Security & Identity

Cyber Snapshot Report: Go beyond the toolchain and build enterprise resilience

Mon, 27 Jul 2026 16:00:00 +0000

Even as machine-speed attacks dominate the headlines, Mandiant’s view from the frontline reveals that the vast majority of successful intrusions still stem from fundamental human and systemic failures.

This operational break-down shows up pointedly in research from the M-Trends 2026 report. Exploits remain the most common initial infection vector for the sixth consecutive year at 32%, voice phishing surged to second place at 11%, and prior compromise was the number one confirmed vector for ransomware-related incidents, according to the report.

To stay ahead, leaders should shift from prevention-focused strategies to an operating model where compromise is anticipated, exploitation is recognized as inevitable, and a continuous, intelligence-led feedback cycle leads their defense. Business and security leaders should rethink how they architect and implement resilience strategies and train cross-functional teams. At the same time, they should also systematically address technical debt and organizational security culture.

To help your team navigate this reality, we have curated the frontline insights and blueprints you need to turn potential organizational crises into manageable events in the newest Defender’s Advantage: Cyber Snapshot Report.

Hardening architecture to contain blast radius

When we accept that intrusions will happen, the goal of security shifts from keeping attackers out to containing their impact.

Ransomware operators now aggressively target recovery paths — virtualization hypervisors, backup environments, and privileged access management (PAM) vaults — to deny organizations the ability to restore operations and maximize the pressure to negotiate. Hardening the architecture means implementing strict credential separation and air-gapped isolated recovery environments (IRE) to help verify that a compromise in the production network can not destroy backups.

However, containing the blast radius also requires securing soft entry points beyond traditional data centers — starting with your executives and high-value personnel. Threat actors increasingly target personal digital footprints, including personal devices, home networks, and family members, as entry points into critical corporate infrastructure.

A resilient posture should expand to protect this extended ecosystem, integrating digital footprint management with traditional executive protection programs.

Forging readiness for the inevitable crisis

While architectural guardrails can limit the physical reach of an attacker, human readiness and decision-making often determines how quickly your organization can respond and recover.

This capacity can only be forged from first-hand experience. While policy can encourage its growth, enabling a culture of "safe failure" supported by immersive learning and mentoring can help teams to build the collective muscle memory needed to manage high-stress incidents.

This human readiness is tested even further as adversaries embrace automation. Recent research by the Google Threat Intelligence Group (GTIG) identified the first known zero-day exploit developed with AI. This finding, combined with the intense industry focus on AI-driven vulnerability discovery, has driven many organizations to search for a quick technological countermeasure.

While AI-assisted discovery provides advanced technical capabilities for defenders, it requires integrating these automated tools into a mature, structured program that aligns people and processes. By transforming raw discovery into a continuous, risk-based readiness capability, teams can overcome alert fatigue and achieve both machine-speed execution and strategic control.

Activate your Defender's Advantage today

Technology alone will not define your cyber defense outcomes. True resilience lies in preparing your team, hardening your architectures, and practicing under pressure.

To help arm your organization with the frontline insights needed to navigate evolving threats confidently, you can download your copy of The Defender’s Advantage: Cyber Snapshot Report, Issue 8, today.

Now in preview: Find and fix software vulnerabilities with CodeMender

Tue, 21 Jul 2026 15:00:00 +0000

As adversarial AI threats accelerate attacks on code, security teams must counter them with machine-speed defenses that can automate code remediation and fight AI with AI.

CodeMender is our managed code security agent, and starting today, we're bringing its code scanning and remediation capabilities directly to you in preview.

CodeMender offers access to our generally available models via Gemini Enterprise Agent Platform, or it can be deployed as a core component of AI Threat Defense.

CodeMender also aligns with our multi-model approach, so you can choose the right model to optimize for cost, speed, and deep scanning performance. It will support third-party frontier model options later this year.

Watch this overview of CodeMender in Gemini Enterprise Agent Platform.

CodeMender can help you advance from passive scanning to automated code remediation, and reduce zero-day risk. It examines and remediates existing code security issues without sacrificing development velocity by:

Deploying the best-fit model. You can choose from multiple models to optimize for costs, speed, deep scanning, and coding performance.
Automating machine-scale remediation. You can now eliminate remediation bottlenecks caused by manual verification and patching, while keeping developers in the loop.
Prioritizing fixes by exploitability. You can run proof-of-concept exploits and execute simulations to verify that vulnerabilities in the code are exploitable, and prioritize resources on fixing the most critical issues first.

Find and fix vulnerabilities with AI

Born from Google DeepMind's pioneering AI research, CodeMender transforms vulnerability management from a manual bottleneck into an autonomous, high-speed system. Your developers and security practitioners can automatically scan software for flaws, verify them with executable exploits, and remediate them with tested code fixes.

“At Salesforce, trust is our number one value, and protecting customer data means continually raising the bar for how we find, validate, and mitigate risks. CodeMender brings AI into a critical part of the security lifecycle by accelerating the path from validated vulnerability to tested fix. As AI reshapes the threat landscape, capabilities like this help strengthen resilience and give our customers the confidence to keep innovating,” said Iain Mulholland, CISO, Salesforce.

"CodeMender consistently identified critical vulnerabilities that our other AI-enabled tools completely missed. It doesn't just find theoretical flaws — it proves the immediate risk and delivers targeted, validated fixes that secure our environment without disrupting core business logic," said Scott Ponte, head, Security Operations, Robinhood.

"CodeMender is fast, comprehensive, and genuinely ambitious about closing the loop from detection to fix, enabling teams to secure their software supply chain without losing velocity," said Ashwin Kannan, principal AI engineer, Office of the CTO, Palo Alto Networks.

How the CodeMender agent works

We’ve fine-tuned CodeMender’s harness to be continuously updated with the latest Google DeepMind research, including the up-to-date agent skills, security tools, and system prompts.

Operating in the secure-by-design Agent Platform, CodeMender is protected by enterprise-grade, built-in governance and security guardrails, including secure traffic routing through your VPC, data isolation and encryption, and zero retention of source code data.

As an agent, it can integrate with existing continuous integration and continuous delivery (CI/CD) workflows, or run directly in local developer environments using a lightweight command-line interface (CLI) client.

You can also configure CodeMender to scan and analyze code in a sandbox that you manage. The agent connects to your code repositories and works with developer tools, such as VS Code and Antigravity, to safely analyze first-party, open-source, and third-party software.

Scan: Find hidden vulnerabilities with flexible model scanning

CodeMender scans for top vulnerability classes and understands the unique context, goals, and functionality of your software repositories and applications.

Scan: Discovered new vulnerabilities and categorized by severity and type.

CodeMender’s harness with security context helps you discover sophisticated vulnerabilities that static and model-only scanning miss. These scans look for hard-to-find vulnerabilities like memory corruption, injection, web security issues, cryptographic flaws, and insecure data handling. CodeMender supports common software languages including C/C++, Go, Java, Python, Ruby, Rust, and TypeScript.

Verify: Simulate and verify exploits to reduce noise

CodeMender can help cut alert fatigue and false positives by proving a vulnerability presents a legitimate risk before fixing it. The agent goes beyond static code-pattern analysis by simulating an attack with exploit code it builds and runs in an isolated, customer-managed sandbox.

Verify: Creates verification plan and builds and tests exploits in your sandbox environment.

The agent uses this proof-of-concept exploit to verify that the security flaw poses a legitimate risk. This critical verification phase allows your security practitioners and developers to prioritize validated risks by eliminating false positives.

Remediate: Automatically generate and test code fixes

Identifying risky security flaws is only half the battle. Once a vulnerability is verified, CodeMender automatically generates a secure patch to resolve the issue. The fix is delivered as a code difference directly in developer tools, so it can be integrated into existing development workflows.

Remediate: Generates and tests code fix with code diff for developer review and approval.

CodeMender further strengthens the fix by using LLM-as-a-judge to ensure it doesn’t disrupt existing application functionality. You can even provide context on your codebase's distinct coding conventions and styles so that CodeMender generates code that matches it. Developers remain in full control, manually reviewing and approving CodeMender's patches before any code is committed to the repository.

CodeMender in AI Threat Defense

When leveraged as part of AI Threat Defense, Wiz orchestrates agentic application security, analyzing applications to prioritize investigations. It calls CodeMender to scan code (coming soon), enrich findings within the Wiz Security Graph with deployment context, and trigger Wiz Red Agent for AI pentesting to prove exploitability, ensuring that teams focus on the highest-risk vulnerabilities.

Through Wiz, AI Threat Defense calls CodeMender to scan code, enrich findings, and trigger AI pentesting.

Wiz serves as a command center for governing and scaling remediation in AI Threat Defense. The Wiz Green Agent orchestrates this lifecycle by directing CodeMender to generate and test high-fidelity patches enriched with application context from the Security Graph. This workflow empowers teams to resolve complex vulnerabilities with unprecedented speed and precision.

How to get started with CodeMender

Consistent with our multi-model approach, CodeMender can help you optimize for cost, speed, and deep scanning performance.

You can use CodeMender with our generally available Gemini models via Agent Platform, or deploy it as a core component of AI Threat Defense.

Separately, CodeMender with Gemini 3.5 Flash Cyber will be exclusively available to a small set of governments and trusted partners. We plan to expand this access over time.

CodeMender is a critical step towards a continuous, self-healing agentic software development lifecycle, a future where code is autonomously secured, validated, and patched before it ever hits production.

You can learn more about CodeMender and review the documentation here.

Cloud CISO Perspectives: How AI leverages deep context as the defender’s advantage

Thu, 16 Jul 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for July 2026. Today, Francis deSouza, COO, Google Cloud and President, Security Products, explains the crucial role that deep context plays in creating an AI advantage for defenders.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7fad5f590160>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How AI leverages deep context as the defender’s advantage

By Francis deSouza, COO, Google Cloud and President, Security Products

Francis deSouza, COO, Google Cloud and President, Security Products

Attackers are making headlines with AI, but defenders have a distinct and powerful advantage.

AI is rapidly transforming the cyberthreat landscape, driving unprecedented shifts in the scale, speed, and sophistication of attacks. Just recently, Google Threat Intelligence Group documented a critical milestone: the first known case of a zero-day exploit built entirely with AI. While we successfully disrupted their plans and got the vulnerability patched before launch, it highlights exactly what we are up against.

With AI agents, attacks are accelerating at machine speed. The handoff time between the first and second stage of an attack used to be eight hours; today, it takes just 22 seconds.

There’s an old saying in cybersecurity that adversaries only have to be right once, but defenders have to be right every time. That is the attacker’s advantage.

But AI is rewriting those rules, delivering a decisive defender's advantage built on deep context.

The AI Era: Attacker’s Profile vs. Defender’s Advantage

Aspect	Attacker's Profile	Defender's Advantage
Visibility	Limited to outside-in probing; little enterprise context upon entry.	Complete inside-out context; knows exact asset locations, application behavior, and team ownership.
Operational Speed	Executes multi-agent handoffs in 22 seconds.	Machine-speed defense; proactive mitigation in seconds (such as Morgan Stanley's 90-second resolution.)
Core Tactics	Multi-model phishing, deepfakes, AI-built zero-days, and model poisoning.	Closed-loop defense; continuous exposure mapping and accelerated code patching.

The unified blueprint: Google AI Threat Defense

Previously, enterprise context data was fragmented across disconnected security tools. Now, AI empowers defenders to synthesize this rich data into a unified, always-on, autonomous defense.

We built Google AI Threat Defense to combine Google’s security capabilities into a single platform: the advanced reasoning of Gemini, the contextual cloud power of Wiz, the code-level remediation capabilities of CodeMender, and the frontline intelligence of Mandiant.

Our platform transforms vulnerability management across a continuous four-step framework:

Stage	Technology & Actions	Strategic Value to the Enterprise
1. Prepare	Map exposed applications, APIs, identities, and runtime environments using Wiz. Simulate attack paths with the Wiz Red Agent.	Hardens the foundation to reduce internet reachability before vulnerabilities hit production.
2. Scan & Prioritize	Run multi-model scanning — using lighter models for broad coverage and Gemini frontier models for deep-dive analysis of high-risk assets.	Replaces massive alert lists with deep, context-driven risk validation, including an optimal cost per token.
3. Remediate	Deploy CodeMender inside developer IDEs/CLIs to auto-generate verified code fixes.	Replaces slow, manual patching with autonomous code-level remediation and memory-safe migrations.
4. Monitor	Deploy AI agents tied to Wiz to hunt for vulnerabilities and anomalies across network, identity, and application telemetry. Pair with Google Security Operations to rapidly hunt for unknown threats.	Establishes machine-speed runtime detection for zero-day response and threats against unpatchable environments.

To stop vulnerabilities before they hit production, Morgan Stanley partnered with Google Cloud and Wiz, aligning their strategy with the core principles of the AI Threat Defense framework: prepare, scan, remediate, and monitor. By replacing fragmented tools with this unified blueprint, Morgan Stanley collapsed its mean time to detect threats by 99.9%, shifting from a reactive 45-minute window to proactive mitigation in 90 seconds or less.

Google Cloud x Morgan Stanley: Redefining Threat Defense in the AI Era

Maintaining strategic human oversight

While human-speed execution cannot keep pace with automated threats, human management remains essential. We align autonomous AI agents directly with the human teams they support. In Wiz, for example, the Red agent automates penetration testing, the Blue agent drives threat investigations, and the Green agent accelerates cloud remediation.

Every AI conversation is a security conversation. That means securing AI infrastructure requires building from the ground up, and not bolting on.

This ensures autonomy under human supervision, empowering engineering and security teams to eliminate backlogs and secure the software development lifecycle without sacrificing speed.

What’s next: AI-native, agent-driven infrastructure

The foundation of your defender's advantage starts with protecting your environments — not just from outside threats, but from internal risks like shadow AI and unauthorized agents. When employees download models and deploy agents outside of IT oversight, they create silent logic breaches and data-poisoning risks.

The key to countering this is enforcing Zero Trust for AI, and directing teams toward approved architectures with proper governance. Every AI conversation is a security conversation. That means securing AI infrastructure requires building from the ground up, and not bolting on.

At Google, security is not just an added layer; it is our foundation. Our secure-by-default architecture automatically blocks nearly 15 billion unwanted emails and protects billions of users every day.

As the threat landscape matures, outperforming automated adversaries requires a platform built from the ground up to be AI-native and agent-driven.

Fight AI with AI. Learn more about how to secure your software lifecycle with Google AI Threat Defense.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7fad5f590940>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=CmGWIwgHR60'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

FinOps for SecOps: How to optimize the agentic SOC for value: To be more resilient in AI adoption, CISOs should develop a disciplined "FinOps for SecOps" blueprint that maximizes threat disruption while keeping control over compute costs. Here's how. Read more.
New IDC study: How Mandiant transforms security into a competitive advantage: A new IDC Business Value White Paper found that you save an average of $4.3 million, driving a 268% three-year ROI, with Mandiant Consulting. Read more.
Drive proactive security, prioritize risks with Google Threat Intelligence and Wiz ASM: To help you match your real-world exposures with real-time adversary activity, we’ve begun integrating Google Threat Intelligence with Wiz Attack Surface Management. Read more.
Shift into high gear with agents: Securing the software-defined vehicle: To better support and secure SDVs, Google Cloud and Valtech have partnered to develop Nexus SDV, a highly-scalable, AI-enabled connected vehicle platform. Read more.
Meet the 33 cybersecurity startups joining the Gemini Startup Forum: Our flagship Google for Startups program, Gemini Startup Forum: Cybersecurity, has selected its first 33 trailblazing startups. Read more.
Introducing k8s-aibom on GKE for automated AI bills of materials: We’re open-sourcing k8s-aibom, a Kubernetes controller that continuously monitors environments to detect AI runtimes and generate standard ML-BOMs. Read more.
BGP route policies: Top 3 use cases by customer demand: We detail the three most impactful use cases for Cloud Router BGP route policies that have emerged since 2025. Read more.
Contributing to U.K. financial sector resilience as a critical third party: The U.K. Treasury has designated Google Cloud EMEA as a critical third party (CTP) to the U.K. financial sector under the CTP regime. Here’s how that helps you. Read more.
Google Cloud confirmed to offer a safer choice for EU public sector organizations with Dutch DPIA approval: We understand that for the EU public sector, data protection is a prerequisite. We’re excited to reinforce this commitment with a major milestone. Read more.
Why IaC coverage belongs on your security dashboard: Rethinking infrastructure-as-code coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed. Read more.
Inside the ProdSec playbook: Operationalizing Wiz for end-to-end cloud security: Rethinking infrastructure-as-code coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed. Read more.
Build AI security agents with Wiz MCP: Power AI-driven security with trusted security context, Wiz AI Agents, and Wiz AI Skills. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7fad5f5907f0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

A look at the drivers, dynamics, and applications of the pro-Russia influence ecosystem: Four years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset. The interconnected nature of the ecosystem's disparate components makes it resilient to limited scope disruptions, a factor that defenders need to consider to mitigate pro-Russia influence threats. Read more.
Google’s continued disruption of malicious residential proxy networks: In coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks. Read more.
GhostApproval: A trust boundary gap in AI coding assistants: Learn how Wiz uncovered a category-level blind spot in modern AI coding assistants, and why the human-in-the-loop safety model fails against this classic threat. Read more.
The latest addition to Turla’s intelligence gathering apparatus: Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla, one of the oldest known cyber espionage groups, since at least December 2022. As part of our continued tracking of this group, we’re providing an overview of our STOCKSTAY analysis, a timeline of key developmental and operational observations, and detailed similarities to KAZUAR to contextualize this new capability in Turla’s arsenal. Read more.
Recovering active ADFS signing keys via Machine DPAPI: During a recent red team engagement, Mandiant discovered that when ADFS certificates are manually rotated, configuration drift can silently leave active signing keys exposed in Machine DPAPI. Here’s how to defend against it. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Building an AI-pilled, solo vibe-coded, Clickhouse-based SIEM: Dan Lussier, founder, Nano, unpacks how he vibe-coded an entire SIEM from scratch during his end-of-year holiday break. Listen here.
Cloud Security Podcast: Scaling lessons, from leading the NSA to defending the world: Morgan Adamski discusses how public-private partnerships and the shift to cloud infrastructure have transformed cybersecurity defense through improved intelligence sharing and collective trust. Listen here.
Cloud Security Podcast: Closest alligator to the canoe: How transforming the SOC became P0 for Lloyds Bank: Matt Row, chief security officer, Lloyds Bank, explains the bank's digital transformation strategy, highlighting how it modernized its security operations center to achieve a 20x reduction in human-reviewed alerts. Listen here.
Defender’s Advantage: Human-machine teaming and applying AI to frontline threat intelligence workflows: Jake Nicastro, AI lead, Frontline Intelligence Operations, GTIG, details how his team is shifting from simple prompt engineering to more advanced agentic workflows, focusing on a model of human-machine teaming. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Securing the AI supply chain on GKE: Introducing k8s-aibom for automated AI BOMs

Mon, 13 Jul 2026 16:00:00 +0000

How should your security team manage shadow AI? Workloads deployed by developers without formal registration can often evade traditional security scanners, because organizations are reluctant to slow down development and compromise stability by demanding privileged Daemonsets, kernel-level access, and manual pod-spec edits.

To break this deadlock, today we are open-sourcing k8s-aibom. This lightweight, unprivileged Kubernetes controller continuously monitors the cluster API and container environments to automatically detect running AI runtimes (like vLLM and Triton) and generate standard CycloneDX Machine Learning Bill of Materials (ML-BOMs).

By providing automated, audit-grade visibility directly from runtime execution — regardless of whether the workload was formally registered — k8s-aibom can help teams safely move AI projects from pilot to production without developer integration friction.

The architecture of zero friction

k8s-aibom is designed from the ground up to respect both the CISO mandate for total visibility and the SRE mandate for cluster stability. It deploys as a single, unprivileged Deployment in the k8s-aibom-system namespace. It involves zero developer friction — no sidecars, no eBPF kernel modules, no privileged DaemonSets, and no modifications to existing developer pod specifications.

k8s-aibom watches for AI workloads and produces BOMs.

The discovery pipeline executes through four clear stages:

Scrape cluster workloads: The controller continuously monitors KServe resources, Deployments, StatefulSets, DaemonSets, and Jobs across the cluster.
Identify AI stacks: Advanced pattern matching inspects container images, environment variables, and command-line arguments to detect serving runtimes (vLLM, Triton Inference Server, TGI, Ollama), autonomous agent frameworks (LangChain, AutoGen, CrewAI), vector databases and RAG stores (Milvus, Qdrant, pgvector), as well as distributed training jobs and evaluation harnesses.
Generate standard manifests: The controller compiles the discovered artifacts into formal OWASP CycloneDX 1.6 Machine Learning Bill of Materials (ML-BOM) documents.
Export to sinks: The controller attaches the resulting ML-BOM directly to the custom resource status (status.bomDocument) of an in-cluster AIBOM Custom Resource (CR) and routes it to optional external sinks, including Google Cloud Storage buckets and external webhook endpoints.

Application teams do not need to modify their pod specifications, inject sidecar containers, or alter their continuous integration and continuous delivery (CI/CD) pipelines. Furthermore, k8s-aibom treats the Kubernetes cluster state as a pure functional input: Identical cluster inputs produce byte-identical ML-BOM documents. This deterministic property makes k8s-aibom an ideal fit for GitOps workflows, enabling site-reliability engineers (SREs) to perform exact diffs and trigger precise change-detection alerts when AI dependencies drift.

Where existing AIBOM tooling falls short

Many AI BOM solutions offer build-time scanners producing BOMs from artifacts at rest. These tools help you track the code that was intended to be deployed.

Commercial AI security platforms extend the picture with cloud-native posture management, but typically through external scanning shaped around vendor-specific data models. Few, if any, of these tools help compliance reviewers, security operations (SecOps) teams, and platform engineers understand what is running right now, what is it connected to, and how can we verify those assertions.

We purpose-built k8s-aibom to bridge that gap. It produces BOMs from live cluster observation rather than artifact scanning, emits standards-conformant CycloneDX 1.6 ML-BOMs that integrate with the broader OWASP and Open Source Security Foundation (OpenSSF) supply-chain ecosystem rather than vendor-proprietary formats, and runs as an unprivileged controller on any conformant Kubernetes cluster — making it complementary to existing build-time and posture-management tooling rather than a replacement for either.

The Confidence Model: Separating intent from inference

For compliance auditors and SecOps engineers, raw telemetry is often noise. Standard monitoring tools indicate that a container is running, but can’t prove whether an AI model was explicitly configured by a platform engineer or dynamically pulled by an autonomous script at runtime. k8s-aibom solves this ambiguity through its deterministic Confidence Model, categorizing discovered assets into distinct tiers:

Declared: Explicitly defined by the customer or developer in the workload configuration (For example, explicitly passed container arguments such as --model meta-llama/Llama-2-7b.) A “declared” confidence detection represents clear human intent.
Inferred: Derived autonomously by the controller's pattern-matching engine through deep inspection of container images, environment variables, and execution profiles. (For example, identifying ^vllm/.* container signatures.)
Unresolved: Applied to workloads where an active AI presence is detected, but exact model parameters, weights, and versions can’t be deterministically established. An “unresolved” confidence detection immediately flags the workload for targeted security review.

This structured taxonomy allows compliance reviewers to instantly separate explicit engineering intent from machine inference, establishing an unassailable chain of trust during audits.

Immutability and least privilege: Building an audit-grade security model

Auditors remain deeply skeptical of standard observability telemetry because logs and metrics can be modified, dropped, and tampered with by compromised nodes or elevated administrators. k8s-aibom establishes an audit-grade evidence trail built on strict least-privilege isolation and data immutability.

The controller operates under a dedicated Kubernetes service account bound to a minimal Identity and Access Management (IAM) Workload Identity. It acts as the sole identity authorized to write BOM records to external storage sinks, requiring only roles/storage.objectCreator permissions.

To satisfy the most stringent audit and evidentiary standards, the Google Cloud Storage external sink implementation enforces DoesNotExist preconditions on object creation. Once an ML-BOM is written to the Cloud Storage bucket, the object becomes cryptographically immutable.

It can’t be silently overwritten, modified, or retroactively tampered with by compromised cluster actors or rogue workloads. SecOps teams gain absolute assurance that the historical audit log presented to regulators represents an unalterable record of cluster execution.

Accelerating governance readiness: Mapping to global regulatory frameworks

By automating the generation of standardized CycloneDX 1.6 ML-BOMs, k8s-aibom directly bridges the gap between low-level Kubernetes runtime state and high-level governance frameworks. It unblocks stalled GKE AI deployments by providing the foundational empirical data essential to major global standards:

EU AI Act: Designed to help organizations align with Article 12 (automated logging and record-keeping for continuous traceability) and Article 50 (transparency obligations for AI systems). By automatically cataloging serving runtimes and agent stacks, the tool helps simplify the gathering of technical evidence that may be needed during compliance audits.
NIST AI Risk Management Framework (AI RMF): Provides continuous, empirical asset visibility that can help support the Govern, Map, Measure, and Manage functions, helping shift compliance workflows from purely manual checks toward more automated asset inventory tracking.
ISO/IEC 42001:Supports compliance efforts for AI management system asset discovery and tracking, reducing the reliance on manual spreadsheets or periodic snapshot audits for inventory validation.

Getting started

It’s rare that a technical solution like k8s-aibom can help mitigate the multi-faceted problem of shadow AI, impacting CISOs, governance, risk, and compliance teams, SecOps teams, platform engineers, and developers.

To learn more by inspecting the controller, review the CRD definitions, and contribute to the open-source k8s-aibom project, please visit the k8s-aibom GitHub Repository.

Contributing to U.K. financial sector resilience as a critical third party

Fri, 10 Jul 2026 17:00:00 +0000

At Google Cloud, we take our role in the financial ecosystem very seriously. We firmly believe that operational resilience is essential to driving and sustaining responsible innovation.

Today, we mark a milestone in our ongoing commitment to the financial sector that’s directly relevant to our customers in the U.K. On July 10, the U.K. Treasury designated Google Cloud EMEA as a critical third party (CTP) to the U.K. financial sector under the CTP regime.

This designation takes account of the number and type of U.K. firms using our services and the materiality of their use cases. We acknowledge HMT’s decision on the systemic impact of our services and are committed to playing our part in safeguarding the stability of, and confidence in, the U.K. financial system.

Building sector-wide resilience

As a CTP, Google Cloud EMEA will be directly overseen by the Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA). These authorities are known collectively as the U.K. financial regulators.

In their oversight of CTPs, the U.K. financial regulators will aim to build sector-wide operational resilience. Google Cloud wholeheartedly supports this objective.

We will continue to engage constructively with the U.K. financial regulators as we enter this new phase of deeper collaboration. We are confident that this ongoing dialogue will deliver tangible benefits for the U.K. financial sector.

Enabling customer success

Alongside our commitment to effective oversight, Google Cloud remains dedicated to supporting our customers with the requirements for U.K. firms relating to operational resilience, outsourcing and third party risk management.

We provide insight into how Google Cloud can help customers meet their operational resilience obligations under PRA Supervisory Statement 1/21 in our SS1/21 whitepaper.
We explain how Google Cloud’s contracts for UK firms address the outsourcing and third party risk management requirements under PRA Supervisory Statement 2/21 our SS2/21 mapping.

While the CTP regime does not replace these requirements, it is designed to complement them. We are confident that it will.

Looking ahead

We look forward to collaborating with the U.K. financial regulators under the CTP regime. We will do so with the same commitment to ongoing transparency and assurance that we offer our customers and their regulators today.

As this new era begins, our core objective remains unchanged: to ensure Google Cloud is the most secure, scalable, and resilient platform for digital transformation.

Meet the 33 cybersecurity startups joining the Gemini Startup Forum

Wed, 08 Jul 2026 13:30:00 +0000

Startups are at the forefront of tackling some of the world’s most complex challenges, especially in cybersecurity, where new ideas and adaptability are always needed. These companies are embracing AI as a powerful tool, enabling them to scale their impact.

Google believes that enabling the next generation of AI-native cybersecurity startups will have a positive impact across the globe. Today, we are thrilled to announce that our flagship Google for Startups program, Gemini Startup Forum: Cybersecurity, has selected its first 33 trailblazing startups. This exclusive forum is designed to address critical domains and foster deep dialogue on AI integration in cybersecurity.

Every startup will be able to work on their roadmap alongside AI and cybersecurity specialists from Google DeepMind, Google Cloud, and Wiz. This year’s cohort is organized into six specialized focus areas, from autonomous agent protection to post-quantum cryptography.

AI agent security and governance

Capsule Security (Israel): Delivers runtime protection and behavioral monitoring for autonomous AI agents. The platform tracks agent activities, API calls, and tool usage in real-time to prevent unauthorized actions and data exfiltration across software-as-a-service (SaaS) and endpoint agents.
Evoke Security (United States): Functions as an endpoint detection and response (EDR) platform designed for AI agents. It deploys an endpoint sensor to scan for risky agent configurations, monitor runtime behavior, and block unauthorized skill executions.
Manifold Security (United States): Provides agentless detection and response for AI agents using graph analysis and runtime monitoring. By tapping into open telemetry and API hooks, the platform maps agent behavior and connections to identify anomalies without installing software on local machines.
Mirror Security (Ireland): Specializes in data-in-use protection for AI workloads using fully homomorphic encryption. The platform enables enterprises to perform model inference, database searches, and agent communications directly on encrypted data without decrypting it.
Onyx Security (Israel): Offers an AI control plane to discover, govern, and monitor autonomous AI agents across enterprise environments. The platform analyzes agent posture, tracks session token streams, and uses a model mesh to enforce context-aware compliance policies.
Refractal (United Kingdom): Builds runtime security and governance, risk, and compliance (GRC) infrastructure to monitor and govern enterprise AI agents. It intercepts agent actions, evaluates them against organizational policies and European regulations, and generates cryptographic audit logs.
Unbound Security (United States): Acts as an agent access security broker (AASB) that provides visibility and governance for developer-focused coding agents. It deploys endpoint hooks to monitor terminal commands and restricts agent actions based on user identity and group permissions.
XOR (United States): Produces reinforcement learning training data and environments to help AI models autonomously find and fix their own security flaws. The company provides verified task trajectories and benchmarks that developers use to train secure coding agents.

Application security and vulnerability management

Aisy (United Kingdom): Models enterprise environments from an attacker's perspective to prioritize vulnerability remediation. The platform maps external attack surfaces, groups related assets into business-centered threat models, and identifies critical exploit chains.
Alt Security (Israel): Develops an agentic penetration testing platform that uses autonomous AI agents to perform security testing. The system automates reconnaissance, chains vulnerability findings to identify critical business risks, and validates exploits in sandboxed environments.
Arcjet (United States): Provides application security that executes natively inside developer codebases via an SDK. The platform handles bot detection, rate limiting, and prompt injection directly in the codebase, maintaining a low-latency decision loop.
Pixee (United States): Automates vulnerability triage and code remediation by converting scanner results into verified pull requests. The platform uses a context graph and a deterministic harness to generate codebase-compatible fixes that pass developer continuous integration (CI) pipelines.

Cloud, network, and infrastructure security

CloudFence (United States): Monitors a company's cloud network like an invisible overhead drone. It studies the normal patterns of how systems talk to each other and immediately alerts managers if a system starts talking to an unfamiliar location.
CyberSeQ (United Kingdom): Scans software code and digital pipelines to check if their encryption is outdated. It helps organizations plan their transition to modern, quantum-proof security keys.
Huskeys (Israel): Works as a smart tuner for a company's digital firewall. It automatically optimizes and adapts traffic filters in real-time, reducing false alarms so legitimate customers can visit websites without being blocked.
Native (Israel): Serves as a multicloud security control plane that manages built-in native provider controls across Google Cloud, AWS, Azure, and Oracle. The platform uses a simulation engine to preview the operational impact of security policy changes before deployment.
Prowler (United States): Automates cloud security posture management and compliance checks across multicloud environments. The open-source platform uses a database of community-driven security controls to identify and remediate misconfigurations.
QIZ Security (Israel): Manages enterprise cryptographic assets and compliance posture through a centralized dashboard. The platform maps certificates, databases, and source code into a knowledge graph to help organizations transition to post-quantum cryptography.
Tracebit (United Kingdom): Uses cloud-native decoys, or canaries, to detect infrastructure intrusions and unauthorized access. The platform deploys these decoy resources at scale via infrastructure-as-code to trigger alerts the moment an attacker moves.

Endpoint security and data protection

Bold Security (United States): Provides a user-space endpoint security agent that protects enterprise devices from data exfiltration and insider threats. The agent runs local classification models on-device, allowing for policy enforcement and data loss prevention without cloud latency.
Glow (Israel): Unifies endpoint, software, and AI agent monitoring into a single workspace protection layer. By using a team of collaborative AI agents, the platform maps organization-wide software footprints and blocks unauthorized browser extensions and plugins.
Jazz (United States): Modernizes data loss prevention (DLP) by analyzing user intent and business context rather than relying on static pattern rules. It uses a lightweight endpoint agent and an intelligent investigator to automatically triage and resolve data-flow alerts.
ORION Security (United States): Deploys an indicator-driven data loss prevention platform that tracks data lineage across endpoints, browsers, and SaaS tools. By mapping file movements in a graph database, the platform identifies exfiltration risks without requiring manual policies.
MokN (France): Combats credential theft through a proactive identity recovery platform. Its proprietary technology turns the tables on attackers by using ultra-realistic decoy access points to trick them into revealing the credentials they have stolen. This can help neutralize threats before the compromised credentials can be exploited.

SOC automation and offensive security

COGNNA (Saudi Arabia): Operates an agentic security operations center (SOC) platform that analyzes security alerts and automates threat response workflows. The platform ingests telemetry from existing endpoint and security information and event management (SIEM) tools, using AI agents to investigate incidents and reduce alert noise.
Latent Defense (United States): Builds foundational world models for cybersecurity to represent complex system architectures as dense, multi-dimensional graphs. The platform uses these graph representations to identify exploitable attack paths and test them with automated red-teaming agents.
Mate Security (Israel): Investigates security alerts at scale using an AI-native security operations platform. It integrates with existing SIEM and security orchestration, automation, and response (SOAR) tools to map asset relationships, automatically triage incoming alerts, and minimize false-positive rates.
Nrdsnipe (Sweden): Builds an AI-driven security testing platform, Hedgehog, that automates internal network penetration testing. Deployed directly in customer networks, it uses planner and terminal agents to map assets and construct exposure-based knowledge graphs.
RIFFSEC (Poland): Delivers an early-warning threat intelligence and attack surface management platform tailored for the central European market. It monitors the dark web, Telegram channels, and code repositories to identify leaks, exposed credentials, and phishing campaigns.
TandemTrace (Spain): Augments security operations teams with autonomous AI agents that analyze raw telemetry to investigate alerts and hunt threats. The platform connects directly to existing data lakes and SIEM APIs to build human-readable context around security incidents.

Security infrastructure and specialized services

Netsec (France): Manages the entire IT and cybersecurity lifecycle for mid-sized organizations through an all-in-one platform delivered directly inside collaboration channels. It automates user onboarding, device management, and SaaS posture remediation from a single control plane.
Revelum (United States): Detects and dismantles deepfake-driven fraud and impersonation campaigns at scale. The platform uses vision models and classification engines to analyze social media advertisements, verify biometric identities, and automate domain takedowns.
Synqly (United States): Provides a unified connectivity platform and API management control plane that simplifies integrations between IT and cybersecurity tools. It normalizes data schemas and acts as a deterministic middleware layer to facilitate bidirectional data sharing.

By collaborating with global specialists, these startups are well-positioned to build a safer, more resilient digital infrastructure. The Gemini Startup Forum is a benefit of the Google for Startups Gemini Kit, packed with APIs, tools, training and technical resources to help startups scale with AI. You can learn more about the kit here.

The threat landscape is always evolving. To meet this challenge, we will continue our commitment to Google for Startups. Over the past four years, we’ve supported more than 50 cybersecurity founders, including Authologic, BforeAI, Build38, Cerby, Crowdsec, and Risk Ledger.

This year's cohort reflects the industry's transition from perimeter defense to autonomous AI agent security — emphasizing enterprise governance and the safe deployment of self-governing AI. Looking ahead, the integration of these technologies will help define the next generation of proactive digital defense.

Drive proactive security, prioritize risks with Google Threat Intelligence and Wiz ASM

Tue, 07 Jul 2026 16:00:00 +0000

Being more proactive continues to be a leading goal for security organizations. As AI accelerates the pace of vulnerability discovery and exploitation, organizations will rely on the personalization of their security investments to help prioritize their defenses.

To help you be more proactive by matching your real-world exposures with real-time adversary activity, we’ve begun integration efforts between Google Threat Intelligence and Wiz Attack Surface Management (ASM).

By connecting exposure and validated exploitable risks directly to real-time threat intelligence, we can help you detect and prioritize external-facing exploitable issues and uncover logic-driven vulnerabilities with AI scanning at the speed needed for today’s defenses. This allows you to shift to a strategy that prioritizes actions based on the real-world threats that pose the greatest risks to your organization.

Combining these two perspectives on threats can help you move from reactive maintenance to a proactive security strategy. In addition to detecting your exploitable exposures, you gain insight into which of those exposures are being actively targeted by adversaries.

We will continue to build towards native integration that will feed exposure data directly into the Google Threat Intelligence correlation engine. This automated connection will help you focus on the exposures adversaries are targeting in the wild, and use our real-time threat intelligence to prioritize remediation efforts and threat hunting activities.

Building a proactive security strategy

Google Threat Intelligence provides global visibility into how adversaries operate, tracking their infrastructure and campaign activity in real time.

Wiz ASM maps your external attack surface across cloud, AI, software-as-a-service (SaaS), and on-premises environments to reveal exposed assets like domains, IPs, and APIs. It scans for exploitable vulnerabilities, misconfigurations, and default credentials to validate exploitability. It also scans for and validates exposed secrets and sensitive data.

At the same time, the Wiz Red Agent scans exposures with AI to uncover complex, logic-driven vulnerabilities by reasoning about applications behavior.

The power of this combination lies in the ability to prioritize and hunt with confidence:

Prioritize based on real-world activity: With the incoming integration, exposure data feeds into the Google Threat Intelligence engine. This helps you spot the exposures that adversaries are currently exploiting, allowing your team to focus remediation efforts where they are needed most.
Understand attacker behavior: When a critical risk is flagged, we plan to provide behavior-based guidance alongside the alert. This details how an attacker typically acts after exploiting a vulnerability, using specific host commands or malware, giving your defenders the context they need to hunt for active footprints inside your network.
Discover complex vulnerabilities: The Wiz Red Agent uses AI to scan for logic-driven vulnerabilities, such as authentication bypasses, business logic flaws, and multi-step attack chains, helping you uncover risks that traditional scanners often miss.

Get started with proactive defense

This combined approach is designed to help you streamline your security posture by reducing the noise and focusing on the signals that represent real danger to your organization. To get started with Google Threat Intelligence and Wiz ASM today, contact your Google sales representative.

Shift into high gear with agents: Securing the software-defined vehicle

Mon, 06 Jul 2026 16:00:00 +0000

The automotive industry is at a pivotal crossroads as it hits the gas on adopting new technology. The era of the traditional connected vehicle has shifted into the age of the software-defined vehicle (SDV), notable for rapid innovation with many new capabilities delivered over the air.

By integrating AI and agents, the next generation of SDVs will be capable of turning raw telemetry into actionable insights in real-time, allowing for a fundamental rethink of how vehicles interact with their environment and their users. To better support and secure SDVs, Google Cloud and Valtech have partnered to develop Nexus SDV, a highly-scalable, AI-enabled connected vehicle platform built on Google Cloud. This modular, developer-friendly and open-source solution is designed to manage up to 100 million devices, and features deep integration with Android Automotive OS (AAOS) to streamline data flows and in-vehicle experiences.

We are proud to announce the first release of the Nexus SDV open-source core that showcases how it can reduce total cost of ownership through Arm-based compute and Bigtable, while providing a AI-native environment for building the next era of automotive intelligence.

AI-driven experiences with Nexus SDV

Nexus AI serves as the platform’s intelligent engine, transforming the vehicle from a passive data source into a proactive, agentic partner. Using Gemini models and Gemini Enterprise Agent Platform, Nexus AI can analyze complex telemetry in real-time to provide information for autonomous decision-making and hyper-personalized driver assistance, effectively acting as an intelligent agent that anticipates user needs.

Crucially, this advanced intelligence is paired with a focus on significant total cost of ownership (TCO) reduction. By using high-efficiency Arm-based compute and Bigtable-optimized data storage, the platform lowers the operational costs associated with processing massive data volumes. This modular, AI-native architecture ensures that manufacturers can scale their fleet intelligence rapidly without the prohibitive cloud and development expenses traditionally associated with next-generation vehicle software.

Cloud-native under the hood

The architecture of Nexus SDV is built on a modular, cloud-native foundation designed to bridge the gap between the vehicle edge and the data center. Deep compatibility with AAOS is the keystone of the close integration between the cloud and the vehicle, and will help ensure that high-fidelity telemetry is ingested and synchronized in real-time. This robust data loop allows Nexus AI to quickly push intelligent updates and services back to the vehicle.

By providing this developer-friendly, open framework, Nexus SDV enables manufacturers to manage the entire lifecycle of a SDV with the scalability and reliability of the Google Cloud ecosystem.

Architecture for Nexus SDV.

Defense in depth with Google Cloud Security controls

By building on Google's secure foundations, including secure-by-design and Zero Trust architecture, Nexus SDV supports the heavy lifting of compliance and threat protection. To achieve this, the Nexus SDV architecture implements a comprehensive, defense-in-depth security model across six key elements:

Mutual TLS (mTLS) and public key infrastructure (PKI)
Nexus SDV relies on cryptographic trust chains to authenticate vehicles before any data exchange can occur. The infrastructure uses Google Cloud Certificate Authority Service (CAS) to manage distinct CA pools (server, factory, and registration CAs), ensuring a highly available and secure root of trust.

Specifically, the registration server enforces registration by forcing clients to present a valid "factory-issued" certificate during the initial TLS handshake, extracting and parsing the certificate directly from the connection stream to definitively prove the vehicle's identity. During registration, the server performs Certificate Signing Request (CSR) validation sent by the vehicle before issuing a new operational certificate.

Identity and access management
The system uses identity brokering where Keycloak is deployed as the central OpenID Connect (OIDC) identity provider. Vehicles authenticate against Keycloak using their operational certificate via mTLS to receive a short-lived JSON Web Token (JWT).

For fine-grained access control, a custom NATS Auth Callout service provides dynamic subject permissions: It intercepts all messaging broker connection attempts, validates the Keycloak JWT using public JWK keys, and programmatically maps the vehicle's roles to specific NATS subjects.

For secure service-to-service communication, it uses Workload Identity Federation so pipelines exchange GitHub OIDC tokens for temporary Google Cloud access, removing static credentials, while GKE Workload Identity allows Kubernetes Pods to access backend services like Bigtable by binding Kubernetes service accounts to Google service accounts.

Security is reinforced through restricted IAM scopes, ensuring dedicated service accounts are provisioned with minimal permissions, such as the data API being restricted only to reading from Bigtable. Using VPC-SC, Organization policy constraints and Private Service Connect (PSC) in your deployment context also helps you achieve secure foundations.

Secret management
Nexus SDV relies on centralized secret management to protect sensitive information. All sensitive configurations, database passwords, and cryptographic signing keys are generated dynamically during Terraform infrastructure provisioning and locked inside Google Cloud Secret Manager.

A secret fetching during deployment is used to avoid baking secrets into application code and container images. Instead, services pull signing keys and credentials directly into memory only at runtime, minimizing exposure both at rest and in transit.

Network isolation
To enforce network isolation, the underlying computer infrastructure is heavily shielded. Nexus SDV runs on private GKE clusters where worker nodes have no public IP addresses, preventing direct internet exposure. Additionally, the Keycloak PostgreSQL database uses Cloud SQL IAM Authentication, which allows the Cloud SQL Proxy to connect securely using IAM roles rather than relying on static database passwords or managing IP allowlists.

Secure AI Framework
Google Cloud secures these advanced AI capabilities through a comprehensive, enterprise-grade framework that prioritizes data privacy, model governance, and safe execution, based on guidance from the Secure AI Framework (SAIF). With Gemini Enterprise Agent Platform, security and governance are natively embedded into the machine-learning lifecycle through capabilities, such as dedicated Explainability and Safety controls, continuous Evaluation and Monitoring, and secure model registries.

You can learn more about how we secure AI here.

Data API
Instead of allowing downstream applications and external clients direct access to data stores like Bigtable, Nexus SDV routes data retrieval through a custom Data API. This microservice acts as a secure abstraction layer that translates strictly, such as querying specific vehicle IDs, sensor data types, and predefined time windows, into heavily constrained Bigtable row-range scans and column filters.

By doing so, it serves as a secure gateway that enforces structured data access patterns.

Start your journey with Nexus SDV

Nexus SDV represents a new era of automotive intelligence, delivering an agentic, secure, and cost-efficient platform that empowers manufacturers to harness the full power of AI in an open-source framework. You can learn more about how we are redefining the software-defined vehicle here.

New IDC study: The business value of Mandiant Consulting

Wed, 01 Jul 2026 16:00:00 +0000

Security leaders are now expected to protect business growth and clearly articulate security value to their board of directors, in addition to managing risk. While translating technical defense into measurable financial returns can be challenging, Mandiant Consulting can help you bridge the gap.

Organizations that engaged with Mandiant Consulting reported an average annual benefit of $4.3 million, driving a 268% three-year ROI, with a payback period of just 4.1 months, according to a new IDC Business Value White Paper commissioned by Mandiant. IDC based these findings on its standard ROI methodology and qualitative and quantitative interviews of current Mandiant customers, applying standard financial models. The interviewed organizations are large, highly-complex environments with an average of $17.3 billion in revenue and 74,000 employees.

At Google Cloud, we strongly believe that security is a strategic business enabler that can directly impact your bottom line.

One healthcare organization interviewed by IDC reported that its partnership with Mandiant completely changed the dynamic of its commercial conversations. "Mandiant has enabled us to engage more confidently with customers and position our security posture as a market differentiator, with security now consistently ranking among the top three reasons clients choose us. It has also contributed to reducing our insurance costs by $50,000 per year,” said the healthcare organization.

Frontline threat intelligence in action

CISOs consistently struggle with internal resource constraints and skill deficits, and internal security teams rarely have the time to track every emerging threat group. Mandiant addresses this by distilling findings and delivering frontline threat intelligence and guidance derived from over 500K hours of global incident investigations last year.

Instead of trying to monitor everything, resource-constrained teams can focus their limited hours on the specific threats that are most relevant to them and likely to target their specific industry and build specific targeted defenses. A retail organization highlighted how working with Mandiant experts allowed them to actively defend against targeted campaigns, like those from the Scattered Spider cybercrime group.

"One of the most significant accomplishments from using Mandiant has been their ability to help us create detection use cases specific to Scattered Spider based on their industry knowledge. This has enabled us to monitor, detect, and neutralize related attacks, which is a key reason we have avoided incidents,” the organization told IDC.

To ensure detections are built on solid foundations, many organizations also use Mandiant to run deep technical audits across their identity infrastructure — including Active Directory, privileged account management, and multi-factor authentication (MFA). This independent verification provides crucial reassurance to leadership, an energy-sector organization told IDC.

"Mandiant provides external assurance that our cyberprogram is thorough and validated from a risk management perspective. Their validation and recommendations have helped us reinforce that messaging to our board. They are highly professional, risk aligned, and among the most trusted,” they said.

Quantifying the business and operational impact

By synthesizing customer experiences, IDC quantified the broader operational advantages seen, on average, by customers who worked with Mandiant:

59% greater preparedness to successfully address cyberattacks.
45% overall improvement in cyber-resilience.
36% more efficient security analyst teams, allowing internal staff to focus on more strategic, growth-oriented initiatives.

To learn more about how security is a business enabler, register for our July customer webinar.

_{Source: IDC Business Value White Paper, Sponsored by Google, The Business Value of Mandiant Consulting (Doc #US54605426-BVWP, July 2026)}

Google Cloud confirmed to offer a safer choice for EU public sector organizations with Dutch DPIA approval

Wed, 01 Jul 2026 16:00:00 +0000

At Google Cloud, we are committed to providing public sector organizations around the globe with cloud technology that is highly flexible, scalable, and built with market-leading standards for data protection, sovereignty, and security. We understand that for public sector organizations in the European Union, confidence in data protection is not just a preference — it’s a prerequisite.

Today, we’re excited to announce a major milestone that reinforces this commitment for Google Cloud.

Dutch government DPIA confirms strong privacy foundation for Google Cloud

We have successfully collaborated with SLM Rijk, the Dutch government's strategic vendor management agency, who completed their rigorous data protection impact assessment (DPIA) of Google Cloud.

This engagement confirms Google Cloud’s strong commitment to strengthening trust in its privacy posture across the Dutch public sector. Given that all the key points raised during the DPIA have been successfully addressed (see SLM Rijk’s summary here), and that their DPIA concluded that there are no known high data protection risks when the recommended measures are implemented, the Dutch central public sector is now officially enabled to use Google Cloud with a clear path from a privacy-assessment perspective.

Accordingly, we encourage Dutch central public sector prospects and customers to engage with us to learn more about Google Cloud.

More broadly, we believe this outcome provides a strong foundation for public sector organisations across the Netherlands and beyond, to confidently evaluate and adopt Google Cloud, unlocking modernization and digital transformation securely.

This achievement builds upon our strong track record in the region, including the successful completion of the Dutch DPIA on Google Workspace. This previous success affirmed the safe use of Workspace across the Dutch public sector and educational institutions. Together, these assessments demonstrate Google's continued commitment to helping public sector organisations meet their privacy, security, and compliance requirements while benefiting from the innovation and scalability of Google Cloud.

Continued support for all customers on their compliance journeys

We welcome independent assessments that help strengthen trust, transparency, and accountability. The Dutch government's DPIA process represents an important example of constructive collaboration between public institutions, independent experts, and cloud providers to advance privacy protections.

Google Cloud remains committed to helping customers meet their compliance obligations while providing secure, transparent, and privacy-conscious cloud services.

We will continue investing in privacy-enhancing technologies, transparency initiatives, and customer controls to support organisations across Europe and around the world.

We know first-hand that conducting DPIAs can be a complex task, and we remain firmly committed to helping our customers navigate DPIAs with resources at our comprehensive DPIA Cloud Resource Center.

Cloud CISO Perspectives: How Google Cloud Security uses AI internally

Mon, 29 Jun 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for June 2026. Today, we’re discussing how we use AI to chart a path to autonomous software development lifecycle security.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7fad5f3f4580>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Cloud CISO Perspectives: Our path to autonomous SDLC security

By Chris Betz, CISO, and Ruchi Shah, senior director, Security Engineering, Google Cloud

Chris Betz, CISO, Google Cloud

AI has upended the economics of exploiting vulnerabilities, effectively erasing the traditional patching window. To survive this new reality, security requires an autonomous defense.

To counter machine-speed, AI-driven threats, we’ve worked hard to transition Google Cloud’s security posture to an autonomous, proactive model. By embedding specialized AI agents directly into our software development lifecycle (SDLC), we’ve created automated guardrails that protect code at a scale and speed unreachable by human teams — and we’re taking steps to make those same guardrails widely available.

Ruchi Shah, senior director, Security Engineering, Google Cloud

How we designed agentic, secure SDLC architecture

Google Cloud deploys modular, interconnected AI agents across every stage of the software lifecycle to continuously harden products from code ingestion to production.

1. Design, review, and gate

Historically, launch intakes and threat modeling were manual bottlenecks. Today, Google Cloud engineering teams route product launches through an agent-based security review pipeline.

Agents cross-reference designs against a continuous control catalog of more than 200 rigorous security requirements. High-risk indicators are automatically triaged and flagged for human engineering intervention, while a dynamic product dossier updates in real-time to replace static threat models.

Google Cloud has embedded agentic capabilities across the entire SDLC flow to continuously harden products end-to-end.

2. Centralized AI code scanning and the Mantis framework

Naive, decentralized AI code scanning suffers from sloppiness, frequently hallucinating bugs and yielding true-positive rates under 7%. To solve this, we built Mantis, our core multi-agent orchestration framework designed specifically for scalable, context-aware repository analysis.

The core skills at the heart of Mantis are now open source to demonstrate the fundamental concept. We have a more full-fledged version running internally and securing our customers.

Mantis eliminates brute-force code ingestion by constructing a hierarchical security summary tree. By condensing individual files into directory and root-level summaries, Mantis reduces token overhead by over 85% while preserving critical structural context across massive repositories.

The architecture relies on a highly-coordinated workflow across new agents and existing technologies:

Strategist agent: Evaluates the high-level code structure, threat models, and dependency graphs to isolate risky architectural patterns, establishing a prioritized global plan of targeted investigation tasks.
Research agents: Acting as specialized domain investigators, these agents use internal code searches to drill into raw source files, examining data tracking, control flows, and sanitization logic.
Deduplicator, reviewer, and critic agents: Sanitize findings to filter out noise and eliminate false positives.
Reproduction sandbox: Automatically runs AI-generated proof-of-concept exploits in an isolated, emulated environment to verify real-world exploitability before alerting developers.

3. Self-healing fuzz testing

While code scanning provides breadth, dynamic fuzz testing uncovers deep runtime vulnerabilities. However, writing and maintaining fuzz harnesses are often a significant engineering bottleneck.

Our autonomous, multi-agent engine eliminates manual intervention:

Context and Drafting agents synthesize product logic and existing unit tests to author initial fuzzing harnesses.
Building and Testing agents execute the code and feed real-time compiler and linker errors into a Hallucination Cleaner agent, which acts as an automated mechanic to repair broken dependencies and build configurations.
Quality Analyzer agents monitor runtime execution, actively adjusting inputs to bypass code blockers and penetrate deeper into complex, stateful APIs.

4. The unified AI patching pipeline

Finding thousands of vulnerabilities at scale can create a dangerous remediation backlog without proper planning. To close the exposure window, our discovery tools route findings directly into an autonomous remediation pipeline:

The Reproduce agent replicates the crash in the sandbox.
The Bug Context agent maps the failure execution path.
The Patch agent generates a targeted code fix.
The Evaluation agent runs a rigorous regression loop (that re-compiles code and executes tests) to ensure the patch is safe. Only fully-validated fixes are submitted to a human reviewer.

5. Autonomous and secure posture management

Post-launch, we maintain security integrity with an autonomous security posture management (ASPM) system. By converting our security standard catalog into programmable skills files, the ASPM system continuously checks production systems for configuration drift, automatically triggering agentic remediation when a violation occurs.

Continuous augmentation via self-reflection

Stateless AI systems repeatedly fall into the same logical traps, such as attempting to fix bugs inefficiently and hallucinating about non-existent code. Our framework solves this by introducing a post-hoc self-reflection loop. After a workflow concludes, a dedicated reflection agent analyzes execution logs, tool histories, and human feedback.

Successful trajectories and design patterns are permanented into a global knowledge store. When future agents spin up, this intelligence is injected directly into their context window, creating a compounding-interest effect on our security engineering. This approach has helped us to improve both the vulnerability fix success rate and efficiency.

Moving toward immune software

Google Cloud's internal journey demonstrates that protecting software at AI-scale requires a fundamental paradigm shift from human-dependent checklists to proactive multi-agent orchestration. By pairing open-source tooling like Mantis with autonomous, self-healing execution loops, we are pioneering a future of "immune" software development — where applications continuously discover, validate, and patch their own weaknesses in real-time.

You can learn more about how we use Mantis and other tools to find and fix vulnerabilities at machine-speed here.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7fad5f668460>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=C1wEjzOHh7Y'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Verifiable trust in the AI era: What’s new in Confidential Computing: To help further strengthen verifiable privacy in cloud AI deployments, here’s our latest Confidential Computing innovations. Read more.
Choice, compliance, and collaboration: Europe’s path to open digital sovereignty: Our Sovereign Cloud solutions are designed to meet Europe's tiered compliance requirements at every level. Read more.
How AI Is rewriting the SecOps playbook: With adversaries operating at machine speed, defenders must prioritize speed, automation, and continuous decision-making. Read more.
Google named a Leader in IDC MarketScape SIEM 2026 Vendor Assessment: We are proud to announce that Google has been named a Leader in the 2026 IDC MarketScape for worldwide SIEM platforms. Read more.
Announcing the Wiz Runtime Sensor for Windows: Wiz pairs real-time threat detection with a memory-safe architecture that scales efficiently to protect your essential cloud infrastructure. Read more.
New VPC Service Controls updates can help secure agents: Designed for agentic workloads, new capabilities in VPC Service Controls can help establish a network-level, destination-based perimeter. Read more.
Bug hunting on Gemini Spark: Gemini Spark brings a persistent agent to the Gemini App. Learn how to approach security testing for this new paradigm and focus on high-impact bugs. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7fad5f6687c0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

China-nexus threat actor targets medical community for cross-sector research: Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting the North American academic, medical, and military research community, that went undetected for more than a year. Read more.
ShinyHunters targets education sector with Oracle PeopleSoft exploit: Mandiant and GTIG have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. Read more.
Zero-day exploitation in Cisco Catalyst SD-WAN Manager: Mandiant has identified a threat actor targeting a vulnerability in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: How Google Cloud uses LLMs to defend billions of users: Google Cloud CISO Chris Betz discusses AI Threat Defense, and emphasizes shifting security practices earlier in the development lifecycle through human-AI collaboration. Listen here.
Cloud Security Podcast: To couple or decouple SIEM: Alex Hurtado, director, Detection Engineering, Scanner, and Christopher Witter, DNR lead, Dropbox, debate the merits of centralized versus decentralized SIEM architectures. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Securing agentic AI with perimeter guardrails: What's new in VPC Service Controls

Fri, 26 Jun 2026 18:00:00 +0000

As enterprises scale autonomous AI agents into production, enabling safe innovation requires robust architectural guardrails. AI agents connect across tools and datasets, so it’s essential to establish clear network-level boundaries for comprehensive data protection.

To help organizations confidently deploy these workflows, we recommend VPC Service Controls (VPC-SC) to establish an essential network-level, destination-based perimeter. Today we’re announcing several new capabilities specifically designed for agentic workloads.

What's new in VPC Service Controls

Designed to enhance AI security, the new capabilities we’re announcing today strengthen boundaries enforced by VPC-SC.

The capability updates include:

Agent identity in directional rules: Enforcing least-privilege access requires treating agents as first-class identities. You can now add agentic identities directly to service perimeter ingress and egress rules using standard Identity and Access Management (IAM) principals.

A single principal maps to an individual agent, while a principalSet maps to a broader collection of agents. PrincipalSets lets administrators apply consistent, auditable access policies across agent fleets. If an agent is compromised, you can immediately revoke its access at the network perimeter.

Granular control with model context protocol (MCP) attributes: As MCP becomes the standard integration layer for agentic systems, the ability to enforce policy at the tool level is critical. VPC Service Controls now support conditional access rules based on specific MCP attributes, including mcp.toolName, mcp.method, and mcp.tool.isReadOnly.

For example, you can grant an agent read access to a Workspace MCP server while explicitly denying its ability to send emails.

Securing the Gemini Enterprise Agent Platform: The Gemini Enterprise Agent Platform provides a comprehensive foundation for production-grade agent deployments. VPC Service Controls is now natively integrated with Agent Platform. When you include Agent Platform as a protected service within a VPC-SC perimeter, the system automatically blocks all public internet access to the Agent Platform instance — enforcing a secure boundary without additional configuration overhead.

"At Mercado Libre, VPC Service Controls serve as an essential, foundational layer of our security architecture. By building a strong perimeter enforcement across hundreds of Google Cloud projects in our organization, we established robust network-level security controls with VPC-SC, ensuring all our data remains protected in our cloud environment," said Juan Pablo Boschi, project lead at Mercado Libre.

Defining a layered approach to enterprise AI security with VPC-SC

Securing an autonomous agent requires a layered approach. Identity, network, and resource controls each target a distinct threat vector.

Identity controls: IAM and Principal Access Boundaries (PAB) focus on "who" can access specific resources. By enforcing strict least-privilege principles for agent identities, you help ensure that autonomous workloads only have the permissions necessary for their specific objectives.
Network controls: Next-generation network firewalls and VPC Service Controls define a robust data perimeter on top of your infrastructure, governing the flow of information across boundaries and preventing data exfiltration.
Resource controls: Organization Policy and other resource-level guardrails set broad, immutable constraints on how resources can be configured and used, preventing risky configurations by default.

While identity and network controls effectively secure the front door, VPC Service Controls provide a critical destination-based defense. In the probabilistic world of autonomous agents, VPC-SC is the control that focuses on the "how” and "where" of the agent’s network and operations, in addition to the “who”.

Defending against the unique attack vectors

Unlike traditional applications, an AI agent's input can inadvertently prompt it to execute an unintended command or action. If an agent is successfully compromised — whether driven by malicious prompts, tool manipulation, or malicious insider commands — VPC Service Controls serves as a critical network safety net.

To illustrate how this network boundary defends against industry-standard risks as mapped by the OWASP Top 10 for LLM Applications, here are three real-world threat vectors where VPC Service Controls can help supplement identity-based controls to prevent data exfiltration.

Exfiltration prevention via indirect prompt injection (OWASP ASI01): A malicious actor could attempt to embed a hidden prompt asking an agent to summarize internal data and transmit it to an unauthorized user. If the hijacked agent has IAM permissions, IAM detects no anomaly.

However, when the agent tries to send that data to an external webhook, VPC-SC blocks the API-layer transfer because the destination is outside the defined perimeter.

Guardrail for tool misuse (OWASP ASI02, ASI08): Prompt hijacks can lead agents to chain tools maliciously, such as sending internal directory data to an external service. By enforcing a VPC-SC perimeter around sensitive assets, you prevent misbehaving agents from bridging data across isolated trust zones.
Neutralizing insider threats (OWASP AS103): Attackers can command a data-processing agent to perform a direct cloud-to-cloud copy from a BigQuery dataset to an unauthorized project. While network firewalls see legitimate HTTPS traffic to BigQuery, and IAM sees an authorized service account, VPC-SC evaluates the destination resource. Since the destination project is outside the enterprise perimeter, the system immediately denies the API request.

VPC Service Controls acts as a perimeter to block data exfiltration attempts from a compromised agent, even if the agent has valid IAM credentials.

Data protection for the autonomous agent world

Perimeter security has evolved from a recommended best practice in the deterministic application and workload centric age to an absolute requirement for the era of autonomous AI agents. VPC-SC provides the necessary control over data movement that IAM cannot address alone.

In an era where agents interpret prompts as code, VPC-SC becomes the mandatory safety net for enterprise data. Pairing the mapping capability of IAM with the rigid data perimeters of VPC-SC lets organizations securely build agentic innovation while maintaining an absolute guardrail against exfiltration.

To learn more, you can explore VPC-SC resources here.

Verifiable, private AI: Google Cloud expands Confidential Computing frontiers

Tue, 23 Jun 2026 16:00:00 +0000

Protecting sensitive data used with AI is a critical part of our commitment to providing advanced and secure cloud infrastructure. Confidential Computing cryptographically protects data in use in hardware-based Trusted Execution Environments (TEEs) with verifiable data integrity.

We are thrilled to share our latest Confidential Computing innovations across our hardware ecosystem that help further strengthen verifiable privacy in cloud AI deployments.

Confidential AI at global scale

By scaling our Confidential AI capabilities globally, we help ensure that AI inference and fine-tuning workloads can run with enforceable privacy guarantees.

Democratizing Confidential AI: Confidential G4 VMs with NVIDIA RTX PRO 6000 Blackwell GPUs in preview

We are excited to announce a landmark moment for accessible Confidential AI at global scale: Confidential VMs and Confidential GKE Nodes on the accelerator-optimized G4 machine series, featuring NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs.

What makes this a game-changer is its global scale and flexibility. Confidential G4 is available in every Google Cloud region that the standard G4 is available, across multiple consumption models including On Demand, Reservations, DWS Flex Start, and Spot/Preemptible.

"As organizations scale AI across multiple infrastructure environments, maintaining privacy and control over data and execution becomes increasingly challenging. Google Cloud Confidential G4 VMs powered by NVIDIA RTX PRO 6000 Blackwell GPUs are a meaningful addition to the expanding Confidential AI infrastructure ecosystem. As AI workflows now span agents, data sources, and infrastructure boundaries, Super Protocol provides a consistent Confidential AI operating model across Google Cloud Confidential VMs, other clouds, and on-premises environments — abstracting away confidential computing complexity and allowing teams to focus on AI outcomes," said Yulia Gontar, COO, Super Protocol.

Powered by 5th Generation AMD EPYC Turin CPUs leveraging AMD SEV, the G4 machine series with NVIDIA RTX PRO 6000 Blackwell GPUs activates robust hardware-based security. This architecture helps ensure that sensitive data is protected during processing inside the TEE, while also encrypting data as it travels between the CPU and GPU.

"GCP's Confidential G4 VM was the obvious choice for Vertebrae because privacy and security are non-negotiable for our customers. Our product processes sensitive work discussions, so we need to support hardware-signed attestation that both CPU and GPU are running in a trusted execution environment. Using confidential computing on Google Cloud lets us deliver the frontier of AI privacy in the cloud," said Andy Qin, CEO, Vertebrae.

With Confidential G4, you can unlock AI inference, fine-tuning, HPC, and use cases involving highly restricted data, sensitive models, or private prompts, all with minimal performance impact. Get started with Confidential G4 VMs and Confidential G4 GKE Nodes.

Enabling end-to-end private inference: Open-source Prompt Encryption SDKs

Even as we make Confidential AI accessible, we understand that protecting sensitive data in AI workloads goes beyond securing the model execution environment. The prompts and responses themselves can contain highly-confidential information. To provide cryptographic protection for the entire inference lifecycle, we are happy to announce the open-source launch of our Prompt Encryption SDKs, now available on GitHub.

This toolkit helps you establish an end-to-end secure channel for your AI inference workloads, ensuring that prompts are cryptographically protected from the moment they leave the client until they are processed in the TEE; model responses are similarly protected all the way back to the client.

Prompt and response encryption using Prompt Encryption SDK.

The Client SDK is integrated into the client application and works in tandem with the Server SDK integrated into the inference server running in the TEE. Once the SDKs have been used to establish an attested TLS session, the client can be confident that the server is running an authorized workload within a verified Confidential Computing environment.

The client app can then send encrypted prompts to the inference server, knowing that only this server will be able to decrypt and process it in the TEE. Once the server has a response ready, it sends it back via the same encrypted channel to the client app.

You can get started today with the GitHub repository and the Codelab.

Enabling Apple Private Cloud Compute on Google Cloud

Our commitment to privacy is deeply exemplified by our collaboration with Apple to expand Private Cloud Compute (PCC) on Google Cloud.

We are proud to collaborate with Apple to extend Apple’s privacy and security commitments to PCC on Google Cloud. Our platform supports Apple’s PCC privacy commitments with a layered security approach built upon Google Cloud’s infrastructure. This includes leveraging Google Cloud Confidential Computing with Intel TDX, NVIDIA Confidential Computing with NVIDIA Blackwell GPUs, our Titanium security architecture with the Titan chip, and a co-engineered open-source host stack to ensure verifiable transparency.

Together, these technologies help Apple PCC on Google Cloud meet stringent requirements for data protection and user privacy. To dive deeper into this collaboration, read our blog post: Powering the next era of Confidential AI.

Advancing confidential foundations

Google Cloud is committed to making Confidential Computing capabilities broadly available across our infrastructure. Our goal is to integrate hardware-based security features deeply into our foundational compute offerings, allowing customers to enhance data protection without compromising performance or operational flexibility.

Bringing Intel Trusted Domain Extensions (TDX) to the C4 machine series

Confidential VMs with Intel TDX on the C4 machine series will be available in preview soon.

Powered by the latest 6th Generation Intel Xeon processors, this integration offers a significant leap in compute density and performance for data-intensive workloads. By using Intel TDX, C4 instances create hardware-isolated Trust Domains (TDs) that protect sensitive applications and data from the underlying host and hypervisor.

This architecture provides confidentiality and privacy while enabling remote attestation so you can cryptographically verify the environment before processing sensitive data. Best of all, you can turn Confidential Computing on with a few clicks and no code changes.

Expanding Live Migration capabilities

Running mission-critical production environments requires high availability and continuous uptime, even during scheduled cloud maintenance.

Live Migration on C3D-based Confidential VMs is now generally available. This capability allows Google Cloud to perform planned hardware maintenance without interrupting workloads or exposing encrypted guest memory, ensuring seamless uptime for long-running confidential applications.

Enhancing trust and collaboration: Innovations in Confidential Space

Confidential Space is a Confidential Computing environment designed to enable secure multi-party computation and data sharing. It allows organizations to collaborate on sensitive data, such as for joint machine learning or data analytics, without revealing the data to each other or to Google Cloud.

“Google Cloud Confidential Space allows us to provide financial institutions with security guarantees similar to or better than an on-prem service," said Olivier Richaud, vice-president, Platforms and Site Reliability Engineering, Symphony. "Transitioning such security and privacy-sensitive customers to a cloud-based SaaS service would have been impossible without the power of Confidential Computing.”

A key design principle of Confidential Space is to remove the workload operator from the trust boundary, providing cryptographic assurance that only the authorized, attested workload can access the data.

“As AI systems increasingly act on behalf of consumers in financial services, trust in how data is processed becomes paramount. At Sahamati, we see Google Cloud Confidential Space as a foundational technology for enabling privacy-preserving AI in India’s Open Finance ecosystem, creating the trust needed for innovation while maintaining strong security and accountability guarantees,” said Kiran Gopinath, chief innovation officer, and Head, Sahamati Labs.

Our new advancements for Confidential Space provide greater flexibility and stronger assurances. Key updates include:

Independent Verification: Integration with Intel Trust Authority

We are pleased to announce that Intel Trust Authority (ITA) is now generally available as an independent attestation verifier service for Confidential Space.

This integration enables organizations to independently verify the integrity of the Confidential Space environment using Intel’s hardware-rooted attestation before encryption keys are released to workloads. By decoupling attestation verification from the cloud service provider, customers benefit from enhanced transparency, stronger assurance, and a more robust trust model.

"With Confidential Computing woven into our core infrastructure, Google Cloud and Intel are making hardware‑rooted security and independent attestation part of the default fabric of modern compute. From Intel TDX‑powered C4 Confidential VMs running production workloads, to Confidential Space with Intel Trust Authority — now generally available — enabling verifiable multi‑party collaboration, customers can now encrypt, verify, and scale their most sensitive AI and data workflows without rewriting applications or compromising performance, even in the most demanding regulatory environments,” said Anand Pashupathy, general manager and vice-president, Intel Product Assurance and Security (IPAS), Intel Corporation.

Accelerating secure collaboration: Confidential Space with H100 GPU support

To power secure multi-party AI and machine learning, Confidential Space support for NVIDIA Hopper GPUs is now generally available. This can help multiple parties pool their data for training and inference within a Confidential Space environment, using the power of Hopper GPUs, while ensuring that their individual data remains protected from other participants and from Google Cloud.

Confidential Space unlocks use cases like federated learning on sensitive datasets, and building joint models without centralizing data.

“Confidential GPU support in Google Cloud Confidential Space removes one of the biggest barriers to adopting secure AI: the tradeoff between protecting sensitive workloads and achieving production-grade performance," said Adi Hirschtein, VP Product, Duality. "For Duality customers in healthcare, financial services, and government, this enables federated learning, confidential AI, and encrypted RAG workflows to run on sensitive data at scale while keeping data and models protected throughout processing.”

Next steps

Confidential Computing is becoming an essential layer of cloud computing in the AI era. Explore our expanding portfolio of Confidential VMs, accelerated hardware, and open-source tools to see how you can enable secure collaboration and private AI innovation within your organization.

To learn more, join us at the Confidential Computing Summit on June 23 and 24, 2026.

Choice, compliance, and collaboration: Europe’s path to open digital sovereignty

Thu, 18 Jun 2026 07:00:00 +0000

The European Commission’s Tech Sovereignty Package comes at a defining moment for the continent's digital future. European competitiveness and security are top of the agenda for European business, institutions, and citizens, and a significant investment in European digital capacity is needed to deliver those goals. In that context, it is understandable that Europe is considering how to boost the European Union digital footprint from chips, to cloud adoption, to AI data infrastructure.

The European Commission’s strategy is to be grounded in "openness, partnership, and fair competition." Indeed, the package contains bold measures consistent with these principles on interoperability to address vendor lock-in and an open source strategy for the public sector, as well as on more rapid data center deployment.

We will work cooperatively with the EU institutions providing our best knowledge about how to achieve these stated objectives in practical terms. To that end, we believe certain elements of the Cloud and AI Development Act (CADA) should be changed to avoid unintended market isolation, ensuring that trusted global partners can continue to support Europe’s security and scaling goals under a framework of true openness.

Our approach to sovereignty, developed over many years, is grounded in delivering tangible, technical, and verifiable control and open choice, while investing in the growth and security of Europe’s digital infrastructure — consistent with what we understand to be the goals of this strategy.

We have engineered a comprehensive menu of Sovereign Cloud solutions, designed to meet Europe's tiered compliance requirements at every level. From standard public cloud configurations with strict European data boundaries to independently operated regional cloud services to fully air-gapped solutions for the most sensitive public-sector operations, we ensure that compliance never requires sacrificing technological excellence.

Through our deep “Made with Europe” collaborations with regional champions — including S3NS in France; Thales, the Schwarz Group, and T-Systems in Germany; PSN in Italy; Clarence in Luxembourg; and Telefónica in Spain — we are actively delivering the operational resilience and jurisdictional controls designed to meet the highest regulatory standards of existing sovereignty frameworks at national level.

Across our partner-led sovereign solutions, the S3NS offering in France has been qualified to meet SecNumCloud 3.2, Europe’s highest sovereignty regulatory bar. Our partners Clarence and S3NS, together with Mistral, offer services that have been approved by the EU Directorate-General for Digital Services (DIGIT) for use by EU Institutions who have sovereign cloud needs. We believe this is what constitutes a true trusted partnership and encourage the Commission to follow this existing path, which is already meeting sovereign expectations across Europe today.

1. Refining sovereign certification

A primary concern within the CADA proposal is the design of the Union Assurance Levels (UALs). While harmonizing sovereignty criteria across member states is a constructive step, criteria at each of the four UALs would limit or exclude global providers, regardless of the security mitigations they offer.

Regulations should create space for innovative and effective technology approaches to sovereign control, instead of rigid geographic criteria that sacrifice the potential to have control without undue disruption to global supply chains.

We understand and support the data sovereignty and extra-territorial risk-mitigation priorities of European policymakers. Through capabilities like Cloud External Key Manager (EKM), one of the tools within our suite of sovereign solutions, Google Cloud allows customers to maintain their encryption keys outside of Google's infrastructure. This control creates a technical barrier to unauthorized access to unencrypted data by third parties without the explicit consent and awareness of the customer.

The EU has already designed an alternative, more balanced model in the proposed Industrial Accelerator Act. This framework has the potential to successfully maintain collaboration with trusted non-EU partners under a default presumption that trusted partners can operate as EU origin, underpinned by robust global trade rules and strong back-stop powers. We urge co-legislators to apply a similar philosophy to CADA.

2. Promoting interoperability, combating vendor lock-in, and reforming procurement

Sovereignty must empower end-users with more choice, not less. A healthy European digital ecosystem requires open foundations that prevent vendor lock-in, restrict choice, and drive up costs.

We strongly support CADA's goal to foster an open, interoperable cloud ecosystem. To make this meaningful, we believe that the policy must align with a commitment to openness across every level of the digital stack — infrastructure, models, and applications.

Our own approach is built on this foundation: We offer open, portable infrastructure with no data transfer exit fees, we champion open AI models like Gemma, and we support open-standards applications. Our stack-wide open approach is designed to help European enterprises build, migrate, and scale without friction.

Yet organizations can’t maximize the benefits of an open approach because restrictive licensing practices lock customers into a single ecosystem. To restore true choice, we advocate for three straightforward reforms: allowing users to move their software licenses freely, ensuring fair pricing for legacy software, and guaranteeing that software runs equally well on any cloud platform.

3. Building sustainable, open infrastructure for Europe's AI future

Physical compute infrastructure is the bedrock of digital sovereignty. While we support the ambitions of the Chips Act 2.0 to invest €30 billion in European semiconductor research and development, we believe that this investment is just as important as establishing regulatory rules that attract large scale investments in compute infrastructure.

To help achieve that goal, we recommend the measures outlined below. As a long-standing investor in European data infrastructure, operating 13 European cloud regions and deepening that commitment with recent investments in Germany, Belgium and Sweden, we hope to see a policy that leverages the pace and scale of committed global investors like us.

We welcome the introduction of "special project" status to streamline permitting, grid access, and power purchase agreements (PPAs) in designated zones. To ensure these measures succeed, we support:

Prioritizing fast-track permitting benefits for highly sustainable infrastructure projects.
Aligning national sustainability criteria with the upcoming EU-wide rating scheme, ensuring it does not penalize energy-efficient technologies like water cooling.
Ensuring that these acceleration zones do not artificially constrain the geographic location of new sites, and extending supportive grid connection measures to viable data centers operating outside of designated zones.

The path forward: Made with Europe

As ministers prepare to gather for the upcoming Council Summit, Europe has a historic opportunity to build a resilient, competitive, and truly open digital future.

By championing open-source software — from our contributions to Kubernetes, Chromium, Android, TensorFlow, and open AI models like Gemma — and by co-engineering solutions with Europe's industrial leaders, we are proving that global innovation and European values can be furthered together.

We look forward to collaborating with Member States, European policymakers and our regional partners to ensure that the final Tech Sovereignty Package fosters local economic growth, safeguards national security, and keeps Europe at the cutting edge of global AI innovation.

From AI potential to agentic reality: Driving the UK’s next chapter

Wed, 17 Jun 2026 08:00:00 +0000

The United Kingdom, and London in particular, continues to be one of the great hubs for AI development in Europe and the world. We’re home to Google DeepMind, of course, as well as significant AI unicorns — and Google Cloud customers — like Ineffable Intelligence, which is today announcing an important partnership with us.

A year ago, we joined you for the London Summit to showcase the vast potential of generative AI, including a major investment in upskilling the UK civil service. Today, as we welcome our partners once again to the historic vaults of Tobacco Dock, that potential has become an industrial-scale reality. In my conversations with leaders across both Whitehall and The City, the focus has moved from chatbots and media experiments to full-production execution. This is the moment of the agentic enterprise, where we shift from systems that simply chat with us to systems that can reason, plan, and execute multi-step workflows.

This transition is the cornerstone of the UK’s projected £400 billion economic boost from AI by 2030. At Google Cloud, we are the only provider offering the full integrated stack — custom silicon, frontier models, and planet-scale infrastructure — required to turn the Agentic Enterprise into a reality.

The new frontier of British enterprise and research

The banking sector is a key proving ground for this shift. And HSBC, one of the largest and most important financial institutions in the world, is showing the way. Today, we’re announcing a multi-year transformational partnership with HSBC to accelerate AI adoption across HSBC’s products and services globally. This new collaboration will further accelerate the shift towards AI-enabled ways of working across HSBC’s global operations.

HSBC will work with Google Cloud and Google DeepMind engineering teams to collaborate on new AI-powered tools and programmes, with access to Google’s latest agentic AI capabilities – including Gemini models and the Gemini Enterprise Agent Platform. The initial delivery focus on three areas: hyper‑personalised wealth management support, stronger financial crime risk management, and AI tools to enhance frontline/relationship manager client service

UK startups also continue to break new ground with technology, and AI in particular, as demonstrated by the work of frontier labs like Ineffable Intelligence. The company, which launched earlier this year, has chosen Google Cloud as its preferred cloud partner, utilizing Google’s full stack of AI-optimized hardware and tools to build and train Ineffable’s first generation of foundational models.

Led by David Silver, a former Google DeepMind researcher who was instrumental in the AlphaGo project, Ineffable Intelligence is taking a unique approach to AI development. The team are building systems that learn primarily through their own experience through reinforcement learning, instead of relying on the large-scale human-generated datasets behind language models. The ambition is to create a “superlearner” that develops knowledge through trial and error. This year, Ineffable Intelligence set a record for a European seed funding round of $1.1 billion, and now Ineffable Intelligence will support its training work by deploying one of the largest clusters of A5X, powered by the NVIDIA Vera Rubin NVL72 platform on Google Cloud, delivering massive computational scale.

To move from experimentation to true industrial production, businesses need more than just models; they need a roadmap. To help show them the way, we’re expanding our partnership with Deloitte, which will open a new AI Studio at its London campus. Developed in collaboration with Google Cloud, the studio will help British organisations move beyond AI experimentation to deploy autonomous, action-oriented AI systems at scale.

Deloitte is also committing to upskill 1,000 members of its UK AI and data workforce on Gemini Enterprise. This certification program will ensure that Deloitte’s AI and data engineers’ are equipped with the technical expertise to implement Google’s most advanced agentic architecture, providing UK clients with one of the largest pools of certified AI talent in the region.

Building a future-ready public sector

The blueprint for a modern digital government requires moving away from rigid legacy contracts toward agile, AI-driven public services. In collaboration with the Ministry of Housing, Communities and Local Government (MHCLG), the i.AI incubator, Google Deepmind, and Faculty, we are delivering tangible public sector reform and tools for reinvention that directly support the national goal to "get Britain building."

Agencies like MHCLG are already using a tool called Extract which was built using Google technology to help transform planning processes by reducing document processing times from two hours to just two minutes. Simultaneously, we are supporting trials of an AI planning tool — co-created with local planning authorities in Barnet, Dorset, and Camden — which aims to cut decision times for everyday applications by 50%. Furthermore, the Department for Transport (DfT) is utilizing Gemini to streamline public consultation analysis, a move projected to save £4 million annually.

Innovation on this scale also requires a secure, sovereign foundation. That is why Google Cloud is working to strengthen our UK data residency commitments, including measures like making Gemini 3.5 Flash, which features in-country AI processing, available by late June 2026 for sensitive sovereign use cases. We are giving British organizations the confidence to innovate within strict compliance boundaries.

To help keep businesses safe from the challenges posed by bad actors using AI and other digital threats, we also recently announced a comprehensive AI-powered cybersecurity platform — Google AI Threat Defense — which combines Wiz, Mandiant, Gemini & CodeMender to find, fix, and protect our customers from vulnerabilities.

Proven impact from the high street to public service

Autonomous agents are no longer a future prospect; they are delivering value across the UK economy today. Our work with THG Ingenuity, an ecommerce solutions provider, has delivered an 8x higher conversion rate via its AI Shopping Assistant. Starling is similarly empowering customers with "spending intelligence" tools for instant habit analysis around purchases and expenses. And Rightmove, has launched a beta version of an AI-powered conversational property search, built with Google’s Gemini models, enabling users to search for homes in their own words.

The breadth of this impact is visible across every sector: Kingfisher is pioneering retail-specific agentic applications; Openreach is driving field service optimization in telecommunications; andUnilever is using AI at scale across the entire value chain to drive growth and build desirable brands in the new era of consumer goods.

Meanwhile, VMO2 is streamlining complex data operations; Vodafone is executing a $1 billion partnership to redefine network performance; and WPP is integrating Gemini across creative workflows, whether that's generating high-fidelity campaign assets at speed and scale, powering AI agents, or training robotic camera operators.

Empowering the engine of growth for small to medium businesses and startups

The true measure of Britain’s AI success lies in its small and medium enterprises and startup ecosystem. Our AI Works research highlights a pivotal moment: AI has the potential to boost productivity for small and medium enterprises by 20% and unlock £198 billion in output for the UK economy. With 56% of smaller firms already seeking guidance, we have launched the AI Works for Britain upskilling initiative to ensure no business is left behind.

We also continue to foster the next generation of British unicorn startups through our ongoing partnership with Tech Nation at the London AI Hub. This sustained commitment ensures founders have the resources and community needed to scale, and this September, we will further this mission by hosting the Gemini Startup Forum: Cybersecurity in London to help startups build secure-by-design AI applications.

The Model Garden at Platform 37

Our belief in the UK’s potential is reflected in our physical footprint, too. We are continuing to invest in the UK's digital infrastructure to support growing demand: Our state-of-the-art data center in Waltham Cross launched in September 2025, a key part of our two-year, £5 billion investment to help power the UK's AI economy. And earlier this year, we opened our new office in London in Kings Cross, Platform 37, along with plans for The AI Exchange, a new public space dedicated to deepening understanding of AI.

Building on this momentum, we are excited to introduce The Model Garden at Platform 37, launching in the fourth quarter of 2026. This London-based hub is far more than a physical space; it serves as a strategic investment designed to fundamentally elevate how we engage with our most important customers. Blending the timeless aesthetics of a classic English garden with immersive, high-tech innovation — from living digital walls to a three-story atrium — The Model Garden acts as a physical marketplace for our best ideas.

The blueprint for the agentic enterprise

For UK businesses, civic leaders, and organizations to continue to lead in the AI moment, they must not only rethink the technology they use but also fundamental aspects of how we work. As we support thousands of organizations and millions of teams here and around the globe, we see three core strategies helping achieve success with AI:

Culture: We must reimagine our organizations for the future. True transformation means getting teams excited, enabled, and equipped to work with AI agents in completely new ways. It is about human-AI collaboration, not just automation.
Responsibility: We must build with safety and security in mind from day one. Protecting your users, your customers, and your brand is paramount. Our frontier models are built on a foundation of rigorous AI principles and secure-by-design infrastructure.
Sustainability: In an era of rising compute demands, we must scale in a way that is both financially viable and positive for our planet. At Google, we are committed to carbon-free energy 24/7, ensuring that the UK’s AI growth does not come at the cost of our climate goals.

Architecting the future together

Google Cloud is the primary partner for the UK’s agentic transition. We are moving beyond the hype of experimentation into the rigor of production. From the research labs of King's Cross to the diverse enterprises powering the high street, we are architecting a resilient, sovereign, and prosperous future for the United Kingdom.

Thank you to everyone who’s joining us in London — yesterday, today, and into the future. This year we’ve packaged up an exclusive on-demand experience, allowing you to stream the defining London Summit moments, available anywhere, anytime.

Google named a Leader in IDC MarketScape SIEM 2026 Vendor Assessment

Tue, 16 Jun 2026 17:30:00 +0000

Security operations teams are under immense pressure to defend against adversaries who use AI to act with unprecedented speed, scale, and sophistication. To navigate these moments, secure mission-critical workloads, and build confident defense programs, organizations rely on modern security information and event management (SIEM) systems as the backbone of their security operations.

We are proud to announce that Google has been named a Leader in the 2026 IDC MarketScape for Worldwide SIEM Vendor Assessment (#US54126826, June 2026). We believe this recognition reflects our sustained investment and innovation in Google Security Operations, bringing together Mandiant's frontline expertise, comprehensive automation, and advanced AI agents to empower defenders.

According to the report, Google was recognized for several key strengths, including:

The Alert Triage and Investigation agent collects evidence, runs correlated searches, and produces a transparent verdict, reducing the security analyst workload. The additional agents announced at Google Cloud Next extend agentic workflows beyond triage into proactive hunting and rule generation.
Google designs the silicon, runs the infrastructure, develops the Gemini foundation models through DeepMind, and encodes its internal security expertise into agent evaluation loops. Vertical AI integration supports unit economics that would be difficult to achieve through third-party model APIs and gives Google tighter control over the iteration cycle that improves agent accuracy on security-specific tasks.
Curated detection content authored by Mandiant analysts is mapped to MITRE ATT&CK and refreshed on a regular cadence. Customers report that the higher-tier curated rule sets deliver useful detections out of the box.
Search performance over large data volumes is a consistently cited technical strength. The unified data lake, combined with all-time UDM search and multistage search with cross joins, allows analysts to query the full retention period without the performance degradation common on legacy on-premises platforms.

IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of technology and service suppliers in a given market.  The research methodology utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each vendor’s position within a given market. The Capabilities score measures vendor product, go-to-market and business execution in the short-term. The Strategy score measures alignment of vendor strategies with customer requirements in a 3-5-year timeframe. Vendor market share is represented by the size of the circles. Vendor year-over-year growth rate relative to the given market is indicated by a plus, neutral or minus next to the vendor name.

Google Security Operations, powered by AI

Speed and accuracy are crucial in threat detection and incident response. Google continues to drive security operations innovation to help defenders work smarter, not harder. By deeply embedding Gemini in Google Security Operations, we enable analysts to perform complex natural language searches across vast amounts of security telemetry. We have also added agents such as the Triage and Investigation agent that enhance analyst productivity by accelerating event summarization, dynamically generating detection rules, and building automated response playbooks in seconds instead of hours.

“With Google Security Operations, we’re able to take in large volumes of telemetry, introduce AI into our workflows, and we saw a 97% reduction in alerts,” Daniel Peterpaul, VP, Information Security, Sunrun.

Unparalleled access to threat intelligence

A modern SIEM must go beyond data aggregation; it requires context. Google Threat Intelligence combines Mandiant's frontline expertise, the global reach of the VirusTotal community, and the unparalleled visibility of Google's services and devices into Google Security Operations.

Our applied threat intelligence capability enables security teams to spend less time on manual monitoring and more time contextualizing alerts for better decision-making. Through services like Mandiant Hunt, we integrate our proactive experts directly into Google Security Operations to help defenders search for undetected attacks and adversary tactics, techniques, and procedures (TTPs) before they escalate.

Ensuring operational resilience for global enterprises

Organizations around the globe are making significant leaps in both the technology they use and the way they think about security operations by partnering with Google. The ability to stitch together security telemetry and threat intelligence gives organizations visibility to full-service recovery and holistic security transformation.

“Our engineers in the SOC are working on high fidelity, true positives only. So, you've got a high fidelity true positive that's fired, and frankly, you want that alarm then to be enriched with as much contextual information as possible, that's the shift that Gemini in SecOps will allow us to get to. We want AI to work in service of our people, and then we want people to use their human brilliance, creativity, big picture problem-solving to think about attack paths and predicting them, and really making our environment a hard target,” Matt Rowe, chief security officer, Lloyds Banking Group.

Take the next step in advancing your cyber defenses

Organizations that seek to work with a globally capable security leader with strong threat intelligence capabilities and a holistic approach to security operations should consider Google. To learn more about our capabilities and why Google has been named a Leader, read a complimentary excerpt of the 2026 IDC MarketScape for Worldwide SIEM Vendor Assessment here.

Cloud CISO Perspectives: The 4 lessons that guided AI Threat Defense

Mon, 15 Jun 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for June 2026. Today, we introduce Chris Betz as the new CISO of Google Cloud. For his first Cloud CISO Perspectives, Chris shares four key lessons we learned about using AI to the defender’s advantage while building AI Threat Defense.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7fad6c051520>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Cloud CISO Perspectives: The 4 lessons that guided AI Threat Defense

By Chris Betz, CISO, Google Cloud

Chris Betz, CISO, Google Cloud

Just a year ago, it would take months or even years for a good application security team to find thousands of vulnerabilities. Today, a team equipped with multiple AI models can find the same number in hours — or even minutes.

AI is rewriting the rules of cybersecurity. It’s true that AI has boosted adversaries, introducing new threat actors, techniques, and surfaces to defend against, all operating with unprecedented scale, speed, and sophistication. AI-powered attackers are developing zero-day exploits by analyzing more than just source code: Configuration vulnerabilities, binaries, and firmware are all in their crosshairs.

However, AI has also created a significant advantage for defenders. Not only are these same capabilities in our hands, adding to our defense, but we have the added advantage of the full business context that adversaries lack. Software security, and especially vulnerability finding and fixing, is being revolutionized.

Security is changing rapidly, demanding that we all innovate in response. Here is how we are approaching this work today, and some of the lessons we learned along the way.

It’s clear that the AI benefits for security are rapidly evolving, and we can no longer rely on legacy, manual defenses. The new imperative for CISOs and business leaders is to transform vulnerability management by combating machine-speed threats with a defensive strategy that’s AI native, agentic, and open.

We’ve been preparing for this moment for years: From Project Naptime, an internal project to automate vulnerability hunting (so security researchers can take regular naps), to Big Sleep, our autonomous zero-day hunter, to CodeMender, our automated AI-patching agent, we’ve innovated to advance using AI to improve security for all.

Across our products and services, we’ve found that a unified approach helps us protect Google at Google scale. Based on this approach, we recently introduced AI Threat Defense as a pathway to achieve the threat-readiness transformation that you need to defend against AI threats with AI.

The framework is straightforward, and you’ll find that it’s ultimately about two key points:

Using rapidly-advancing AI to protect ourselves.
Shifting the way we develop from the ground up.

Security is changing rapidly, demanding that we all innovate in response. Here is how we are approaching this work today, and some of the lessons we learned along the way.

Four key lessons

Our work is built on a four-step framework, structured directly on what we learned:

Prepare: How Google started the journey — hardening our foundation and operationalizing the framework.
Scan and prioritize: How we identified vulnerabilities — conduct deep-dive analysis and posture validation.
Remediate: What we learned from remediation — implement workflows to autonomously verify and patch vulnerabilities quickly.
Monitor: How we evolved monitoring with AI agents — transition to continuous detection and active response playbooks.

1. Prepare: A modern enterprise runs on an enormous amount of software, and at Google that amount is even greater. We needed focus in order to move at speed, so our first lesson was to reduce our attack surface. That let us narrow our focus, reduce complexity, and use insights we have on our software supply chain and dependencies to prioritize and protect our external interfaces.

Second, we invested in the operational framework supporting the vulnerability work. Early experimentation quickly showed us how valuable a scaling framework is that applies our knowledge of the environment, protects and allocates resources for scanning, and allows new capabilities to be iterated on and used by multiple teams. The amplifying power of good information, code access, dependency graphs, token budgets, and infrastructure are key friction reducers.

Third, we planned engineering work alongside security work: Your engineering partners are critical, especially for aligning with your resiliency and deployment processes.

How Google Cloud CISO Chris Betz Uses LLMs to Defend Billions of Users from Vulnerablities

Key lessons include:

Tagging components with the model, harness, and issues found when scanning.
Allocating hardware and token budgets for finding, developing fixes, build and test.
Managing change volume (and engineer hours) while simultaneously focusing on more, smaller updates, where possible, with good rollout plans to de-risk the change.

2. Scan and prioritize: We continuously scan our code across products — Search, Ads, Android, Chrome, and Google Cloud — managing tens of thousands of packages.

First, we kicked off scanning and centrally tracked our progress, integrating the same tools into our pipelines. We learned early on that the best scanning results come from a combination of an expert in the specific product plus the harness plus the AI model. The combination is crucial, because results will be markedly different without all three.

It’s worth noting that if you can only pick two, we recommend expertise and harness. A less capable model with a good harness and good expert is more powerful than the best model without a good harness or good experts. We also advise using more than one model.

It’s important to track and iterate the data. Since the technology is evolving fast, your data is critical to revise and refine your processes.

Second, look carefully at your software supply chain, and engage your key suppliers. Reachability remains a key criteria for fixes, as does streamlining and simplifying the areas you work on.

Third, because there are so many vulnerabilities that can show up, it’s important to have the right methodology to prioritize them. Normally, when you’re rolling out a change you prioritize the smallest blast radius to make incremental change. Here, we recommend flipping that model: Begin with foundational code with the biggest blast radius to tackle the hardest problems first.

AI models can do a good job of developing proof-of-concepts to rapidly test accuracy. Harness and models play a significant role in reducing false positive rate. Adapting your harness to do validation and using a different agent or model to validate results are both very valuable.

Another key to AI-powered triage is to use your harness and tools to state vulnerability confidence as well as severity. Of course, developing a patch is only part of the problem.

3. Remediate: Fixing vulnerabilities at Google scale required a fundamental shift in strategy. We developed a new approach centered on three lessons.

First, how you roll out patches matters. We adopted a risk-based approach that prioritized code reachable from the outside and had the largest blast radius, such as critical applications like BoringSSL and gVisor. We also learned that providing the model with context was the key to faster, more trusted remediation.

Second, we learned you cannot fix what you cannot track. To manage remediation at scale, we built a central system to track every vulnerability, from discovery to resolution, with every finding labeled in a central repository. This single source of truth allowed us to enforce service-level objectives (SLOs) for patching, and enabled us to deploy constant autonomous patching with human review. Coupled with robust roll-back capabilities, our teams got better at fixing things quickly and safely.

Finally, we learned to build resilience directly into the system. The ultimate goal was to create an inherently-resilient system that can also patch vulnerabilities, not the other way around. We don't just fix the code; we harden the entire system around it.

These changes helped us rethink our approach to securing open-source software with a three-R’s strategy: Refresh, remove, and rewrite.

First, we refresh what is foundational — finding and fixing vulnerabilities in the code. This is about being good network citizens and protecting the core.
Second, we remove what is peripheral. We are removing dependencies and replacing them with custom code. This is about both efficiency and reducing the attack surface, moving from a broad base of trust to a narrow, controlled one.
Third, we rewrite what is critical. For everything in between, we are transitioning legacy logic and critical capabilities into modern, memory-safe languages using AI to automate the transition to eliminate entire classes of vulnerabilities from that software.

This evolution is a deliberate approach to reduce complexity, shrinking the attack surface, and building a more resilient, autonomous, and secure-by-design foundation for everything we do.

4. Monitor: Our work doesn’t stop there, and neither should yours. The security landscape is always changing, and the monitor phase is where our approach comes alive by creating a perpetual feedback loop to ensure we stay secure — and get stronger over time.

We had three key lessons in this phase. First, security demands a constant feedback loop. We created a feedback loop to monitor the entire ecosystem for two things: system strain and vulnerability hotspots.

Second, we invested in tracking our long-term remediation health. You can only improve what you measure. We built a comprehensive asset inventory to track our overall security posture and the completeness of our remediation efforts. Here’s where we hold ourselves accountable to product-level SLOs for vulnerability management.

This system allows us to deploy rolling patches that can update even our data center hardware continuously and use AI agents to verify patch efficacy at a scale no human team could manage.

Third, we planned for the future by using AI agents for both coding and monitoring. You have to assume that at some point, the attackers' models will become more advanced. We need to evolve our operating model and build for that reality.

We use AI agents to automate and standardize our response playbooks, enabling instantaneous containment when an issue is found. We move beyond just finding bugs by feeding key libraries into Gemini to improve its pattern recognition, creating security-aware coding agents. Meanwhile, our AI-assisted red teamers are continuously stress-testing our core infrastructure, ensuring our defenses are always evolving.

The outcome of this constant monitoring is a living, measured program that we can trust.

This is how we protect billions of users every day, and it provides a framework that any team can use to build a defense that learns, adapts, and hardens itself against the threats of tomorrow.

To learn more about AI Threat Defense, you can watch our recent Security Talks online event.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7fad6c051220>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=blh0hhHJ4pI'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Detecting and containing AI-powered threats with Google Security Operations agents: Learn how Google Security Operations works in concert with AI Threat Defense to monitor, detect, and respond to threats, particularly from code you do not own or can not patch. Read more.
How to stop AI voice clones from bypassing your security perimeter: The traditional, relatively stable network perimeter has been replaced by one far more malleable: Identity, driven by vishing attacks. Here’s how to defend against them. Read more.
5 lessons from red teaming AI applications: Distilled from Mandiant’s hands-on red team experiences, check out our clear, concise guidance to help customers securely develop and deploy AI apps. Read more.
Introducing Wiz Cloud Cost: Powering cost management and optimization with context: Wiz unifies cloud and AI cost visibility to help teams eliminate waste and improve spend efficiency across their AWS, Azure, and Google Cloud environments. Read more.
Bringing AI agents to Chrome Enterprise security management: We're launching an open-source model context protocol (MCP) server that connects AI agents directly to Chrome Enterprise APIs, helping IT and security teams manage browser security more efficiently. Read more.
How Google Does It: An inside look at cybersecurity: Learn how Google approaches some of today's most pressing security topics, challenges and concerns, straight from Google experts. View the collection.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7fad6c0512b0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Seeking counsel: Ongoing targeted campaign against U.S. law firms: Mandiant Consulting details a financially-motivated data theft extortion campaign executed by the threat cluster UNC3753, highlighting tactics like physical office targeting, and provides actionable recommendations to safeguard endpoints and infrastructure. Read more.
Welcome to BlackFile: Inside a vishing extortion operation: Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. Read more.
2 PhaaS 2 Furious: The evolution of Chinese-language phishing services: While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Within this ecosystem, GTIG has observed a fundamental move away from static password harvesting towards real-time interception and tokenization. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Deceiving adversaries at scale: Kevin Conley from Riot Games discusses how modern organizations can use deception technology to gain a home-field advantage against adversaries by proactively monitoring their environments. Listen here.
Cloud Security Podcast: Hyperscaling cloud security with Wiz: Yinon Costica, co-founder and VP of product, Wiz, discusses how the company used a product-led approach and a unique security graph model to scale rapidly within the competitive cloud security market. Listen here.
Behind the Binary: When AI features create zero-click exploits: Google Project Zero’s Seth Jenkins joins the podcast to dissect a full two-bug, zero-click exploitation chain targeting the Pixel 9. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Powering the next era of Confidential AI

Thu, 11 Jun 2026 19:30:00 +0000

At Google Cloud, we’re committed to providing the most advanced, secure, and private infrastructure for the most demanding AI workloads, and partnering with a broad and diverse range of organizations to help them meet their AI workload needs.

We are thrilled to collaborate with Apple on its expanded Private Cloud Compute (PCC) systems announced this week at WWDC 2026. Working closely together, Apple and Google have built a serving platform on Google Cloud that meets the rigorous security, confidentiality, and transparency goals that Apple has for PCC. This achievement is a testament to the strong collaboration between our teams, as well as with Intel and NVIDIA.

Our commitment to privacy with Confidential Computing

Our collaboration with Apple is built on a foundation of deep commitment to privacy that leverages Google Cloud's security and privacy technologies. At the heart of this collaboration is our Confidential Computing portfolio and our Titanium security architecture.

Titanium architecture, featuring our custom-designed Titan chip, provides a hardware root of trust that underpins the security and integrity of Google's infrastructure and services. Confidential Computing builds on this secure foundation by helping ensure data is protected throughout the lifecycle, encrypted at rest, in transit, and crucially in use within hardware-based Trusted Execution Environments (TEEs).

By protecting data in use, Confidential Computing becomes a fundamental and foundational element for building trust in AI systems, providing verifiable integrity and isolation for sensitive workloads. Confidential Computing helps prevent unauthorized access because data remains encrypted and isolated.

Enabling Apple Private Cloud Compute on Google Cloud

We are proud to collaborate with Apple to extend the privacy and security properties of PCC infrastructure to Google Cloud. Our platform supports Apple’s PCC privacy commitments with a layered security approach built upon Google Cloud’s infrastructure, including:

Google Cloud Confidential Computing: Our core Confidential Computing platform provides the hardware-based TEEs necessary for PCC. By leveraging Intel TDX (Trust Domain Extensions) and NVIDIA Confidential Computing, we provide hardware-based isolation for virtual machines, designed to create a highly secure and private environment where workloads can run with cryptographic assurances.
Google Titanium security architecture and Titan chip: Google Titan chips are a key component in powering security and transparency posture for PCC infrastructure on Google Cloud. Deployed across our fleet, Titan establishes a strong hardware root of trust, helping to ensure the integrity of the boot process and the hardware platform itself.
Intel TDX and NVIDIA Confidential Computing: Google Cloud leverages the security features on Intel CPUs and NVIDIA Blackwell GPUs to protect data-in-use during high-performance AI inference, helping ensure that the entire compute path – from CPU to GPU – is protected.
Open-source transparency: With our commitment to verifiable security, Apple and Google have collaborated in engineering an open-source host stack specifically to support PCC's transparency, enabling independent inspection and verification of the system's security properties.

Together, these technologies help ensure that Apple PCC on Google Cloud meets requirements with enforceable protections, no privileged runtime access, and verifiable transparency.

Building the future of private AI infrastructure

Our collaboration with Apple represents a significant milestone in further strengthening a secure cloud for AI by building on technologies and standards from Apple, Google Cloud, Intel, and NVIDIA. By ensuring that every layer of the stack — both hardware and software — contributes to a verifiable and secure system, we’ve created an advanced platform that is designed to uphold the stringent standards of user privacy and data security that PCC architecture demands.

The advancements built through this collaboration will benefit all Google Cloud customers. We are committed to continuous improvement and offering more transparent, secure, resilient platforms for all types of workloads, especially those handling AI and sensitive data.

You can learn more about Confidential Computing here.

Detecting and containing AI-powered threats with Google Security Operations agents

Tue, 09 Jun 2026 09:00:00 +0000

To defend against the growing range of AI-accelerated threat actors, organizations need to be able to respond faster to outpace the adversary.

Recently, we announced Google AI Threat Defense, an automated security system designed to help you continuously monitor for and stop AI-powered threats before they can impact your business. Based on Google’s own approach to today’s threats and vulnerability management, it’s centered on a four-step framework: Prepare, scan and prioritize, remediate, and monitor.

Today, we’re sharing more details on how Google Security Operations works in concert with AI Threat Defense to monitor, detect, and respond to threats, particularly from code you do not own or can not patch. The remediation gap represents a critical vulnerability.

According to M-Trends 2026, the exploitation of vulnerabilities has become the most common initial infection vector. Notably, the report also indicates that the mean time to exploit has dropped to an estimated minus seven days, meaning exploitation frequently occurs even before a patch is officially released. Google Security Operations delivers vital operational fabric to autonomously contain active attacks across your entire environment.

Google Security Operations supports AI Threat Defense to monitor, detect, and respond to threats.

Engineered around a comprehensive approach that uses compensating controls with proactive security to strengthen operational resilience, Google Security Operations is built on a strategic, three-part approach to cross-environment visibility across your entire attack surface:

Continuous and autonomous coverage analysis and detection generation
Autonomous investigation, containment, and response
Retroactive hunting

Designed to help you see and respond to threats faster than ever before, we deliver these capabilities at machine-scale and machine-speed. Together with Google AI Threat Defense, we’re able to provide the autonomous platform you need to outpace AI-driven attacks.

1. Continuous and autonomous coverage analysis and detection generation

While proactive defense can identify vulnerabilities before they can be exploited, there will be applications that you can not patch, as well as potential gaps in the time it takes to remediate vulnerabilities.

The 2026 Verizon Data Breach Investigations Report underscores the magnitude of this challenge. In a study encompassing over 13,000 organizations, only 26% of vulnerabilities identified on the CISA Known Exploited Vulnerabilities (KEV) list had been fully remediated. Moreover, the median duration required to achieve full patching after detection stands at 43 days. Clearly, you still need continuous monitoring to detect threats in your environments.

Detection Engineering agent. Results for illustrative purposes.

The Detection Engineering agent in Google Security Operations can automatically translate new exploitation patterns of unpatched vulnerabilities into custom detections for your specific environment. Available in preview, it analyzes a diverse array of input sources to quickly and effectively recognize malicious activity, so you can uncover novel attack patterns evolving from new and unpatched vulnerabilities.

The agent’s sources include Google Threat Intelligence (such as emerging threat intelligence, new attack patterns curated by Mandiant, offensive tool repositories, red and purple team reports, autonomous malware analysis, open-source detection repositories and blogs), and internal security telemetry.

The workflow of the Detection Engineering agent.

To automatically find and fill coverage gaps tailored to your environment, the agent proactively builds new rules and validates them with synthetic events to help ensure your environment is covered before an exploit hits.

2. Autonomous investigation, containment, and response

If a threat is detected, you need to immediately and autonomously assess and respond to protect your environment. By bringing together visibility from cloud and enterprise assets, including endpoints, on-premises firewall, identity, network, and custom application logs, your security operations center (SOC) can gain the full context of an attack, and unify disparate signals into a complete, actionable narrative the moment an adversary strikes.

The Triage and Investigation agent in Google Security Operations, generally available, helps analysts drastically reduce time to respond by autonomously investigating alerts, gathering evidence for analysis, and providing verdicts with comprehensive explanations. It can help security analysts automate decision-making, alert closure, and remediation flows, allowing them to spend more time prioritizing high-priority threats instead of false positives.

The agent has already investigated over 5 million alerts, reducing a typical 30-minute manual analysis to 60 seconds with Gemini.

While identifying threats is critical, the ultimate goal is rapid remediation. Agentic automation, available in preview, can help contain attacks by combining dynamic AI agents — which autonomously gather evidence and reason through complex alerts — with deterministic enterprise playbooks.

This hybrid approach ensures that analysts remain in absolute control of critical, high-impact actions while using AI to safely automate decision-making and remediation workflows.

3. Retroactive hunting

Even with autonomous detections and rapid-response handling of active threats, stealthy adversaries and zero-day exploits can sometimes bypass frontline controls. To achieve operational resilience, security teams must also look backward through their data to uncover hidden compromises.

Strong, effective defensive strategies rely on more than just reacting to alerts. The Threat Hunting agent, available in preview, can help teams proactively hunt for novel attack patterns and stealthy adversary behaviors that bypass traditional defenses.

By scouring petabytes of enterprise telemetry (including historical logs) for subtle anomalies the agent fundamentally shifts the SOC posture from reactive to deeply proactive.

Auditing the Axios supply chain attack

When adversaries can generate unique exploits and command-and-control (C2) infrastructure at zero marginal cost, static indicators like hashes and IPs decay instantly. Defenders must instead detect the behavioral tactics, techniques, and procedures (TTPs) of the attack.

We had the Detection Engineering agent audit our coverage against the recent Axios supply chain attack (UNC1069). The agent mapped the campaign intelligence into behavioral threat detection opportunities (TDOs), simulated the attack chain using high-fidelity synthetic UDM logs, and ran them against active rules.

Google Detection Engineering agent output.

We successfully flagged the execution phases in the middle (renamed PowerShell and macOS background shells), but were blind at the initial entry point (NPM postinstall dropper) and the final C2 exit point.

By exposing these blind spots, the agent helped us proactively engineer custom YARA-L rules to close the loop at the first and final steps of the kill chain. You can sign up for the Google Security Operations Detection Engineering agent preview today.

Next steps

By integrating Google Security Operations Gemini-native specialized agents into your workflow, you can autonomously generate detections, orchestrate containment, and hunt for stealthy threats at machine speed. This allows you to maintain a resilient defense even when primary controls fail, ultimately driving a 70% reduction in both breach risks and costs.

Google AI Threat Defense working alongside Google Security Operations can help you consistently outpace automated adversaries. To learn more about how Google AI Threat Defense and Google Security Operations can help you fight AI with AI, check out our Security Talks online event on June 10.

Cloud CISO Perspectives: How to build an AI-ready security program for the public sector

Fri, 29 May 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for May 2026. Today, Usman Chaudhary, Field CISO, Google Public Sector, offers a guide for CISOs protecting government agencies and critical infrastructure on how to get started — and get the most out of — defending with AI.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7fad5e564c40>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How to build an AI-ready security program for the public sector

By Usman Chaudhary, Field CISO, Google Public Sector

Usman Chaudhary, Field CISO, Google Public Sector

Deciphering actionable signals from deafening noise can be hard for CISOs, even with AI — and especially for those guiding government agencies, critical manufacturing plants, or in a foundational industry.

From industrial control systems to decades-old municipal databases, you’re securing complex, deeply entrenched systems, and the sudden mandate to adopt AI can feel less like an evolution and more like a breaking point.

While it’s true that you face a monumental challenge, we know that from our conversations with CISOs and customers that we can offer concrete, actionable steps on how to build an adaptable, AI-augmented defense while managing the operational load on your staff.

The urgency created by machine-speed exploits means you can not rely solely on reactive measures. Once the immediate administrative toil has been reduced, you should aggressively shift your focus toward posture elevation, proactive hunting, and structural integration in the next six to 12 months.

Importantly, executing this vision does not mean developing everything from scratch. This roadmap relies on a strategic combination of building custom internal workflows (like Gemini Gems), buying established commercial AI capabilities, and integrating them into your existing security stack.

Google's Gemini for Government delivers agentic AI for more than three million federal civilian and military personnel on a platform accredited at FedRAMP High and DOW Impact Level 5.

To help you prioritize resources, we have structured the necessary AI initiatives across five core CISO workload domains, highlighting your team's immediate quick wins in the first 90 days alongside tactical goals in the first six months, and strategic goals in the six-to-12-month horizon.

Your tactical execution plan: Months zero to six

Building an AI-ready security program is a journey. We’re focusing strictly on high-value use cases you can deploy immediately and in the next six months.

1. Executive alignment and business justification: The goal is to stop defending your budget with technical jargon and start explaining resilience in terms of financial risk and operational efficiency.

AI-driven board reporting (Immediate): Translate complex technical data into clear business impact. Pipe your metrics into a secure enterprise workspace (like Gemini for Workspace). Prompt the model to synthesize the raw data into a concise, two-page risk narrative that includes highlights such as containment metrics, potential impact on citizen services, and production uptime for critical assembly lines.
Vendor and spend optimization (Immediate): Upload vendor capability matrices and contracts to an isolated AI agent (like NotebookLM). Have it identify feature redundancies across your stack, suggesting clear paths for tool consolidation and budget optimization. Be sure to ground these insights with third-party validation from reputable sources like Gartner or Forrester.

2. Process optimization and toil reduction: The goal is to treat AI as a muse, not an oracle. Do not trust it to make final administrative decisions, but do use it to drastically reduce cognitive fatigue.

Automated context gathering and SOC triage (Immediate): Level 1 analysts spend a lot of time manually gathering context across logs, correlating IP reputations, and triaging ambiguous alerts. Integrate a specialized large-language model (LLM) workflow or use built-in capabilities in your SIEM and SOAR (like Google Security Operations) to consolidate this data automatically and provide instant, clear triage verdicts to investigate further or ignore.
Threat intelligence analysis (within six months): Automate a daily pipeline where an LLM ingests industry advisories and distills the noise into prioritized summaries relevant to your sector. Translating that raw text into functional detection rules is a complex engineering challenge. Instead of building this pipeline internally, use security platforms that natively automate indicators of compromise (IOC) extraction and rule engineering.
SOP mapping and agent creation (within six months): Churn and burnout are significant operational risks. Ingest your historical incident resolution notes and standard operating protocols (SOP) into an AI to build a knowledge-base agent. Identify the top five most frequent manual processes, and task an analyst with using a coding agent to document and automate them.

3. Talent upleveling and augmentation: The goal is to empower your practitioners to become AI builders rather than viewing technology as a threat to their expertise.

Natural language to query generation (within six months): Bridge the skills gap inside your SOC. Provide analysts with a secure conversational AI assistant or chatbot to translate plain English hypotheses into executing SIEM queries.
AI-driven security training (within six months): As manual processes are increasingly automated, use that reclaimed time to run capture the flag (CTF) exercises and community contests for your security team. Use an LLM to generate unique, one-shot red team test cases and training scripts that map specifically to your environment's architecture, helping train analysts through hyper-realistic, hands-on learning in simulated environments.

Your strategic horizon: Months six to 12

4. Posture elevation and threat hunting: The goal is to transition your team from a purely reactive posture into a state of continuous defense.

Contextual vulnerability prioritization: Deploy an AI agent to correlate scanner output with your internal architecture context and active threat intelligence, scoring vulnerabilities against actual environment exposure.
AI-assisted architectural threat modeling: Paste proposed system architecture diagrams into an AI assistant during the design phase — before your developers write a single line of application code — to generate a prioritized risk backlog, highlighting business logic flaws and data egress risks early.
Proactive threat hunting: Use AI as a hunting advisor. Have it generate hypotheses aligned with MITRE ATT&CK, suggest the necessary log sources to prove or disprove the hypothesis, and help pivot investigations when a human analyst hits a dead end. Eventually, you want to move to a fully-automated hunting agent which initiates a hunt upon detecting a new IOC and proactively selects the appropriate data, searches through it, and provides findings.
Continuous red team agents: Deploy autonomous or semi-autonomous red team agents to continuously probe your defenses. The active findings and attack paths generated by these agents create a continuous feedback loop — feeding directly into your threat intelligence analysis, SOC playbooks, and contextual vulnerability prioritization.

5. Advanced governance and incident response: The goal is to build structural guardrails for an environment where AI generates code, while preparing for high-stress incidents.

Policy and compliance gap analysis: Rapidly check if new operational proposals or cloud architectures conflict with internal policies or strict regulatory frameworks (like FedRAMP and NIST guidelines). Use an isolated agent preloaded with your governance documentation to review new project proposals and highlight violations.
Interactive incident response (IR) playbooks: Standard tabletops and static PDF playbooks often fail during a real breach. Train an internal agent on your organization’s historical IR tickets and SOPs. During a live crisis, this agent can act as an interactive guide, providing step-by-step containment instructions that actively adapt to the specific details and telemetry of the ongoing incident.
Secure code review at the pull request: The proliferation of AI coding assistants means your developers are generating code — and potential vulnerabilities — faster than ever. Manual security reviews can no longer keep up. You must turn AI inward on your own pipelines. Integrate advanced LLM-powered auditors directly into your CI/CD pipeline as a mandatory security gate to catch AI-generated vulnerabilities and automatically block insecure commits before they merge into production.
Autonomous defense for collapsed exploit windows: The rapid advancement of AI capabilities has effectively collapsed the time-to-exploit window, and to be faster than the adversary you should use AI to actively find and patch vulnerabilities. This approach requires a continuous, multi-step workflow to map and prioritize your codebase, deploy AI to deeply scan the highest-risk code, autonomously verify and implement patches, and continuously monitor the runtime environment.

Because these sophisticated workflows are incredibly difficult to build and maintain internally, it is highly practical to use leading solutions — such as Google AI Threat Defense — to help you predict attack paths and deploy fixes at machine speed.

Moving forward with confidence

The transition to an AI-augmented security program can feel intimidating, but the technological barrier to entry is lower than it has ever been. By shifting your focus from reactive alert management to internal context, structured automation, and rapid governance, you can effectively outpace modern threats while also alleviating the operational burden on your workforce.

Start small. Pick one quick win from the roadmap this week — such as automating your alert triage or mapping your top five SOPs — and begin building the muscle memory your team needs to stay resilient for the era ahead.

To learn more, check out our Security Talks online event on June 10.

aside_block: <ListValue: [StructValue([('title', 'Fact of the month'), ('body', <wagtail.rich_text.RichText object at 0x7fad5e5649a0>), ('btn_text', 'Learn more'), ('href', 'https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Introducing Google AI Threat Defense to help you outpace the adversary: AI Threat Defense is a comprehensive AI-powered cybersecurity solution, an always-on security platform to outpace AI-driven attacks. Read more.
State of SDLC Security 2026: How risk scales in modern development: Wiz researchers share their latest insights from real-world environments into how code, developer tooling, automation, and AI are reshaping application security. Read more.
Claude Enterprise meets the Wiz Security Graph: Security and compliance teams can now monitor Claude activity directly in Wiz, extending to AI the workflows they already rely on. Read more.
How Fraud Defense uses AI to protect the internet: Google Cloud Fraud Defense (formerly reCAPTCHA) now supports agents as first-class users in the browser, has extensively revamped our detection stack with advanced predictive machine learning to model user and bot behavior, and can adapt continuously to new bots and threat vectors. Read more.
What’s new in Android security and privacy in 2026: Android elevates mobile security with new AI-powered protections and advanced safeguards to help keep you safe. Read more.
Defending at machine-speed: Building AI threat readiness with Wiz: Learn how Wiz can help organizations adopt an AI-driven operating model for AI threat readiness. Read more.
Introducing Runtime Threat Detection for Google Cloud Run: Wiz Runtime Sensor support for Google Cloud Run Containers is now generally available, giving teams real-time threat detection and response for their serverless container workloads. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7fad5e564fa0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Welcome to BlackFile: Inside a vishing extortion operation: Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. Read more.
2 PhaaS 2 Furious: The evolution of Chinese-language phishing services: While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Within this ecosystem, GTIG has observed a fundamental move away from static password harvesting towards real-time interception and tokenization. Read more.
Exploitation of KnowledgeDeliver via ViewState deserialization vulnerability: In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver, a learning management system (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated remote code execution (RCE), stemming from the use of identical pre-shared ASP.NET machine keys across customer deployments. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Is ‘good enough’ the same as winning: Gal Ordo, co-founder and chief product officer, Native, debates native controls and what happens when a customer needs a feature that a cloud provider hasn't built yet. Listen here.
Cloud Security Podcast: What agentic SOCs should measure: So far this year, what are we measuring for success in agentic SOCs? Matt Gregson, principal, PwC Cyber Security, talks about the state of the agentic SOC. Listen here.
Cloud Security Podcast: CISO as CFO: From Citi to celery, it's all about the cabbage: Most people do not associate grocery wholesale and retail with cutting edge technology and threat models. Arvin Bansal, CISO, C&S Wholesale Grocers, explains why there’s more here than just dry goods. Listen here.
Cyber-Savvy Boardroom: From CISO checklists to CEO strategy: Dom Cussatt discusses the importance of mapping security and risk directly to business objectives. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.