Security & Identity

PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap

Tue, 11 Aug 2026 16:00:00 +0000

Securing infrastructure and services against a future cryptographically-relevant quantum computer has been a goal for Google for a decade, and we’ve dedicated ourselves to help developers by advancing open standards that can benefit everyone. As post-quantum cryptography (PQC) has matured, we’ve been rolling it out in our infrastructure for internal and customer-facing services.

Today, we're sharing our updated Google Cloud roadmap to migrate to PQC by 2029.

Our strategy: Secure by design

We’ve based our PQC migration strategy on the Google Quantum Threat Model, prioritizing protection across three key domains:

Mitigating Store Now, Decrypt Later (SNDL) risks: Protecting today's encrypted data from being harvested and decrypted by a future quantum computer.
Ensuring integrity against forgery: Strengthening digital signatures to prevent attackers from falsifying data and identity.
Enhancing foundational capabilities for cryptographic agility: Building flexible systems that can easily adopt new cryptographic standards with minimal engineering effort as cryptographic standards evolve.

We’re actively transitioning internal infrastructure and customer-facing services to PQC algorithms far ahead of regulatory deadlines.

We are also deploying PQC solutions across our Sovereign Cloud initiatives, such as Google Cloud Dedicated (GCD) and Google Distributed Cloud (GDC), in collaboration with our partners. Similarly, our strategy allows us to progress on integrating post-quantum protections across our AI services to secure the next generation of cloud workloads.

These efforts are fundamental pillars of our overarching strategy to achieve full post-quantum readiness across Google Cloud. As this landscape evolves, we will continue to refine and update our deployment schedules.

Visualization of our Google Cloud PQC roadmap. Our efforts converge in 2029, and extend beyond it.

We plan to achieve full PQC readiness by 2029, when our efforts converge. We anticipate continuing those efforts into the 2030s to support broader industry guidance and evolving global standards. These standards include CNSA 2.0 and the transition paths defined in NIST IR 8547, which anticipate the final deprecation of legacy, quantum-vulnerable algorithms between 2030 and 2035.

Immediate progress: 2026 milestones

Leadership in the quantum era requires deployment at global scale. We have achieved foundational milestones that provide immediate protection for our customers:

API endpoint readiness: Google Cloud API endpoints now offer quantum-safe key exchange, protecting incoming traffic from future decryption. These endpoints include google.com and *.googleapis.com, and both have implemented NIST-standardized ML-KEM (FIPS 203) in hybrid mode.
Load balancers PQC support: Application and proxy load balancers now support quantum-safe hybrid key exchange (X25519MLKEM768) for TLS 1.3. Initially available on an opt-in basis, this allows our customers to perform validation, while minimizing impacts to their existing applications.
Quantum-safe certificate experimentation at scale: We’re collaborating with the IETF PLANTS Working Group to produce a public key infrastructure (PKI) standard that minimizes impact to your operations teams. Chrome and Cloudflare have started experimenting with Merkle Tree Certificates to address challenges using PQC signatures for WebPKI, and we have been sharing insights with the standards working group.
Cloud KMS PQC algorithms: NIST standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) for your encryption and signing keys are now generally available.

The roadmap to 2029

We’ve established specific customer-centered journeys for Google Cloud to achieve quantum readiness that allow us to prioritize our quantum-safety initiatives. By adopting this risk-based approach, we focus on the core journeys our security experts have identified as most vulnerable to the potential impacts of quantum computing.

Risk-based prioritization for core quantum readiness user journeys.

These scenarios offer diverse platform perspectives to ensure global enablement across our services to meet you where you are.

For each risk domain, we provide a roadmap for key products and services organized by domain, although the services highlighted are not exhaustive lists. We project most services will meet their respective domain's target completion date, though specific product timelines may be adjusted if necessary to account for evolving engineering requirements and any third-party dependencies.

Domain 1: Store Now Decrypt Later (SNDL) mitigation

This domain focuses on addressing vulnerabilities in asymmetric encryption where a future cryptographically-relevant quantum computer (CRQC) could decrypt data captured today.

We’re enabling incremental progress for our customers based on their typical journeys.

Securing your customer workloads: Offer quantum-confidential TLS 1.3 handshakes for your Google Cloud services and configured load balancers to protect user sessions.
Securing administrator and developer flows: Protect the admin pathways used to manage your cloud environment against SNDL. This includes services such as Cloud VPN and Interconnect. For developers, these include client libraries, SDKs, and Tink, our open-source cryptographic library.
Securing data pipelines: Safeguard the confidentiality of data transfers for our analytics and storage platforms. PQC is essential to ensure that sensitive intellectual property and customer data flowing through these systems cannot be captured today and decrypted by a future quantum-capable adversary.

Roadmap
We are targeting these changes for 2027.

Journey	Benefits	Representative services
Store now decrypt later mitigation (End of 2027)
Securing your customer workloads	Quantum-safe ingress: Protects your cloud perimeter using standardized post-quantum algorithms.	Application and proxy load balancing [2026 (Completed)]
Securing admin and developer flows	Secure operations: Validates that your management and deployment stack meets emerging cryptographic standards.	Quantum-confidential ALTS [2025 (Completed)]
		API endpoints [2026 (Completed)]
		Cloud VPN, Cloud Interconnect, GCE OS Login, Cloud SDK, gCloud CLI, GKE service mesh, and client libraries [2026/2027]
Securing data pipelines	Confidential data transfers: Protect sensitive intellectual property and customer data against quantum attackers.	Cloud Storage SDK, Storage Transfer Service, BigQuery CLI, Data Transfer Service [2026/2027]

Domain 2: Integrity and non-repudiation

This domain addresses quantum-proofing of digital signatures and attestations to safeguard against forgery that could compromise data integrity and authenticity.

Securing the software supply chain: Ensure that only trusted, untampered images with quantum-resistant attestations run in production to help prevent a quantum attacker from altering builds. This includes services like Binary Authorization, Cloud Build, and Assured Open Source Software.
Issuing quantum-safe certificates: Transition the public key infrastructure (PKI) including our internal and external certificate authorities (CAs) to support ML-DSA certificates and where meaningful, SLH-DSA certificates. This transition will follow Internet Engineering Task Force (IETF) standardization efforts that are currently in development. We’re actively contributing to these efforts, and we’re also conducting several large-scale experiments:

Address large PQC signature sizes that can impact the performance of certificate chain validations through novel approaches like Merkle Tree Certificates for Web PKI.
Support ML-DSA/SLH-DSA (pure PQC)-based certificates in private CA solutions such as Certificate Authority Service (CAS).
Add quantum-authentication in addition to our internal traffic protocol ALTS that already supports PQC for confidentiality. You can learn more technical details on our approach to digital signatures and Public Key Infrastructure here.

Protecting identity and access: Ensure authentication mechanisms like service account keys and tokens (JWT/OAuth) are resistant to quantum forgery.

Roadmap
We are targeting completion of these milestones by 2028. We also are mindful of ongoing standardization efforts particularly in the field of certificates. Google is actively contributing to quantum-safe certificate standards, and we are committed to help the industry overall meet those deadlines.

Domain / Journey	Benefit	Representative services
Integrity and non-repudiation (End of 2028)
Securing the software supply chain and signature services	Quantum-safe software attestations: Prevents unauthorized build tampering by ensuring only trusted images run in production.	Binary Authorization, Access Approval (AXA) [2026]
		Assured OSS [2027]
Issuing quantum-safe certificates	Quantum-safe standardized trust: Safeguards the authenticity of your internal and external communications against quantum-calculated certificate forgery.	Quantum-authentic ALTS [2026/2027]
		Private CA (Certificate Authority Service) [2027]
		Google Trust Service: Merkle Tree Certificates [2028]
		Roll out of PQC certificates across Google Cloud products and infrastructure [2027/2028]
Protecting identity and access	Governed identity: Eliminates the risk of adversarial credential fabrication with NIST-standardized signatures for auditable integrity.	Cloud IAM [2028]
		Infra-wide rollout of quantum-safe authentication and access [2027/2028]

Domain 3: Foundations and key management

Cryptographic agility is the foundation of our PQC migration. Our ongoing investment in this area drives our end-to-end strategy for key management, libraries, and infrastructure changes.

Foundational key management and libraries: Enable NIST-approved algorithms through Cloud KMS and libraries like BoringSSL and Tink.

Note that Cloud KMS achieved general availability for the NIST standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA), and is in the process of enabling quantum-safe key import.

Hardware-backed cryptographic services: Secure physical foundations using quantum-resistant roots of trust. This includes PQC as part of our Confidential Computing offerings and Cloud Hardware Security Module (HSM).
Key sovereignty and partner solutions: Enable PQC orchestration for Google Workspace Client-side Encryption (CSE) and External Key Managers (EKM). Collaborate with partners to support PQC on-premises key providers.

Roadmap
We are targeting completion of these milestones by 2028.

Domain / Journey	Benefit	Representative services
Foundations and key management (End of 2028)
Foundational key management and libraries	Standardized quantum-safe keys: Provides the NIST-approved building blocks to help migrate your applications.	ML-DSA and SLH-DSA in KMS, ML-KEM and Hybrids in KMS [2025 (completed)]
		Quantum-safe Key Import (BYOK) [2026]
Hardware-backed cryptographic services	Silicon rooted hardware: Anchors your security in quantum-safe hardware roots of trust.	Confidential Compute (including attestation and vTPM) [2028]

		Quantum-Safe Cloud HSM (FIPS 140-3 L3) [2028]
Key sovereignty and partner solutions	Cryptographic provenance: Provides control and provenance of your keys where you need them.	External Key Management [2028]
		Partner enablement (key providers and sovereignty solutions) [2028]

A shared responsibility for quantum safety

Security has long been a collaborative partnership with our customers.

Google’s responsibility — Security of the cloud: We manage the transition to a quantum-safe infrastructure, including our network and encryption in-transit, global front-ends, and the ALTS protocol.

This responsibility encompasses the end-to-end PQC transition of our servers, ensuring that the underlying hardware and operating systems are secured against quantum threats. We maintain hardware integrity through quantum-safe, open-source silicon foundations such as Caliptra v2.1, TPM 2.0 v185, and OpenTitan. The latter is the first open-source silicon root of trust and already supports quantum-secure boot.

While we are working toward our 2029 target, hardware transition to PQC involves both active replacement, where feasible, and natural equipment replacement cycles. Our phased approach ensures stability, though the timeline for some physical components may extend beyond 2029.

Customer’s responsibility — Security in the cloud: Organizations must manage their own applications, including updating client-side software to negotiate PQC handshakes and managing the lifecycle of your asymmetric keys.

In addition, you should update your Google Cloud service configurations with quantum-safe settings and policies.

Our path forward, together

Building momentum toward quantum readiness requires immediate, practical action. We recommend starting with these three steps:

Inventory: Identify your cryptographic resources (such as keys and certificates) using Cloud Asset Inventory and solutions such as Wiz’s cryptography and PQC readiness. When you map cryptographic resource usage across your organization, you can more accurately define and prioritize your migration backlog.
Update: Ensure your development and Site Reliability Engineering teams are using software that supports PQC algorithms such as BoringSSL, Chrome, and SDKs. This update ensures your internal workflows are prepared to negotiate quantum-safe connections by default as we enable them at the edge.
Validate: Test the behaviors of your existing application using our quantum-safe APIs and load balancers. Validating your workflows today will identify architectural bottlenecks before they impact your primary production environments.

Google Cloud is committed to managing the complexity of this transition so you can achieve your regulatory and compliance commitments, while focusing on innovation. We are just beginning to share our progress as we work to empower our customers to lead in the post-quantum landscape.

To learn more about our PQC approach, please visit our post-quantum cryptography (PQC) hub.

How Google Cloud detects, contains, and protects against emerging threats

Fri, 07 Aug 2026 16:00:00 +0000

At Google Cloud, securing your data and business systems is our foundational commitment. We empower our customers with the tools, governance, and infrastructure needed to securely deploy workloads and maintain long-term trust.

We approach security from a shared fate model, and we continuously work to proactively identify and mitigate potential threats before they can compromise your data and misuse your infrastructure.

Understanding the risk: How bad actors attempt to exploit cloud workloads

Hyperscale cloud platforms like Google Cloud offer massive compute capacity, high-speed networking, and cutting-edge AI engines, but these same core strengths also make us high-value targets for malicious actors seeking service disruption, financial gain, or exploit cloud resources.

By tracking active adversary techniques, Google’s specialist security teams actively monitor and defend across several areas.

AI workload exploitation: As organizations rapidly adopt AI tools and systems, including Gemini Enterprise Agent Platform, threat actors target unsecured API keys and leaked access tokens. Common attack patterns include using stolen credentials for unauthorized distillation attacks and reselling access tokens on third-party marketplaces. We track consumption rates, account standing, and access context to catch these anomalies early.
Cryptocurrency mining: Malicious actors often use stolen credentials to spin up virtual machines (VM) for illicit cryptomining. While Google Cloud respects customer privacy and does not inspect internal VM processes, we can accurately infer mining activity by analyzing infrastructure telemetry — such as distinctive CPU and memory utilization spikes and rapid VM creation rates.
Exfiltrated credentials and supply chain attacks: Developers occasionally commit secrets and API keys to public source repositories where automated scrapers harvest them in seconds. Exposed credentials also stem from supply chain attacks against local development environments or managed cloud workloads.
Account takeover (ATO): Adversary-in-the-middle (AITM) techniques — such as sophisticated phishing and session cookie theft — can grant unauthorized users administrative control. Once inside, adversaries establish persistence, move laterally, and execute downstream abuse like resource hijacking or data exfiltration.

Without proper containment, these attacks can lead to operational disruptions, compromised system integrity, and unchecked resource misuse — such as runaway costs — creating substantial friction for impacted users.

Mitigating risks: Tailored containment in action

Detecting a threat is only half the battle; maintaining business continuity by containing it without interrupting your legitimate operations is critical. Google Cloud deploys tailored mitigation strategies based on the nature of the threat.

Granular containment and throttling: When anomalous traffic indicates AI abuse or cryptomining, we apply targeted throttling measures. This isolates malicious activity while preserving legitimate corporate traffic.
Collaborative triage for complex workloads: In AI environments, malicious API calls are often interlaced with critical business operations. In these scenarios, our Cloud Abuse and Cloud Support teams collaborate directly to isolate and inspect specific traffic vectors.
Localized identity isolation: To prevent lateral movement, localized containment protocols can be systematically applied across compromised user identities and Google Workspace domains.
Targeted suspensions as a last resort: Our primary objective is to enforce containment at the most granular resource level possible. However, if platform integrity or customer financial exposure is severely threatened, we may temporarily suspend specific projects, backed by a clear appeal process.

Additionally, to stop attacks at the root, Google actively partners with public repository hosters through initiatives like GitHub Secret Scanning to catch exposed credentials immediately and trigger proactive warnings before exploitation occurs.

Communicating risk: Proactive transparency and log visibility

During a security event, time-to-awareness is everything. We provide a robust suite of tools and channels to ensure your key security stakeholders receives actionable visibility:

Cloud Abuse Event Logging: Provides a 30-day window into security and abuse notifications with resource-level granularity. These logs can be ingested directly into your SIEM product for automated orchestration and response.
Proactive support cases and abuse notifications: When critical abuse is detected, automated email notifications and high-touch support cases are generated to open an immediate channel for resolution and best-practice sharing.
Cloud Audit Logging and anomaly spending alerts: Audit logs monitor unexpected resource changes that point to an ATO, while automated billing alerts notify key stakeholders of sudden spend spikes driven by compromised workloads.
Essential Contacts: To ensure notifications reach the right people instantly, Google Cloud allows you to maintain a dedicated directory of designated contacts across security, billing, and operations.

Customer action plan: Hardening your environment

We handle the security of the underlying infrastructure, yet your organization remains resilient only through proactive hygiene on your side of our shared fate partnership.

To minimize risk exposure across your user accounts, service accounts, and API keys, we recommend implementing these foundational defenses.

Mandatory identity protection: Enforce multi-factor authentication (MFA) and 2-Step Verification (2SV) across all user accounts and Google Workspace domains without exception to prevent AITM cookie theft and phishing attacks. Ensure that you use Device Bound Session Credentials (DBSC) for your Google Workspace accounts to bind a user's session to their specific device.
Secure service accounts and API keys: Treat keys and tokens as top-tier secrets. Never embed API keys in source code or public repositories. Use keyless authentication where possible, rotate keys regularly, and follow strict governance for service account management.
Enforce least privilege and perimeter defense: Use Identity and Access Management (IAM), VPC Service Controls (VPC-SC), and Context-Aware Access (CAA) to restrict access so identities only have the exact permissions required for their specific function.
Configure Essential Contacts and billing alerts: Set up detailed billing alerts to identify unauthorized spending before costs rise, and conduct quarterly reviews to keep your Essential Contacts directory current.
Regular resource hygiene: Conduct periodic audits of your organization to identify and decommission unused resources, legacy billing accounts, and dormant user accounts. Pay special attention to groups or service accounts with elevated permissions to ensure your attack surface remains as small as possible.

Continuous vigilance together

Google continuously monitors platform health to detect anomalous usage patterns before they impact your workloads.

Ultimately, maintaining a secure environment is a partnership built on shared fate. While we take every precaution to prevent bad actors from gaining a foothold, protecting your organization requires equal dedication on your end. By applying robust access controls, staying vigilant, and adopting security best practices, together we can keep your workloads secure and resilient.

Explore key resources to harden your environment:

Advancing brain tumor research with privacy-first AI

Thu, 06 Aug 2026 16:00:00 +0000

The intersection of medicine and AI has led to remarkable innovations. However, developers now face the thorny challenge of building robust medical AI tools that have been tested and evaluated on diverse, real-world patient data while also protecting patient privacy. At Google Cloud, our approach combines strategic collaboration with Confidential Computing.

To help protect both patient privacy and AI models during validation, we’re collaborating with MLCommons through the MedPerf initiative. First announced at Google Cloud Next earlier this year, this partnership uses Confidential Computing to establish a secure clean room for benchmarking AI models in real-world settings.

The challenge: Evaluating AI without seeing the data

MLCommons, a global community with over 125 members across tech and academia, launched MedPerf in 2023 to standardize the evaluation of medical AI. MedPerf, an open-source platform for benchmarking AI models, has advanced clinical research using federated evaluation to test models.

By using Google Cloud Confidential Space, proprietary AI models can be evaluated inside hardware-isolated Trusted Execution Environments (TEEs). This special virtual machine encrypts memory in-use and hardens the operating system, so none of the parties — the hospital or research institution, other participants, or Google — can see model code or patient data while it's evaluated.

Medical AI benchmarking is compute-heavy, so the Confidential VM extends beyond the CPU to the GPU. To protect model weights and patient data even during GPU-accelerated inference, MedPerf runs on Google Cloud's A3 machine series with NVIDIA H100 GPUs, which pairs Intel TDX technology on the CPU with NVIDIA Confidential Computing on the GPU.

Before any patient data is released into the workload, the system provides cryptographic proof that only the approved code is running on genuine Confidential Computing hardware and that the environment has been properly hardened.

Learn how ML Commons MedPerf integrates with Google Cloud Confidential Compute to enable secure, real-world evaluation of medical AI models.

From theory to critical impact: Advancing brain tumor research

This technology is already driving critical research through the Federated Tumor Segmentation (FeTS) initiative. Brain tumors, such as glioblastomas, are rare, making it difficult for any single hospital to collect enough data for high-accuracy AI training.

Compounding the problem, a model that performs perfectly in one hospital can struggle in another due to differences in patient demographics, data acquisition techniques, and even in equipment.

Working with visionary researchers like Indiana University’s Dr. Spyridon Bakas, Northwestern University’s Dr. Yury Velichko, and the University of Alberta, Canada’s Dr. Amber Simpson, MedPerf on Google Cloud is validating AI models on private brain MRI data from around the world, and identifying potential performance gaps.

For example, a model might be 95% accurate at one site but only 63% accurate at another. Our collaborative approach demonstrates that when an AI tool reaches a clinician, it has been proven to work across a truly representative patient population.

Achieving clinical trust and validation

The impact of this collaboration is best summarized by those on the front lines of clinical research.

"My experience testing federated learning on Google Cloud has shown that the future of medical AI lies in secure, scalable, and collaborative cloud environments," said Dr. Yury Velichko, associate professor, Radiology, Northwestern University. "Moving beyond the controlled lab setting to test these workflows in a production-ready infrastructure provided a unique opportunity to evaluate the performance and security of federated learning in real-world clinical applications.”

"Medical AI holds enormous promise for patients around the world, but that promise can only be realized if clinicians, researchers, and regulators can trust the benchmarks we use to evaluate it,” said Alexandros Karargyris, MedPerf lead, MLCommons. By bringing MedPerf onto Google Cloud's Confidential Computing infrastructure, we have taken a major step toward a future where AI models can be rigorously tested on real patient data — without compromising privacy, intellectual property, or benchmark integrity.”

The future: Scaling secure medical breakthroughs

The collaboration between MLCommons and Google Cloud represents a fundamental shift toward privacy by design in healthcare AI. By making it easier to securely share and evaluate data and models, we are clearing the path for faster, safer, and more equitable medical breakthroughs.

Research institutions and healthcare model developers interested in using the MedPerf platform on Google Cloud should contact medical@mlcommons.org or your Google Cloud account team.

Cloud CISO Perspectives: Why AI Threat Defense is the new boardroom baseline

Fri, 31 Jul 2026 13:00:00 +0000

Welcome to the second Cloud CISO Perspectives for July 2026. Today, Chris Betz, CISO, Google Cloud, and Alicja Cade, Senior Director, Office of the CISO, Google Cloud, explain what boards of directors need to know about AI security and how to prepare their organizations for security governance and business agility in the AI era.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c35b2850>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Why AI Threat Defense is the new boardroom baseline

By Chris Betz, CISO, and Alicja Cade, Senior Director, Office of the CISO, Google Cloud

Chris Betz, CISO, Google Cloud

Modern security governance has become a critical part of the foundation for business agility. Often treated as an operational cost center, security is increasingly recognized as a primary business enabler, a runway that empowers your organization to move fast, adopt cutting-edge generative AI, and capture new markets securely.

In today’s environment, every major business initiative is an AI initiative, and every AI initiative requires a secure foundation. Ensuring your company is investing in the right technologies and using the right tools will be crucial in leading through the rapid AI transformation.

Alicja Cade, Senior Director, Office of the CISO, Google Cloud

To operate against AI speed threats, boards of directors should encourage their CISOs and business leaders to transform their strategic approach for speed, scope, and scale. We need to emphasize risk and vulnerability management with a defensive strategy that’s AI native, agentic, and open.

By aligning defensive speeds with automated attack cycles, using deep internal business context, and integrating tools into unified platforms, AI-powered defense can help you confidently manage today’s threats at machine speed, and simultaneously greenlight aggressive innovation. Based on our learnings defending ourselves and our customers, Google developed AI Threat Defense (AITD) to help transition security from manual, reactive firefighting to an automated, continuous capability.

While directors don’t need to manage the execution of these technologies, they have to provide the governance frameworks that encourage operational modernization. To help guide your organization’s leadership team in this transition, we recommend focusing on these five strategic, constructive areas of inquiry.

For boards of directors, investing in these capabilities helps build the resilience required to drive business velocity.

Key questions for CISOs, business, and tech leadership

1. Business enablement: When an enterprise transitions to automated threat defense, it is not just closing a security gap — it’s reclaiming engineering productivity and protecting operational continuity.

Ask your team: How will modernization investments speed up our business to deliver value to our customers? What additional resources do we need (if any) to create this business value more quickly, and create a competitive advantage?
Governance objective: Ensure that any decisions about investments align with business strategy. Speed up time to market on new features. Create competitive agility advantage for security and shareholders.
Expected operational standard: Consolidate business process, speed up execution and time to market.

2. Remediation cycle: By integrating business logic and context into defensive platforms, AI can help filter out the background noise that has historically overwhelmed security operations, and also keep you on top of the complex threat landscape.

Ask your team: How are we managing the organization’s risk in the era of fighting AI with AI?
Governance objective: Expect a management plan with CISO input for balancing business operations, risk, and profitability with speed and reliability in an AI threat-driven world.
Expected operational standard: Your organizational mean time to remediate (MTTR) exposures and other desired changes into production goes down and to the right.

3. System consolidation: Boards should look beyond standalone AI features and point products to address systemic risk and truly enable business speed.

Ask your team: Are we moving toward a unified security platform, or maintaining a patchwork of point tools?
Governance objective: Reduce visibility gaps and operational friction created by fragmented vendor environments.
Expected operational standard: Consolidate scanning, risk prioritization, and code remediation into an integrated workflow.

4. Contextual prioritization: Your organization knows exactly how applications are interconnected, where critical data assets reside, who has access privileges, and which workflows drive actual business logic. That deep context becomes the defender’s advantage when you are using AI powered defenses, including those in AI Threat Defense.

Ask your team: How are we using our deep business context to reduce security alert fatigue?
Governance objective: Optimize engineering resources by ensuring teams are not consumed by false-positive alerts.
Expected operational standard: Direct AI systems to prioritize vulnerabilities based on actual reachability and business context.

5. AI safety and policy: Every AI conversation is a security conversation. Securing AI infrastructure starts with directing teams toward approved architectures with proper governance.

Ask your team: What frameworks do we have in place to secure our internal AI pipelines and monitor shadow AI?
Governance objective: Protect intellectual property and maintain compliance as the enterprise adopts generative tools.
Expected operational standard: Implement clear runtime visibility, data egress controls, and secure development standards for AI.

Innovate with confidence

In a highly automated digital environment, passive oversight is no longer practical. Your teams should be looking at how they are using AI to accelerate security and respond to AI-driven threats at AI speed.

By steering the enterprise toward a platform-centered, context-driven security posture, boards can support long-term business resilience, protect asset value, and give the organization the confidence to innovate, scale, and lead in its next phase of growth safely. Consider technologies like AI Threat Defense as part of your defenses in this new world.

For more insight, check out our Board of Directors hub here.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c2c7c9d0>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=CmGWIwgHR60'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Now in preview: Find and fix software vulnerabilities with CodeMender: Our AI code security agent CodeMender can scan and fix software vulnerabilities, and is now available in preview through Agent Platform and AI Threat Defense. Read more.
Cyber Snapshot Report: Enterprise resilience key to toolchain success: Check out curated frontline insights and blueprints to turn potential crises into manageable events in the newest Cyber Snapshot Report. Read more.
Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS: TWe are extending the PQC digital signature algorithms suite available in Google Cloud Key Management System to include ML-DSA and SLH-DSA. Here’s why. Read more.
Atlas, Wiz's autonomous vulnerability-research agent, has been ranked #1 on CyberGym: See how Wiz built Atlas, an autonomous AI system for vulnerability research that validates every finding with a real, working exploit. Read more.
Best Buy scales AI workloads and secures access with Workforce Identity Federation: As Best Buy expanded its use of Google Cloud for advanced analytics and AI, its technology teams faced two significant scaling challenges: Mitigating risk and managing administrative friction when syncing thousands of backend users from Microsoft Entra ID. Here’s how Workforce Identity Federation helped them solve both problems. Read more.
The risk hiding behind exposed MCP servers: Learn how unauthenticated model context protocol (MCP) servers are opening doors to sensitive cloud data, IAM, and command execution. Read more.
Agentless threat detection: Illuminating cloud blind spots: Learn how Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks. Read more.
AlloyDB adds group authentication to secure enterprise scale and AI agents: We’re bringing identity-driven access control to your enterprise workloads through IAM group authentication for AlloyDB, now available in preview. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c2c7e150>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Updated cyber threat actor naming system: Google Threat Intelligence Group (GTIG) has begun rolling out a unified naming schema for tracking threat actors. This new naming taxonomy represents an effort to standardize tracking across platforms and public reporting. Read more.
Demystifying AI exploits: A blueprint for AI-assisted vulnerability management: Concerned about how to safely integrate AI capabilities into vulnerability management workflows? Here’s actionable guidance from Mandiant Consulting on establishing operational guardrails for AI assisted vulnerability management, including detailed scenarios. Read more.
GhostApproval: A trust boundary gap in AI coding assistants: Learn how Wiz uncovered a category-level blind spot in modern AI coding assistants, and why the human-in-the-loop safety model fails against this classic threat. Read more.
The risk of exposed cloud functions and how to harden: Mandiant uses recent lessons from customer engagements to describe attack scenarios and provide actionable guidance on how to secure serverless environments. While this analysis focuses on hardening strategies for Google Cloud Run services and functions that must remain publicly accessible, these principles apply universally to any public serverless deployment. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: CISO tested, board approved: Noah Korba, vice-president, Digital Core, Cybersecurity, and Enterprise Architecture, General Mills, goes under the hood of Mills Collaborative Recovery, the company’s intensive, annual two-week drill that recovers 90% of their Google Cloud estate to test real-world cyber resilience. Listen here.
Cloud Security Podcast: Creating trust at global scale with local AI: Shuman Ghosemajumder, CEO, Reken, traces the evolution of automated fraud, from Gmail's early invite days to the origin of credential stuffing. Listen here.
Defender’s Advantage: Shadow LLMs, agentic identities, and securely integrating AI: Join Muhammad Muneer, technical manager, Incident Response, Mandiant, as he unpacks the stark realities of enterprise AI adoption. Listen here.
Behind the Binary: The challenges of reversing modern languages: Jae Young Kim from the Mandiant FLARE team discusses navigating how software has evolved, and what it actually takes to reverse engineer modern compiled languages like Go and Rust. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

AlloyDB adds group authentication to secure enterprise scale and AI agents

Thu, 30 Jul 2026 16:00:00 +0000

Database security traditionally relies on a fragile balance between the granular control developers need and the administrative overhead of managing thousands of individual database passwords. Between managing AI agent access, rotating static credentials, handling employee on-boarding and off-boarding, and auditing access logs, passwords remain an operational tax — and a potential security vulnerability.

At Google Cloud, our goal is to help make database access transparent, secure, and passwordless.

Today, we are taking an important step forward in that journey. We’re announcing Identity and Access Management (IAM) group authentication for AlloyDB, available in preview. This capability brings identity-driven access control to your enterprise workloads.

Cloud SQL customers have already adopted this authentication pattern with great success, and this launch unifies our security stance across both services.

The problem with individual scale

For years, both Cloud SQL and AlloyDB have mapped individual Google Cloud identities directly to database users using native IAM authentication. However, at enterprise scale, managing access on an individual basis can introduce significant complexity.

Without group-based management, scaling to hundreds of instances and thousands of users creates distinct challenges:

On-boarding bottlenecks: Every new team member requires individual database user provisioning.
Off-boarding risks: Ensuring an employee’s access is entirely removed across a distributed database environment can complicate auditing.
Policy drift: Maintaining identical permissions across development, staging, and production systems becomes highly error-prone.

Faced with these challenges, it is tempting to use a single, powerful user or service account to serve a whole application. However, oversimplifying access for such powerful application accounts comes at the cost of risk exposure and loss of granular auditing capabilities.

Securing the future of agentic AI

The scale challenge isn't just about human users anymore. As organizations deploy an increasing number of AI agents, managing database identity and access controls will become more complex.

If an AI agent connects to a database using a generic, shared account, or a broad service account, it risks acting as a confused deputy. When using credentials with overly-powerful permissions instead of carrying through the user’s identity, an agent could access or modify data beyond what the end user requesting the action is authorized to see. Crucially, it can hide individual accountability from audit logs because actions map to a generic service account.

Granular authentication can help mitigate this risk. Agents can pass the end user’s specific identity and authentication scope through to the database layer so that queries are run on behalf of the user, limiting data access to objects that an end user is allowed to.

Passing user group identity through an AI agent to AlloyDB allows the database to authorize access and record precise audit trails.

IAM group authentication simplifies this architecture. Instead of managing micro-permissions for every combination of agent and user, security teams can define up to 200 functional Google Groups (such as financial-agents@company.com or regional-analysts@company.com). Google Cloud’s managed database infrastructure validates the user's group context, helping ensure the database authorizes data access at the database or table level while audit logs capture exactly what data was accessed, modified, and on whose behalf.

Proven value for digital leaders

Enterprises are already improving their operational velocity by adopting centralized identity principles. Bilt, a leading platform rewards program, uses our unified approach to help enhance the security of its high-scale database environments:

"By combining AlloyDB’s group-based IAM with our automated group management and Privileged Access Manager (PAM) entitlements, we've eliminated the risk of shared credentials entirely. Database and role provisioning are now fully templated from day one, allowing our engineers to securely access only the data they need and exactly when they need it," said Kosta Krauth, CTO, Bilt.

A unified blueprint for passwordless access

With this launch, Google Cloud provides a unified approach for access control across both Cloud SQL and AlloyDB. Organizations can now enforce a standardized, defense-in-depth access strategy across their relational database portfolio.

By pairing IAM group authentication with features like VPC Service Controls, Organization Policies, IAM conditions, and Private Service Connect, security teams can help ensure that database access — whether by a human engineer or an autonomous AI agent — is bound to verified corporate identities and secure network perimeters.

Moving toward a Zero Trust database future

Security shouldn't force a trade-off between engineering velocity and compliance. By integrating AlloyDB with Cloud Identity and Workforce Identity Federation, we are removing the friction of database administration while helping you implement a more secure architecture.

You can explore how to set up group-based database roles by trying out the feature today. You can find more recommendations and best practices for security and compliance in our documentation.

Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS

Tue, 28 Jul 2026 17:00:00 +0000

With cryptographically relevant quantum computers (CRQC) on the horizon, transitioning to quantum-safe digital signatures is critical to safeguarding long-term data integrity and authenticity. Organizations are steadily recognizing this urgency.

For example, the U.S. government announced an update to the timelines by which departments and agencies must transition to quantum safe digital signatures. To help with the transition, we are announcing the general availability of our quantum-safe digital signatures (ML-DSA, SLH-DSA) and post-quantum key encapsulation (ML-KEM) in Google Cloud Key Management Service (Cloud KMS).

The immediate challenge for your organization is functional: You need to sign massive data payloads without encountering the bandwidth and processing issues inherent with post-quantum cryptography (PQC). To proactively address these emerging threats and help you support compliance with regulatory obligations, you can use the suite of PQC digital signature algorithms available in Cloud KMS, which includes ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), featuring dedicated support for the efficient external-µ variants.

PQC digital signature algorithms in Cloud KMS

As standards and regulatory institutions are setting requirements and timelines for adopting quantum-safe algorithms, such as the National Security Agency’s CNSA 2.0, they’re underscoring the need for organizations to start their migration planning. To help you choose the specific security strength and signing method necessary for your applications, Cloud KMS gives you a broad selection of ML-DSA and SLH-DSA algorithms that are publicly available.

Cloud KMS now supports the following PQC algorithms and variants:

Algorithm Name	NIST Security Category	Variant Type	Description
SLH-DSA-SHA2-128s	Level 1	Pure, Pre-hash	Stateless Hash-Based Digital Signature for defense-in-depth
ML-DSA-44	Level 2	Pure, External-µ	High performance, Level 2 quantum security (equivalent to a collision search on SHA-256)
ML-DSA-65	Level 3	Pure, External-µ	Balance of security and performance, Level 3 quantum security (equivalent to an exhaustive key search on AES-192)
ML-DSA-87	Level 5	Pure, External-µ	Highest security for long-term data protection, Level 5 quantum security (equivalent to an exhaustive key search on AES-256)

The need for pre-hash and external-µ variants

The cryptographic elements used for digital signatures have a fixed or predictable size in memory. In contrast, the message being signed can range from a few bytes to massive files. This size disparity creates a major challenge when you use a separate, secure device, such as an HSM or a dedicated key management service.

These systems are often optimized for security and key operations, but they have limited bandwidth and processing power, making it impractical or impossible to securely transmit and process extremely large messages in the security boundary for signing. Therefore, the application first processes the large message locally using a cryptographic hash function (such as SHA2 or SHAKE) to create a fixed-size, small digest that is around 32 bytes. The application then sends this small digest to the hardware security module (HSM) or key management service for the actual signing operation using the private key.

NIST’s ML-DSA standard, FIPS 204 (Algorithm 7), uses an external-µ variant for its prehash functionality, which helps with this workflow. RFC 9881 Appendix D describes the details of external-µ. This method allows the application to calculate the digest (also called the message representative) externally and feed it into the pure ML-DSA signing algorithm. This offers the best of both worlds: The bandwidth efficiency of a pre-hash workflow, and full compatibility with pure ML-DSA verifiers.

These external-µ variants also bind the public key mathematically to the message representative to achieve non-resignability, an important security property that prevents an attacker from manipulating the message representative in a way that verifies under a different, possibly attacker-controlled key. You can learn more details here, and explore the BoringSSL implementation for a practical example of handling external-µ.

Google Cloud KMS now supports the pre-hash and external-µ variants. This enables high-performance, low-latency signing workflows that securely handles large payloads via external hashing, while integrating with pure verifiers.

Getting started with PQC signatures in Cloud KMS

Your applications can integrate these algorithms through the Cloud KMS API. Developers can use existing Cloud KMS capabilities to create, manage, and use PQC keys for signing operations. Detailed instructions and code samples are available in our KMS documentation to guide you through the process.

The PQC road ahead

The transition to a post-quantum cryptographic landscape is a collaborative journey. Adding PQC digital signatures in Google Cloud KMS is a significant milestone, helping you with your quantum-safe migration strategies.

We will continue to update our services to incorporate future NIST standards and guidance, helping you maintain the security of your critical systems. We look forward to collaborating with you on your specific cryptographic needs, and we welcome your feedback.

Best Buy scales AI workloads and secures access with Workforce Identity Federation

Tue, 28 Jul 2026 16:00:00 +0000

As Best Buy expanded its use of Google Cloud for advanced analytics and AI, its technology teams faced two significant scaling challenges: Mitigating risk and managing administrative friction when syncing thousands of backend users from Microsoft Entra ID.

The retailer solved both problems and paved the way for a massive cloud expansion by implementing Google Cloud's Workforce Identity Federation. This direct approach allowed developers to access cloud resources securely using their existing Microsoft credentials without a separate identity store, giving technical leadership confidence that access remains strictly controlled, auditable, and manageable at scale.

Replacing service accounts with direct federation

Best Buy historically maintained complex synchronization pipelines to copy backend users from Entra ID to Google Cloud. Because the organization used Cloud Identity without a Google Workspace deployment, it needed a more direct approach. Previously, Best Buy's Power BI integration with BigQuery relied on service account credentials.

This pattern can work at a small scale, but quietly becomes a liability as your team grows.

Manually rotating keys for service accounts meant tracking the credentials each team held, and accepting that every key was a potential security vulnerability. Service account keys created daily friction for the Best Buy security and platform teams, and the technical debt compounded as data access requirements grew more complex.

To support tens of thousands of users, Best Buy modernized its identity architecture. The team adopted Workforce Identity Federation to federate existing Entra ID identities directly into Google Cloud.

Now, when developers access BigQuery through Power BI, they authenticate as themselves using their existing Entra ID identity. They no longer need to rotate keys, worry about credentials exposed in chat messages, or guess who performed an action in the audit log.

The architecture relies on two components working together: Entra ID handles authentication, Workforce Identity Federation brokers the trust relationship between Entra ID and Google Cloud. This federation is stateless on Google's side. It validates tokens at the moment of access instead of syncing user records. Removing the service account key layer greatly reduces the credential management burden.

Architecture

The diagram below shows how identity flows from Entra ID through the Workforce Identity Federation to the services teams use at Best Buy. The key change from the previous approach is the removal of the service account key layer entirely; there is no credential to manage between Entra ID and Google Cloud.

Identity flows from Entra ID through the Workforce Identity Federation to the services teams use at Best Buy

Key implementation decisions

When implementing this architecture, Best Buy made several important technical choices:

Separate provisioning and SSO apps in Entra ID: The configuration follows the Entra ID provisioning and single sign-on (SSO) setup guide. You should separate the provisioning application from the SSO application in Entra ID. Running them as two distinct enterprise apps provides a cleaner separation of concerns; provisioning changes do not affect SSO configuration, and vice versa.
Place the automation OU carefully: You need to place the Entra ID provisioning service account in a separate organizational unit (OU) and explicitly disable SSO for that OU. This prevents a bootstrapping problem: If you enforce SSO globally, the provisioning account cannot authenticate to set up the provisioning in the first place.
Understand that syncless means stateless on Google's side: Workforce Identity Federation does not create or maintain user records in Cloud Identity. It validates tokens at the moment of access. This makes the architecture viable for Best Buy's target scale, because it eliminates synchronization lag, stale record cleanup, and separate provisioning pipelines.

Secure authentication for developers

For developers, the change was practically invisible. They authenticate once through their corporate Entra ID credentials, and access to BigQuery works automatically, whether through Power BI or direct API calls. The SSO experience matches everything else they access through their Microsoft identity.

For the security and platform teams, the benefits are significant. The attack surface from credential management disappears. Audit logs now show individual users instead of shared service account identities, and you can revoke access quickly based on the enterprise identity lifecycle rather than waiting for manual key rotation.

If you currently manage service account keys for developer access to Google Cloud, moving to Workforce Identity Federation is worth the effort. You gain significant security benefits, and the operational simplicity grows as your team expands. Best Buy is currently scaling this secure access to a broader workforce to power its future retail operations.

Expanding Workforce Identity Federation support

Google Cloud continues to make it easier for all organizations to bring their own identity providers. Recent updates simplify the setup for Ping Identity users and extend access to online billing accounts.

Ping Identity integration: If you use Ping Identity, you can follow a new, dedicated setup guide to configure federation. This guide provides step-by-step instructions so you can securely connect your workforce to Google Cloud resources.
Online billing support: Google Cloud now supports customers with online billing accounts. You can use Workforce Identity Federation for secure, syncless access without needing an enterprise billing agreement.

Get started

Google Cloud is committed to removing friction from cloud adoption and making it simpler for organizations to secure their environments. To explore these new capabilities and connect your organization's identity provider, read more about how Workforce Identity Federation allows you to federate identities directly, and explore our supported Google Cloud services.

Cyber Snapshot Report: Go beyond the toolchain and build enterprise resilience

Mon, 27 Jul 2026 16:00:00 +0000

Even as machine-speed attacks dominate the headlines, Mandiant’s view from the frontline reveals that the vast majority of successful intrusions still stem from fundamental human and systemic failures.

This operational break-down shows up pointedly in research from the M-Trends 2026 report. Exploits remain the most common initial infection vector for the sixth consecutive year at 32%, voice phishing surged to second place at 11%, and prior compromise was the number one confirmed vector for ransomware-related incidents, according to the report.

To stay ahead, leaders should shift from prevention-focused strategies to an operating model where compromise is anticipated, exploitation is recognized as inevitable, and a continuous, intelligence-led feedback cycle leads their defense. Business and security leaders should rethink how they architect and implement resilience strategies and train cross-functional teams. At the same time, they should also systematically address technical debt and organizational security culture.

To help your team navigate this reality, we have curated the frontline insights and blueprints you need to turn potential organizational crises into manageable events in the newest Defender’s Advantage: Cyber Snapshot Report.

Hardening architecture to contain blast radius

When we accept that intrusions will happen, the goal of security shifts from keeping attackers out to containing their impact.

Ransomware operators now aggressively target recovery paths — virtualization hypervisors, backup environments, and privileged access management (PAM) vaults — to deny organizations the ability to restore operations and maximize the pressure to negotiate. Hardening the architecture means implementing strict credential separation and air-gapped isolated recovery environments (IRE) to help verify that a compromise in the production network can not destroy backups.

However, containing the blast radius also requires securing soft entry points beyond traditional data centers — starting with your executives and high-value personnel. Threat actors increasingly target personal digital footprints, including personal devices, home networks, and family members, as entry points into critical corporate infrastructure.

A resilient posture should expand to protect this extended ecosystem, integrating digital footprint management with traditional executive protection programs.

Forging readiness for the inevitable crisis

While architectural guardrails can limit the physical reach of an attacker, human readiness and decision-making often determines how quickly your organization can respond and recover.

This capacity can only be forged from first-hand experience. While policy can encourage its growth, enabling a culture of "safe failure" supported by immersive learning and mentoring can help teams to build the collective muscle memory needed to manage high-stress incidents.

This human readiness is tested even further as adversaries embrace automation. Recent research by the Google Threat Intelligence Group (GTIG) identified the first known zero-day exploit developed with AI. This finding, combined with the intense industry focus on AI-driven vulnerability discovery, has driven many organizations to search for a quick technological countermeasure.

While AI-assisted discovery provides advanced technical capabilities for defenders, it requires integrating these automated tools into a mature, structured program that aligns people and processes. By transforming raw discovery into a continuous, risk-based readiness capability, teams can overcome alert fatigue and achieve both machine-speed execution and strategic control.

Activate your Defender's Advantage today

Technology alone will not define your cyber defense outcomes. True resilience lies in preparing your team, hardening your architectures, and practicing under pressure.

To help arm your organization with the frontline insights needed to navigate evolving threats confidently, you can download your copy of The Defender’s Advantage: Cyber Snapshot Report, Issue 8, today.

Now in preview: Find and fix software vulnerabilities with CodeMender

Tue, 21 Jul 2026 15:00:00 +0000

As adversarial AI threats accelerate attacks on code, security teams must counter them with machine-speed defenses that can automate code remediation and fight AI with AI.

CodeMender is our managed code security agent, and starting today, we're bringing its code scanning and remediation capabilities directly to you in preview.

CodeMender offers access to our generally available models via Gemini Enterprise Agent Platform, or it can be deployed as a core component of AI Threat Defense.

CodeMender also aligns with our multi-model approach, so you can choose the right model to optimize for cost, speed, and deep scanning performance. It will support third-party frontier model options later this year.

Watch this overview of CodeMender in Gemini Enterprise Agent Platform.

CodeMender can help you advance from passive scanning to automated code remediation, and reduce zero-day risk. It examines and remediates existing code security issues without sacrificing development velocity by:

Deploying the best-fit model. You can choose from multiple models to optimize for costs, speed, deep scanning, and coding performance.
Automating machine-scale remediation. You can now eliminate remediation bottlenecks caused by manual verification and patching, while keeping developers in the loop.
Prioritizing fixes by exploitability. You can run proof-of-concept exploits and execute simulations to verify that vulnerabilities in the code are exploitable, and prioritize resources on fixing the most critical issues first.

Find and fix vulnerabilities with AI

Born from Google DeepMind's pioneering AI research, CodeMender transforms vulnerability management from a manual bottleneck into an autonomous, high-speed system. Your developers and security practitioners can automatically scan software for flaws, verify them with executable exploits, and remediate them with tested code fixes.

“At Salesforce, trust is our number one value, and protecting customer data means continually raising the bar for how we find, validate, and mitigate risks. CodeMender brings AI into a critical part of the security lifecycle by accelerating the path from validated vulnerability to tested fix. As AI reshapes the threat landscape, capabilities like this help strengthen resilience and give our customers the confidence to keep innovating,” said Iain Mulholland, CISO, Salesforce.

"CodeMender consistently identified critical vulnerabilities that our other AI-enabled tools completely missed. It doesn't just find theoretical flaws — it proves the immediate risk and delivers targeted, validated fixes that secure our environment without disrupting core business logic," said Scott Ponte, head, Security Operations, Robinhood.

"CodeMender is fast, comprehensive, and genuinely ambitious about closing the loop from detection to fix, enabling teams to secure their software supply chain without losing velocity," said Ashwin Kannan, principal AI engineer, Office of the CTO, Palo Alto Networks.

How the CodeMender agent works

We’ve fine-tuned CodeMender’s harness to be continuously updated with the latest Google DeepMind research, including the up-to-date agent skills, security tools, and system prompts.

Operating in the secure-by-design Agent Platform, CodeMender is protected by enterprise-grade, built-in governance and security guardrails, including secure traffic routing through your VPC, data isolation and encryption, and zero retention of source code data.

As an agent, it can integrate with existing continuous integration and continuous delivery (CI/CD) workflows, or run directly in local developer environments using a lightweight command-line interface (CLI) client.

You can also configure CodeMender to scan and analyze code in a sandbox that you manage. The agent connects to your code repositories and works with developer tools, such as VS Code and Antigravity, to safely analyze first-party, open-source, and third-party software.

Scan: Find hidden vulnerabilities with flexible model scanning

CodeMender scans for top vulnerability classes and understands the unique context, goals, and functionality of your software repositories and applications.

Scan: Discovered new vulnerabilities and categorized by severity and type.

CodeMender’s harness with security context helps you discover sophisticated vulnerabilities that static and model-only scanning miss. These scans look for hard-to-find vulnerabilities like memory corruption, injection, web security issues, cryptographic flaws, and insecure data handling. CodeMender supports common software languages including C/C++, Go, Java, Python, Ruby, Rust, and TypeScript.

Verify: Simulate and verify exploits to reduce noise

CodeMender can help cut alert fatigue and false positives by proving a vulnerability presents a legitimate risk before fixing it. The agent goes beyond static code-pattern analysis by simulating an attack with exploit code it builds and runs in an isolated, customer-managed sandbox.

Verify: Creates verification plan and builds and tests exploits in your sandbox environment.

The agent uses this proof-of-concept exploit to verify that the security flaw poses a legitimate risk. This critical verification phase allows your security practitioners and developers to prioritize validated risks by eliminating false positives.

Remediate: Automatically generate and test code fixes

Identifying risky security flaws is only half the battle. Once a vulnerability is verified, CodeMender automatically generates a secure patch to resolve the issue. The fix is delivered as a code difference directly in developer tools, so it can be integrated into existing development workflows.

Remediate: Generates and tests code fix with code diff for developer review and approval.

CodeMender further strengthens the fix by using LLM-as-a-judge to ensure it doesn’t disrupt existing application functionality. You can even provide context on your codebase's distinct coding conventions and styles so that CodeMender generates code that matches it. Developers remain in full control, manually reviewing and approving CodeMender's patches before any code is committed to the repository.

CodeMender in AI Threat Defense

When leveraged as part of AI Threat Defense, Wiz orchestrates agentic application security, analyzing applications to prioritize investigations. It calls CodeMender to scan code (coming soon), enrich findings within the Wiz Security Graph with deployment context, and trigger Wiz Red Agent for AI pentesting to prove exploitability, ensuring that teams focus on the highest-risk vulnerabilities.

Through Wiz, AI Threat Defense calls CodeMender to scan code, enrich findings, and trigger AI pentesting.

Wiz serves as a command center for governing and scaling remediation in AI Threat Defense. The Wiz Green Agent orchestrates this lifecycle by directing CodeMender to generate and test high-fidelity patches enriched with application context from the Security Graph. This workflow empowers teams to resolve complex vulnerabilities with unprecedented speed and precision.

How to get started with CodeMender

Consistent with our multi-model approach, CodeMender can help you optimize for cost, speed, and deep scanning performance.

You can use CodeMender with our generally available Gemini models via Agent Platform, or deploy it as a core component of AI Threat Defense.

Separately, CodeMender with Gemini 3.5 Flash Cyber will be exclusively available to a small set of governments and trusted partners. We plan to expand this access over time.

CodeMender is a critical step towards a continuous, self-healing agentic software development lifecycle, a future where code is autonomously secured, validated, and patched before it ever hits production.

You can learn more about CodeMender and review the documentation here.

Cloud CISO Perspectives: How AI leverages deep context as the defender’s advantage

Thu, 16 Jul 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for July 2026. Today, Francis deSouza, COO, Google Cloud and President, Security Products, explains the crucial role that deep context plays in creating an AI advantage for defenders.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7fa7d4605690>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How AI leverages deep context as the defender’s advantage

By Francis deSouza, COO, Google Cloud and President, Security Products

Francis deSouza, COO, Google Cloud and President, Security Products

Attackers are making headlines with AI, but defenders have a distinct and powerful advantage.

AI is rapidly transforming the cyberthreat landscape, driving unprecedented shifts in the scale, speed, and sophistication of attacks. Just recently, Google Threat Intelligence Group documented a critical milestone: the first known case of a zero-day exploit built entirely with AI. While we successfully disrupted their plans and got the vulnerability patched before launch, it highlights exactly what we are up against.

With AI agents, attacks are accelerating at machine speed. The handoff time between the first and second stage of an attack used to be eight hours; today, it takes just 22 seconds.

There’s an old saying in cybersecurity that adversaries only have to be right once, but defenders have to be right every time. That is the attacker’s advantage.

But AI is rewriting those rules, delivering a decisive defender's advantage built on deep context.

The AI Era: Attacker’s Profile vs. Defender’s Advantage

Aspect	Attacker's Profile	Defender's Advantage
Visibility	Limited to outside-in probing; little enterprise context upon entry.	Complete inside-out context; knows exact asset locations, application behavior, and team ownership.
Operational Speed	Executes multi-agent handoffs in 22 seconds.	Machine-speed defense; proactive mitigation in seconds (such as Morgan Stanley's 90-second resolution.)
Core Tactics	Multi-model phishing, deepfakes, AI-built zero-days, and model poisoning.	Closed-loop defense; continuous exposure mapping and accelerated code patching.

The unified blueprint: Google AI Threat Defense

Previously, enterprise context data was fragmented across disconnected security tools. Now, AI empowers defenders to synthesize this rich data into a unified, always-on, autonomous defense.

We built Google AI Threat Defense to combine Google’s security capabilities into a single platform: the advanced reasoning of Gemini, the contextual cloud power of Wiz, the code-level remediation capabilities of CodeMender, and the frontline intelligence of Mandiant.

Our platform transforms vulnerability management across a continuous four-step framework:

Stage	Technology & Actions	Strategic Value to the Enterprise
1. Prepare	Map exposed applications, APIs, identities, and runtime environments using Wiz. Simulate attack paths with the Wiz Red Agent.	Hardens the foundation to reduce internet reachability before vulnerabilities hit production.
2. Scan & Prioritize	Run multi-model scanning — using lighter models for broad coverage and Gemini frontier models for deep-dive analysis of high-risk assets.	Replaces massive alert lists with deep, context-driven risk validation, including an optimal cost per token.
3. Remediate	Deploy CodeMender inside developer IDEs/CLIs to auto-generate verified code fixes.	Replaces slow, manual patching with autonomous code-level remediation and memory-safe migrations.
4. Monitor	Deploy AI agents tied to Wiz to hunt for vulnerabilities and anomalies across network, identity, and application telemetry. Pair with Google Security Operations to rapidly hunt for unknown threats.	Establishes machine-speed runtime detection for zero-day response and threats against unpatchable environments.

To stop vulnerabilities before they hit production, Morgan Stanley partnered with Google Cloud and Wiz, aligning their strategy with the core principles of the AI Threat Defense framework: prepare, scan, remediate, and monitor. By replacing fragmented tools with this unified blueprint, Morgan Stanley collapsed its mean time to detect threats by 99.9%, shifting from a reactive 45-minute window to proactive mitigation in 90 seconds or less.

Google Cloud x Morgan Stanley: Redefining Threat Defense in the AI Era

Maintaining strategic human oversight

While human-speed execution cannot keep pace with automated threats, human management remains essential. We align autonomous AI agents directly with the human teams they support. In Wiz, for example, the Red agent automates penetration testing, the Blue agent drives threat investigations, and the Green agent accelerates cloud remediation.

Every AI conversation is a security conversation. That means securing AI infrastructure requires building from the ground up, and not bolting on.

This ensures autonomy under human supervision, empowering engineering and security teams to eliminate backlogs and secure the software development lifecycle without sacrificing speed.

What’s next: AI-native, agent-driven infrastructure

The foundation of your defender's advantage starts with protecting your environments — not just from outside threats, but from internal risks like shadow AI and unauthorized agents. When employees download models and deploy agents outside of IT oversight, they create silent logic breaches and data-poisoning risks.

The key to countering this is enforcing Zero Trust for AI, and directing teams toward approved architectures with proper governance. Every AI conversation is a security conversation. That means securing AI infrastructure requires building from the ground up, and not bolting on.

At Google, security is not just an added layer; it is our foundation. Our secure-by-default architecture automatically blocks nearly 15 billion unwanted emails and protects billions of users every day.

As the threat landscape matures, outperforming automated adversaries requires a platform built from the ground up to be AI-native and agent-driven.

Fight AI with AI. Learn more about how to secure your software lifecycle with Google AI Threat Defense.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c332a990>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=CmGWIwgHR60'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

FinOps for SecOps: How to optimize the agentic SOC for value: To be more resilient in AI adoption, CISOs should develop a disciplined "FinOps for SecOps" blueprint that maximizes threat disruption while keeping control over compute costs. Here's how. Read more.
New IDC study: How Mandiant transforms security into a competitive advantage: A new IDC Business Value White Paper found that you save an average of $4.3 million, driving a 268% three-year ROI, with Mandiant Consulting. Read more.
Drive proactive security, prioritize risks with Google Threat Intelligence and Wiz ASM: To help you match your real-world exposures with real-time adversary activity, we’ve begun integrating Google Threat Intelligence with Wiz Attack Surface Management. Read more.
Shift into high gear with agents: Securing the software-defined vehicle: To better support and secure SDVs, Google Cloud and Valtech have partnered to develop Nexus SDV, a highly-scalable, AI-enabled connected vehicle platform. Read more.
Meet the 33 cybersecurity startups joining the Gemini Startup Forum: Our flagship Google for Startups program, Gemini Startup Forum: Cybersecurity, has selected its first 33 trailblazing startups. Read more.
Introducing k8s-aibom on GKE for automated AI bills of materials: We’re open-sourcing k8s-aibom, a Kubernetes controller that continuously monitors environments to detect AI runtimes and generate standard ML-BOMs. Read more.
BGP route policies: Top 3 use cases by customer demand: We detail the three most impactful use cases for Cloud Router BGP route policies that have emerged since 2025. Read more.
Contributing to U.K. financial sector resilience as a critical third party: The U.K. Treasury has designated Google Cloud EMEA as a critical third party (CTP) to the U.K. financial sector under the CTP regime. Here’s how that helps you. Read more.
Google Cloud confirmed to offer a safer choice for EU public sector organizations with Dutch DPIA approval: We understand that for the EU public sector, data protection is a prerequisite. We’re excited to reinforce this commitment with a major milestone. Read more.
Why IaC coverage belongs on your security dashboard: Rethinking infrastructure-as-code coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed. Read more.
Inside the ProdSec playbook: Operationalizing Wiz for end-to-end cloud security: Rethinking infrastructure-as-code coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed. Read more.
Build AI security agents with Wiz MCP: Power AI-driven security with trusted security context, Wiz AI Agents, and Wiz AI Skills. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c3329450>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

A look at the drivers, dynamics, and applications of the pro-Russia influence ecosystem: Four years into Russia’s full-scale invasion of Ukraine, the pro-Russia influence ecosystem has evolved from a tool of war back into a global strategic asset. The interconnected nature of the ecosystem's disparate components makes it resilient to limited scope disruptions, a factor that defenders need to consider to mitigate pro-Russia influence threats. Read more.
Google’s continued disruption of malicious residential proxy networks: In coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks. Read more.
GhostApproval: A trust boundary gap in AI coding assistants: Learn how Wiz uncovered a category-level blind spot in modern AI coding assistants, and why the human-in-the-loop safety model fails against this classic threat. Read more.
The latest addition to Turla’s intelligence gathering apparatus: Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla, one of the oldest known cyber espionage groups, since at least December 2022. As part of our continued tracking of this group, we’re providing an overview of our STOCKSTAY analysis, a timeline of key developmental and operational observations, and detailed similarities to KAZUAR to contextualize this new capability in Turla’s arsenal. Read more.
Recovering active ADFS signing keys via Machine DPAPI: During a recent red team engagement, Mandiant discovered that when ADFS certificates are manually rotated, configuration drift can silently leave active signing keys exposed in Machine DPAPI. Here’s how to defend against it. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Building an AI-pilled, solo vibe-coded, Clickhouse-based SIEM: Dan Lussier, founder, Nano, unpacks how he vibe-coded an entire SIEM from scratch during his end-of-year holiday break. Listen here.
Cloud Security Podcast: Scaling lessons, from leading the NSA to defending the world: Morgan Adamski discusses how public-private partnerships and the shift to cloud infrastructure have transformed cybersecurity defense through improved intelligence sharing and collective trust. Listen here.
Cloud Security Podcast: Closest alligator to the canoe: How transforming the SOC became P0 for Lloyds Bank: Matt Row, chief security officer, Lloyds Bank, explains the bank's digital transformation strategy, highlighting how it modernized its security operations center to achieve a 20x reduction in human-reviewed alerts. Listen here.
Defender’s Advantage: Human-machine teaming and applying AI to frontline threat intelligence workflows: Jake Nicastro, AI lead, Frontline Intelligence Operations, GTIG, details how his team is shifting from simple prompt engineering to more advanced agentic workflows, focusing on a model of human-machine teaming. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Securing the AI supply chain on GKE: Introducing k8s-aibom for automated AI BOMs

Mon, 13 Jul 2026 16:00:00 +0000

How should your security team manage shadow AI? Workloads deployed by developers without formal registration can often evade traditional security scanners, because organizations are reluctant to slow down development and compromise stability by demanding privileged Daemonsets, kernel-level access, and manual pod-spec edits.

To break this deadlock, today we are open-sourcing k8s-aibom. This lightweight, unprivileged Kubernetes controller continuously monitors the cluster API and container environments to automatically detect running AI runtimes (like vLLM and Triton) and generate standard CycloneDX Machine Learning Bill of Materials (ML-BOMs).

By providing automated, audit-grade visibility directly from runtime execution — regardless of whether the workload was formally registered — k8s-aibom can help teams safely move AI projects from pilot to production without developer integration friction.

The architecture of zero friction

k8s-aibom is designed from the ground up to respect both the CISO mandate for total visibility and the SRE mandate for cluster stability. It deploys as a single, unprivileged Deployment in the k8s-aibom-system namespace. It involves zero developer friction — no sidecars, no eBPF kernel modules, no privileged DaemonSets, and no modifications to existing developer pod specifications.

k8s-aibom watches for AI workloads and produces BOMs.

The discovery pipeline executes through four clear stages:

Scrape cluster workloads: The controller continuously monitors KServe resources, Deployments, StatefulSets, DaemonSets, and Jobs across the cluster.
Identify AI stacks: Advanced pattern matching inspects container images, environment variables, and command-line arguments to detect serving runtimes (vLLM, Triton Inference Server, TGI, Ollama), autonomous agent frameworks (LangChain, AutoGen, CrewAI), vector databases and RAG stores (Milvus, Qdrant, pgvector), as well as distributed training jobs and evaluation harnesses.
Generate standard manifests: The controller compiles the discovered artifacts into formal OWASP CycloneDX 1.6 Machine Learning Bill of Materials (ML-BOM) documents.
Export to sinks: The controller attaches the resulting ML-BOM directly to the custom resource status (status.bomDocument) of an in-cluster AIBOM Custom Resource (CR) and routes it to optional external sinks, including Google Cloud Storage buckets and external webhook endpoints.

Application teams do not need to modify their pod specifications, inject sidecar containers, or alter their continuous integration and continuous delivery (CI/CD) pipelines. Furthermore, k8s-aibom treats the Kubernetes cluster state as a pure functional input: Identical cluster inputs produce byte-identical ML-BOM documents. This deterministic property makes k8s-aibom an ideal fit for GitOps workflows, enabling site-reliability engineers (SREs) to perform exact diffs and trigger precise change-detection alerts when AI dependencies drift.

Where existing AIBOM tooling falls short

Many AI BOM solutions offer build-time scanners producing BOMs from artifacts at rest. These tools help you track the code that was intended to be deployed.

Commercial AI security platforms extend the picture with cloud-native posture management, but typically through external scanning shaped around vendor-specific data models. Few, if any, of these tools help compliance reviewers, security operations (SecOps) teams, and platform engineers understand what is running right now, what is it connected to, and how can we verify those assertions.

We purpose-built k8s-aibom to bridge that gap. It produces BOMs from live cluster observation rather than artifact scanning, emits standards-conformant CycloneDX 1.6 ML-BOMs that integrate with the broader OWASP and Open Source Security Foundation (OpenSSF) supply-chain ecosystem rather than vendor-proprietary formats, and runs as an unprivileged controller on any conformant Kubernetes cluster — making it complementary to existing build-time and posture-management tooling rather than a replacement for either.

The Confidence Model: Separating intent from inference

For compliance auditors and SecOps engineers, raw telemetry is often noise. Standard monitoring tools indicate that a container is running, but can’t prove whether an AI model was explicitly configured by a platform engineer or dynamically pulled by an autonomous script at runtime. k8s-aibom solves this ambiguity through its deterministic Confidence Model, categorizing discovered assets into distinct tiers:

Declared: Explicitly defined by the customer or developer in the workload configuration (For example, explicitly passed container arguments such as --model meta-llama/Llama-2-7b.) A “declared” confidence detection represents clear human intent.
Inferred: Derived autonomously by the controller's pattern-matching engine through deep inspection of container images, environment variables, and execution profiles. (For example, identifying ^vllm/.* container signatures.)
Unresolved: Applied to workloads where an active AI presence is detected, but exact model parameters, weights, and versions can’t be deterministically established. An “unresolved” confidence detection immediately flags the workload for targeted security review.

This structured taxonomy allows compliance reviewers to instantly separate explicit engineering intent from machine inference, establishing an unassailable chain of trust during audits.

Immutability and least privilege: Building an audit-grade security model

Auditors remain deeply skeptical of standard observability telemetry because logs and metrics can be modified, dropped, and tampered with by compromised nodes or elevated administrators. k8s-aibom establishes an audit-grade evidence trail built on strict least-privilege isolation and data immutability.

The controller operates under a dedicated Kubernetes service account bound to a minimal Identity and Access Management (IAM) Workload Identity. It acts as the sole identity authorized to write BOM records to external storage sinks, requiring only roles/storage.objectCreator permissions.

To satisfy the most stringent audit and evidentiary standards, the Google Cloud Storage external sink implementation enforces DoesNotExist preconditions on object creation. Once an ML-BOM is written to the Cloud Storage bucket, the object becomes cryptographically immutable.

It can’t be silently overwritten, modified, or retroactively tampered with by compromised cluster actors or rogue workloads. SecOps teams gain absolute assurance that the historical audit log presented to regulators represents an unalterable record of cluster execution.

Accelerating governance readiness: Mapping to global regulatory frameworks

By automating the generation of standardized CycloneDX 1.6 ML-BOMs, k8s-aibom directly bridges the gap between low-level Kubernetes runtime state and high-level governance frameworks. It unblocks stalled GKE AI deployments by providing the foundational empirical data essential to major global standards:

EU AI Act: Designed to help organizations align with Article 12 (automated logging and record-keeping for continuous traceability) and Article 50 (transparency obligations for AI systems). By automatically cataloging serving runtimes and agent stacks, the tool helps simplify the gathering of technical evidence that may be needed during compliance audits.
NIST AI Risk Management Framework (AI RMF): Provides continuous, empirical asset visibility that can help support the Govern, Map, Measure, and Manage functions, helping shift compliance workflows from purely manual checks toward more automated asset inventory tracking.
ISO/IEC 42001:Supports compliance efforts for AI management system asset discovery and tracking, reducing the reliance on manual spreadsheets or periodic snapshot audits for inventory validation.

Getting started

It’s rare that a technical solution like k8s-aibom can help mitigate the multi-faceted problem of shadow AI, impacting CISOs, governance, risk, and compliance teams, SecOps teams, platform engineers, and developers.

To learn more by inspecting the controller, review the CRD definitions, and contribute to the open-source k8s-aibom project, please visit the k8s-aibom GitHub Repository.

Contributing to U.K. financial sector resilience as a critical third party

Fri, 10 Jul 2026 17:00:00 +0000

At Google Cloud, we take our role in the financial ecosystem very seriously. We firmly believe that operational resilience is essential to driving and sustaining responsible innovation.

Today, we mark a milestone in our ongoing commitment to the financial sector that’s directly relevant to our customers in the U.K. On July 10, the U.K. Treasury designated Google Cloud EMEA as a critical third party (CTP) to the U.K. financial sector under the CTP regime.

This designation takes account of the number and type of U.K. firms using our services and the materiality of their use cases. We acknowledge HMT’s decision on the systemic impact of our services and are committed to playing our part in safeguarding the stability of, and confidence in, the U.K. financial system.

Building sector-wide resilience

As a CTP, Google Cloud EMEA will be directly overseen by the Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA). These authorities are known collectively as the U.K. financial regulators.

In their oversight of CTPs, the U.K. financial regulators will aim to build sector-wide operational resilience. Google Cloud wholeheartedly supports this objective.

We will continue to engage constructively with the U.K. financial regulators as we enter this new phase of deeper collaboration. We are confident that this ongoing dialogue will deliver tangible benefits for the U.K. financial sector.

Enabling customer success

Alongside our commitment to effective oversight, Google Cloud remains dedicated to supporting our customers with the requirements for U.K. firms relating to operational resilience, outsourcing and third party risk management.

We provide insight into how Google Cloud can help customers meet their operational resilience obligations under PRA Supervisory Statement 1/21 in our SS1/21 whitepaper.
We explain how Google Cloud’s contracts for UK firms address the outsourcing and third party risk management requirements under PRA Supervisory Statement 2/21 our SS2/21 mapping.

While the CTP regime does not replace these requirements, it is designed to complement them. We are confident that it will.

Looking ahead

We look forward to collaborating with the U.K. financial regulators under the CTP regime. We will do so with the same commitment to ongoing transparency and assurance that we offer our customers and their regulators today.

As this new era begins, our core objective remains unchanged: to ensure Google Cloud is the most secure, scalable, and resilient platform for digital transformation.

Meet the 33 cybersecurity startups joining the Gemini Startup Forum

Wed, 08 Jul 2026 13:30:00 +0000

Startups are at the forefront of tackling some of the world’s most complex challenges, especially in cybersecurity, where new ideas and adaptability are always needed. These companies are embracing AI as a powerful tool, enabling them to scale their impact.

Google believes that enabling the next generation of AI-native cybersecurity startups will have a positive impact across the globe. Today, we are thrilled to announce that our flagship Google for Startups program, Gemini Startup Forum: Cybersecurity, has selected its first 33 trailblazing startups. This exclusive forum is designed to address critical domains and foster deep dialogue on AI integration in cybersecurity.

Every startup will be able to work on their roadmap alongside AI and cybersecurity specialists from Google DeepMind, Google Cloud, and Wiz. This year’s cohort is organized into six specialized focus areas, from autonomous agent protection to post-quantum cryptography.

AI agent security and governance

Capsule Security (Israel): Delivers runtime protection and behavioral monitoring for autonomous AI agents. The platform tracks agent activities, API calls, and tool usage in real-time to prevent unauthorized actions and data exfiltration across software-as-a-service (SaaS) and endpoint agents.
Evoke Security (United States): Functions as an endpoint detection and response (EDR) platform designed for AI agents. It deploys an endpoint sensor to scan for risky agent configurations, monitor runtime behavior, and block unauthorized skill executions.
Manifold Security (United States): Provides agentless detection and response for AI agents using graph analysis and runtime monitoring. By tapping into open telemetry and API hooks, the platform maps agent behavior and connections to identify anomalies without installing software on local machines.
Mirror Security (Ireland): Specializes in data-in-use protection for AI workloads using fully homomorphic encryption. The platform enables enterprises to perform model inference, database searches, and agent communications directly on encrypted data without decrypting it.
Onyx Security (Israel): Offers an AI control plane to discover, govern, and monitor autonomous AI agents across enterprise environments. The platform analyzes agent posture, tracks session token streams, and uses a model mesh to enforce context-aware compliance policies.
Refractal (United Kingdom): Builds runtime security and governance, risk, and compliance (GRC) infrastructure to monitor and govern enterprise AI agents. It intercepts agent actions, evaluates them against organizational policies and European regulations, and generates cryptographic audit logs.
Unbound Security (United States): Acts as an agent access security broker (AASB) that provides visibility and governance for developer-focused coding agents. It deploys endpoint hooks to monitor terminal commands and restricts agent actions based on user identity and group permissions.
XOR (United States): Produces reinforcement learning training data and environments to help AI models autonomously find and fix their own security flaws. The company provides verified task trajectories and benchmarks that developers use to train secure coding agents.

Application security and vulnerability management

Aisy (United Kingdom): Models enterprise environments from an attacker's perspective to prioritize vulnerability remediation. The platform maps external attack surfaces, groups related assets into business-centered threat models, and identifies critical exploit chains.
Alt Security (Israel): Develops an agentic penetration testing platform that uses autonomous AI agents to perform security testing. The system automates reconnaissance, chains vulnerability findings to identify critical business risks, and validates exploits in sandboxed environments.
Arcjet (United States): Provides application security that executes natively inside developer codebases via an SDK. The platform handles bot detection, rate limiting, and prompt injection directly in the codebase, maintaining a low-latency decision loop.
Pixee (United States): Automates vulnerability triage and code remediation by converting scanner results into verified pull requests. The platform uses a context graph and a deterministic harness to generate codebase-compatible fixes that pass developer continuous integration (CI) pipelines.

Cloud, network, and infrastructure security

CloudFence (United States): Monitors a company's cloud network like an invisible overhead drone. It studies the normal patterns of how systems talk to each other and immediately alerts managers if a system starts talking to an unfamiliar location.
CyberSeQ (United Kingdom): Scans software code and digital pipelines to check if their encryption is outdated. It helps organizations plan their transition to modern, quantum-proof security keys.
Huskeys (Israel): Works as a smart tuner for a company's digital firewall. It automatically optimizes and adapts traffic filters in real-time, reducing false alarms so legitimate customers can visit websites without being blocked.
Native (Israel): Serves as a multicloud security control plane that manages built-in native provider controls across Google Cloud, AWS, Azure, and Oracle. The platform uses a simulation engine to preview the operational impact of security policy changes before deployment.
Prowler (United States): Automates cloud security posture management and compliance checks across multicloud environments. The open-source platform uses a database of community-driven security controls to identify and remediate misconfigurations.
QIZ Security (Israel): Manages enterprise cryptographic assets and compliance posture through a centralized dashboard. The platform maps certificates, databases, and source code into a knowledge graph to help organizations transition to post-quantum cryptography.
Tracebit (United Kingdom): Uses cloud-native decoys, or canaries, to detect infrastructure intrusions and unauthorized access. The platform deploys these decoy resources at scale via infrastructure-as-code to trigger alerts the moment an attacker moves.

Endpoint security and data protection

Bold Security (United States): Provides a user-space endpoint security agent that protects enterprise devices from data exfiltration and insider threats. The agent runs local classification models on-device, allowing for policy enforcement and data loss prevention without cloud latency.
Glow (Israel): Unifies endpoint, software, and AI agent monitoring into a single workspace protection layer. By using a team of collaborative AI agents, the platform maps organization-wide software footprints and blocks unauthorized browser extensions and plugins.
Jazz (United States): Modernizes data loss prevention (DLP) by analyzing user intent and business context rather than relying on static pattern rules. It uses a lightweight endpoint agent and an intelligent investigator to automatically triage and resolve data-flow alerts.
ORION Security (United States): Deploys an indicator-driven data loss prevention platform that tracks data lineage across endpoints, browsers, and SaaS tools. By mapping file movements in a graph database, the platform identifies exfiltration risks without requiring manual policies.
MokN (France): Combats credential theft through a proactive identity recovery platform. Its proprietary technology turns the tables on attackers by using ultra-realistic decoy access points to trick them into revealing the credentials they have stolen. This can help neutralize threats before the compromised credentials can be exploited.

SOC automation and offensive security

COGNNA (Saudi Arabia): Operates an agentic security operations center (SOC) platform that analyzes security alerts and automates threat response workflows. The platform ingests telemetry from existing endpoint and security information and event management (SIEM) tools, using AI agents to investigate incidents and reduce alert noise.
Latent Defense (United States): Builds foundational world models for cybersecurity to represent complex system architectures as dense, multi-dimensional graphs. The platform uses these graph representations to identify exploitable attack paths and test them with automated red-teaming agents.
Mate Security (Israel): Investigates security alerts at scale using an AI-native security operations platform. It integrates with existing SIEM and security orchestration, automation, and response (SOAR) tools to map asset relationships, automatically triage incoming alerts, and minimize false-positive rates.
Nrdsnipe (Sweden): Builds an AI-driven security testing platform, Hedgehog, that automates internal network penetration testing. Deployed directly in customer networks, it uses planner and terminal agents to map assets and construct exposure-based knowledge graphs.
RIFFSEC (Poland): Delivers an early-warning threat intelligence and attack surface management platform tailored for the central European market. It monitors the dark web, Telegram channels, and code repositories to identify leaks, exposed credentials, and phishing campaigns.
TandemTrace (Spain): Augments security operations teams with autonomous AI agents that analyze raw telemetry to investigate alerts and hunt threats. The platform connects directly to existing data lakes and SIEM APIs to build human-readable context around security incidents.

Security infrastructure and specialized services

Netsec (France): Manages the entire IT and cybersecurity lifecycle for mid-sized organizations through an all-in-one platform delivered directly inside collaboration channels. It automates user onboarding, device management, and SaaS posture remediation from a single control plane.
Revelum (United States): Detects and dismantles deepfake-driven fraud and impersonation campaigns at scale. The platform uses vision models and classification engines to analyze social media advertisements, verify biometric identities, and automate domain takedowns.
Synqly (United States): Provides a unified connectivity platform and API management control plane that simplifies integrations between IT and cybersecurity tools. It normalizes data schemas and acts as a deterministic middleware layer to facilitate bidirectional data sharing.

By collaborating with global specialists, these startups are well-positioned to build a safer, more resilient digital infrastructure. The Gemini Startup Forum is a benefit of the Google for Startups Gemini Kit, packed with APIs, tools, training and technical resources to help startups scale with AI. You can learn more about the kit here.

The threat landscape is always evolving. To meet this challenge, we will continue our commitment to Google for Startups. Over the past four years, we’ve supported more than 50 cybersecurity founders, including Authologic, BforeAI, Build38, Cerby, Crowdsec, and Risk Ledger.

This year's cohort reflects the industry's transition from perimeter defense to autonomous AI agent security — emphasizing enterprise governance and the safe deployment of self-governing AI. Looking ahead, the integration of these technologies will help define the next generation of proactive digital defense.

Drive proactive security, prioritize risks with Google Threat Intelligence and Wiz ASM

Tue, 07 Jul 2026 16:00:00 +0000

Being more proactive continues to be a leading goal for security organizations. As AI accelerates the pace of vulnerability discovery and exploitation, organizations will rely on the personalization of their security investments to help prioritize their defenses.

To help you be more proactive by matching your real-world exposures with real-time adversary activity, we’ve begun integration efforts between Google Threat Intelligence and Wiz Attack Surface Management (ASM).

By connecting exposure and validated exploitable risks directly to real-time threat intelligence, we can help you detect and prioritize external-facing exploitable issues and uncover logic-driven vulnerabilities with AI scanning at the speed needed for today’s defenses. This allows you to shift to a strategy that prioritizes actions based on the real-world threats that pose the greatest risks to your organization.

Combining these two perspectives on threats can help you move from reactive maintenance to a proactive security strategy. In addition to detecting your exploitable exposures, you gain insight into which of those exposures are being actively targeted by adversaries.

We will continue to build towards native integration that will feed exposure data directly into the Google Threat Intelligence correlation engine. This automated connection will help you focus on the exposures adversaries are targeting in the wild, and use our real-time threat intelligence to prioritize remediation efforts and threat hunting activities.

Building a proactive security strategy

Google Threat Intelligence provides global visibility into how adversaries operate, tracking their infrastructure and campaign activity in real time.

Wiz ASM maps your external attack surface across cloud, AI, software-as-a-service (SaaS), and on-premises environments to reveal exposed assets like domains, IPs, and APIs. It scans for exploitable vulnerabilities, misconfigurations, and default credentials to validate exploitability. It also scans for and validates exposed secrets and sensitive data.

At the same time, the Wiz Red Agent scans exposures with AI to uncover complex, logic-driven vulnerabilities by reasoning about applications behavior.

The power of this combination lies in the ability to prioritize and hunt with confidence:

Prioritize based on real-world activity: With the incoming integration, exposure data feeds into the Google Threat Intelligence engine. This helps you spot the exposures that adversaries are currently exploiting, allowing your team to focus remediation efforts where they are needed most.
Understand attacker behavior: When a critical risk is flagged, we plan to provide behavior-based guidance alongside the alert. This details how an attacker typically acts after exploiting a vulnerability, using specific host commands or malware, giving your defenders the context they need to hunt for active footprints inside your network.
Discover complex vulnerabilities: The Wiz Red Agent uses AI to scan for logic-driven vulnerabilities, such as authentication bypasses, business logic flaws, and multi-step attack chains, helping you uncover risks that traditional scanners often miss.

Get started with proactive defense

This combined approach is designed to help you streamline your security posture by reducing the noise and focusing on the signals that represent real danger to your organization. To get started with Google Threat Intelligence and Wiz ASM today, contact your Google sales representative.

Shift into high gear with agents: Securing the software-defined vehicle

Mon, 06 Jul 2026 16:00:00 +0000

The automotive industry is at a pivotal crossroads as it hits the gas on adopting new technology. The era of the traditional connected vehicle has shifted into the age of the software-defined vehicle (SDV), notable for rapid innovation with many new capabilities delivered over the air.

By integrating AI and agents, the next generation of SDVs will be capable of turning raw telemetry into actionable insights in real-time, allowing for a fundamental rethink of how vehicles interact with their environment and their users. To better support and secure SDVs, Google Cloud and Valtech have partnered to develop Nexus SDV, a highly-scalable, AI-enabled connected vehicle platform built on Google Cloud. This modular, developer-friendly and open-source solution is designed to manage up to 100 million devices, and features deep integration with Android Automotive OS (AAOS) to streamline data flows and in-vehicle experiences.

We are proud to announce the first release of the Nexus SDV open-source core that showcases how it can reduce total cost of ownership through Arm-based compute and Bigtable, while providing a AI-native environment for building the next era of automotive intelligence.

AI-driven experiences with Nexus SDV

Nexus AI serves as the platform’s intelligent engine, transforming the vehicle from a passive data source into a proactive, agentic partner. Using Gemini models and Gemini Enterprise Agent Platform, Nexus AI can analyze complex telemetry in real-time to provide information for autonomous decision-making and hyper-personalized driver assistance, effectively acting as an intelligent agent that anticipates user needs.

Crucially, this advanced intelligence is paired with a focus on significant total cost of ownership (TCO) reduction. By using high-efficiency Arm-based compute and Bigtable-optimized data storage, the platform lowers the operational costs associated with processing massive data volumes. This modular, AI-native architecture ensures that manufacturers can scale their fleet intelligence rapidly without the prohibitive cloud and development expenses traditionally associated with next-generation vehicle software.

Cloud-native under the hood

The architecture of Nexus SDV is built on a modular, cloud-native foundation designed to bridge the gap between the vehicle edge and the data center. Deep compatibility with AAOS is the keystone of the close integration between the cloud and the vehicle, and will help ensure that high-fidelity telemetry is ingested and synchronized in real-time. This robust data loop allows Nexus AI to quickly push intelligent updates and services back to the vehicle.

By providing this developer-friendly, open framework, Nexus SDV enables manufacturers to manage the entire lifecycle of a SDV with the scalability and reliability of the Google Cloud ecosystem.

Architecture for Nexus SDV.

Defense in depth with Google Cloud Security controls

By building on Google's secure foundations, including secure-by-design and Zero Trust architecture, Nexus SDV supports the heavy lifting of compliance and threat protection. To achieve this, the Nexus SDV architecture implements a comprehensive, defense-in-depth security model across six key elements:

Mutual TLS (mTLS) and public key infrastructure (PKI)
Nexus SDV relies on cryptographic trust chains to authenticate vehicles before any data exchange can occur. The infrastructure uses Google Cloud Certificate Authority Service (CAS) to manage distinct CA pools (server, factory, and registration CAs), ensuring a highly available and secure root of trust.

Specifically, the registration server enforces registration by forcing clients to present a valid "factory-issued" certificate during the initial TLS handshake, extracting and parsing the certificate directly from the connection stream to definitively prove the vehicle's identity. During registration, the server performs Certificate Signing Request (CSR) validation sent by the vehicle before issuing a new operational certificate.

Identity and access management
The system uses identity brokering where Keycloak is deployed as the central OpenID Connect (OIDC) identity provider. Vehicles authenticate against Keycloak using their operational certificate via mTLS to receive a short-lived JSON Web Token (JWT).

For fine-grained access control, a custom NATS Auth Callout service provides dynamic subject permissions: It intercepts all messaging broker connection attempts, validates the Keycloak JWT using public JWK keys, and programmatically maps the vehicle's roles to specific NATS subjects.

For secure service-to-service communication, it uses Workload Identity Federation so pipelines exchange GitHub OIDC tokens for temporary Google Cloud access, removing static credentials, while GKE Workload Identity allows Kubernetes Pods to access backend services like Bigtable by binding Kubernetes service accounts to Google service accounts.

Security is reinforced through restricted IAM scopes, ensuring dedicated service accounts are provisioned with minimal permissions, such as the data API being restricted only to reading from Bigtable. Using VPC-SC, Organization policy constraints and Private Service Connect (PSC) in your deployment context also helps you achieve secure foundations.

Secret management
Nexus SDV relies on centralized secret management to protect sensitive information. All sensitive configurations, database passwords, and cryptographic signing keys are generated dynamically during Terraform infrastructure provisioning and locked inside Google Cloud Secret Manager.

A secret fetching during deployment is used to avoid baking secrets into application code and container images. Instead, services pull signing keys and credentials directly into memory only at runtime, minimizing exposure both at rest and in transit.

Network isolation
To enforce network isolation, the underlying computer infrastructure is heavily shielded. Nexus SDV runs on private GKE clusters where worker nodes have no public IP addresses, preventing direct internet exposure. Additionally, the Keycloak PostgreSQL database uses Cloud SQL IAM Authentication, which allows the Cloud SQL Proxy to connect securely using IAM roles rather than relying on static database passwords or managing IP allowlists.

Secure AI Framework
Google Cloud secures these advanced AI capabilities through a comprehensive, enterprise-grade framework that prioritizes data privacy, model governance, and safe execution, based on guidance from the Secure AI Framework (SAIF). With Gemini Enterprise Agent Platform, security and governance are natively embedded into the machine-learning lifecycle through capabilities, such as dedicated Explainability and Safety controls, continuous Evaluation and Monitoring, and secure model registries.

You can learn more about how we secure AI here.

Data API
Instead of allowing downstream applications and external clients direct access to data stores like Bigtable, Nexus SDV routes data retrieval through a custom Data API. This microservice acts as a secure abstraction layer that translates strictly, such as querying specific vehicle IDs, sensor data types, and predefined time windows, into heavily constrained Bigtable row-range scans and column filters.

By doing so, it serves as a secure gateway that enforces structured data access patterns.

Start your journey with Nexus SDV

Nexus SDV represents a new era of automotive intelligence, delivering an agentic, secure, and cost-efficient platform that empowers manufacturers to harness the full power of AI in an open-source framework. You can learn more about how we are redefining the software-defined vehicle here.

New IDC study: The business value of Mandiant Consulting

Wed, 01 Jul 2026 16:00:00 +0000

Security leaders are now expected to protect business growth and clearly articulate security value to their board of directors, in addition to managing risk. While translating technical defense into measurable financial returns can be challenging, Mandiant Consulting can help you bridge the gap.

Organizations that engaged with Mandiant Consulting reported an average annual benefit of $4.3 million, driving a 268% three-year ROI, with a payback period of just 4.1 months, according to a new IDC Business Value White Paper commissioned by Mandiant. IDC based these findings on its standard ROI methodology and qualitative and quantitative interviews of current Mandiant customers, applying standard financial models. The interviewed organizations are large, highly-complex environments with an average of $17.3 billion in revenue and 74,000 employees.

At Google Cloud, we strongly believe that security is a strategic business enabler that can directly impact your bottom line.

One healthcare organization interviewed by IDC reported that its partnership with Mandiant completely changed the dynamic of its commercial conversations. "Mandiant has enabled us to engage more confidently with customers and position our security posture as a market differentiator, with security now consistently ranking among the top three reasons clients choose us. It has also contributed to reducing our insurance costs by $50,000 per year,” said the healthcare organization.

Frontline threat intelligence in action

CISOs consistently struggle with internal resource constraints and skill deficits, and internal security teams rarely have the time to track every emerging threat group. Mandiant addresses this by distilling findings and delivering frontline threat intelligence and guidance derived from over 500K hours of global incident investigations last year.

Instead of trying to monitor everything, resource-constrained teams can focus their limited hours on the specific threats that are most relevant to them and likely to target their specific industry and build specific targeted defenses. A retail organization highlighted how working with Mandiant experts allowed them to actively defend against targeted campaigns, like those from the Scattered Spider cybercrime group.

"One of the most significant accomplishments from using Mandiant has been their ability to help us create detection use cases specific to Scattered Spider based on their industry knowledge. This has enabled us to monitor, detect, and neutralize related attacks, which is a key reason we have avoided incidents,” the organization told IDC.

To ensure detections are built on solid foundations, many organizations also use Mandiant to run deep technical audits across their identity infrastructure — including Active Directory, privileged account management, and multi-factor authentication (MFA). This independent verification provides crucial reassurance to leadership, an energy-sector organization told IDC.

"Mandiant provides external assurance that our cyberprogram is thorough and validated from a risk management perspective. Their validation and recommendations have helped us reinforce that messaging to our board. They are highly professional, risk aligned, and among the most trusted,” they said.

Quantifying the business and operational impact

By synthesizing customer experiences, IDC quantified the broader operational advantages seen, on average, by customers who worked with Mandiant:

59% greater preparedness to successfully address cyberattacks.
45% overall improvement in cyber-resilience.
36% more efficient security analyst teams, allowing internal staff to focus on more strategic, growth-oriented initiatives.

To learn more about how security is a business enabler, register for our July customer webinar.

_{Source: IDC Business Value White Paper, Sponsored by Google, The Business Value of Mandiant Consulting (Doc #US54605426-BVWP, July 2026)}

Google Cloud confirmed to offer a safer choice for EU public sector organizations with Dutch DPIA approval

Wed, 01 Jul 2026 16:00:00 +0000

At Google Cloud, we are committed to providing public sector organizations around the globe with cloud technology that is highly flexible, scalable, and built with market-leading standards for data protection, sovereignty, and security. We understand that for public sector organizations in the European Union, confidence in data protection is not just a preference — it’s a prerequisite.

Today, we’re excited to announce a major milestone that reinforces this commitment for Google Cloud.

Dutch government DPIA confirms strong privacy foundation for Google Cloud

We have successfully collaborated with SLM Rijk, the Dutch government's strategic vendor management agency, who completed their rigorous data protection impact assessment (DPIA) of Google Cloud.

This engagement confirms Google Cloud’s strong commitment to strengthening trust in its privacy posture across the Dutch public sector. Given that all the key points raised during the DPIA have been successfully addressed (see SLM Rijk’s summary here), and that their DPIA concluded that there are no known high data protection risks when the recommended measures are implemented, the Dutch central public sector is now officially enabled to use Google Cloud with a clear path from a privacy-assessment perspective.

Accordingly, we encourage Dutch central public sector prospects and customers to engage with us to learn more about Google Cloud.

More broadly, we believe this outcome provides a strong foundation for public sector organisations across the Netherlands and beyond, to confidently evaluate and adopt Google Cloud, unlocking modernization and digital transformation securely.

This achievement builds upon our strong track record in the region, including the successful completion of the Dutch DPIA on Google Workspace. This previous success affirmed the safe use of Workspace across the Dutch public sector and educational institutions. Together, these assessments demonstrate Google's continued commitment to helping public sector organisations meet their privacy, security, and compliance requirements while benefiting from the innovation and scalability of Google Cloud.

Continued support for all customers on their compliance journeys

We welcome independent assessments that help strengthen trust, transparency, and accountability. The Dutch government's DPIA process represents an important example of constructive collaboration between public institutions, independent experts, and cloud providers to advance privacy protections.

Google Cloud remains committed to helping customers meet their compliance obligations while providing secure, transparent, and privacy-conscious cloud services.

We will continue investing in privacy-enhancing technologies, transparency initiatives, and customer controls to support organisations across Europe and around the world.

We know first-hand that conducting DPIAs can be a complex task, and we remain firmly committed to helping our customers navigate DPIAs with resources at our comprehensive DPIA Cloud Resource Center.

Cloud CISO Perspectives: How Google Cloud Security uses AI internally

Mon, 29 Jun 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for June 2026. Today, we’re discussing how we use AI to chart a path to autonomous software development lifecycle security.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c332a510>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Cloud CISO Perspectives: Our path to autonomous SDLC security

By Chris Betz, CISO, and Ruchi Shah, senior director, Security Engineering, Google Cloud

Chris Betz, CISO, Google Cloud

AI has upended the economics of exploiting vulnerabilities, effectively erasing the traditional patching window. To survive this new reality, security requires an autonomous defense.

To counter machine-speed, AI-driven threats, we’ve worked hard to transition Google Cloud’s security posture to an autonomous, proactive model. By embedding specialized AI agents directly into our software development lifecycle (SDLC), we’ve created automated guardrails that protect code at a scale and speed unreachable by human teams — and we’re taking steps to make those same guardrails widely available.

Ruchi Shah, senior director, Security Engineering, Google Cloud

How we designed agentic, secure SDLC architecture

Google Cloud deploys modular, interconnected AI agents across every stage of the software lifecycle to continuously harden products from code ingestion to production.

1. Design, review, and gate

Historically, launch intakes and threat modeling were manual bottlenecks. Today, Google Cloud engineering teams route product launches through an agent-based security review pipeline.

Agents cross-reference designs against a continuous control catalog of more than 200 rigorous security requirements. High-risk indicators are automatically triaged and flagged for human engineering intervention, while a dynamic product dossier updates in real-time to replace static threat models.

Google Cloud has embedded agentic capabilities across the entire SDLC flow to continuously harden products end-to-end.

2. Centralized AI code scanning and the Mantis framework

Naive, decentralized AI code scanning suffers from sloppiness, frequently hallucinating bugs and yielding true-positive rates under 7%. To solve this, we built Mantis, our core multi-agent orchestration framework designed specifically for scalable, context-aware repository analysis.

The core skills at the heart of Mantis are now open source to demonstrate the fundamental concept. We have a more full-fledged version running internally and securing our customers.

Mantis eliminates brute-force code ingestion by constructing a hierarchical security summary tree. By condensing individual files into directory and root-level summaries, Mantis reduces token overhead by over 85% while preserving critical structural context across massive repositories.

The architecture relies on a highly-coordinated workflow across new agents and existing technologies:

Strategist agent: Evaluates the high-level code structure, threat models, and dependency graphs to isolate risky architectural patterns, establishing a prioritized global plan of targeted investigation tasks.
Research agents: Acting as specialized domain investigators, these agents use internal code searches to drill into raw source files, examining data tracking, control flows, and sanitization logic.
Deduplicator, reviewer, and critic agents: Sanitize findings to filter out noise and eliminate false positives.
Reproduction sandbox: Automatically runs AI-generated proof-of-concept exploits in an isolated, emulated environment to verify real-world exploitability before alerting developers.

3. Self-healing fuzz testing

While code scanning provides breadth, dynamic fuzz testing uncovers deep runtime vulnerabilities. However, writing and maintaining fuzz harnesses are often a significant engineering bottleneck.

Our autonomous, multi-agent engine eliminates manual intervention:

Context and Drafting agents synthesize product logic and existing unit tests to author initial fuzzing harnesses.
Building and Testing agents execute the code and feed real-time compiler and linker errors into a Hallucination Cleaner agent, which acts as an automated mechanic to repair broken dependencies and build configurations.
Quality Analyzer agents monitor runtime execution, actively adjusting inputs to bypass code blockers and penetrate deeper into complex, stateful APIs.

4. The unified AI patching pipeline

Finding thousands of vulnerabilities at scale can create a dangerous remediation backlog without proper planning. To close the exposure window, our discovery tools route findings directly into an autonomous remediation pipeline:

The Reproduce agent replicates the crash in the sandbox.
The Bug Context agent maps the failure execution path.
The Patch agent generates a targeted code fix.
The Evaluation agent runs a rigorous regression loop (that re-compiles code and executes tests) to ensure the patch is safe. Only fully-validated fixes are submitted to a human reviewer.

5. Autonomous and secure posture management

Post-launch, we maintain security integrity with an autonomous security posture management (ASPM) system. By converting our security standard catalog into programmable skills files, the ASPM system continuously checks production systems for configuration drift, automatically triggering agentic remediation when a violation occurs.

Continuous augmentation via self-reflection

Stateless AI systems repeatedly fall into the same logical traps, such as attempting to fix bugs inefficiently and hallucinating about non-existent code. Our framework solves this by introducing a post-hoc self-reflection loop. After a workflow concludes, a dedicated reflection agent analyzes execution logs, tool histories, and human feedback.

Successful trajectories and design patterns are permanented into a global knowledge store. When future agents spin up, this intelligence is injected directly into their context window, creating a compounding-interest effect on our security engineering. This approach has helped us to improve both the vulnerability fix success rate and efficiency.

Moving toward immune software

Google Cloud's internal journey demonstrates that protecting software at AI-scale requires a fundamental paradigm shift from human-dependent checklists to proactive multi-agent orchestration. By pairing open-source tooling like Mantis with autonomous, self-healing execution loops, we are pioneering a future of "immune" software development — where applications continuously discover, validate, and patch their own weaknesses in real-time.

You can learn more about how we use Mantis and other tools to find and fix vulnerabilities at machine-speed here.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c330be90>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=C1wEjzOHh7Y'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Verifiable trust in the AI era: What’s new in Confidential Computing: To help further strengthen verifiable privacy in cloud AI deployments, here’s our latest Confidential Computing innovations. Read more.
Choice, compliance, and collaboration: Europe’s path to open digital sovereignty: Our Sovereign Cloud solutions are designed to meet Europe's tiered compliance requirements at every level. Read more.
How AI Is rewriting the SecOps playbook: With adversaries operating at machine speed, defenders must prioritize speed, automation, and continuous decision-making. Read more.
Google named a Leader in IDC MarketScape SIEM 2026 Vendor Assessment: We are proud to announce that Google has been named a Leader in the 2026 IDC MarketScape for worldwide SIEM platforms. Read more.
Announcing the Wiz Runtime Sensor for Windows: Wiz pairs real-time threat detection with a memory-safe architecture that scales efficiently to protect your essential cloud infrastructure. Read more.
New VPC Service Controls updates can help secure agents: Designed for agentic workloads, new capabilities in VPC Service Controls can help establish a network-level, destination-based perimeter. Read more.
Bug hunting on Gemini Spark: Gemini Spark brings a persistent agent to the Gemini App. Learn how to approach security testing for this new paradigm and focus on high-impact bugs. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7fa7c330ba50>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

China-nexus threat actor targets medical community for cross-sector research: Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting the North American academic, medical, and military research community, that went undetected for more than a year. Read more.
ShinyHunters targets education sector with Oracle PeopleSoft exploit: Mandiant and GTIG have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. Read more.
Zero-day exploitation in Cisco Catalyst SD-WAN Manager: Mandiant has identified a threat actor targeting a vulnerability in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: How Google Cloud uses LLMs to defend billions of users: Google Cloud CISO Chris Betz discusses AI Threat Defense, and emphasizes shifting security practices earlier in the development lifecycle through human-AI collaboration. Listen here.
Cloud Security Podcast: To couple or decouple SIEM: Alex Hurtado, director, Detection Engineering, Scanner, and Christopher Witter, DNR lead, Dropbox, debate the merits of centralized versus decentralized SIEM architectures. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Securing agentic AI with perimeter guardrails: What's new in VPC Service Controls

Fri, 26 Jun 2026 18:00:00 +0000

As enterprises scale autonomous AI agents into production, enabling safe innovation requires robust architectural guardrails. AI agents connect across tools and datasets, so it’s essential to establish clear network-level boundaries for comprehensive data protection.

To help organizations confidently deploy these workflows, we recommend VPC Service Controls (VPC-SC) to establish an essential network-level, destination-based perimeter. Today we’re announcing several new capabilities specifically designed for agentic workloads.

What's new in VPC Service Controls

Designed to enhance AI security, the new capabilities we’re announcing today strengthen boundaries enforced by VPC-SC.

The capability updates include:

Agent identity in directional rules: Enforcing least-privilege access requires treating agents as first-class identities. You can now add agentic identities directly to service perimeter ingress and egress rules using standard Identity and Access Management (IAM) principals.

A single principal maps to an individual agent, while a principalSet maps to a broader collection of agents. PrincipalSets lets administrators apply consistent, auditable access policies across agent fleets. If an agent is compromised, you can immediately revoke its access at the network perimeter.

Granular control with model context protocol (MCP) attributes: As MCP becomes the standard integration layer for agentic systems, the ability to enforce policy at the tool level is critical. VPC Service Controls now support conditional access rules based on specific MCP attributes, including mcp.toolName, mcp.method, and mcp.tool.isReadOnly.

For example, you can grant an agent read access to a Workspace MCP server while explicitly denying its ability to send emails.

Securing the Gemini Enterprise Agent Platform: The Gemini Enterprise Agent Platform provides a comprehensive foundation for production-grade agent deployments. VPC Service Controls is now natively integrated with Agent Platform. When you include Agent Platform as a protected service within a VPC-SC perimeter, the system automatically blocks all public internet access to the Agent Platform instance — enforcing a secure boundary without additional configuration overhead.

"At Mercado Libre, VPC Service Controls serve as an essential, foundational layer of our security architecture. By building a strong perimeter enforcement across hundreds of Google Cloud projects in our organization, we established robust network-level security controls with VPC-SC, ensuring all our data remains protected in our cloud environment," said Juan Pablo Boschi, project lead at Mercado Libre.

Defining a layered approach to enterprise AI security with VPC-SC

Securing an autonomous agent requires a layered approach. Identity, network, and resource controls each target a distinct threat vector.

Identity controls: IAM and Principal Access Boundaries (PAB) focus on "who" can access specific resources. By enforcing strict least-privilege principles for agent identities, you help ensure that autonomous workloads only have the permissions necessary for their specific objectives.
Network controls: Next-generation network firewalls and VPC Service Controls define a robust data perimeter on top of your infrastructure, governing the flow of information across boundaries and preventing data exfiltration.
Resource controls: Organization Policy and other resource-level guardrails set broad, immutable constraints on how resources can be configured and used, preventing risky configurations by default.

While identity and network controls effectively secure the front door, VPC Service Controls provide a critical destination-based defense. In the probabilistic world of autonomous agents, VPC-SC is the control that focuses on the "how” and "where" of the agent’s network and operations, in addition to the “who”.

Defending against the unique attack vectors

Unlike traditional applications, an AI agent's input can inadvertently prompt it to execute an unintended command or action. If an agent is successfully compromised — whether driven by malicious prompts, tool manipulation, or malicious insider commands — VPC Service Controls serves as a critical network safety net.

To illustrate how this network boundary defends against industry-standard risks as mapped by the OWASP Top 10 for LLM Applications, here are three real-world threat vectors where VPC Service Controls can help supplement identity-based controls to prevent data exfiltration.

Exfiltration prevention via indirect prompt injection (OWASP ASI01): A malicious actor could attempt to embed a hidden prompt asking an agent to summarize internal data and transmit it to an unauthorized user. If the hijacked agent has IAM permissions, IAM detects no anomaly.

However, when the agent tries to send that data to an external webhook, VPC-SC blocks the API-layer transfer because the destination is outside the defined perimeter.

Guardrail for tool misuse (OWASP ASI02, ASI08): Prompt hijacks can lead agents to chain tools maliciously, such as sending internal directory data to an external service. By enforcing a VPC-SC perimeter around sensitive assets, you prevent misbehaving agents from bridging data across isolated trust zones.
Neutralizing insider threats (OWASP AS103): Attackers can command a data-processing agent to perform a direct cloud-to-cloud copy from a BigQuery dataset to an unauthorized project. While network firewalls see legitimate HTTPS traffic to BigQuery, and IAM sees an authorized service account, VPC-SC evaluates the destination resource. Since the destination project is outside the enterprise perimeter, the system immediately denies the API request.

VPC Service Controls acts as a perimeter to block data exfiltration attempts from a compromised agent, even if the agent has valid IAM credentials.

Data protection for the autonomous agent world

Perimeter security has evolved from a recommended best practice in the deterministic application and workload centric age to an absolute requirement for the era of autonomous AI agents. VPC-SC provides the necessary control over data movement that IAM cannot address alone.

In an era where agents interpret prompts as code, VPC-SC becomes the mandatory safety net for enterprise data. Pairing the mapping capability of IAM with the rigid data perimeters of VPC-SC lets organizations securely build agentic innovation while maintaining an absolute guardrail against exfiltration.

To learn more, you can explore VPC-SC resources here.

Verifiable, private AI: Google Cloud expands Confidential Computing frontiers

Tue, 23 Jun 2026 16:00:00 +0000

Protecting sensitive data used with AI is a critical part of our commitment to providing advanced and secure cloud infrastructure. Confidential Computing cryptographically protects data in use in hardware-based Trusted Execution Environments (TEEs) with verifiable data integrity.

We are thrilled to share our latest Confidential Computing innovations across our hardware ecosystem that help further strengthen verifiable privacy in cloud AI deployments.

Confidential AI at global scale

By scaling our Confidential AI capabilities globally, we help ensure that AI inference and fine-tuning workloads can run with enforceable privacy guarantees.

Democratizing Confidential AI: Confidential G4 VMs with NVIDIA RTX PRO 6000 Blackwell GPUs in preview

We are excited to announce a landmark moment for accessible Confidential AI at global scale: Confidential VMs and Confidential GKE Nodes on the accelerator-optimized G4 machine series, featuring NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs.

What makes this a game-changer is its global scale and flexibility. Confidential G4 is available in every Google Cloud region that the standard G4 is available, across multiple consumption models including On Demand, Reservations, DWS Flex Start, and Spot/Preemptible.

"As organizations scale AI across multiple infrastructure environments, maintaining privacy and control over data and execution becomes increasingly challenging. Google Cloud Confidential G4 VMs powered by NVIDIA RTX PRO 6000 Blackwell GPUs are a meaningful addition to the expanding Confidential AI infrastructure ecosystem. As AI workflows now span agents, data sources, and infrastructure boundaries, Super Protocol provides a consistent Confidential AI operating model across Google Cloud Confidential VMs, other clouds, and on-premises environments — abstracting away confidential computing complexity and allowing teams to focus on AI outcomes," said Yulia Gontar, COO, Super Protocol.

Powered by 5th Generation AMD EPYC Turin CPUs leveraging AMD SEV, the G4 machine series with NVIDIA RTX PRO 6000 Blackwell GPUs activates robust hardware-based security. This architecture helps ensure that sensitive data is protected during processing inside the TEE, while also encrypting data as it travels between the CPU and GPU.

"GCP's Confidential G4 VM was the obvious choice for Vertebrae because privacy and security are non-negotiable for our customers. Our product processes sensitive work discussions, so we need to support hardware-signed attestation that both CPU and GPU are running in a trusted execution environment. Using confidential computing on Google Cloud lets us deliver the frontier of AI privacy in the cloud," said Andy Qin, CEO, Vertebrae.

With Confidential G4, you can unlock AI inference, fine-tuning, HPC, and use cases involving highly restricted data, sensitive models, or private prompts, all with minimal performance impact. Get started with Confidential G4 VMs and Confidential G4 GKE Nodes.

Enabling end-to-end private inference: Open-source Prompt Encryption SDKs

Even as we make Confidential AI accessible, we understand that protecting sensitive data in AI workloads goes beyond securing the model execution environment. The prompts and responses themselves can contain highly-confidential information. To provide cryptographic protection for the entire inference lifecycle, we are happy to announce the open-source launch of our Prompt Encryption SDKs, now available on GitHub.

This toolkit helps you establish an end-to-end secure channel for your AI inference workloads, ensuring that prompts are cryptographically protected from the moment they leave the client until they are processed in the TEE; model responses are similarly protected all the way back to the client.

Prompt and response encryption using Prompt Encryption SDK.

The Client SDK is integrated into the client application and works in tandem with the Server SDK integrated into the inference server running in the TEE. Once the SDKs have been used to establish an attested TLS session, the client can be confident that the server is running an authorized workload within a verified Confidential Computing environment.

The client app can then send encrypted prompts to the inference server, knowing that only this server will be able to decrypt and process it in the TEE. Once the server has a response ready, it sends it back via the same encrypted channel to the client app.

You can get started today with the GitHub repository and the Codelab.

Enabling Apple Private Cloud Compute on Google Cloud

Our commitment to privacy is deeply exemplified by our collaboration with Apple to expand Private Cloud Compute (PCC) on Google Cloud.

We are proud to collaborate with Apple to extend Apple’s privacy and security commitments to PCC on Google Cloud. Our platform supports Apple’s PCC privacy commitments with a layered security approach built upon Google Cloud’s infrastructure. This includes leveraging Google Cloud Confidential Computing with Intel TDX, NVIDIA Confidential Computing with NVIDIA Blackwell GPUs, our Titanium security architecture with the Titan chip, and a co-engineered open-source host stack to ensure verifiable transparency.

Together, these technologies help Apple PCC on Google Cloud meet stringent requirements for data protection and user privacy. To dive deeper into this collaboration, read our blog post: Powering the next era of Confidential AI.

Advancing confidential foundations

Google Cloud is committed to making Confidential Computing capabilities broadly available across our infrastructure. Our goal is to integrate hardware-based security features deeply into our foundational compute offerings, allowing customers to enhance data protection without compromising performance or operational flexibility.

Bringing Intel Trusted Domain Extensions (TDX) to the C4 machine series

Confidential VMs with Intel TDX on the C4 machine series will be available in preview soon.

Powered by the latest 6th Generation Intel Xeon processors, this integration offers a significant leap in compute density and performance for data-intensive workloads. By using Intel TDX, C4 instances create hardware-isolated Trust Domains (TDs) that protect sensitive applications and data from the underlying host and hypervisor.

This architecture provides confidentiality and privacy while enabling remote attestation so you can cryptographically verify the environment before processing sensitive data. Best of all, you can turn Confidential Computing on with a few clicks and no code changes.

Expanding Live Migration capabilities

Running mission-critical production environments requires high availability and continuous uptime, even during scheduled cloud maintenance.

Live Migration on C3D-based Confidential VMs is now generally available. This capability allows Google Cloud to perform planned hardware maintenance without interrupting workloads or exposing encrypted guest memory, ensuring seamless uptime for long-running confidential applications.

Enhancing trust and collaboration: Innovations in Confidential Space

Confidential Space is a Confidential Computing environment designed to enable secure multi-party computation and data sharing. It allows organizations to collaborate on sensitive data, such as for joint machine learning or data analytics, without revealing the data to each other or to Google Cloud.

“Google Cloud Confidential Space allows us to provide financial institutions with security guarantees similar to or better than an on-prem service," said Olivier Richaud, vice-president, Platforms and Site Reliability Engineering, Symphony. "Transitioning such security and privacy-sensitive customers to a cloud-based SaaS service would have been impossible without the power of Confidential Computing.”

A key design principle of Confidential Space is to remove the workload operator from the trust boundary, providing cryptographic assurance that only the authorized, attested workload can access the data.

“As AI systems increasingly act on behalf of consumers in financial services, trust in how data is processed becomes paramount. At Sahamati, we see Google Cloud Confidential Space as a foundational technology for enabling privacy-preserving AI in India’s Open Finance ecosystem, creating the trust needed for innovation while maintaining strong security and accountability guarantees,” said Kiran Gopinath, chief innovation officer, and Head, Sahamati Labs.

Our new advancements for Confidential Space provide greater flexibility and stronger assurances. Key updates include:

Independent Verification: Integration with Intel Trust Authority

We are pleased to announce that Intel Trust Authority (ITA) is now generally available as an independent attestation verifier service for Confidential Space.

This integration enables organizations to independently verify the integrity of the Confidential Space environment using Intel’s hardware-rooted attestation before encryption keys are released to workloads. By decoupling attestation verification from the cloud service provider, customers benefit from enhanced transparency, stronger assurance, and a more robust trust model.

"With Confidential Computing woven into our core infrastructure, Google Cloud and Intel are making hardware‑rooted security and independent attestation part of the default fabric of modern compute. From Intel TDX‑powered C4 Confidential VMs running production workloads, to Confidential Space with Intel Trust Authority — now generally available — enabling verifiable multi‑party collaboration, customers can now encrypt, verify, and scale their most sensitive AI and data workflows without rewriting applications or compromising performance, even in the most demanding regulatory environments,” said Anand Pashupathy, general manager and vice-president, Intel Product Assurance and Security (IPAS), Intel Corporation.

Accelerating secure collaboration: Confidential Space with H100 GPU support

To power secure multi-party AI and machine learning, Confidential Space support for NVIDIA Hopper GPUs is now generally available. This can help multiple parties pool their data for training and inference within a Confidential Space environment, using the power of Hopper GPUs, while ensuring that their individual data remains protected from other participants and from Google Cloud.

Confidential Space unlocks use cases like federated learning on sensitive datasets, and building joint models without centralizing data.

“Confidential GPU support in Google Cloud Confidential Space removes one of the biggest barriers to adopting secure AI: the tradeoff between protecting sensitive workloads and achieving production-grade performance," said Adi Hirschtein, VP Product, Duality. "For Duality customers in healthcare, financial services, and government, this enables federated learning, confidential AI, and encrypted RAG workflows to run on sensitive data at scale while keeping data and models protected throughout processing.”

Next steps

Confidential Computing is becoming an essential layer of cloud computing in the AI era. Explore our expanding portfolio of Confidential VMs, accelerated hardware, and open-source tools to see how you can enable secure collaboration and private AI innovation within your organization.

To learn more, join us at the Confidential Computing Summit on June 23 and 24, 2026.

Security & Identity

PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap

Our strategy: Secure by design

Immediate progress: 2026 milestones

The roadmap to 2029

Domain 1: Store Now Decrypt Later (SNDL) mitigation

Domain 2: Integrity and non-repudiation

Domain 3: Foundations and key management

A shared responsibility for quantum safety

Our path forward, together

How Google Cloud detects, contains, and protects against emerging threats

Understanding the risk: How bad actors attempt to exploit cloud workloads

Mitigating risks: Tailored containment in action

Communicating risk: Proactive transparency and log visibility

Customer action plan: Hardening your environment

Continuous vigilance together

Advancing brain tumor research with privacy-first AI

The challenge: Evaluating AI without seeing the data

Learn how ML Commons MedPerf integrates with Google Cloud Confidential Compute to enable secure, real-world evaluation of medical AI models.

From theory to critical impact: Advancing brain tumor research

Achieving clinical trust and validation

The future: Scaling secure medical breakthroughs

Cloud CISO Perspectives: Why AI Threat Defense is the new boardroom baseline

Why AI Threat Defense is the new boardroom baseline

In case you missed it

Threat Intelligence news

Now hear this: Podcasts from Google Cloud

AlloyDB adds group authentication to secure enterprise scale and AI agents

The problem with individual scale

Securing the future of agentic AI

Proven value for digital leaders

A unified blueprint for passwordless access

Moving toward a Zero Trust database future

Future-proofing data integrity: Quantum-safe digital signatures in Cloud KMS

PQC digital signature algorithms in Cloud KMS

The need for pre-hash and external-µ variants

Getting started with PQC signatures in Cloud KMS

The PQC road ahead

Announcing quantum-safe Key Encapsulation Mechanisms in Cloud KMS

Best Buy scales AI workloads and secures access with Workforce Identity Federation

Replacing service accounts with direct federation

Key implementation decisions

Secure authentication for developers

Expanding Workforce Identity Federation support

Get started

Cyber Snapshot Report: Go beyond the toolchain and build enterprise resilience

Hardening architecture to contain blast radius

Forging readiness for the inevitable crisis

Activate your Defender's Advantage today

Now in preview: Find and fix software vulnerabilities with CodeMender

Watch this overview of CodeMender in Gemini Enterprise Agent Platform.

Find and fix vulnerabilities with AI

How the CodeMender agent works

Scan: Find hidden vulnerabilities with flexible model scanning

Verify: Simulate and verify exploits to reduce noise

Remediate: Automatically generate and test code fixes

CodeMender in AI Threat Defense

How to get started with CodeMender

Cloud CISO Perspectives: How AI leverages deep context as the defender’s advantage

How AI leverages deep context as the defender’s advantage

The AI Era: Attacker’s Profile vs. Defender’s Advantage

Google Cloud x Morgan Stanley: Redefining Threat Defense in the AI Era

In case you missed it

Threat Intelligence news

Now hear this: Podcasts from Google Cloud

Securing the AI supply chain on GKE: Introducing k8s-aibom for automated AI BOMs

The architecture of zero friction

Where existing AIBOM tooling falls short

The Confidence Model: Separating intent from inference

Immutability and least privilege: Building an audit-grade security model

Accelerating governance readiness: Mapping to global regulatory frameworks

Getting started

Contributing to U.K. financial sector resilience as a critical third party

Building sector-wide resilience

Enabling customer success

Looking ahead

Meet the 33 cybersecurity startups joining the Gemini Startup Forum

AI agent security and governance

Application security and vulnerability management

Cloud, network, and infrastructure security