystem.
Exabeam: Delivering behavior‑driven security analytics at enterprise scale, Exabeam New‑Scale Analytics is purpose‑built to secure Google AI and Agent Platform environments. Exabeam can ingest and analyze telemetry from Agent Platform including Agent Gateway, applying behavioral analytics to identify anomalous and high‑risk AI agent activity. Together, Google provides the AI infrastructure and controls, and Exabeam delivers the enhanced behavioral intelligence, governance, and continuous security oversight required to operate AI agents safely at scale.
F5: F5 AI Guardrails provides runtime protection for agents against data leakage, harmful outputs, and adversarial attacks. Integrated via Agent Gateway, it enforces data security and policy controls to ensure agent interactions remain governed and compliant across all models.
Netskope: Netskope One DLP On Demand with Agent Gateway inspects data at the precise moment it moves through your AI workloads and enforces the data security policies your team has already built. By embedding DLP in their architectures, organizations can govern sensitive data generated and routed by AI agents without creating new configurations, ensuring data security evolves alongside cloud and AI innovations.
Okta: Okta for AI Agents provides centralized identity governance and access control for Agent Gateway. With Okta as the identity layer, Google’s policy engine can defer access decisions to Okta, enabling organizations to govern which users and agents can access specific agents and tools. Agents created in Google Cloud can also be automatically registered in Okta, keeping identity and governance policies in sync.
Palo Alto Networks: Deploying Palo Alto Networks Prisma AIRS as an AI security layer with Agent Gateway can provide the real-time security and governance necessary to oversee agentic interactions and intercept adversarial attacks on AI before they can compromise the system. This architectural integration can help ensure that as you scale your autonomous agents, every agentic action is validated against enterprise safety and security policies, providing comprehensive operational integrity without hindering the speed of innovation.
Ping Identity: Ping Identity integrates with Agent Gateway to bring runtime identity and real-time, fine-grained authorization to agent and tool traffic. The integration with Agent Gateway ensures every request is continuously verified based on user, agent, context, and policy, rather than relying on static credentials. Together, they provide centralized, consistent governance and visibility across all agent interactions without requiring changes to application code.
Saviynt: Saviynt provides identity security and governance that helps enterprises govern every identity — human, non-human, and AI — across cloud environments. Saviynt’s integration with Agent Gateway provides live identity intelligence for every AI agent access request, evaluating intent, data sensitivity, and organizational policy in real time before access is granted. This ensures AI agents remain purpose-bound and continuously governed, with high-risk actions surfaced for human oversight and a defensible audit trail for compliance.
Silverfort: Silverfort provides identity security for agentic workloads by extending its patented Runtime Access Protection (RAP) to agent platforms, automatically discovering AI agents, mapping each to its human owner, and surfacing risks such as overprivileged access and stale credentials. By integrating directly with Agent Gateway, Silverfort can authenticate and authorize every agent-to-resource request at runtime, blocking unauthorized actions before they reach downstream systems.
Thales (Imperva): Thales provides advanced web application and API security for the Agent Platform, including security for client‑to‑agent traffic leveraging Agent Gateway. Imperva for Google Cloud (IGC), currently in preview, deploys natively in Google Cloud, eliminating the need for external software-as-a-service (SaaS) integrations and avoiding traffic redirection outside of Google’s infrastructure.
Zscaler: Providing runtime protection and governance for AI apps, models, and agents, Zscaler AI Guard can help enable real-time inspection of prompts and responses to detect malicious inputs like prompt injections and prevent sensitive data leakage through advanced content moderation and data protection detectors. The Zscaler AI Guard integration with Agent Gateway can help ensure that agentic workflows remain secure, compliant, and aligned with enterprise security policies.

As enterprises build and deploy a wide range of agents and agentic use cases, Agent Gateway supports a wide variety of agentic security controls tailored to your unique operational needs. Our approach can help your business meet compliance and governance requirements, while offering the freedom to use your choice of security provider.

To learn more about how our partners can elevate your Google Cloud experience, reach out to our team for a personalized consultation and discover the power of an open, integrated approach.

Cloud CISO Perspectives: At Next ‘26, why we’re multicloud and multi-AI

Thu, 30 Apr 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for April 2026. Today, Francis deSouza, COO Google Cloud and President, Security Products, explains why Google is multicloud and multi-AI, straight from Next ‘26.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f496f28d940>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Cybersecurity in the era of the agentic enterprise

By Francis deSouza, COO Google Cloud and President, Security Products

Francis deSouza, COO Google Cloud and President, Security Products

Last week at Google Cloud Next ‘26, we announced 220 products, and signaled a paradigm shift. We are not just moving workloads to the cloud; we are entering the era of the agentic enterprise.

The AI megatrend, coupled with an accelerating cloud adoption, is the most profound enterprise IT transformation of our lifetimes. It is igniting a new wave of innovation, and also demands a fundamental re-architecting of cybersecurity. Our vision at Google Cloud is clear: to be the most AI-native, open, and secure platform on the planet, meeting enterprises exactly where they are.

Security at machine speed: From minutes to seconds

In this new landscape, IT resilience is defined by a multi-AI and multicloud strategy. A durable AI roadmap cannot rely on a single model or a single cloud provider. For CISOs, the mission-critical frontlines have shifted to securing models, agents, and the data that fuels them.

AI isn't just a security challenge — it is also the ultimate security tool. Today, our security operations center (SOC) agents automatically triage tens of thousands of unstructured threat reports every month. The results of our AI-first cyberdefense are transformative:

90% reduction in threat mitigation time by filtering noise and extracting intelligence instantly.
30 minutes to 60 seconds: Our Triage and Investigation agent, powered by Gemini, has processed over 5 million alerts this year, turning half-hour manual tasks into one-minute automated actions.
98% accuracy: Our new dark web intelligence capability analyzes millions of daily external events to surface the threats that actually matter.

The multicloud reality is non-negotiable

Modern organizations are multicloud by default. Between hyperscalers, SaaS vendors, and legacy systems, the single cloud dream is over. Our ethos has always been open because that is the only way to protect a fragmented world.

The reality is that AI and cloud applications are built across multiple platforms and models. To protect them, we focus on making it easier and faster to mitigate risk across all major cloud environments.

By unifying security across all major cloud environments, we aren't just simplifying management — we are lowering the stakes. Our unified approach reduces the risk and cost of a breach by 70%.

The integration of Wiz into Google Cloud has further deepened this advantage. With 90% of environments now running self-hosted AI software, Wiz allows us to secure the entire AI development lifecycle across any cloud, complementing our deep expertise in threat intelligence.

The Google advantage: From lab to live on day 1

The speed of innovation in AI is relentless. Standard security industry timelines of six months to a year to incorporate the latest models into security products are not sufficient; they leave organizations two generations behind their adversaries.

Francis deSouza, COO Google Cloud and President, Security Products, explains Google Cloud's multicloud and multi-AI approach to Next '26 attendees in Las Vegas.

Google occupies a unique position in this race. We co-design the entire stack: hardware, AI, and security.

Vertical integration: We are the only security provider that integrates a new model on day 1.
Research to reality: When Google DeepMind achieves a breakthrough in the lab, we move it to your security platform faster than anyone else in the industry.

A blueprint for the agentic future

As we advocate for a multi-AI world, we are providing the tools to build it safely. Our latest whitepaper, Building Secure Multi-Agent Systems on Google Cloud, is a robust framework for this transition.

It highlights the power of our newly announced Gemini Enterprise Agent Platform, featuring:

Agent Gateway: A single governance layer for identity and access management.
Model Armor: Sophisticated prompt sanitization to prevent adversarial attacks.
Agent Identity: Ensuring that as agents move at machine speed, they do so with authenticated authority.

The announcements at Next ‘26 were more than a recap; they were a promise. We are committed to being your partner in this new era — providing the most open, productive, and secure foundation for the AI-driven future.

You can also catch up on all our Next ‘26 security announcements here.

aside_block: <ListValue: [StructValue([('title', 'Tell us what you think'), ('body', <wagtail.rich_text.RichText object at 0x7f496f28dbe0>), ('btn_text', 'Vote now'), ('href', 'https://www.linkedin.com/feed/update/urn:li:activity:7455362783040282624'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Next ‘26: Redefining security for the AI era with Google Cloud and Wiz: At Google Cloud Next, we showcased how we can help you defend against threats at machine speed, protect AI and multicloud environments, and secure cloud workloads at scale. Read more.
Next ‘26: Introducing Google Cloud Fraud Defense, the next evolution of reCAPTCHA: We’ve launched Google Cloud Fraud Defense, the trust platform for the agentic web and the next evolution of reCAPTCHA. Read more.
Next ‘26: New partner-supported workflows for Google Security Operations: We’ve introduced new partners for Google Security Operations as part of the Google Cloud Security Integration Ecosystem program. Read more.
How Google Does It: An inside look at cybersecurity: Learn how Google approaches some of today's most pressing security topics, challenges and concerns, straight from Google experts. View the collection.
The current state of prompt injections on the web: Our threat intelligence teams initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f496f28d130>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Defending your enterprise when AI models can find vulnerabilities faster than ever: Now is the time to strengthen playbooks, reduce exposure, and incorporate AI into security programs. Here’s an overview of the evolving attack lifecycle, how threat actors will weaponize these capabilities, and a roadmap for modernizing enterprise defensive strategies. Read more.
German cyber criminal Überfall and shifts in Europe's data leak landscape: Germany has reclaimed its position as a primary focus for cyber extortion in Europe. While data leak site posts rose almost 50% globally in 2025, Google Threat Intelligence (GTI) data shows that the surge is hitting German infrastructure harder and faster than its regional neighbors. Read more.
How UNC6692 employed social engineering to deploy a custom malware suite: Google Threat Intelligence Group (GTIG) has identified a multistage intrusion campaign by a newly-tracked threat group, UNC6692, that used persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

AI, Zero Trust, and secure by design walk into a bar: Is there Zero Trust for AI? Why is secure by design picking up speed now, just as issues of machine identity come to the fore? Grant Dasher, distinguished engineer, Google, analyzes the intersection of trust, secure design, and AI with hosts Anton Chuvakin and Tim Peacock. Listen here.
From CISA to cloud: AI assurance, concentration risk, and the new regulatory frontier: Jeanette Manfra, VP, head of Risk and Compliance, Google Cloud, joins Anton and Tim to discuss the current regulatory landscape facing cloud and AI, and the ongoing tug-of-war between security and privacy at the enterprise level. Listen here.
More than just packets: Is NDR a first-class cloud security control: Extrahop’s Raja Mukerji and Rafal Los join Anton and Tim to delve into the value proposition of network detection and response in 2026, and how it can apply to the worlds of work from home, cloud and SaaS, encryption, and high bandwidth. Listen here.
Defender’s Advantage: Takeaways from the 2026 M-Trends report: Host Luke McNamara is joined by Mandiant’s Chris Linklater to discuss the breach trends throughout 2025 and into this year. He notes key areas that organizations should focus on as we approach the mid-point of 2026. Listen here.
Cyber-Savvy Boardroom: Head in, hands out: Mark Lobel, formerly of PwC, joins hosts Alicja Cade and David Homovich to discuss why high-stakes simulations are essential to protecting corporate reputation when the regulatory clock is ticking. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.