Security & Identity

Cloud CISO Perspectives: Our security forecast for 2027

Mon, 09 Nov 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for November 2026. Today, Chris Betz shares our security forecast for 2027, with insights from top leaders at Google, Google Cloud, and Mandiant.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25783ad0>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', None)])]>

Our security forecast for 2027

By Chris Betz, CISO, Google Cloud

Chris Betz, CISO, Google Cloud

Today, we’re publishing insights on the cybersecurity trends and challenges we anticipate in 2027, including agentic threats, changing attack tactics, and the new security defense approaches required.

This year we’ve witnessed a fundamental change in cybersecurity. When the year began, only a few organizations were using LLMs and agents to find and fix vulnerabilities. Today, it’s happening at scale across enterprises.

Organizations expected a reality with agentic hacking where scale, speed and sophistication would outpace human-only response; today, we’re seeing it in practice. Organizations predicted software development at an unheard of pace; today, we’re securing software delivered in hours and days instead of weeks and months.

We have passed many milestones, and the world won’t go back — and we are all digging in to fully understand the new reality.

The year ahead promises to be challenging, exciting, innovative and will outpace 2026. In the year ahead, enterprise software will change as agility and speed provided by agentic development shifts us from a collection of static applications to a live fabric of autonomous agents that can manage pricing, negotiate supplier contracts, allocate capital, and reroute supply chains in real time.

To make this vision a reality, many organizations are rushing to build agents. It’s on us as an industry to ensure the development and operations models are designed to be trustworthy and safe.

The risks in 2027 won’t be just server outages or stolen databases. As the agentic operations world takes off, we also need to be concerned about the data and technology foundation that agents rely on.

When an agent makes a consequential decision, you must be able to reconstruct the entire story: what inputs came in, how the agent reasoned through them, which tools it called, what parameters it passed, and why policy allowed it. Without that trace, you can't debug it, you can't validate its correctness, and you can't trust it. And if you can't trust it, you can't scale it. Karthik Narain
chief product and customer officer, Google Cloud

Security must evolve to protect the balance sheet through decision integrity. Every consequential action taken by an autonomous system requires a complete, tamper-proof decision trace, recording and tracking:

Inputs entered into the system.
How the model reasoned through its decisions.
Which tools the model called, what parameters it passed, and why policy allowed it.

Collecting this data will help ensure that your teams can reconstruct, validate, and audit every automated decision before scaling.

Making the alert queue disappear, from chasing tickets to setting doctrine

For decades, security operations centers (SOCs) have suffered from crippling alert fatigue — too many alerts compounded by legacy security tools that hand human analysts half-finished investigations. When autonomous threats can probe a network and move laterally in minutes, human defenders can’t manually stitch together logs across eight different consoles or approve individual defensive actions at microsecond speed.

2027 is the year analysts stop chasing alerts and start shaping outcomes. Ramya Chitrakar
vice-president, Engineering, Google Cloud Security

That broken alert queue disappears in 2027 by flipping the operational model. The alert becomes the final output of an investigation. Autonomous defensive agents will handle the data enrichment, correlation, and triage automatically, surfacing a verified conclusion rather than a raw ticket.

Instead of chasing alerts at a keyboard, human analysts move up the stack to set strategic doctrine, define risk appetite, and verify automated actions built for rapid explainability — where any defensive decision can be understood by a human in 60 seconds and reversed in 30.

Moving Beyond Zero: Transaction-level trust and first-class agent identities

As enterprises deploy thousands of custom agents across multicloud environments, flat trust architectures, shared human service accounts, and blanket administrator tokens are turning internal workflows into high-leverage entry points for prompt injection and lateral movement.

Traditional Zero Trust is too rigid and broad to govern autonomous software acting on its own.

We need to extend the Zero Trust concept, not just at the network layer and the machine layer, but now down to the transaction layer. Heather Adkins
vice-president, Security Engineering, Google

The year ahead demands an architectural shift to Beyond Zero so we can extend verification down to every individual transaction, network packet, and point-in-time authorization. Every autonomous agent should be treated as a first-class identity with its own verifiable credentials, strict least-privileged scope, and open communication standards.

When backed by real-time autonomous reasoning, we can dynamically allow a transaction on Tuesday and block the exact same request on Wednesday if conditions look anomalous.

Closing the loop between live runtime and defect-free code

The traditional divide between writing software and securing it is breaking down, while adversaries actively target the open-source libraries and external tools that coding assistants pull into codebases. Developers can no longer file a ticket and wait weeks for a manual security review, yet deploying hasty, unvalidated automated patches in production is just as dangerous to business continuity as the vulnerability itself.

Adversaries aren't just attacking model math and algorithms. They're actually poisoning the open source software, supply chain, MCP tools, and external libraries that agentic coding assistants pull automatically into code bases. Sandra Joyce
vice-president, Google Threat Intelligence

In 2027, security becomes a closed-loop, continuous system embedded directly into the software delivery pipeline. By placing agentic reasoning inside developer tools, we can perform threat modeling and catch configuration errors side-by-side as code is written.

It’s also crucial that we link live production environments directly back to source code so that defenders can trace a real-world exposure to the exact line of code, validate whether it is genuinely exploitable, and deliver a pre-tested fix at machine speed without breaking production.

Turning internal ground truth into a decisive defender advantage

Concerns persist around attackers gaining the upper hand in cybersecurity, and many fear autonomous capabilities will only widen that gap in 2027. Adversaries are already compressing six months of reconnaissance into hours, and exploiting flaws before vendors even know they exist. Compounding the challenge for defenders, no single model can discover or patch every vulnerability across code and cloud on its own.

The defender's advantage is that attackers operate with fragmented external visibility and guesswork. Defenders own the complete ground truth, identity privilege graphs, internal network architecture, code lineage, and real-time runtime activity. Sandra Joyce
vice-president, Google Threat Intelligence

In the year ahead, defenders will use autonomous technology to capitalize on the one thing an outside attacker will never have: complete internal ground truth. While adversaries operate with fragmented external visibility and guesswork, defenders own the full picture of their identity privilege graphs, internal network architecture, code lineage, and live runtime activity.

By feeding that unified context into multi-model ensembles — such as pairing lightweight models for continuous scanning with deep reasoning models that cross-validate findings and eliminate false positives — organizations can spot and remediate toxic combinations of permissions and configurations that look harmless in isolation, before an external attacker can ever piece them together.

Countering asymmetric threat speed and the new extortion playbook

Not every adversary will embrace machine speed the same way in 2027. While state-sponsored espionage actors often avoid loud, hyper-fast automated scripts that risk triggering alarms and blowing their long-term stealth, cybercriminals tend to go all-in on autonomous velocity.

What we're seeing right now is a variety of adversaries that are exploiting vulnerabilities before the vendors even know about it. Charles Carmakal
CTO, Mandiant Consulting

As endpoint defenses get better at blocking traditional file-encrypting ransomware, criminal crews are shifting to rapid, high-volume data theft and extortion — specifically targeting proprietary model weights, custom agent skills, prompt libraries, and cloud GPU compute (“LLMJacking”).

Preparation here means eliminating security silos. It’s a critical failure point to treat models, agent permissions, software supply chains, and cloud infrastructure as separate domains.

Instead, we want to unite them under a single, intelligence-led governance framework that allows defenders to lock down high-value autonomous assets and shut down extortion paths before data can leave the environment.

Red-teaming the agentic enterprise before adversaries attack

In the rush to capture productivity gains in the year ahead, many enterprises are deploying custom agents directly into core business workflows without testing how those systems behave under adversarial pressure. That mistake leaves guardrails vulnerable to bypasses, scanner blinding, and indirect prompt injection.

One of the things that the team's been doing over the past few years is doing a lot of red team exercises… with those agentic solutions, so that we have the opportunity to identify and fix the issues before an adversary has the ability to do that against victim organizations. Charles Carmakal
CTO, Mandiant Consulting

Continuous, proactive adversarial red-teaming must be a mandatory prerequisite before any autonomous workflow touches production. Systematically attempting to break into agentic systems, bypass safety controls, and manipulate model behavior prior to deployment is crucial to securing the agentic era.

Critically, model safety engineering should combine the results of those tests with frontline threat intelligence on novel attack prompts and evasion techniques. Defenders can then harden classifiers and neutralize new attack techniques before adversaries can use them against real victims.

Orchestrating specialized agent teams to prevent agent sprawl

Relying on a single generalist agent to defend an enterprise will fail in 2027 because deep technical skills do not transfer across domains. For example, an agent built to reverse-engineer malware is not the agent that should reason about an identity blast radius.

As departments across the business rapidly spin up uncoordinated, standalone agents without centralized oversight, agent sprawl is emerging as the next iteration of shadow IT, threatening to derail enterprise agent deployments through inadequate governance.

Technological adoption cannot outpace architectural governance… We have to prioritize machine speed defense. Security cannot remain a manual checkpoint that slows innovation down. Sandra Joyce
vice-president, Google Threat Intelligence

Just as a well-coordinated human team beats a lone generalist, the year ahead belongs to orchestrated networks of specialized hunter, decoder, and responder agents, each operating with its own domain depth, memory, and dedicated tools.

Succeeding at scale requires building the governance and orchestration layer first. The key here will be to establish graduated autonomy, shared state, clean handoffs between specialized agents, and a central coordinator that knows precisely when to act autonomously and when to escalate to a human.

To learn more about our cybersecurity guidance for the coming year, check out our Security 2027 video.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25780790>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', None)])]>

Threat Intelligence news

The rise of LLMJacking: How threat actors monetize compromised resources: Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to large language models, a tactic known as LLMJacking that can generate large spikes in fraudulent cloud charges in a matter of hours. Read more.
Shutting the door on the XCPE botnet: Google and industry partners dismantled the XCPE backdoor that had assembled more than 1.3 million set-top boxes into a botnet. We assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Company, an Android original equipment manufacturer and original design manufacturer. Read more.
ARTEX and friends: Enter agentic offensive frameworks: Since September, Google Threat Intelligence Group and Mandiant have observed multiple threat actors abusing the open-source, agentic pentesting frameworks ARTEX, Hexstrike, and CAIRN to conduct a broad range of actions across multiple phases of the attack life cycle. Read more.
Investigating ephemeral supply chain tampering: For the first time, Google Threat Intelligence Group (GTIG) and Mandiant have encountered a software supply chain compromise that was implemented with very short tampering windows that were active for only five to 10 minutes, and effectively evading traditional point-in-time triage and automated file scanning. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Helping you build and defend at machine-speed in the agentic era

Wed, 04 Nov 2026 17:00:00 +0000

As both a frontier lab and the operator of the world's most comprehensive threat intelligence network, Google occupies a unique vantage point: We see exactly how Large Language Models are engineered, and how adversaries are targeting them in the wild.

Passive defense is no longer viable. Allowing rapid, ungoverned adoption of autonomous systems into traditional workflows can lead to critical security incidents.

At the Google Cloud Security Summit, we are sharing updates on how we are helping organizations build securely, secure systems, and defend at machine speed in the agentic era.

Building securely in the agentic era

Agentic coding tools have dramatically accelerated software delivery, but human review can’t keep up with machine-speed commits and unvetted dependencies. Because autonomous agents are now part of the supply chain, blind trust can turn them into direct backdoors for attackers.

Our approach to securing the development lifecycle builds native, real-time guardrails in the integrated development environment (IDE), unifies asset graphs across code and identity and access management (IAM,) and verifies models to weed out logic flaws before code merges.

CodeMender: Frontier cyber with enterprise control

As software-driven threats continue to escalate, our autonomous code-security agent CodeMender helps organizations find and fix code vulnerabilities at machine speed. It can eliminate manual triage bottlenecks while deeply embedding security in the software development lifecycle.

CodeMender works with multiple models, including Gemini 4 Argon, that can bring state-of-the-art cybersecurity capabilities. These include identifying previously-unknown vulnerabilities, and generating tested patches before they can be exploited.

Most recently, Wiz used Gemini 4 Argon along with other models to identify and help remediate core PHP vulnerabilities that affected 70% of websites. Gemini 4 Argon made a notable contribution to finding the vulnerability, developing a likely exploit path, detecting attacks, and validating the patch.

Currently in preview, CodeMender delivers new capabilities for secure isolation and flexible scanning:

Secure autonomous remediation: CodeMender isolates vulnerability verification and exploit simulation inside your choice of operating system-level sandbox or isolated virtual machine, and adds human-in-the-loop checks for local write and command execution helping to reduce the risks of malicious exploits and zero-day testing gone awry.
Flexible scanning modes: CodeMender now allows you to scan a specific folder, entire repository, or only modified files since the last scan so you have fine grain control on how many files to scan to optimize for scanning speed and costs.

Since the CodeMender preview became available in July, hundreds of customers have used CodeMender to help them find and fix vulnerabilities at machine speed.

“As adversaries attack at machine speed, Google’s Fairwind Program helps us keep pace with our application security. Our early evaluation of CodeMender shows the potential to reduce vulnerability discovery time by over 95%, while keeping expert validation and remediation under human oversight,” said Ivan Fontarensky, CTO Cybersecurity Services, Thales Group.

“IDC research finds that nearly 40% of enterprises add vulnerabilities faster than they can remediate them. Detection without remediation only adds to developer workloads,” said Katie Norton, research director, Cloud Security, IDC. “CodeMender solves this by pairing exploitability validation with deployable code fixes, driving the continuous, verified patching required as exploitation timelines compress.”

Securing workloads everywhere

When autonomous workloads transition to production, the threat landscape shifts entirely. Adversaries target your plumbing — credentials, data boundaries, and integrations that connect agents to the enterprise. Once inside, attackers exploit over-privileged credentials and unsegmented environments to move laterally across enterprise data boundaries.

To eliminate these flat-trust architectures, Google Cloud delivers a unified framework of foundational security and governance controls for agents everywhere they run. Whether your agents are operating on the Gemini platform, Google Kubernetes Engine (GKE) and Cloud Run, the new Agent Compute Engine, or are coordinating across multi-cloud environments — they are bound by the same rigorous enterprise controls.

To enforce our agents everywhere framework at the transaction level, we are introducing critical identity, network, and content controls:

Auth Manager (Agent Identity): Centralizes credential management inside a Google-managed vault governed by IAM. Now generally available, Auth Manager automates OAuth 2.0/PKCE flows and refreshes user-delegated tokens to minimize consent fatigue and reduce credential theft. Alongside Auth Manager, Agent Identity JWT support, now in preview, issues standard OIDC tokens, allowing agents to authenticate securely across AWS, Azure, on-premises backends, and MCP servers without static, long-lived API keys.
Identity-based VPC Service Controls: Reinforcing perimeter defenses against data exfiltration, VPC-SC ingress and egress rules now support IAM roles, generally available, and Workload Identity Federation for GKE, in preview, enabling security teams to enforce granular, identity-based perimeter boundaries across enterprise GKE clusters without complex, manual exceptions.
Model Armor custom topic detector: This new enhancement, available in preview, enables you to enforce topic adherence for agents. You can define custom prompt-based rules to identify on-topic and off-topic interactions. Tailored for industry use cases in healthcare, insurance, and retail, it keeps your agent conversations focused, compliant, and secure.
Advanced network threat protection: Building on Cloud NGFW Enterprise’ IPS capabilities, you can now protect workloads with the new Cloud NGFW advanced malware sandbox, generally available, enabled by Palo Alto Networks WildFire, streamline firewall operations using Cloud NGFW project-level resources, generally available, and automate exploit protection with Cloud Armor managed rules, available in preview, backed by Thales Imperva’s global threat intelligence that scans 1.5 trillion monthly web requests.

Defending at machine-speed

Attackers are integrating advanced capabilities across their operational lifecycles to achieve unprecedented scale and velocity. To defeat autonomous, multi-agent threats, we must empower defenders with agentic, intelligence-driven operations to neutralize adversaries in minutes, not days.

Modern SOCs require autonomous investigation, detection, and response powered by planetary-scale infrastructure:

Continuous monitoring catches live compromises at the workload layer and feeds telemetry directly into the Wiz Security Graph.
Google Threat Intelligence telemetry is codified directly into the runtime logic of defensive models, triggering automated agentic threat hunts that reconstruct process trees and isolate threats in real time.
Autonomous agents analyze complex alerts, run correlation queries across multi-vendor telemetry in sub-second timeframes, and present clear mitigation actions for strategic human sign-off.

Of course, deploying autonomous technology is only half the battle; teams also need the right operational frameworks to wield it effectively. To help you evolve your cyber defense operations, Mandiant Transformation Services experts can modernize your operating models to maximize the benefits of these advanced technologies. By refining processes and workforce skills with frontline best practices, Mandiant enables your organization to proactively mitigate threats and ensure business continuity during a breach.

Better together: Wiz and Google Cloud

Delivering end-to-end defense requires extending these native platform controls into multi-cloud environments where organizations run diverse tooling.

Together, Wiz and Google Cloud are combining deep autonomous application understanding, connected security context, and threat intelligence to help organizations innovate securely and stay ahead of emerging threats. Recent highlights include:

Securing autonomous workloads wherever you build and run with Wiz: As organizations build and scale with Google Cloud and Gemini platform, Wiz protects autonomous applications across their entire lifecycle from code to runtime. Wiz discovers and maps autonomous applications, agents, and infrastructure, deeply analyzing the application itself, including its purpose, capabilities, and permissions, to uncover hidden risks. Combined with the context of the Wiz Security Graph, this surfaces complex attack paths and runtime threats, empowering teams to prioritize risk and innovate with confidence.
Securing code at machine speed with Wiz AI SAST: Now in preview, Wiz AI Static Application Security Testing (SAST) uses agentic reasoning to understand how an application behaves and surface complex business logic flaws. Grounded in Wiz Research and powered by our proprietary Atlas harness, Wiz AI SAST correlates code weaknesses with infrastructure context on the Wiz Security Graph so teams can prioritize the risks that matter most. Exploitable attack paths can then be remediated at machine speed using our Green Agent and CodeMender.
Strengthening threat defense together with Wiz plus Google Security Operations: Wiz Defend and Google Security Operations now work from a shared data model, giving security operations teams the flexibility to investigate threats in either platform. Improvements include a dedicated Wiz Content Pack in Google Security Operations, Wiz Blue Agent investigation analysis in Google Security Operations, and bi-directional syncing between the platforms for a streamlined analyst experience. Additionally, Wiz Defend now integrates with Google Threat Intelligence, bringing the latest insights and frontline intelligence directly into Wiz.
Protecting under-resourced organizations with Scan for Good: A joint initiative launched by Google DeepMind and Wiz, Scan for Good brings the power of autonomous technology coupled with human security researchers to under-resourced organizations, including public services, critical infrastructure, and non-profits. In its first month, this initiative has used Argon to help more than 50 public service organizations and critical infrastructure providers find and remediate critical exposures.

Turning the advantage back to the builders and defenders

Securing the agentic era requires evolving operational models, enforcing secure-by-design pipelines, and taking direct action against malicious infrastructure. At Google, our responsibility extends to disrupting adversaries at the source:

Tracking bad actors targeting Google Cloud environments and permanently disabling their infrastructure.
Engineering specialized defensive architectures with Google DeepMind, including models trained specifically for high-stakes cybersecurity and automated code analysis.
Feeding frontline threat intelligence back into model alignment and classifier training to neutralize emerging attack vectors before they materialize.

By establishing native pipeline defenses, dismantling flat trust architectures, and deploying machine-speed operations, enterprises can turn the AI advantage back to defenders.

Join us at the Google Cloud Security Summit to explore these capabilities and learn how to secure your organization in the agentic era.

Cloud CISO Perspectives: Introducing new $250,000 tier for Google Cloud VRP (Q&A)

Thu, 29 Oct 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for October 2026. Today, Chris Betz talks with Michael Cote, our vulnerability rewards program lead, about the new tier of our Cloud VRP program and the current state of vulnerability rewards.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f8c258fb710>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', None)])]>

Why we've created a new $250,000 tier for Google Cloud VRP (Q&A)

By Chris Betz, CISO, Google Cloud

The Google Cloud Vulnerability Reward Program (VRP) partners with the global security research community to help elevate cloud security for all by encouraging the discovery of critical software vulnerabilities. In an era when automated research has made it more challenging to verify authentic vulnerabilities, we have a critical need to boost high-level, human-led research that can transcend automated-only discovery.

Today, we are expanding our top reward tier with a new $250,000 Root-in-Cloud reward, specifically designed to recognize high-impact architectural research. Identifying tenant-isolation bypasses and complex cross-service logic flaws requires human creativity, intuition, and rigorous systems analysis combined with the power of agentic systems.

To earn this premier reward, you must demonstrate full administrative control, the equivalent of “roles/owner” or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup.

The exploit path can not depend on:

Pre-existing access or footholds in the victim project.
Leaked, phished, or stolen credentials.
User interaction or social engineering.

Proof-of-root: Clear, cryptographic validation

To make testing safe, clear, and reproducible, without impacting production environments, we have defined technical criteria for validating root-in-cloud access.

Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility.

Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are not allowed and will result in researcher disqualification.

The Google Cloud VRP panel will analyze the initial entry point, execution context, and attack surface to determine whether full arbitrary tenant or project takeover is achievable from that position, and award the bounty accordingly.

This new bounty tier reflects how security research continues to evolve, and the importance of continuing to recognize the most innovative and valuable security research. As part of those efforts, Google Security held its annual Escal8 conference in Singapore last week, and I had the opportunity to discuss the changing landscape with Michael Cote, Google Cloud’s vulnerability reward program lead.

The following transcript has been lightly edited.

Chris Betz: You are at Escal8 in Singapore announcing the new $250,000 Root-in-Cloud tier for our VRP. Why introduce this tier now, and what kind of research are you hoping to spark?

Michael Cote: This is a recognition of how the field of security research has changed over the past year. We value quality submissions from anyone, and we’ve seen that the combination of human creativity and agentic power is much richer than either on its own.

While automated scanners generate a high volume of low-impact noise, first-time researchers who pair human intuition with agentic tools are finding, on average, more interesting bugs than novices did two years ago. With the new Root-in-Cloud tier, we want to challenge the community and increasingly reward the complex, high-impact findings — like tenant-isolation bypasses and cross-service logic flaws — that require deep architectural intuition alongside agentic tools, because getting that information is essential to protecting our customers.

Chris Betz: Google Threat Intelligence Group (GTIG) recently shared research showing that monthly CVE disclosures have doubled as agentic tools mature. From your seat leading the Cloud VRP, how has automation technology impacted the reports we’ve received?

Michael Cote: It has transformed our intake volume, though not in the way many people assume. While the number of valid vulnerability reports submitted to the Google Cloud VRP has remained stable over the last 18 months, the total number of reports has grown tremendously.

Automation has helped democratize vulnerability discovery, and the barrier to entry has been rapidly flattening, something even our top researchers noted at Escal8. Because we’re seeing more researchers and more first-timers with interesting bugs, that creates pressure on more experienced researchers to move faster and bring more impactful findings — although their experience continues to be a key differentiator in success.

Chris Betz: I’ve been working with the research community for more than 20 years. One of the things I appreciate most is how much the community values making the world more secure. Bounty programs let us recognize this valuable work. How do you see the community changing as we move further into the agentic era?

Michael Cote: That shared commitment to making the world more secure is still the heart of this community, which is why the pressure to move faster is something we have to watch closely. As our GTIG colleagues found, the sharpest rise in the number of exploited vulnerabilities comes from n-days, not zero-days.

Open source accounts have suggested that threat actors are using LLMs to rapidly turn newly-public vulnerability details into working exploits. When triage teams are already working through a surge in report volume, disclosing an unmitigated vulnerability well ahead of the standard 90-day coordinated disclosure window gives attackers the exact knowledge and time window they need to target customers.

With the influx of new submissions, I worry about a growing pressure to rush to publish. Something that concerns me because we’re already seeing early indications of it. Because LLMs lower the barrier to finding bugs in source-available software, researchers worry that waiting to verify risks will allow someone else to be first to publish. Even more concerning, that same competitive pressure can tempt even established security companies to disclose unmitigated vulnerabilities without coordination, and that rush puts our users directly at risk.

Project Zero helped establish the industry’s 90-plus-30-day responsible disclosure policy, and autonomous detection and exploitation capabilities make following coordinated disclosure more important than ever. In the long run, rushing to be first works against a security company's own self-interest. Novel discoveries may bring temporary visibility, but customers will ultimately choose not to work with organizations that put them and the broader ecosystem at risk.

Chris Betz: When you offer a $250,000 bounty, how do you make sure researchers can validate their findings without putting customer environments or service availability at risk?

Michael Cote: High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects. Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity.

We’ve also updated our program rules to establish strict boundaries around underlying production infrastructure. If researchers think they are close to a breakthrough but are uncertain where the boundary lies, we encourage them to reach out. We are always more than happy to work with them to ensure they are recognized and rewarded for the value of their research without taking steps that would invalidate the bounty.

Chris Betz: What should enterprise CISOs take away from these trends? Especially those who run their own vulnerability management pipelines and partner with external researchers, what advice would you offer for navigating this AI inflection point?

Michael Cote: First, prepare your vulnerability triage workflows for agent-generated submissions. To keep valid reports from getting stuck in a backlog, security teams need ways to separate plausible-sounding hallucinations from real security risks.

Second, compress your remediation timelines once a vulnerability becomes public. Defensive patching and mitigations have to move faster because autonomous technology compresses the time from disclosure to working exploits.

Finally, hold your security partners and vendors to high standards of coordinated disclosure. It’s important that our industry continues to normalize agentic vulnerability research, but we must do so responsibly. Let’s continue to keep user safety at the center of everything we do.

For more information on the Google Cloud VRP, including detailed endpoint specifications, JSON payloads, and CLI examples, please check out our rules page.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25e10a10>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', None)])]>

Threat Intelligence news

Investigating ephemeral supply chain tampering: For the first time, Google Threat Intelligence Group (GTIG) and Mandiant have encountered a software supply chain compromise that was implemented with very short tampering windows that were active for only five to 10 minutes, and effectively evading traditional point-in-time triage and automated file scanning. Read more.
ARMORY CASTLE exploits BeyondTrust: During an incident response engagement, Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor, exploited a vulnerability impacting BeyondTrust Remote Support appliances. Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public. Read more.
Vulnerability discovery and exploitation trends in the AI era: To counter the increased risk from rapid vulnerability discovery and exploitation, organizations should transition from unprioritized mass-patching to threat intelligence-driven triage, combining targeted edge-defense with automated, agentic remediation. Read more.
Defending against active exploitation of Citrix NetScaler ADC and Gateway appliances: Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Here’s our containment and remediation guidance. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here.
Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Nir Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Scale agents securely with IAM Helper Agent Skills and MCP Tools

Tue, 27 Oct 2026 16:00:00 +0000

As organizations adopt autonomous agents to build applications, securing identities and access has become more challenging. Developers relying on agents to provision cloud resources, write Terraform, and deploy microservices at machine-speed only find their CI/CD pipelines blocked even faster as security friction scales.

To help you get ahead of agentic-era Identity and Access Management, today we’re introducing IAM Helper. This suite of intelligent, agent-facing building blocks can automate complex, end-to-end IAM workflows.

As an agent-native orchestration and interface layer for Google Cloud IAM, it augments Google Cloud’s core IAM engines — including Policy Intelligence and Privileged Access Manager (PAM) — making IAM skills callable directly by autonomous code assistants, deployment pipelines, and custom agents. Using this functionality reduces the administrative overhead of maintaining least-privilege security and agent governance, while maximizing utility, and accelerating deployment.

IAM Helper Agent Skills: Fast, secure deployment with automated governance

Manual troubleshooting of permission blockers creates friction for engineering and administrators, while shortcuts can lead to broad agent over-permissioning that puts least privilege at risk.

IAM Helper empowers agents to handle access management dynamically. It shifts the burden of policy evaluation away from human administrators and LLMs, offloading complex orchestration directly to the Google Cloud backend, to maximize token efficiency and prevent costly operational bottlenecks.

Rather than operating as isolated utilities, IAM Helper Agent Skills guide agents through the cloud access lifecycle. These end-to-end workflows, helper scripts, and guardrails packaged using the open Agent Skills standard can orchestrate multiple underlying functions and APIs to resolve complex IAM tasks. They work across common agents (Gemini CLI, Gemini Cloud Assist, ADK, Claude Code, and Cursor).

Built-in guardrails and real-world impact

Every IAM Helper agent skill separates read-only discovery from policy changes: Diagnostics and simulations run automatically, while any change to access policies pauses for human-in-the-loop (HITL) confirmation based on customizable risk tiers. To see the value of IAM Helper in practice, consider how it transforms two everyday scenarios:

Scaled user-assisted remediation: Suppose a developer's coding agent hits a 403 error while deploying a new application. Rather than filing a support ticket and idling, the agent uses iam-helper-for-troubleshooting to identify the missing Pub/Sub permission in seconds, then uses iam-helper-for-privileged-access-management to request a one-hour JIT grant, eliminating hours of debugging friction.
Autonomous pipeline self-healing: An infrastructure agent encounters a permission block during a routine deployment pipeline. Rather than failing the build, the pipeline uses IAM Helper Agent skills to generate a revised, least-privilege policy, verifies against 90 days of logs via iam-helper-for-policy-simulator that active services won't break, and routes the change to an admin for quick approval.

IAM Helper Agent Skills are designed for maximum token and cost efficiency, allowing agents to execute multi-step administrative operations autonomously.

Authoring compliant, least-privilege policies: As DevOps engineers translate access requirements into JSON, YAML, or Terraform HCL, iam-helper-for-policy-management generates and validates IAM v1 allow bindings and IAM v2 deny rules. It automatically catches and blocks risky configs before they are applied, including public access (allUsers) and broad basic roles (roles/owner, roles/editor).
Unblocking 403 errors in seconds: When an on-call engineer or deployment agent hits a cryptic 403 PERMISSION_DENIED error, iam-helper-for-troubleshooting identifies the exact missing permission or blocking rule in seconds. It adapts to the user’s role: Developers can check if they can unblock themselves locally or generate a structured ticket for their administrator (Requester flow), while security administrators can trace inherited allow and v2 deny rules across organization, folder, and project hierarchies to resolve the issue (Resolver flow).
Simulating blast radius before rolling out changes: Before a platform engineer updates a policy or applies IAM Recommender role reductions, they need confidence that active workloads won't break. iam-helper-for-policy-simulator walks the agent through a structured plan, simulate, analyze, and apply flow, testing proposed changes against 90 days of historical access logs to confirm existing traffic won't be disrupted before any update takes effect.
Elevating access just-in-time instead of granting standing privileges: When responders or maintenance agents need temporary production access, iam-helper-for-privileged-access-management manages the lifecycle of on-demand credentials through Privileged Access Manager (PAM). It supports requester, administrator, and approver workflows so elevated access is audited, time-bound, and automatically revoked once the task is done.

While IAM Helper Agent Skills supply the high-level workflow logic, they are all based on a common set of foundational MCP Tools.

Powered by Google Cloud IAM MCP tools

Google Cloud IAM Helper MCP tools provide the backend connection through atomic, read-only functions exposed via Google-managed MCP servers across core IAM endpoints (Policy Troubleshooter, Policy Analyzer, Policy Simulator, and IAM v1/v2 APIs).

Rather than requiring teams to write custom API wrappers, MCP tools give agents a standard way to query the cloud backend and get exact answers without parsing verbose policy documents in the prompt, maximizing token efficiency. Agents can dynamically discover and invoke these tools to execute basic operations like checking permissions or listing roles when custom logic is required.

Because operations like hierarchy traversal, group expansion, and policy evaluation happen on dedicated IAM endpoints (spanning IAM v1 allow roles, IAM v2 deny, Policy Troubleshooter, and Policy Analyzer), skills run quickly and accurately with minimal token usage. Teams can also use these atomic MCP tools directly when writing their own custom Agent Skills, making it straightforward to combine Google Cloud's IAM capabilities with internal ticketing systems, custom compliance checks, and existing deployment pipelines.

Getting started

Accelerate your agentic workflows, reduce operational overhead, and bring intelligent, scalable security to your deployment pipelines. Start building with IAM Helper Agent skills today by exploring our Google Cloud Agent Skills Catalog and dive deeper with the official IAM documentation.

Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Wed, 21 Oct 2026 14:00:00 +0000

Editor's note: This blog was updated on Oct. 23, 2026 at 3:20 p.m. PDT, with additional guidance from Mandiant Consulting on monitoring, patching, and remediation. We have previously updated the blog on Oct. 22, 2026, with revised guidance for Security Command Center and Cloud Armor, and on Oct. 21, 2026.

PHP and Wiz Research disclosed today two critical vulnerabilities in the core PHP language runtime that can expose applications to unauthenticated remote code execution and memory disclosure. Wiz used a mix of models to identify and help remediate these vulnerabilities.

Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.

While Google Cloud itself is not vulnerable, users of PHP running on Google Cloud may be vulnerable. At Google Cloud, we understand the severity of these vulnerabilities, and are sharing guidance to help our customers take immediate action to secure their applications.

Vulnerability background

PHP is a widely-used, server-side scripting language that powers many websites, content management systems, and web applications. On Oct. 21, 2026, CVE.org assigned the vulnerabilities as CVE-2026-109618 and CVE-2026-109619.

The official Common Vulnerability Scoring System (CVSS) base severity score for each of the PHP flaws has been determined as Critical, a severity of 9.2. Generally, this ranking means that threat actors can crash and hijack the affected system, and can easily steal, alter, and wipe its data — although mitigating circumstances can make it harder to exploit the flaw.

CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
Vulnerable versions: All versions of PHP from 5.4 through 8.5.11
Patched in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Not patched: The PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life.
Fix: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp):
Announcement: PHP has published a security advisory on these two vulnerabilities.

Wiz Research has published a detailed description of the research and the coordinated disclosure process.

Update PHP and redeploy your applications

We urge all customers running PHP applications on Google Cloud to immediately update to PHP 8.2 or newer, and redeploy their services using a patched version.

This applies specifically to applications deployed on:

App Engine standard environment: Supported runtimes are patched automatically. If you are on PHP 8.1 or earlier, upgrade to PHP 8.2 or newer and redeploy.
App Engine flexible environment: Redeploy your PHP runtimes using a supported runtime. If you are using a custom runtime, update your PHP dependencies to a patched version and redeploy your application.
Cloud Run: If automatic base image updates are not enabled, or you deploy your own container image, rebuild with a patched version of PHP and redeploy.
Google Kubernetes Engine (GKE): Update your container images with a patched version of PHP and redeploy your pods.
Google Cloud Marketplace: If you run a Marketplace solution that includes PHP, such as a content management system or LAMP stack, apply the update from the solution provider or update PHP directly.

Automatic patches for serverless platforms

Google Cloud is rolling out updated serverless base images for all supported PHP versions on App Engine Standard, App Engine Flexible, Cloud Run, Cloud Run function, and Cloud Functions for Firebase.

What this means for you:

App Engine standard environment (PHP 8.2 and newer): Applications are updated automatically. No action is required.
App Engine flexible environment (all PHP versions): Applications are not updated automatically. Redeploy your application as soon as possible to PHP 8.2 and newer.
Cloud Run functions (PHP 8.2 and newer): Functions with automatic base image updates enabled are updated automatically. Functions without automatic base image updates enabled must be redeployed.
Cloud Run (PHP 8.2 and newer): Services with automatic base image updates enabled are updated automatically. Services built without automatic base image updates must be rebuilt and redeployed to pick up the patched runtime.

Important considerations:

Unsupported runtimes will not be patched. The upstream PHP project is not backporting these fixes to PHP 8.1 or earlier. Applications on PHP 5.5, PHP 7.2, PHP 7.3, PHP 7.4, or PHP 8.1 remain vulnerable and must be upgraded to PHP 8.2 or newer. See the following runtime support schedules for serverless lifecycle dates:

Container images you build yourself are your responsibility. If you have deployed your own container image to Cloud Run or App Engine Flexible (such as with a custom runtime), rebuild it with a patched version of PHP and redeploy.
Capture memory forensics before restarting suspect hosts: If a server shows signs of active probing or anomalous PHPSESSID cookies, capture worker memory before patching or rebooting, as restarting workers permanently destroys volatile heap evidence.
Restart the actual web-serving SAPI (including supervisor-managed workers): Upgrading packages on disk leaves vulnerable libphp.so or php-fpm binaries resident in running worker processes. Explicitly restart php8.x-fpm, apache2/httpd, frankenphp, or lsws.
Do not wait on volunteer third-party RPM mirrors: The PHP security team noted that third-party mirrors may lag behind coordinated disclosure; use official distro security repositories (verify via apt-get changelog php-fpm or rpm -q --changelog php-fpm | grep -E "CVE-2026-109618|CVE-2026-109619") or official source builds.
Audit and mitigate enterprise edge and management infrastructure: Inventory all edge, gateway, management, storage, and security systems, which frequently embed PHP in administrative control planes or core OS modules. As vendors continue disclosing vulnerabilities, coordinate immediately with manufacturers to apply emergency firmware updates or approved temporary workarounds.

Mitigating CVE-2026-109618 and CVE-2026-109619 with Cloud Armor

Cloud Armor has issued recommended mitigations that use Cloud Armor managed rules. Customers with active managed rules do not need to take action; protection against these vulnerabilities is applied automatically.

If you have not yet deployed Cloud Armor managed rules, doing so now can still help you mitigate these vulnerabilities. The Cloud Armor managed rules protections are available now through automatically-updated threat intelligence rulesets.

These rules are intended to help protect your internet-facing PHP applications and services that use global or regional application load balancers. Follow these steps to deploy the rules immediately as a frontline defense-in-depth mitigation while your vulnerability management program updates and verifies all vulnerable PHP instances in your environment.

1. Deploying stable managed rules in enforce mode for automatic updates:

To protect your workloads, follow this guide to enable the File Upload and RFI categories. We recommend that you configure all ruleset categories in the stable version in enforced mode.

2. Mitigate risk on request bodies that exceed configured inspection limits:

Create a rule in your security policies to help ensure that no uninspected or unnecessarily large content reaches your backends. This is important for these CVEs, because threat actors may use large payloads to trigger out-of-memory conditions.

Verifying WAF rule safety for your application and consuming telemetry

Consult our Cloud Armor best practices guide and account for service limitations to minimize risk and optimize performance.

Cloud Armor mitigations serve solely as compensating controls in your layered defense to reduce immediate exposure. Upgrading PHP to a fixed version and redeploying services is required to fully resolve these vulnerabilities.

Monitoring and auditing

Google Cloud and Wiz are currently supporting customers with active monitoring, auditing, and runtime detection across its native security offerings. Customers can use:

On-Demand Scanning API to manually scan images stored locally on your computer or remotely in Artifact Registry. Customers using Artifact Analysis will be notified of these vulnerabilities on both new and existing artifacts to identify at-risk workloads.
Security Command Center to monitor workloads and identify externally exposed instances affected by these two CVEs.

External exposure: Enable the External Exposure service with the EXTERNALLY_EXPOSED_RCE_VULNERABILITY scanning module to detect exposed PHP workloads across Compute Engine, GKE, and Cloud Run. Findings show the Google Cloud native path across load balancers, Cloud Armor policies, and firewall rules to help you verify WAF coverage and block untrusted firewall access while patching.
Vulnerability assessment: Enable Vulnerability Assessment for your organization or projects to find out if your Compute Engine VMs, GKE nodes, and container workloads are running PHP versions vulnerable to PHP2Shell.
Threat Detection: Enable Container Threat Detection for GKE and Cloud Run Threat detection to monitor your workloads for intrusions.

Google Security Operations now has 23 new curated detections added to the Mandiant Frontline Threats rule pack. We recommend verifying that this rule pack is enabled and reviewing your detections to assess any potential impact to your environment.

Enterprise Plus customers can additionally use the Emerging Threat Center and search for “GLOBAL.26.015” for further details. Enterprise plus customers who have enabled the Threat Hunt Agent in Public Preview can also perform a hunt on GLOBAL.26.015 from the Emerging Threats Center.

Wiz customers can refer to the Wiz Threat Intel Center advisory for PHP2Shell, which includes built-in coverage for agentless and runtime vulnerability detection, exploitation detection via Wiz Defend and Sensor, and automatic response policies, alongside remediation and threat hunting guidance. More information is available here on response steps with Wiz.

Additionally, Mandiant Threat Defense is actively supporting customers by monitoring curated detections in Google Security Operations and hunting for evidence of intrusion activity related to this campaign.

Patching and remediation

The PHP security release has been published. You should update PHP across every server environment, container image, and deployment pipeline. In addition:

As part of Wiz's zero-day response commitment, WizOS PHP images are available at zero billable units for all customers for the next 60 days. WizOS PHP base images, both standard Alpine-hardened and FIPS-compliant builds, are already patched against CVE-2026-109618 and CVE-2026-109619, built from source.
Wiz customers can use the Green Agent to translate the PHP2Shell Threat Intel advisory into resource-tailored remediation guidance, including prescribing the correct PHP patch versions, identifying the right WAF mitigations, recommending opportunities to swap in for hardened WizOS PHP images, and suggesting enabling runtime blocking where there are gaps.

Prepatch PHP runtime hardening

If you can not upgrade every binary immediately, apply the following settings in your master startup php.ini or static FPM pool configuration (php_admin_value / php_admin_flag) and restart all workers.

code_block: <ListValue: [StructValue([('code', '; === 1. Neutralize CVE-2026-109619 Stale Pointer Producers ===\r\n; PERMANENTLY disable session upload progress unless your application explicitly uses\r\n; upload progress tracking.\r\nsession.upload_progress.enabled = 0\r\n\r\n\r\n; On PHP <8.5.12: prevent fatal errors from storing request-owned backtrace pointers\r\nfatal_error_backtraces = 0\r\n\r\n\r\n; === 2. Neutralize CVE-2026-109618 OOM Bailout & Multipart Amplification ===\r\n; TEMPORARY pre-patch stopgap: remove the per-request PHP OOM longjmp() failure path.\r\n; IMPORTANT: Pair with cgroup/container MemoryMax= (NOT ulimit -v / RLIMIT_AS), and\r\n; revert to a finite memory_limit once PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 is\r\n; installed.\r\nmemory_limit = -1\r\n\r\n\r\n; PERMANENTLY enforce conservative upload and input complexity bounds to collapse the\r\n; 390x nested empty-filename $_FILES heap amplifier (Karasawa2025 PoC):\r\npost_max_size = 8M\r\nupload_max_filesize = 4M\r\nmax_input_nesting_level = 16\r\nmax_input_vars = 250\r\nmax_file_uploads = 10\r\nmax_multipart_body_parts = 100\r\n; IMPORTANT: If the service does not accept file uploads at all, disable them outright:\r\n; file_uploads = Off\r\n\r\n\r\n; === 3. Defense-in-Depth Runtime Hygiene ===\r\n; PERMANENTLY implement these PHP hygiene measures.\r\nexpose_php = Off\r\ndisplay_errors = Off\r\ndisplay_startup_errors = Off\r\nlog_errors = On'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f8c25162d10>)])]>

Put all settings in the main php.ini file: Avoid defining per-request settings in .htaccess or web server configurations. Warnings triggered while loading these temporary settings run too early and can activate vulnerable code paths. Moving all options into the global php.ini can prevent this.
Restart workers after each request (pm.max_requests = 1): Certain attacks require reusing a worker process across multiple requests. Setting pm.max_requests = 1 in www.conf forces worker processes to reset after every request, blocking multi-step memory attacks.
Hiding error messages is not enough: Simply setting display_errors = Off does not fully block memory leak attacks. Modern exploits can extract sensitive memory directly through extra-large session cookies or specific error pages, even when standard error display is disabled.

Edge proxy and WAF controls

Because RFC 1867 multipart parsing occurs before script execution, reverse proxies and WAFs serve as critical frontline defenses. To defend against recent PoCs, edge controls should focus on mitigating four key evasion techniques:

Block multipart/form-data on non-upload routes: Block multipart requests where file uploads are not needed. Ensure WAF regexes match commas and whitespace before boundary= (e.g., (?i)^\s*multipart/form-data(?:[\s,;]|$)) to prevent delimiter evasion in PHP's RFC 1867 parser.
Reject chunked transfer encoding and restrict body complexity: Reject Transfer-Encoding: chunked POST requests, enforce client_max_body_size 8m;, block deeply nested bracket field names (name\s*=\s*"?[^"\r\n]*(\[[^\]]*\]){8,}), and cap headers per multipart part (<= 128) to prevent heap amplification.
Enforce strict cookie format and body size limits: Block PHPSESSID cookies containing null bytes or non-alphanumeric characters outside ^[A-Za-z0-9,-]{22,256}$. Enforce strict request body size caps on non-upload routes to stop large multipart padding that bypasses WAF inspection windows.
Enforce ingress restrictions: Limit ingress to vulnerable or unpatched public resources only from WAF. Consider additional network ingress restrictions or taking vulnerable web servers offline until patched.

Operating system sandboxing and detections

Because native use-after-free execution runs inside the worker process — allowing RCE payloads to bypass PHP security settings — robust operating system containment and network monitoring remain critical across both pre-patch and post-patch phases.

Read-only web roots and systemd/container Cgroup limits: Execute PHP workers using a dedicated unprivileged account with read-only access across all document roots (via ProtectSystem=strict in systemd or readOnlyRootFilesystem: true in Kubernetes) alongside NoNewPrivileges=yes.

Limit total worker memory using cgroups (e.g., MemoryMax=2G) instead of LimitAS= or ulimit -v, which cause mmap() to return NULL and trigger the vulnerable out-of-memory path.

Block network connections and restrict process execution: Block outbound internet access from PHP servers using network security rules to stop attackers from downloading malicious files or creating remote shells. Additionally, use process security controls or runtime monitoring to prevent PHP from executing command-line shell tools like /bin/sh, curl, or wget.

What to hunt for

Detection Layer	High-Signal Indicator to Alert On	Why It Matters / Evasion Caveat
Outbound HTTP / WAF Egress Logs	`Set-Cookie: PHPSESSID= headers > 256 bytes` or match regex:`PHPSESSID=[A-Za-z0-9%,_-]{257,}`	Typical PHPSESSID cookies are between 22 and 256 bytes. Catches Heartbleed-style heap leaks (up to 800 KB). IMPORTANT: Include '%' in regexes as leaked pointers are URL-encoded (%XX) by php_url_encode().
Web Server Access Logs (Apache / NGINX)	Bursts of 50–150 concurrent persistent `'OPTIONS * HTTP/1.1'` keep-alive connections OR slow-chunked multipart POSTs	Detects Apache mpm_prefork worker-pool fencing (PreforkParking) and slow HTTP chunk streaming used to pin a single free worker for multi-request heap reuse.
Web Application / HTTP	Repeated `'.php/'` URI segments (e.g., `/index.php/index.php/...`) returning HTTP 404	Detects Karasawa2025's cookie-less ext/phar OOB heap leak in HTTP 404 bodies.
Web Application / HTTP	Rapid interleaved HTTP 500/200 POST bursts against the same endpoint	Detects blind pointer-comparison (*ptr) memory disclosure which leaks memory byte-by-byte without emitting anomalous response cookies.
EDR / auditd Process Telemetry	Child processes (e.g., `sh`, `bash`, `curl`, `wget`, `nc`, `python,chmod`) spawned by `php-fpm`, `httpd`, `apache2`, or `frankenphp` (UID `www-data`)	Catches `zif_system` / `zif_passthru` RCE payloads. Note: Karasawa2025 & LyesH4ck chain `zif_passthru` + `_zend_bailout` to return output in HTTP 200 with ZERO `SIGSEGV` crashes and ZERO `error.log` entries.
Host Application Telemetry	Spikes in FastCGI / PHP-FPM worker respawns (`SIGSEGV` exit code 139) or core dumps	Catches failed heap shaping attempts and memory alignment probes that fail before reaching the clean bailout path

We will continue to monitor the situation closely and provide further updates and guidance as necessary. For the most current information and detailed steps, please refer to the Google Cloud security bulletin.

Hardware-backed security at global scale: Confidential G4 with NVIDIA Blackwell is GA

Wed, 21 Oct 2026 11:30:00 +0000

Bringing autonomous agents into production means processing sensitive data and valuable intellectual property in real time. Protecting proprietary model weights, user prompts, and generated outputs requires security that safeguards data while it is actively being computed.

As part of our efforts to enable your enterprise securely, today we are announcing that Confidential Computing on Google Cloud’s G4 instances enabled by NVIDIA RTX PRO 6000 Blackwell Server edition GPUs is now generally available. This release integrates NVIDIA Confidential Computing directly into Google Cloud's AI Hypercomputer, delivering the dynamic performance needed to scale without compromising privacy.

When we announced Confidential G4 in preview earlier this year, we talked about its global footprint and scale. Today, these instances are generally available across 36 zones, using multiple consumption models, on Compute Engine VMs and GKE nodes.

In addition, support for Confidential Space enabling secure multi-party data sharing is rolling out to general availability in the coming weeks.

Protecting sensitive data and models at low latency

Protecting data in use shouldn't mean sacrificing GPU throughput or operational agility. By combining non-exportable hardware keys, verifiable remote attestation, and transparent memory encryption, Confidential G4 helps organizations maximize their investments in agentic and inference workloads. Enterprises can keep costs low while meeting strict regulatory and compliance requirements.

“As organizations deploy AI across increasingly complex cloud, on-premises, and agentic environments, protecting sensitive data is critical. Enterprises must also ensure that AI systems operate securely and consistently with their policies. Google Cloud Confidential G4 VMs powered by NVIDIA RTX PRO 6000 Blackwell GPUs provide a powerful foundation for privacy-preserving AI and AI operations. Confidential Core AI builds on Google Cloud to transform enterprise principles, policies, and operating requirements into real-time safeguards that monitor and govern AI agents, models, data, and tools. Together, these capabilities enable organizations to scale trusted AI on Google Cloud while maintaining control, confidentiality, and accountability.” - Taher Behbehani, Founder and CEO, Confidential Core AI

Additional benefits for enterprise AI workloads include:

End-to-end confidentiality and isolation: Encrypt data and model parameters in hardware-enforced execution environments to shield intellectual property and customer inputs from host system administrators, hypervisors, and access by cloud providers.
Verifiable cryptographic trust: Use hardware-rooted remote attestation to verify code, platform configuration, and environment integrity before releasing sensitive datasets and running workloads.
No code refactoring: Deploy models out of the box using standard Ubuntu OS images, NVIDIA drivers, and NVIDIA CUDA-X libraries without application changes or custom builds.

For Polaris Cloud, this ease of deployment was transformational.

“Polaris builds workspaces for AI agents, and our customers need to know where an agent's work actually ran and that it was cryptographically isolated along the way. Google Cloud Confidential G4 has been a game changer for that. We get hardware-backed provenance from the NVIDIA RTX PRO 6000 Blackwell GPU, which we bind into the receipt customers get back with their results. Virtually nothing else changed: same G4 image, same NVIDIA driver, same container runtime, one flag at launch, same performance. Overnight it upgraded our customer promise from 'we run your agent' to 'every workload you run with us is verifiable.” - Fred Esere, Founder and CEO, Polaris Cloud

Multi-party data collaboration: Run collaborative analytics and joint model training securely using Confidential Space. Multiple parties can combine sensitive datasets without revealing underlying private data to each other.

“Enterprises need to put their most valuable data to work with AI while protecting it during processing. NVIDIA Confidential Computing brings hardware-backed protection to GPU-accelerated workloads, helping safeguard sensitive data and proprietary models while in use. Together with Google Cloud, we’re bringing NVIDIA Blackwell performance and these security capabilities to Confidential G4 VMs so organizations can scale production AI with high performance and verifiable protection.” - Dave Salvator, Director of Accelerated Computing Products, NVIDIA

Testing performance

To understand the operational impact of memory encryption, we analyzed Confidential G4 instances against standard, non-confidential G4 instances on the g4-standard-48 machine shape. Our testing focused on widely adopted open-weight models that customers frequently deploy on single-GPU instances for their own inference pipelines.

Benchmarking across popular models including Llama 3, Llama 3.3, Resnet-50, and SDXL shows that Confidential G4 delivers performance on par with standard G4 instances for AI inference workloads, with less than 3.5% degradation in throughput (measured in tokens or images per second).

Note: Performance results are based on specific testing conditions and configurations. Individual workload performance may vary based on system setup, hardware choice, and software environment.

Our analysis can help you move fast while protecting sensitive data and meeting compliance requirements — a trade-off that real-world deployments are already validating.

”We benchmarked Google Cloud's Confidential G4 against a standard G4 running identical software on our workloads. We found that for a modest 5.2% increase in end-to-end latency, we get a hardware-level assurance that ensures unauthorized users outside our users' attested environment cannot eavesdrop on their conversations. We'd make that trade every time; our users get the convenience of the cloud with the privacy of on-premises.” - Andy Qin, CEO, Vertebrae

Getting started with Confidential G4s

With Confidential G4, improving enterprise security during model execution and agentic workloads doesn't require sacrificing performance, flexibility, or operational simplicity. By providing verifiable trust and robust hardware isolation with near-zero throughput degradation, organizations can securely deploy high-value models and protect critical data assets at cloud scale.

Get started today by following the Confidential VM with GPU documentation.

Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for Kubernetes

Fri, 16 Oct 2026 16:00:00 +0000

Everything is moving faster in the age of AI, and that includes security threats. What used to take attackers weeks to exploit can now happen in just a few minutes.

Standard vulnerability scans that run on artifacts at rest can catch basic setup issues, but to detect an attack that's actively happening you need real-time runtime protection.

Today, we’re introducing the Wiz Runtime Sensor add-on for Google Kubernetes Engine (GKE), in preview. This built-in integration brings low-touch deployment, automated lifecycle management, enterprise credential security, and fleet-wide governance to Wiz's industry-leading eBPF runtime threat detection for both Standard and Autopilot GKE clusters.

The operational friction of runtime security

Security and platform engineering teams share common dilemmas when deploying in-cluster runtime defenses:

Deployment and lifecycle friction: Deploying runtime agents often requires managing installations from third-party sources across dozens or hundreds of clusters.
Credential sprawl and security risks: Passing and rotating API keys as Kubernetes Secrets introduces administrative overhead and security risk.
Fleet-wide enforcement gaps: Platform teams lack built-in policy controls to enforce that every new cluster has runtime sensors enabled before workloads are deployed and start receiving traffic.
Performance and operational overhead: Without explicit and strategic resource limits, runtime agents can impact how much CPU and memory is available for your workloads and system functionality.

With the Wiz Runtime Sensor for GKE, Google Cloud and Wiz have minimized these operational barriers. The Runtime Sensor is now available in GKE as a first-party, managed platform add-on.

Bridging the gap with Wiz Runtime Sensor for GKE

The Wiz Runtime Sensor for GKE connects central security and platform engineering workflows by simplifying and automating the sensor lifecycle.

Figure 1: High-level architecture showing credential sync, sensor deployment, and threat telemetry.

With the add-on, GKE manages the sensor deployment, credential injection, and lifecycle updates. Building runtime protection directly into the platform reduces administrative overhead and provides the following benefits for your Kubernetes fleet:

Native Secret Manager integration: Security teams no longer need to distribute Wiz API keys across cluster namespaces. The add-on uses GKE's Secret Manager secret sync integration to store your Wiz credentials in an off-cluster, centralized credential vault that only a dedicated service account can access.

GKE automatically retrieves the credentials and injects them directly into the Runtime Sensor pods. Updating a key in Secret Manager automatically syncs to the sensor without requiring cluster restarts or manual intervention.

Simplified enablement: After you add your Wiz credentials to Secret Manager, platform operators can enable the Runtime Sensor add-on by using the gcloud CLI or the GKE API. The GKE control plane handles deploying the sensor components, managing the lifecycle of pods, and configuring the nodes.
Secure egress and proxy support: For environments that restrict public internet access, the managed sensor supports standard HTTP and mTLS proxy configurations. Telemetry is routed back to Wiz without violating your egress firewall policies.
Fleet-wide governance with organization policy: Platform security leads can enforce compliance across their entire organization using custom organization policy constraints. You can use a constraint to reject any attempts to create a cluster that doesn't enable the Runtime Sensor add-on, which can prevent malicious actors from spinning up rogue infrastructure to evade runtime detection.
Kernel-level observability with minimal overhead: The Wiz Runtime Sensor continuously monitors system calls, running processes, network connections, and file access. It catches suspicious activity, including reverse shells, unauthorized privilege escalations, container escapes, and unsafe outbound connections while keeping CPU usage low even under heavy workload activity.

The sensor uses a fixed memory limit on each node to ensure consistent performance as workload density changes. This is especially valuable for AI workloads and web services where application activity might fluctuate quickly.
Independent auto-updates: Security threats and zero-day vulnerabilities don’t wait for scheduled infrastructure maintenance windows. The lifecycle of the Wiz sensor add-on for GKE is independent of your GKE cluster and node lifecycle.

The sensor periodically rolls out updates of new sensor versions published by Wiz, to help ensure that your clusters always have the latest detection rules without requiring GKE version bumps, node pool recreations, or workload disruption.

How it works: Deploying and enforcing the sensor

Enabling the Wiz sensor add-on follows the same process that platform administrators are already familiar with on GKE. Using standard gcloud commands, you can activate runtime protection during cluster creation, turn it on for existing clusters, and enforce it across your fleet while keeping credentials securely managed in Secret Manager.

Check the setup documentation for prerequisites, such as granting GKE access to Secret Manager.

Provisioning a cluster with the Wiz Sensor add-on

To provision a new GKE cluster with the managed Wiz sensor enabled using credentials stored in Secret Manager:

code_block: <ListValue: [StructValue([('code', 'gcloud container clusters create production-ai-cluster \\\r\n --zone=us-central1-a \\\r\n --release-channel=regular \\\r\n --workload-pool=${PROJECT_ID}.svc.id.goog \\\r\n --enable-secret-sync \\\r\n --enable-secret-sync-rotation \\\r\n --addons=WizSensor=ENABLED \\\r\n --wiz-sensor-registry-secret-uri=projects/${PROJECT_ID}/secrets/wiz-registry-secret/versions/latest \\\r\n --wiz-sensor-api-key-secret-uri=projects/${PROJECT_ID}/secrets/wiz-api-key-secret/versions/latest'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f8c2629cf90>)])]>

To enable the sensor on an existing running cluster with Workload Identity Federation for GKE and Secret Manager secret sync enabled, run the following:

code_block: <ListValue: [StructValue([('code', 'gcloud container clusters update production-ai-cluster \\\r\n --zone=us-central1-a \\\r\n --update-addons=WizSensor=ENABLED \\\r\n --wiz-sensor-registry-secret-uri=projects/${PROJECT_ID}/secrets/wiz-registry-secret/versions/latest \\\r\n --wiz-sensor-api-key-secret-uri=projects/${PROJECT_ID}/secrets/wiz-api-key-secret/versions/latest'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f8c256bb3d0>)])]>

Enforcing fleet-wide protection with organization policy

You can require all new GKE clusters across your organization to install the runtime sensor by deploying a custom constraint:

code_block: <ListValue: [StructValue([('code', 'name: organizations/123456789012/customConstraints/custom.GKEWizSensorEnforced\r\nresource_types:\r\n - container.googleapis.com/Cluster\r\nmethod_types:\r\n - CREATE\r\n - UPDATE\r\ncondition: resource.addonsConfig.wizSensorConfig.enabled == true\r\naction_type: ALLOW\r\ndisplay_name: Enforce Wiz Sensor on All GKE Clusters\r\ndescription: Mandates that all GKE clusters enable the managed Wiz Runtime Sensor backed by the corporate Secret Manager vault.'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f8c25e12890>)])]>

Intelligent threat correlation for AI security

The true power of this integration emerges when the managed sensor connects to the broader Wiz AI Application Protection Platform (AI-APP). By feeding GKE runtime telemetry into the Wiz Security Graph, you unlock a security toolkit that goes beyond static alerting, with:

Real-time risk assessment and threat verification: By pairing background security scans with live activity monitoring, you get a clear view of real risks. The sensor checks whether vulnerable code is actually running in memory, so you can focus on active security threats and ignore inactive ones.
Real-time threat detection and response: Identify suspicious activity like malware, unauthorized access attempts, and software vulnerabilities in real time. Security teams can set rules to automatically block or stop threats before they can spread.
Network activity and detailed security insights: Track system activity, network connections, and data flows to uncover hidden risks and unauthorized software usage. If a threat is detected, the sensor automatically gathers diagnostic data to help teams quickly investigate what happened.

Together, these capabilities ensure that mission-critical applications and AI agents deployed on GKE are monitored for attacks and data exfiltration without compromising developer velocity.

Get started today

The Wiz Runtime Sensor add-on for GKE delivers a standard for container security: deep, kernel-level eBPF protection without operational complexity or deployment friction.

By combining GKE's managed platform automation with Wiz's comprehensive security intelligence, platform and security teams can innovate at cloud speed while maintaining strong runtime defense. Check out the Wiz Sensor for GKE documentation to learn more.

Modernizing perimeter security: Scalable perimeters with VPC Service Controls

Thu, 15 Oct 2026 16:00:00 +0000

Agents represent a fundamental shift in cloud operations. They can act on behalf of users or autonomously, make non-deterministic decisions, and request data across projects at unprecedented speed and scale. Because agents are a distinct category of non-human identity (NHI), they require unique secure-by-default guardrails.

Traditional, manually-operated network perimeters are vulnerable to today’s machine-speed attacks. Overly permissive perimeters, built to avoid blocked connections, increase the risk of unauthorized data theft, but overly strict perimeters stall development under a flood of access denials.

Today, we're excited to announce key enhancements to VPC Service Controls (VPC-SC) that make perimeters easier to create, maintain, and scale. You can now add folders to perimeter membership, so that projects contained in them inherit policy. You can also manage granular exceptions and resolve denials with guided, scoped remediation.

The result is data protected by default, so you can scale autonomous agents across your enterprise without letting data leave your perimeter. This update is generally available, and at no additional cost.

Perimeters aligned to your architecture

VPC-SC provides a context-aware network security perimeter around your Google Cloud deployment, designed to secure your organization against data theft, even in the event of compromised credentials, identity and access management (IAM) misconfigurations, and insider threats. By extending network-layer protection across service-to-service interactions in Google Cloud's infrastructure, VPC-SC goes beyond traditional firewalls and creates an additional layer of defense that prevents access outside your corporate network — and is now easier for your organization to manage.

Cloud administrators configuring VPC-SC can now include folders in perimeter membership, automatically extending the folder’s access policy to every project and nested subfolder it contains. New workloads can inherit protection by default, with no further modification.

Figure 1: Simplified perimeter authoring in VPC-SC.

Perimeter membership updates when a project is moved, simplifying lifecycle maintenance. Security coverage follows the resource hierarchy that your organization already governs, and compliance verification requires only confirming that the resource is located in the correct part of the hierarchy.

Dry-run mode also supports folder membership, helping administrators evaluate the effect of a hierarchy-wide perimeter against live traffic before enforcement.

Folder and organization support in ingress and egress rules

Well-defined ingress and egress rules establish granular, context-aware perimeters without sacrificing operational flexibility across complex multi-project environments. Security administrators can now specify Google Cloud folders and organizations directly within those rules. A single hierarchy reference stands in for the set of projects beneath it, which keeps rules concise, keeps attribute counts well within quota limits, and extends access automatically to projects created later in the hierarchy.

Figure 2 : Simplified authoring of ingress/egress rules.

Using Private Service Connect endpoints in ingress and egress rules

Enterprises increasingly use private paths to reach desired endpoints in their deployment instead of exposing the traffic to the internet. Private Service Connect endpoints for Google APIs are now supported as an attribute in ingress and egress rules. Administrators can author a rule that authorizes access specifically over a designated private endpoint, producing a policy that corresponds directly to the connectivity architecture it is intended to govern.

Figure 3: Supporting Private Service Connect endpoints with ingress and egress rules.

For organizations that have standardized on Private Service Connect, including endpoints propagated across the estate through Network Connectivity Center, this provides both a more precise and a more concise means of expressing source for the request.

Service patterns in VPC accessible services

Service patterns in VPC accessible services provide granular control over Google APIs accessed with private Virtual IP addresses (VIP), permitting interoperability beyond just VPC-SC integrated services. If the workload requires controlled access to validated API endpoints over a private path, administrators can now allow only the specific API URL patterns required.

Additionally, the capability supports appending org-restriction-headers with egress requests to facilitate access to only authorized domains and resources. Because you don’t need to manage egress-proxy, you can accommodate legitimate operational requirements while maintaining a tightly-bounded private path, instead of choosing between a broad allowance and no access at all.

Figure 4: Granular control over Google APIs with service patterns in VPC accessible services.

Guided violation remediation

VPC-SC perimeter policies evolve continuously alongside the workloads they protect, and administrators periodically need to authorize a legitimate access request not yet covered. New Guided Violation Remediation in VPC-SC Violation Analyzer cuts resolution time for blocked requests from days to minutes by generating a policy fix with remediation recommendations, which you can validate in Dry-Run mode first.

Rather than just diagnosing why the violation occurred for a given denial, Violation Analyzer evaluates the blocked request against the applicable perimeter configuration, and proposes a specific configuration change, narrowly scoped by least-privilege design principles, to authorize the traffic: an ingress rule, an egress rule, an access level, or an update to VPC accessible services. This relieves pressure on administrators to broadly open up a perimeter just to resolve a violation and get an application working quickly.

Read more about how BlackLine uses Violation Analyzer to streamline investigations.

Figure 5 : VPC-SC Violation Remediation for faster turn-around.

Get started today

VPC-SC makes it simple and automated to deploy and refine granular network perimeter protection, even for autonomous agents. To get started:

Establish your folder baseline: Identify the folders in your resource hierarchy that correspond to the boundaries you intend to enforce, and define perimeters around them so that new workloads inherit policy on creation.
Run risk-free in Dry-Run mode: Observe production traffic safely without blocking active developers.
Unblock traffic with Violation Analyzer and Violation Dashboard: Use automated least-privilege remediation recommendations to resolve any denials that surface.
Enforce with confidence: Secure your full data estate by transitioning to enforcement once your dry-run logs show your intended access with clean, authorized traffic.

To learn more about how VPC-SC can help simplify your data security posture and confidently secure your autonomous agent fleets, check out the VPC-SC documentation.

Cloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQC

Wed, 14 Oct 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for October 2026. Today, Stephanie Kiel explains the latest on our approach to post-quantum cryptography, and shares a new tool to help CISOs and executives prepare their organizations for PQC.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f8c263c9810>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

New Gemini Notebook can help CISOs and policymakers prepare for PQC

By Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Post-quantum cryptography (PQC) is one of the most urgent security shifts of the decade — and one of the easiest to tune out. For security leaders and policymakers, the research is dense, scattered across papers and engineering blogs, and can be challenging to turn into action.

To help, we're launching Prepare for Post-Quantum Cryptography, a public Gemini Notebook that brings Google's PQC research, engineering blogs, and migration guidance together in one place. Ask it questions, listen to an audio overview, or test yourself with flashcards, and quickly get up to speed on the quantum threat.

Why PQC matters now

Quantum computing is rapidly moving from theory to reality. Our Willow chip and Quantum Echoes algorithm mark substantial progress, and Google research estimates that breaking ECDLP-256 and RSA-2048 encryption — the public-key cryptography schemes protecting much of our online data — would require around 500,000 and 1 million imperfect quantum computer components (noisy qubits), respectively.

To help, we're launching Prepare for Post-Quantum Cryptography, a public Gemini Notebook that brings Google's PQC research, engineering blogs, and migration guidance together in one place.

This research has consequences now. It indicates that today’s online security is more vulnerable to future quantum computers than previously thought.

In Store Now, Decrypt Later attacks, adversaries may steal encrypted data now and wait to decrypt it once a sufficiently powerful quantum computer exists. Data that we’ve long considered sensitive — health records, financial data, intellectual property, and government secrets — is already at risk.

With continued advances in architecture, quantum algorithms, and quantum error correction shrinking future quantum hardware requirements, waiting to upgrade our digital locks is not a viable option. To help organizations stay ahead of the curve, Google has published a migration timeline noting our plans to transition to PQC by 2029, and we urge others to consider the same.

As the technology advances, policymakers should consider urging critical infrastructure owners and operators to recognize condensed timelines, and build PQC readiness into existing risk mitigation plans. We also recommend governments engage with global counterparts to promote a harmonized approach to standards development, and include technical and security experts in the building of policy and regulatory requirements focused on quantum safety.

Google's PQC expertise, in one notebook

The Prepare for Post-Quantum Cryptography notebook turns years of Google expertise into an interactive primer that anyone can use. It's built on curated Google sources covering the quantum era, quantum computing breakthroughs like Willow, Quantum Echoes, and surface code error suppression, industry PQC standards, Google's own deployments, and the latest research.

In the Gemini Notebook, you can:

Get answers grounded in Google's sources.
Listen to a podcast-style audio overview.
Test your PQC knowledge with flashcards.
Explore an interactive visual diagram of the quantum threat.
Read a concise briefing document.

Try these prompts

To get started, here are a few questions to ask the notebook:

For CISOs: "What should a CISO prioritize in the first 90 days of a PQC migration?"
For anyone new to PQC: "Explain store-now-decrypt-later in plain terms."
For developers: "How does hybrid ML-KEM key exchange work in Chrome?"

As with all generative AI, the notebook can make mistakes, so check its responses against the linked sources.

What's at stake

Previous cryptographic migrations, such as moving from SHA-1 or upgrading TLS, have taken a decade or more. Waiting for the availability of a cryptographically-relevant quantum computer before beginning the migration journey represents a significant security risk given the importance of public-key cryptography for securing digital essentials like web traffic, software updates, digital identities, and signatures.

For CISOs, we recommend that you start by:

Understanding where vulnerable cryptography lives in your organization.
Identifying and prioritizing data and systems most at risk from quantum threats, and developing a plan for addressing these risks.
Anticipate system-wide effects that PQC migration could have.
Building crypto-agility into your security plans, using learnings from past experiences like Heartbleed.

Additional detail on these recommendations is available in our previous blog post.

For the broader security community, the transition only succeeds if this knowledge is accessible to everyone — not just organizations with dedicated cryptography teams.

How Google is putting PQC into practice

We’ve been deploying PQC for years. Highlights include:

We also co-founded the Post-Quantum Cryptography Alliance at the Linux Foundation with industry leaders including Amazon Web Services, Cisco, IBM, and NVIDIA to support open-source tools like Open Quantum Safe.

Build a PQC notebook for your own team

Here’s how you can create a resource similar to our PQC Gemini Notebook, specific to your organization’s needs:

Curate trusted sources. Start with a focused set of authoritative research, standards, and guidance.
Write neutral prompts. Keep instructions factual so outputs stay grounded in your sources.
Add AI disclaimers and a welcome note. Tell readers what the notebook covers and remind them that AI can make mistakes.
Review all output with human oversight. Have experts check every artifact before you share it.

Start preparing today

The quantum transition has already started, but preparing your organization doesn't have to begin with a 100-page whitepaper. Start by understanding the threat, then assess your cryptographic inventory and build a migration roadmap.

You can get started with the Prepare for Post-Quantum Cryptography Gemini Notebook and share it with your team today. To learn more about Google Cloud’s approach to PQC, check out our dedicated Google Cloud PQC Resource Hub.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f8c2559a410>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=Wpo-5ke9uvQ'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Securing enterprise agility in the machine-speed era: Learn what executives need to know about today’s threat landscape, how security teams should respond, and why Google AI Threat Defense can help. Read more.
Gemini 4 Argon available on Google Cloud: We’re making our new frontier model, Gemini 4 Argon, available for everyone on Google Cloud. Here’s how it can help boost the defender’s advantage. Read more.
Android's next-gen enclave for on-device AI: Learn about Android’s enclave architecture for personalized on-device AI experiences. Read more.
The Wiz Red Agent caught a Fortune 500 firm’s data exposure that other tools missed: Using an attacker’s mindset, the Red Agent found a public page exposing sensitive data in minutes. Read more.
Chrome's response to recent ccTLD registry hijacks: Following recent .gh, .sl, and .as ccTLD domain hijacks, Chrome immediately blocked unauthorized HTTPS certificates via CRLSets to protect users automatically. Read more.
Wiz Blue Agent POV: Investigating data theft across AWS and GitHub: See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling. Read more.
Introducing Wiz AI SAST: Application security that understands you: Find, validate, and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized in your existing security program. Read more.
Introducing WizOS Helm Charts to secure the Kubernetes supply chain: WizOS Helm Charts can help eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for Kubernetes. Read more.
What’s new in Wiz Service Catalog: Smarter discovery, governance, and service-level context can help build your service catalog faster, keep service context current, and give teams a clearer path from cloud risk to accountability. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25599710>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Vulnerability discovery and exploitation trends in the AI era: To counter the increased risk from rapid vulnerability discovery and exploitation, organizations should transition from unprioritized mass-patching to threat-intelligence-driven triage, combining targeted edge-defense with automated, agentic remediation. Read more.
Defending against active exploitation of Citrix NetScaler ADC and Gateway appliances: Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Here’s our containment and remediation guidance. Read more.
ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft: Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. Read more.
Proactively defend by hardening code pipelines and CI/CD infrastructure: Check out our actionable blueprint for software and platform architects designed to safeguard the software supply chain against threat vectors that are actively being exploited, third-party risks, and architectural vulnerabilities throughout the entire software development lifecycle. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here.
Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Nir Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Cloud CISO Perspectives: How cybersecurity startups can win CISOs

Wed, 30 Sep 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for September 2026. Today, Alicja Cade and Nick Godfrey, senior directors, Office of the CISO, share their guidance for cybersecurity startups on how to win over the CISOs who will become crucial business partners and customers.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25687b50>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How cybersecurity startups can win CISOs

By Alicja Cade, Senior Director, Financial Services, Office of the CISO, and Nick Godfrey, Senior Director, Office of the CISO

Alicja Cade, Senior Director, Financial Services, Office of the CISO

Cybersecurity startups play a crucial role in technology as they build to solve both legacy, existential challenges and the latest problems on the cutting edge. A key part of winning and transforming the cybersecurity field is becoming a strategic partner to CISOs and their security teams.

Google has supported more than 50 cybersecurity founders over the past four years through our Google for Startups program, including Authologic, BforeAI, Build38, Cerby, Crowdsec, Risk Ledger, and Mokn.

Christian Torres, co-founder and CEO, Kriptos, and a Google for Startups participant, said that building connections between startups and CISOs is crucial to solving critical security challenges.

Nick Godfrey, Senior Director, Office of the CISO

"The Google for Startups program has been the most impactful initiative we've joined as a cybersecurity company. Unlike other accelerator programs, this one speaks our language — the challenges, the ecosystem, and the conversations are 100% aligned with what we do every day at Kriptos. The access to CISOs and security leaders has been invaluable, and the connections we've built through the program are ones we now see regularly across industry events. It's put us exactly where we need to be,” he said.

Cybersecurity startup founders face many competing taskmasters as they fight for survival, from demanding capital funders to the relentless pressure of growing their market and networks. CISOs should be key stakeholders for cybersecurity startups so that founders focus on solving thorny challenges in a way that works in the real world.

Listening to CISOs and understanding the businesses that they serve takes time and effort, and if done right can help deliver better value and create a lasting enterprise foundation and network of allies.

Here are three top tips from September’s Gemini Startup Forum for Cybersecurity, part of the Google for Startups program, where we offered vital guidance, addressed critical domains, and helped foster deep dialogue for the next generation of AI-native cybersecurity startups.

Tip 1: Listen then design and deliver for your customers

Avoid becoming a round peg in a square hole by combining your problem-solving startup with listening to CISOs who have to protect real systems, networks, and people. Listening to CISOs and understanding the businesses that they serve takes time and effort, and if done right can help deliver better value and create a lasting enterprise foundation and network of allies.

Here’s how to develop trusted CISO relationships:

Host diagnostics meetings. Your meetings with CISOs should focus on mapping their operational bottlenecks and co-authoring collaborative solutions while studying their pain points.
Create "unselling" spaces to build peer trust. Host intimate, pitch-free roundtable discussions on industry challenges or establish a critique-only advisory board to build genuine relationships with CISOs without the pressure of a sales environment.
Use neutral networks that don’t include venture capitalists. Engage with CISOs in low-friction environments by contributing to open-source security projects and participating in academic and geopolitical risk forums where security leaders gather to solve broad industry problems.
Avoid the bait-and-switch pitch. Never disguise a sales pitch as a research or feedback session, as tricking a CISO into a product demo will permanently destroy their trust.
Center their business context. Don’t limit your listening to the technical security stack, because the CISO’s primary job is to enable and protect the broader business strategy.

Tip 2: Evaluate AI security to filter out noise

Instead of just using AI to assemble the product, startups should critically evaluate what makes your approach unique and how you communicate that to potential customers.

Define your moat by investing in proprietary datasets, specialized fine-tuning, and unique orchestration layers that create a true technical moat. Don’t be a wrapper.
Secure the intelligence by proactively designing your models to resist adversarial attacks, prompt injection, and data poisoning. In cybersecurity, model robustness is your ultimate trust signal.
Deliver high-fidelity outcomes by clearly communicating how your AI product reduces cognitive load for defenders, minimizes false positives, and integrates safely into existing operations.

Avoid using generic marketing buzzwords like "cognitive," "autonomous," or "revolutionary" without the technical documentation, case studies, and whitepapers to back them up. In a skeptical market, transparency is your best sales tool.

Tip 3: Enthusiastically embrace your sector

Keep a sharp eye out for common due diligence pitfalls during investment and merger and acquisition cycles. These include ensuring that internal engineering and cybersecurity practices meet external claims, but also evaluating the regulatory context of your business sector as well as the security and reliability of your product and service.

You have to know whether you’re required to abide by data sovereignty, data residency, and other requirements. To avoid this pitfall, engage with broader stakeholders early who know the sector and its nuances well.

How to keep the conversation going

Even beyond the crowded field of aspiring cybersecurity companies, startups broadly can benefit immensely by making sure that they listen carefully, evaluate objectively, and take to their sector requirements enthusiastically.

"Google's Office of the CISO has been a bridge between LetsData and the security leaders we need to reach. Sometimes that bridge is advice on how our offering maps to a CISO's real priorities. Sometimes it is a direct introduction to a CISO who is looking for exactly what we build. For a startup, a warm introduction at that level is priceless,” said Ksenia Iliuk, founder and COO, LetsData.

To learn more about how Google Cloud’s Office of the CISO can help support your organization, check out our CISO Insights hub.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25686290>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=Wpo-5ke9uvQ'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Agentic hacks, real proofs: Inside Google's PageBreak project: Distinguishing a genuine, exploitable flaw from a convincing hallucination has become a major challenge, often increasing the burden on product teams. PageBreak is an internal AI agent of Google's Product Security team developed to test the security of our first-party web applications and address this challenge. Read more.
Investing together: Wiz Defend and Google Security Operations: Continuing to deepen the integration between Wiz Defend and Google Security Operations, helping teams work faster wherever they choose to investigate. Read more.
A unified view of Android security updates for enterprises and OEMs: We're introducing new libraries that give enterprise partners and OEMs a complete, real-time picture of a device’s security posture. Read more.
Delivering new partner security agents and AI defenses with Gemini Enterprise: We're expanding our catalog of partner-built security offerings in the Gemini Enterprise ecosystem to help you leverage your full security context. Read more.
Google named a Leader in the External Threat Intelligence Service Forrester Wave: We are proud to announce that Forrester has named Google a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026. Read more.
Wiz named a Leader in the Proactive Security Platforms Forrester Wave: Forrester’s Proactive Security Platforms evaluation for Q3 2026 rated Wiz with top scores across eight areas, reflecting our commitment to securing the AI era. Read more.
Strengthen your CI/CD pipeline with new Secure Source Manager capabilities: To help you better address software supply chain threats, our Secure Source Manager lets you manage your source and CI/CD systems with unified authentication and authorization mechanisms. Read more.
Building an AI detection engine that understands agent intent: Analyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior. Read more.
Using AI to discover and fix high-priority exposures across public services and critical infrastructure: New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25684c90>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft: Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. Read more.
Proactively defend by hardening code pipelines and CI/CD infrastructure: Check out our actionable blueprint for software and platform architects designed to safeguard the software supply chain against threat vectors that are actively being exploited, third-party risks, and architectural vulnerabilities throughout the entire software development lifecycle. Read more.
Infostealer incursion: How stolen credentials breach cloud, code, and AI environments: Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here.
Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Nir Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Google Cloud partners deliver new security agents and AI defenses with Gemini Enterprise

Tue, 29 Sep 2026 16:00:00 +0000

As threat actors increasingly use AI to accelerate and develop cyberattacks, enterprise defenders need to rely on both AI and a critical defender’s advantage: Business context that only you possess.

Enterprise cyber defense spans identity, network, endpoint, data, cloud, and application layers, often split across a dozen or more products, each with its own context. At Google Cloud Next, we brought partner-built agents into Gemini Enterprise to give you one place to discover and deploy specialized agents across functions including sales, content and creative workflows, HR, and security.

Today, we're expanding our catalog of partner-built security offerings in the Gemini Enterprise ecosystem to help you leverage your full security context from one unified interface.

These new security agents and integrations from leading cybersecurity vendors span two areas: partner security agents that your teams invoke directly in Gemini Enterprise, and protections for AI and agentic workloads. By bringing them into Gemini Enterprise, you can now orchestrate multi-step security workflows directly in your Gemini Enterprise environment, bringing AI-powered capabilities to your defenses.

Meet new security agents and agentic defenses built with Gemini Enterprise

Acalvio: The Acalvio ShadowPlex deception agent, accessible through Gemini Enterprise, automates the deployment of decoys and honeytokens across enterprise networks and embeds deception guardrails directly into customer’s operating environment, with no manual configuration required. ShadowPlex deploys network decoys, identity honey accounts, retrieval-augmented generation (RAG) decoys, honey skills, and honeytokens at scale, trapping unauthorized interactions quickly.

Britive: The Britive Emergency Termination Agent, built on Gemini Enterprise, lets security teams contain a compromised human or non-human identity from a single natural-language request instead of working across multiple consoles. The agent confirms the identity, lists all active privileged sessions, revokes all sessions with human approval, disables the identity, and gathers audit context for the incident ticket. The result is significantly lower mean time to containment (MTTC) while maintaining strict governance and least-privilege access for agents.

Check Point: Integrated with the Google Cloud Agent Gateway and Agent Registry, Check Point AI Defense Plane provides the critical security controls and visibility required for your enterprise-scale AI. It allows organizations to discover AI workloads, monitor risk posture, detect non-compliant behavior, and apply real-time guardrails against prompt injection, data exposure, and rogue agentic behavior. Managed through the Check Point Agent in Gemini Enterprise, the unified solution secures and accelerates AI workload deployments on Gemini Enterprise.

CrowdStrike: CrowdStrike Falcon® Guardian extends guardrails and runtime protection by integrating with Agent Gateway to help secure agentic workloads running in Gemini Enterprise against risks including prompt injection, sensitive data leakage, and malicious AI activity. In addition, the CrowdStrike Gemini Enterprise agent enables practitioners to interact with the CrowdStrike platform through Gemini Enterprise, bringing CrowdStrike security context into agentic investigation and response and helping orchestrate SOC workflows across numerous tools.

Cyberhaven: The Cyberhaven Linea agent brings discovery and classification of sensitive data across endpoints, cloud apps, and agentic workflows to Gemini Enterprise. Powered by Cyberhaven's data lineage model, it can turn plain-language intent into enforceable policies, monitor interactions to catch unmapped risks before they become breaches, and fast-track investigations with automated evidence. Extending across Antigravity in Gemini Enterprise, the Linea agent can eliminate alert fatigue and empowers security teams to protect sensitive assets as fast as autonomous agents move them.

Cyera: Cyera Agent Guardian, built on Gemini Enterprise, secures agents that run on Gemini, providing data security posture management (DSPM) and data loss prevention (DLP). The Cyera agent can correlate machine identities, delegated permissions, and sensitive data classification to verify authorized agentic behavior, so organizations can deploy agents safely and maintain operational compliance at enterprise scale.

Endor Labs: Endor Labs AURI agents bring AI-native application security across the developer and security workflow. Its Static Application Security Testing (SAST) triage agent can automatically classify and prioritize code findings inside developer platforms like Google Antigravity. In Gemini Enterprise, security teams can query and act on those findings conversationally, confirming what's actually exploitable and tracking fixes, all grounded in the Endor Labs application context.

Exabeam: With Gemini Enterprise as its foundation, Exabeam is introducing the next generation of Exabeam Nova, a unified multi-agent AI system that helps security teams investigate and respond to threats faster. Nova coordinates specialized AI agents that can analyze behavior, prioritize risk, conduct investigations, and guide response actions while maintaining a shared operational context across the entire workflow. The result is a more intelligent and efficient analyst experience that helps organizations get greater value from their existing security operations environment.

Fastly: The Fastly Autonomous Edge Defense Agent (AEDA) can help security teams investigate edge and infrastructure incidents in plain language inside Gemini Enterprise, instead of manually parsing logs. AEDA pairs an organization's own telemetry with anonymized intelligence from Fastly's global customer base, determining in seconds whether an anomaly is isolated or part of a broader attack, returning evidence-backed findings with a recommended fix.

Fortinet: Fortinet FortiAIGate delivers large language model (LLM) runtime protection for Google Cloud customers. Integrated with the Gemini Enterprise and deployed in your Google Cloud environment, FortiAIGate can empower organizations to deploy sophisticated, agentic AI applications so that their data, prompts and model interactions are actively protected against emerging threats.

Menlo Security: HEAT Shield Agent, built with Gemini, analyzes web content and blocks zero-day threats and prompt injection at runtime. Alongside it, Menlo Security Orchestrator — built on Gemini Enterprise — turns security operations center (SOC) responses into natural-language, agentic workflows. It can reconstruct attacks, identify blast radius, and enforce policy in seconds, not hours. Menlo Agent Runtime Security (MARS) closes the loop, protecting human and agent-to-agent interactions so detection and containment stay unified across agentic workloads.

Obsidian Security: Obsidian Security's Risk Analyzer and Breach Response agents on Gemini Enterprise can help security analysts assess risk and respond to breaches. Built to secure an organization's cloud and AI-native application portfolio, Obsidian agents discover AI agents across enterprise environments, assess the risk, flag governance gaps, and answer critical questions like which agents hold escalated privileges or write access.

Palo Alto Networks: Palo Alto Networks’ Cloud, Network, and AI Risk Assessment (CLARA) agent can help security teams protect critical data and compliant AI operations, without slowing down the pace of development. It can find and fix cloud and AI risks before they become breaches by continuously scanning cloud infrastructure and AI workloads, automatically surfacing hidden vulnerabilities and prioritizing fixes so security teams spend less time hunting for threats and more time closing them.

Ping Identity: With Ping Identity's new PingID self-service agent, now available in Gemini Enterprise, employees can resolve common identity and device issues, including multi-factor authentication (MFA) resets and device recovery, by asking in natural language — no help-desk ticket required. Built on PingOne with secure delegated authentication, the PingID self-service agent gives IT teams an enterprise-ready way to manage workforce identities while reducing support costs and improving onboarding experience.

Qualys: Qualys ROCky for Gemini Enterprise can help security teams manage and patch vulnerabilities using conversation inside Gemini Enterprise. Ask, "How exposed are we to Log4Shell," "What should we fix first," or "Are we meeting our CISA KEV deadlines," and get answers ranked by the Qualys TruRisk score. It runs on each user's own Qualys entitlements so anyone can self-serve answers without help. It can also stage and deploy the patch.

Splunk, a Cisco company: The Splunk Security AI agent, integrated with Gemini Enterprise, functions as an autonomous system that converts massive telemetry streams into real-time intelligence across security and observability data. By bypassing manual triage to instantly surface critical anomalies and system threats, it shifts teams from reactive investigations to proactive defense, lowering cognitive load during high-pressure incidents and enabling security teams to resolve risks faster.

Snyk: Every enterprise building with Gemini Enterprise and Antigravity is shipping code faster than ever, and Snyk makes sure that code is secure from the moment it's written, not after. Snyk validates what AI agents generate in real time, catching vulnerabilities and insecure dependencies before they ever reach a repo. It's security built for the speed AI writes code, not the speed humans used to.

Thales: The Thales AI Security Fabric, integrated with Gemini Enterprise, can provide visibility, runtime protection, and centralized governance across agentic AI interactions. Organizations can move agentic AI from pilots to production, enforcing fine-grained access policies and protecting critical data assets right where they run.

Transmit Security: Transmit Security Agent Intelligence built with Gemini Enterprise identifies agentic activity interacting with customer-facing applications. As users increasingly delegate tasks, transactions, and authority to AI agents, organizations need clear visibility into what that activity is, its origin, and its intent. That context allows businesses to distinguish good agents from malicious ones, decide what to allow versus block, and stay ahead of the risk without restricting legitimate commerce.

Zscaler: Zscaler Risk360 provides a comprehensive, actionable framework that ingests data from existing Zscaler deployments to quantify cyber risk, create a detailed view of risk posture, and deliver clear insights to reduce risk. The Risk360 Agent is an AI-powered companion built on the ZAgent Framework with Gemini Enterprise, using natural-language interactions to unify Zscaler and partner signals, analyze Zero Trust risk, quantify financial exposure, recommend mitigations, and deliver decision-ready insights.

With this growing ecosystem of partner-built agents and connectors, Gemini Enterprise works with the security tools you already use — and lets you build custom agentic workflows on top of them. You can explore the security agents available in the Google Cloud Marketplace today.

Strengthen your CI/CD pipeline with new Secure Source Manager capabilities

Mon, 21 Sep 2026 16:00:00 +0000

A resilient software supply chain is the foundation of modern delivery, and securing your continuous integration and continuous delivery (CI/CD) pipeline is what keeps innovation moving safely.

Notable supply chain attacks more than doubled in the first half of 2026 compared to the second half of 2025, according to Wiz’s recent Cloud Threat Highlights report.

It’s crucial that your source code not be the weakest link in your private cloud. To help you better address software supply chain threats, Google Cloud Secure Source Manager (SSM) lets you manage your source and CI/CD systems with unified authentication and authorization mechanisms.

We now offer two new capabilities, both generally available, that can simplify and secure your development and CI/CD workflows:

Unauthorized access to CI/CD systems: Attackers only need to alter a single deployment script to turn your CI/CD pipeline into a vehicle for malware. To help mitigate this risk, from the version control system to the build and artifact systems, to deployment tools, SSM can now block unauthorized access to your CI/CD systems even if your corporate network has been compromised.
Unauthorized changes to code by authorized users: The new Code Owners system manages pull request approver sets at a per-file and per-branch level to help provide more granular identity and access management (IAM). Code Owners helps engineers who need to write, edit, and review code. It adds additional guards to files and directories in your repository at a per-file or per-branch level.

Key capabilities

Beginning with source code changes to your CI/CD pipeline, the new code owners feature gives you granular merge guards: Check in CODEOWNERS files to your repository to specify required approvers highly granularly:

Per-path approver sets: Using flexible glob-style path specifiers, you can require that changes to matching files be approved by one or more of given sets of users.
Branch-specific governance: Manage security and deployment rules across branches without friction. You can define different owners for main or dev in the same file, eliminating the merge conflicts that occur with existing CODEOWNERS solutions. See our documentation for more details.
Nestable multi-file ownership: You aren't limited to one giant, 5,000-line root file. You can nest CODEOWNERS files in sub-directories. SSM uses a "more local wins" logic, allowing sub-teams to own their folders while the root admin maintains veto power over the entire repo.
Independent approval sections: Using the [SectionName][count] syntax (e.g., [Security Team][2]), a single pull request (PR) can require independent sign-offs from multiple departments. A PR might be reviewed by a peer, but it won't merge until two members of the security team also approve.

With your source code ready, SSM’s new Developer Connect integration makes it easy to connect your CI/CD system and runtimes securely, even when they are in different private networks.

The private CI/CD blueprint architecture follows a secure path: Secure Source Manager connects to Private Service Connect, which connects to Cloud Build. The repository, the build pools, and the artifact storage all reside in a private network, with VPC Service Controls (VPC-SC) providing defense-in-depth to limit access to proxy endpoints.

Next steps

To secure your network, follow our new Private Network Integrations guide to connect SSM to Cloud Build with Developer Connect.

To secure your pull request approvals, create a root CODEOWNERS file to replace blunt IAM "Approver" roles with file-specific ownership.

Changing the game: Using agentic AI to secure infrastructure code

Sat, 19 Sep 2026 01:00:00 +0000

Blog authors: Andrés Lagar-Cavilla, Distinguished Engineer; Stella Voutsina, Sr. Technical Program Manager; Parthasarathy Ranganathan, VP, Engineering Fellow

AI is accelerating software development at an unprecedented pace. But as code generation scales, so do the challenges of securing the code, especially emerging AI-based vulnerability exploitations. To meet these challenges, the Google AI and Infrastructure team is transforming how we approach security. In this article, we discuss new AI-native agentic methods that we’ve developed that systematically embed high-precision, pervasive vulnerability scanning and patching directly into Google’s software development lifecycle. By continuously scanning every code change across hundreds of millions of lines of code that we deploy onto our infrastructure, we are preventing hundreds of vulnerabilities per month from ever reaching our code base or production, defending our global network, AI infrastructure and our users.

Solution architecture and implementation

Pervasive pre-submit agentic scanning: security as part of ongoing software development

Traditionally, the technology industry relies on large one-off security scans that are slow and lack sufficient context. As a result, they often find vulnerabilities too late. Our approach instead focuses on pre-submit scanning, where we evaluate each code check-in (across every layer of the stack) in real-time using AI agents. By integrating the pre-submit scan into the tools developers already use, security becomes a continuous routine process, similar to rule checkers, readability reviews or other software development tools. Also, from an AI perspective, scanning each individual code change requires much less context than performing a large one-off scan, significantly improving the scan’s effectiveness.

The importance of localized threat models

For this initiative, we evolved Mantis, our open-source multi-agent review harness, to increase the precision of our security agents by matching them with a cohort of robust localized threat models. Rather than relying on static decoupled documents, the threat models use live codebase metadata. The scanning agent improves its accuracy further using a dependence call graph across packages and libraries to expand and refine its threat model context. Making threat models part of our ongoing vulnerability scanning encourages developers to continuously update threats and dependencies, keeping the models up-to-date. Using localized and precise threat model data translates to dramatic accuracy improvements, bringing our false-positive rates down to 3% in some cases.

Specialized triage agents speed up development

Vulnerability scanning as part of code check-in requires it to respond quickly to the developer or agents generating the code, so as not to impede engineering productivity. To get responses with low latency, we run a two-step validation process. First, we run a quick lightweight scan that validates its findings against a specialized triage agent. This agent programmatically checks the actual structure of the code (using abstract syntax tree parsing, call-graph traversal, and pre-indexed domain safety rules) to prove that the vulnerable path is actually reachable by an attacker. This agent gets over 92% precision and completes its work in less than a minute. Then, a post-submit scan as part of nightly integration testing serves as a second layer of defense, using off-peak cycles to test for vulnerabilities that may have been introduced across multiple changes.

Bug fix agents close the loop

Finding vulnerabilities is only half the battle. The last component of our solution is an automated bug-fix agent that uses the scan results and generated proofs (snippet of code that demonstrates how the vulnerability is exercised) to autonomously construct precise fixes that are consistent with our internal coding standards. The agent submits the fixes for human review as part of the original change request’s review, further reducing the time between detection and resolution.

Learnings and call to action

Embedding continuous scanning directly into the software development lifecycle has been a game changer at Google; its suggestions are widely adopted, and it’s prevented a multitude of vulnerabilities from being introduced into the codebase. But any organization wishing to improve security can adopt a similar AI-native approach, following these principles:

Keep systems separate: To prevent bias, keep the harnesses, rules, and context for each of your development, scanning, triage agents separate. Pair lightweight AI scans with deterministic, structural validation to drive down latency and improve accuracy.
Use context wisely: Feed your agents your existing threat models. Precise context is the answer to reducing false positives, and up-to-date threat models set a high floor on a team's security posture by improving the rate of true positives in presubmit scanning.
Build a good harness: While the choice of the underlying model is important, using a multi-agent harness can have substantial impact, by helping compensate for variability in model choice.
Automate the fix: Use agents to also propose human-in-the-loop fixes, to further reduce time-to-resolution.

If you want to get started on your own AI-native security transformation, Mantis is now available as open source for you to use and benefit from. You can also learn more about the fundamentals of cybersecurity and the other platforms that power this agentic pipeline: Google Cloud, Gemini Enterprise and Gemini models running on Trillium and Ironwood TPUs. And you can get inspiration from how agentic vulnerability scanning and remediation defends Google Cloud customers as an integral part of Google Cloud’s secure software development lifecycle (SDLC) effort.

^{With special recognition to critical team members who made this delivery possible: Stella Voutsina (Lead Program Manager), Yulong Zhang (Senior Staff Security Engineer, Mantis), and Nick Galloway (Staff Security Engineer, Mantis).}

Google named a Leader in the External Threat Intelligence Service Forrester Wave™

Thu, 17 Sep 2026 17:00:00 +0000

At Google, we see firsthand how the speed, scale, and sophistication of cyber threats continue to challenge traditional enterprise defenses. Today’s defenders can’t rely on reactive triage or fragmented data feeds; you require high-fidelity intelligence, deep underground visibility, and actionable context to anticipate adversary moves before an attack unfolds.

We are proud to announce that Forrester has named Google a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026. In this evaluation, Google received the highest possible score of 5.0 across nine distinct criteria spanning both Current Offering and Strategy.

Organizations trust our decades of threat intelligence expertise to help them understand today’s attacks and to protect against tomorrow’s threats. Google Threat Intelligence operationalizes protection with specialized threat intelligence agents that autonomously conduct multi-step investigations and malware analysis at machine speed. Underpinning these capabilities is the unified visibility provided by Mandiant’s frontline incident response, VirusTotal’s crowdsourced visibility, and Google-scale infrastructure with industry-leading deep and dark web monitoring, illuminating adversary operations where they begin.

Google is a Leader in the Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026

Key attributes of a leader

Accurate and relevant deep and dark web monitoring enables proactive security, spotting exposed credentials, threat actor reconnaissance, and illicit forum chatter before they escalate into active attacks.

We received the highest possible score in the Deep and Dark Web Monitoring and Intelligence Collection Sources criteria.

As Forrester wrote in the report, “Google is the only vendor in this evaluation that is also a frontier AI model developer and a significant player in quantum computing.”

Because Google Threat Intelligence has direct access to a leading frontier model rather than an off-the-shelf wrapper, our AI agents don’t just summarize data — they can actively evolve. We fine-tune and stress-test our agents continuously using proprietary Gemini best practices, removing the usage limits and latency typical of third-party layers.

For security teams, this translates directly to immediate threat context, faster detection updates, and drastically reduced time to resolution. The Forrester report stated, "Google's recent Gemini advancements accelerated the success of many of its Al-enabled functionalities." In addition to our finished intelligence reports, defenders can now use our agent to create custom analysis derived from frontline observations, tailored to their local threat profile and environment.

Google Threat Intelligence agents autonomously conduct campaign attribution and pioneer complex agentic malware analysis. Backed by codified Mandiant tradecraft, dynamic visual workflows, and real-time telemetry that programmatically hardens tool routing and execution, our agentic platform transforms complex threat landscapes into a decisive defender advantage.

Google received the highest scores possible in the Analyst Tradecraft and Services, Attribution and Frameworks Used, and Analyst Experience criteria in the report. This foundation is built by hundreds of dedicated researchers across the Google Threat Intelligence Group (GTIG) in over 30 countries speaking 30 languages. Our rigorous, evidence-based attribution maps directly to MITRE ATT&CK, empowering practitioners through interactive graphs and Gemini-enabled agentic threat intelligence.

By feeding the newest threat discoveries into detection workflows, these capabilities raise alert quality and take the guesswork out of rule creation across the security stack. Security operations center (SOC) teams and threat hunters can rapidly author resilient rules against novel variants, link suspicious events directly to known actor playbooks, and triage critical alerts with certainty.

While Google also received a 5/5 score in the partner ecosystem criterion, customers using Google Security Operations can directly leverage Google Threat Intelligence enrichments with agents:

The Triage and Investigation agent autonomously investigates alerts and prioritizes threats.
The Detection Engineering agent automatically finds and fills coverage gaps as they emerge.
The Threat Hunting agent proactively searches your environment for novel attack patterns.

Within the strategy category, Google Threat Intelligence received the highest possible scores in the Roadmap, Partner Ecosystem, and Community criteria, as well as the Intelligence Dissemination criterion in the Current Offering category.

The Forrester report stated, “Google maintains an open, partner-centric approach that avoids lock-in to the Google SecOps ecosystem and benefits from a strong community presence across the broader Google Cloud Security ecosystem.”

Delivering measurable value for security teams

Google Threat Intelligence delivers a measurable impact on the speed and scale of modern defense. Our customers report identifying 139% more threats proactively and make their CTI teams 46% more efficient. These gains are accelerated by AI-driven summarization and context, and can help you eliminate manual guesswork, act on validated frontline intelligence, and focus on high-value investigations.

By accelerating detection engineering and proactive exposure management, Google Threat Intelligence identifies malicious infrastructure before adversaries can use it in campaigns. This faster defense helps you anticipate their maneuvers and disrupt their attack chains earlier, reducing threat dwell time and risk to your organization.

Empowering defenders everywhere

We are very pleased that Forrester recognized us as a Leader in Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026. We continue to push the boundaries of what is possible in threat research, as an early, leading innovator enhancing malware analysis and dark web monitoring with AI. We continue to deliver the autonomous decision advantage to preemptively neutralize the right threats with the right action and the right context.

To learn more about Google’s position as a Leader, you can access the full Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 here.

_{Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here .}

Cloud CISO Perspectives: How Google monitors AI threats and advances AI defenses

Wed, 16 Sep 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for September 2026. Today, Sandra Joyce shares the latest details on Google’s visibility into how attackers are using AI, and how we’re using AI to stop them.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25a87b10>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

‘Spellcheck for cybersecurity’ and beyond: How Google monitors AI threats and advances AI defenses

By Sandra Joyce, VP, Google Threat Intelligence

Sandra Joyce, VP, Google Threat Intelligence

Anyone operating in security knows that speculation is a major liability during periods of technological disruption. While there is plenty of hype and understandable concern around how threats might use and target AI, a CISO’s AI security strategy has to be anchored in ground truth.

Google operates at a rare intersection as both a frontier AI lab and a security company with a frontline view of global incidents. This dual vantage point allows us to understand how AI is built, and exactly how AI is being targeted in the wild. To provide the operational realities that security and business leaders need in the AI era, Google Threat Intelligence Group (GTIG) recently released our latest AI Threat Tracker.

When we strip away the noise and look at the telemetry, the real threat landscape boils down to three structural shifts that CISOs must address:

AI is reshaping how software is built.
AI is expanding the attack surface.
AI is enhancing threat capabilities.

Today, we’re sharing details on Google’s visibility into these three challenges, and our approach for solving them.

Building securely in the AI era

AI has fundamentally altered software development velocity. Across the industry, autonomous agents and AI workflows now push code into production at unprecedented speed. This creates exciting opportunities for innovation, yet CISOs are faced with the difficult task of mitigating enterprise risk while maintaining business momentum.

We’re seeing threat actors turn our greatest engineering shortcut against us by contaminating upstream packages that AI assistants are trained to suggest and trust. GTIG believes that malicious contamination of AI-assisted coding practices has been contributing to the significant growth in large-scale, open-source software supply chain compromises we observed in 2025 and early 2026.

The solution to a machine-speed threat landscape isn't slowing developers down — it’s building security natively into the AI pipeline. Part of this process involves in-editor guardrails for developers that create a real-time 'spellcheck for cybersecurity.'

We’re also monitoring adversaries targeting agents. The financially-motivated threat actor TeamPCP (UNC6780) has implemented more than half a dozen methods to exploit AI tools and open-source software development practices, including hijacking AI toolkits, prompt injection, and blinding AI scanners with toxic prompts to obfuscate malicious payloads.

Just as word processors underline typos without forcing the writer to stop, security controls must sit natively inside the developer’s editor and agentic workflows, instantly flagging poisoned packages, toxic prompts, and misconfigured toolkits.

Crucially, this can’t stop at the editor. Traditional security suffers from context blindness: Code editors can’t see cloud configurations, delivery pipelines miss runtime exposure, and production teams can’t easily patch root-cause blueprints.

Bridging this gap requires an integrated code-to-cloud approach — the exact design principle behind platforms like Wiz Code. The underlying approach is to ensure code is continuously verified against live cloud realities before it ships.

When organizations think about AI-driven code analysis, the default assumption is to pick one frontier model and point it at their repository. However, our research and telemetry show that single-model security creates a dangerous monoculture: No single AI model can discover every vulnerability, and threat actors are already testing inputs that can blind specific LLM safety filters and scanners.

To secure this expanding attack surface, CISOs should avoid the trap of managing AI through disconnected silos... The future of cloud and AI defense needs to be built on a unified and dynamic graph that connects your code, your models, your data lineage, and your runtime identities into a single living map.

To solve this, Google takes a deliberate multi-model approach. By orchestrating several foundation models — including Gemini, commercial, and open-source — we cross-validate findings, strip out false positives, remediate code, and identify complex logic flaws that a single model misses. We’re smarter with more than one “brain.”

Securing AI

Securing the development lifecycle is only half the battle. We also need to prevent adversaries from exploiting AI attack surfaces and weaponizing over-privileged agents. Threat actors are targeting AI workloads with techniques that include:

LLMJacking: Cybercriminals and state-sponsored groups target GPU access to support running their AI models and agentic workflows. In one notable intrusion Mandiant investigated in April, a threat actor gained initial access to a victim’s cloud environment from an exposed personal access token, and used it to deploy unauthorized AI infrastructure and scale high-performance compute resources, leaving the victim to absorb the hardware and platform costs.
Targeting of AI data and access: Cybercriminals now recognize that your custom prompts, agent instructions, and fine-tuned models represent high-value crown jewels. In Q2 2026, Mandiant investigated multiple data theft extortion operations where threat actors stole proprietary AI data, including models, skills, prompts, source code, and related research. Demand is also surging for AI account credentials in underground marketplace forums, with some sellers offering steep discounts for consumer accounts at up to 99% off retail prices.

To secure this expanding attack surface, CISOs should avoid the trap of managing AI through disconnected silos. Don’t treat agent access policies, model inventories (AI-BOMs) and shadow AI as separate challenges because these risks are deeply connected. The future of cloud and AI defense needs to be built on a unified and dynamic graph that connects your code, your models, your data lineage, and your runtime identities into a single living map.

Pioneered by the Wiz Security Graph, this approach serves as the contextual engine for Google AI Threat Defense (AITD) — our broader autonomous security framework that fuses the reasoning power of Gemini and other frontier models, the contextual risk prioritization of Wiz, the code remediation capabilities of CodeMender, and the frontline expertise of Mandiant to stay ahead of AI-driven attacks. Crucially, this context is not siloed; it directly feeds Google Security Operations, ensuring that security operations teams can continuously identify, prioritize, and sever toxic attack paths at machine speed.

Defending against AI threats

Threat actors are rapidly moving beyond simple prompt generation toward fully-automated, multi-agent attack pipelines.

Cyber Defense Summit 2026: Security in the AI era

In one notable intrusion investigated by Mandiant, a financially-motivated actor compromised an organization's cloud infrastructure and deployed an autonomous agent framework. The threat actor used an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours.

We’re also tracking adversaries using AI as an intelligent orchestrator across the entire attack lifecycle. GTIG recently observed a PRC-nexus espionage group experimenting with a tool called CC Switch to cycle across multiple accounts and swap AI models — like Claude, Codex, and Gemini — picking the best model for specific tasks, such as writing exploit scripts and drafting lures. While the underlying hacking tools aren’t new, AI turned what had been a disjointed manual process into a smooth and automated workflow.

To take advantage of your deep context, it’s imperative to shift from manual, human-scale incident response to machine-speed security operations. We can no longer rely on human analysts manually triaging endless backlogs of static alerts.

While these machine-speed attacks sound daunting, defenders actually hold an asymmetric advantage. Even when armed with autonomous AI, an attacker operates from the outside with limited context — probing in the dark, guessing connections, and hoping a compromised credential leads to a useful asset.

Defenders, on the other hand, possess deep context that attackers don’t have. You know your code, cloud configurations, user identities, deployment realities, and internal architecture better than anyone. When you feed this rich, multi-dimensional internal observability into security models, AI defense becomes inherently faster and more accurate than AI offense.

By codifying our frontline threat intelligence directly into these AI models, these autonomous agents can continuously monitor for, investigate, prioritize, and remediate attacks.

How Google is helping defend the ecosystem

As adversaries adopt AI, we have a unique opportunity to disrupt them at the source. As a major security and AI provider, we take this responsibility seriously, using multiple levers to stay ahead.

Disabling malicious infrastructure. If you use Google tools to facilitate an attack, you lose access to those tools. We proactively disable the projects, accounts, and assets of known bad actors.
Hardening our AI models and classifiers. We operate a continuous feedback loop for our AI models. By feeding threat intelligence directly back into product development, our models learn to recognize and refuse malicious requests before an attack can even be generated.
Automating vulnerability hunting and patching also disrupt adversaries. We are moving from manual patching to AI-driven hunting. Tools like CodeMender automatically fix critical vulnerabilities in the code itself.
Developing advanced defenses and threat models. Our teams at Google DeepMind are building specialized defenses for generative AI — deploying active monitoring across our entire ecosystem to identify misuse in real-time.

Securing the AI era can’t be achieved with the disconnected, manual tools of the past, and you can only defend against an AI-powered threat with an AI-powered defense. To tip the scales back in favor of defenders, we must transition to a continuous, machine-speed model of protection — and at Google, we are committed to building that secure future alongside you.

To learn more about our approach to securing the AI era, please check out our new Mandiant AI Risk and Resilience report.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25a87610>), ('btn_text', 'Watch now'), ('href', 'https://x.com/googlecloud/status/2090213589558698309?s=20'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

A manufacturing blueprint for secure agentic AI: AI and agents have arrived on the factory floor. Today’s CISOs and business leaders must balance innovation with precision, physical safety, and operational resilience. Read more.
Proactive cyber defense for governments and enterprises: Our new Fairwind Program is a limited access program for governments and trusted partners to use our most advanced cyber defense capabilities. Read more.
Getting started with the Mantis harness to find and fix bugs: Mantis is part of how Google finds and fixes vulnerabilities at machine-speed. The open-source AI harness creates a more effective repository analysis. Read more.
Breaking into Google's GFile for $100,000: Learn about how a vulnerability — that was not exploited and has now been patched — could have allowed attackers to chain unauthenticated, undocumented internal APIs with overly-permissive shared file libraries to achieve unrestricted data access across core infrastructure. Read more.
Introducing new session management tools with native, granular controls: New Google Cloud session controls are deeply integrated and a granular feature of Context-Aware Access. Here’s what you need to know. Read more.
How Blackline prevents data exfiltration with VPC Service Controls: We’re excited to share new policy intelligence capabilities in VPC-SC that help drive operational simplicity: Violation analyzer and violation dashboard. Read more.
Introducing Continuous Vulnerability Assessment: You can detect exposure to new vulnerabilities the moment they’re published with Wiz CVA. Read more.
How developers prevent production risk at the source: Fixing security vulnerabilities in code takes seconds, while patching in production creates high operational costs and risk. Discover how empowering developers as your first line of defense eliminates exposure across every phase of your software pipeline. Read more.
Wiz achieves GovRAMP High authorization: Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f8c25a85410>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

AI Threat Tracker: From prompting to autonomy: In the newest Google Threat Intelligence Group (GTIG) report on the adversarial misuse of AI, we’ve observed adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation, including threat actors compromise a cloud resource, then plan, build, and execute an agent-enabled mass credential harvesting campaign in under six hours. Read more.
Financially-motivated threat actor BREEZE COMET targets Brazil: Learn about BREEZE COMET’s tactics and toolkit, and our mitigation recommendations and detections to support organizations in defending against this active and developing threat. Read more.
JFrog Artifactory under attack: Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory. Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here.
Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Nir Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Introducing new session management tools with native, granular controls

Tue, 15 Sep 2026 17:30:00 +0000

Google Cloud session management provides flexible options for setting up session controls based on your organization’s security policy needs. To help you improve your security posture and mitigate credential theft and account takeover (ATO) risks, we have rolled out a 16-hour default session length for Google Cloud customers.

We’ve now completed extending this security standard to all customers who had not already self-configured session lengths, but today’s cloud environments require even more precision. As we conclude this global rollout, we have also evolved Google Cloud session controls from a broad administrative setting into a deeply integrated, granular feature of Context-Aware Access (CAA).

This update gives administrators more flexibility, better automation, and a more natural security workflow.

What’s new in Session Controls

1. Automation-first: Terraform, gcloud, and API support
Modern infrastructure is managed as code. To support DevSecOps workflows, the Session Controls policy configuration is no longer limited to manual UI configuration. Now generally available, you can define, deploy, and manage your session policies programmatically using:

Terraform: Integrates session controls directly into your infrastructure manifests.
gcloud CLI: Manages policies from the command line.
REST APIs: Automate policy enforcement across complex multi-tenant environments.

2. Granular targeting with Google Groups
One of the most requested upgrades has been the capability to target policies with precision. Previously, session lengths were tied to organizational units (OUs). Now generally available, the Session Controls policy uses Google Groups.

This shift allows you to apply distinct session policies to specific clusters of users — such as requiring a two-hour session for users with elevated privileges (such as billing administrators and project owners) while maintaining a standard 16-hour session for general developers — regardless of where those users sit in your organizational hierarchy.

3. Precision application controls
Instead of a blanket policy that affects every application requiring Google Cloud API scopes, Session Controls policy allows you to configure session controls to specific applications. These applications include:

The Google Cloud Console
The gcloud command-line tool
Specific OAuth applications

Now generally available, this update can help prevent all-or-nothing scenarios where a strict policy on the Cloud SDK might inadvertently disrupt legitimate business intelligence or dashboarding integrations that rely on OAuth.

4. Google Cloud-native experience
Historically, configuring session lengths for Google Cloud could only be done in the Google Workspace administrator console.

Google Cloud customers can also sign up to use the Google Cloud Console to manage session policies alongside other access levels and security bindings in Access Context Manager (ACM). Available in preview, this update can help give Google Cloud administrators who prefer using the Google Console for policy administration tasks greater flexibility and a unified experience for configuring all their CAA policies.

How to get started

By evolving session controls from static organizational defaults into dynamic, context-aware policies, your security teams can enforce tighter reauthentication boundaries against credential theft where risks are highest, without disrupting developer velocity.

Get started with the session controls documentation for instructions on how to use Terraform, REST API, and gCloud to configure session controls.

Getting started with Mantis, our open-source bug finding-and-fixing harness

Wed, 02 Sep 2026 16:00:00 +0000

AI models have clearly proven their ability to discover and exploit vulnerabilities without much, if any, human assistance. To help defenders gain the advantage with AI, we built the Mantis harness to automate the discovery, triage, reproduction, and patching of software vulnerabilities.

Available to all as an open-source framework, Mantis is part of Google’s internal approach to find and fix vulnerabilities at machine-speed. It creates a more effective scalable, context-aware repository analysis.

While sloppiness in AI code scanning frequently leads to hallucinated bugs and weak true-positive rates under 7%, we designed Mantis to be effective by combining industry-standard agentic techniques like critic and review agents with sandboxed reproduction of vulnerabilities for grounding.

As we detailed in June, it examines the history of the repository to learn from past security fixes and automatically builds up architectural and threat model documentation, even if these are not provided.

It constructs a hierarchical security summary tree, condensing individual files into directory and root-level summaries. This technique reduced token overhead by over 85%, while preserving critical structural context across massive repositories.

Mantis distills decades of cybersecurity expertise across a wide spectrum of codebases, and is available on GitHub. Here’s how you can get started using Mantis.

First, clone the Mantis repo locally using:

code_block: <ListValue: [StructValue([('code', 'git clone https://github.com/google/mantis.git'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f8c26462510>)])]>

Second, open your favorite coding agent and use the prompt, “I would like to use Mantis framework in path/to/mantis to review my code in path/to/your/code, can you help me get started?”

Internally at Google, this exact prompt has been used to find real vulnerabilities across our many code repositories. As part of the Mantis repository on GitHub, we’ve included sample sandboxing options. You can also implement your own sandbox to match your own workflow.

Mantis is intended to be an easy place to start with vulnerability discovery, true positive filtering, and patching. Once you've got a handle on AI-discovered vulnerabilities, you can use the new mantis-advise skill to make use of the accumulated knowledge and get your coding agents to write secure code the first time.

To get the most out of AI-driven vulnerability discovery and modernize your development practices, we strongly recommend two essential practices:

Feed your tools the right context: While Mantis automatically analyzes commit history and code to build documentation for itself, human-curated knowledge often can dramatically improve the quality of your results. For example, if you would never waste time fixing bugs where the user can crash their own program, this is critical information for a scanning pipeline to ensure that those types of bugs are never surfaced.
Build a cyber sandbox with vulnerability acceptance criteria. Safe, sandboxed environments where you can reproduce vulnerabilities with clear vulnerability-reproduction criteria will give you better results for surfacing only the things you need to know and also for ensuring that your fixes are correct.

You can learn more about Mantis here.

How BlackLine simplifies perimeter policy intelligence with VPC Service Controls

Tue, 01 Sep 2026 16:00:00 +0000

Establishing network-level perimeters with VPC Service Controls (VPC-SC) is a critical step that can help you protect your cloud environment against data exfiltration, compromised accounts, and insider threats.

Today, Google Cloud is excited to share new policy intelligence capabilities in VPC-SC that can help drive even greater operational simplicity. With our latest release of the VPC-SC violation analyzer and violation dashboard, we have simplified policy management and troubleshooting, to make managing and optimizing your security perimeter more efficient and straightforward than ever.

How BlackLine streamlines incident response

BlackLine, a leader in financial operations management, adopted the VPC-SC policy intelligence solution to maintain strict security perimeters. Chosen by over half of Fortune 500 companies, BlackLine uses Google Cloud's full suite of managed services and built-in security capabilities to protect sensitive customer financial data.

VPC Service Controls are the foundation of BlackLine's preventative compliance and security controls in our Google Cloud environment, helping us to mitigate data exfiltration risks and ensure clear separation between our higher and lower environments by establishing strong security perimeters.

Managing these complex perimeters is a continuous process. VPC Service Controls violation analyzer helps BlackLine cloud infrastructure administrators adapt to changing API connection requirements of the business by adjusting security perimeters through approved access levels, ingress policies, and egress policies.

With only the troubleshooting token or unique ID from any VPC-SC violation error message, we can produce a detailed report identifying the principals and target resources involved in a failed API request, and explaining why and how that API request violated BlackLine's service perimeters. We don’t need to write a Cloud Logging SQL query to extract the data.

The clear access context and actionable insights in the violation details report are an invaluable starting point as we collaborate to resolve violations, significantly reducing our mean-time-to-resolution (MTTR) for service perimeter issues, and helping BlackLine maintain our focus on our customers and continue to innovate on their behalf.

Streamlining the perimeter operations lifecycle

Our new policy intelligence tools — the VPC-SC Violation analyzer and Violation dashboard — simplify real-time monitoring and active incident response. These tools provide clear, actionable insights in the Google Cloud Console, offering greater speed and automation to help you confidently enforce least-privilege perimeters, and quickly resolve access denials.

Violation Dashboard aggregates and visualizes all service perimeter violations across your entire Google Cloud organization in a single pane of glass, helping your team identify trends, spot spikes in access denials, and shareable filters on violations by specific perimeters, projects, or identities.

Violation Analyzer streamlines investigating violations, eliminating the need to query Cloud Logging and manually piece together the details. When you click a troubleshooting token from the dashboard (or input a unique denial ID), the analyzer maps out the identity, source, target, and VPC-SC rule triggered, creating a report telling you why that specific request was blocked. This helps your team more quickly take action to determine whether to modify existing policy rules or create a new one, and resolve incidents more quickly.

Together, the new VPC Service Controls policy intelligence tools go beyond automated log analysis to provide unified visibility of violations and actionable insights to investigate them, making your perimeter deployment and management simpler and lower-risk.

Streamlining the VPC Service Controls lifecycle, from deployment to policy refinement.

With the new VPC-SC troubleshooting tools you can more easily:

Test new perimeters (deployment): Use the violation dashboard to visualize the impact of a service perimeter during your initial dry run phase, helping to verify that enforcement is accurate and predictable before it affects production traffic. Filter violations to track and resolve with prebuilt contextual filters for principals, service perimeters, enforcement type, and more.
Track perimeter denials (monitor): The violation dashboard offers a unified view of your perimeter health, allowing your security operations team to monitor status in real time, including dynamic agentic access denials.
Triage an event (investigate): Violation analyzer provides the identity, source, target, and operations for any violation. It cross-references identity and access management (IAM) permissions, resource ancestry, and context evaluation to identify which rule was triggered, reducing manual effort.
Fix the rule (refine policy): Instead of searching through configuration files, violation analyzer maps violations directly to the relevant line in your VPC-SC policy, allowing you to make updates more quickly and with less manual overhead.

The VPC Service Controls violation dashboard produces detailed reports to jump-start perimeter access investigations that are simplified using the violation analyzer.

Core VPC-SC operations: Simple perimeter enforcement

Our new troubleshooting capabilities build on VPC Service Controls’ foundational simplicity for designing, enforcing, and managing strong perimeters.

By using dry run mode, your teams can build precise, contextual ingress and egress rules based on observed traffic — without disrupting vital business workflows. Once you validate these access patterns, moving to full enforcement becomes a more confident, data-driven process. To keep perimeter maintenance more efficient and straightforward, scoped policies allow you to delegate management directly to project-level administrators, empowering the teams closest to the workload.

Getting started

Simplify data security with VPC Service Controls. With the new Violation Analyzer and Violation dashboard, you can spend less time investigating incidents and more time safely scaling your cloud initiatives. Your data is your most valuable asset — protect it with a perimeter that’s as simple to manage as it is effective in enforcing controls.

Learn more and get started with the VPC-SC violation analyzer and violation dashboard in our documentation.

Cloud CISO Perspectives: Tips on securing the water sector in the AI era

Mon, 31 Aug 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for August 2026. Today, Chris Sistrunk and Stephanie Kiel detail the critical issues facing the water sector, and actionable steps that OT operators can take to secure their infrastructure.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f8c26462210>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Tips on securing the water sector in the AI era

By Chris Sistrunk, Practice Leader, OT, Mandiant Consulting, and Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Chris Sistrunk, Practice Leader, OT, Mandiant Consulting

Google Cloud’s threat intelligence teams have observed that threat actors are becoming bolder when targeting critical infrastructure amid geopolitical conflicts. Recently, we’ve seen increased targeting of water utilities' internet-connected programmable logic controllers in the U.S.

Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Historically, cyber incidents haven’t usually disrupted operations, in part because water utility operators have long had manual override capabilities and established water-quality checks that kick in before water reaches consumers. Pumps and pipes fail routinely for reasons that have nothing to do with cyber threats.

However, they do require our urgent attention and a commitment to stronger security hygiene. Manual overrides provide a reliable safety net, but preventing cyber threats still requires a commitment to fundamental digital security — especially in the AI era.

We recommend a threat-informed, risk-managed response. The current state of water sector security is indicative that additional action should be strongly considered in light of the unique operational resilience that keeps these systems safe.

Actions water and wastewater utilities should consider

For resource-constrained utilities, the most effective defense is to focus on cybersecurity fundamentals. By prioritizing these fundamental practices, you can significantly harden your systems and transform your organization into a far more challenging and resilient target, causing even well-resourced threat actors to look elsewhere.

Inventory assets and assess exposure: Identify if your control systems are insecurely exposed to the internet, which often allows for the successful exploitation of vulnerabilities.
Basic security hygiene: Replace default credentials with strong passwords, and rigorously harden exposed access points, including firewalls.
Backups: Make sure that critical systems, including control systems, are safeguarded following the proven 3-2-1 backup rule (keep three copies of your data on two types of storage, with at least one copy stored off-site). Ensure critical spare equipment is on-hand to minimize downtime from cyberattacks.
Segmentation: Use network segmentation and multifactor authentication to ensure that remote access, when necessary, is strictly controlled. You should use read-only access where full control isn't required.
Emergency planning: Integrate cyber-incident planning into your existing all-hazards incident command system, including FEMA NIMS and Incident Command System for Industrial Control Systems, the same response structures you already use for physical pipe breaks, boil water alerts, and natural disasters.
Secure third-party and vendor access: As many water utilities do not manage their own IT or OT and rely on third-party system integrators, you should audit the remote connections used by the system integrators and maintenance contractors. You should ensure third-party vendors are held to rigorous access controls (such as MFA standards) and logging requirements.

These recommendations echo guidance from the American Water Works Association, the National Rural Water Association, the Water-ISAC, the Environmental Protection Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI.

Recommendations for IT and OT leaders: Bridging the governance gap

IT and OT leaders must work together to build a unified governance framework and should focus on making cyber-physical systems more resilient over the long term, a collective effort that spans government agencies, private sector organizations, and individuals. The goal is to build a future where these systems are secure, adaptable, and capable of recovering quickly from disruptions.

Although PLCs almost always sit outside standard software development practices, a robust approach to the software your organization uses can significantly enhance your overall security posture, such as those outlined in NIST’s Secure Software Development Framework (SSDF). They’re also good examples of leading indicators that can help you gauge your resilience, and to help you get started we’ve published a guide to evaluate leading indicators.

Manual overrides provide a reliable safety net, but preventing cyber threats still requires a commitment to fundamental digital security — especially in the AI era.

As technology evolves, it is critical to modernize security, transitioning from a reactive, manual model to an AI-augmented approach that keeps human expertise central to decision-making. This approach offers an unique opportunity to be a force multiplier for lean security teams.

To stay ahead of today’s threats, organizations must move beyond simple compliance checklists and adopt a more agile, threat-informed strategy that makes compliance a natural outcome of good security, rather than the primary goal.

The Mandiant Operational Technology (OT) Theory of 99 has become more relevant in the AI era. Although the funnel of opportunity has been significantly compressed, in intrusions that go deep enough to impact OT:

99% of compromised systems will be computer workstations and servers
99% of malware will be designed for computer workstations and servers
99% of forensics will be performed on computer workstations and servers
99% of detection opportunities will be for activity connected to computer workstations and servers
99% of intrusion dwell time happens in commercial, off-the-shelf computer equipment before any Purdue level 0-1 devices are impacted

As a result, there is often a significant overlap across tactics, techniques, and procedures used by threat actors who target IT and OT networks. However, the Theory of 99 underscores a significant defender's advantage in the AI era. By using advanced AI capabilities to secure the 99% of intermediary infrastructure, organizations can proactively neutralize threats and ensure robust protection for the critical 1% of physical operational processes.

AI for cyber defense

As we have shared before, AI capabilities offer the opportunity to shift the balance in network security in the favor of defenders. The defender’s advantage becomes even more important as malicious actors increasingly use AI capabilities across the attack lifecycle.

In the current threat environment, automating defenses can serve as a force multiplier for human security teams, enhancing decision-making and productivity to ensure critical exposures are addressed before they can be exploited. With careful planning, critical infrastructure providers can protect their physical assets while building a more resilient, threat-informed defense.

To effectively realize AI advantages for defense, you should integrate AI tools into systems in a structured, intentional way. It’s crucial that operators understand the unique vulnerabilities that AI introduces to physical processes, evaluate specific business uses that can benefit from security automation, and establish clear frameworks to continuously test and monitor. As part of our approach, we’ve developed the Secure AI Framework to help you achieve secure integration and deployment of AI capabilities, regardless of sector.

Most importantly, human oversight must remain central — meaning that AI should support decision-making, and safety practices need to be embedded directly into incident response plans.

What’s next for water security

Protecting water systems from malicious cyber threats is not just a technical challenge; it is a fundamental public safety imperative. Given that access to clean, reliable water is an essential service, we anticipate that federal, state, and local governments will increasingly shift from policy debate to decisive action to ensure the continuity of this critical public infrastructure in the face of cyber threats.

For example, the Office of the National Cyber Director in partnership with the State of Texas has just launched a pilot program to help protect water infrastructure providers from cyberattacks, and U.S. senators have already introduced a new bill in response to recent events.

Google is committed to helping you protect your cloud and hybrid cloud OT environments. To learn more about Google guidance on securing critical infrastructure, please visit our CISO Insights Hub.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f8c2532c310>), ('btn_text', 'Watch now'), ('href', 'https://x.com/googlecloud/status/2090213589558698309?s=20'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Empowering autonomous agents with advanced security governance: To be useful and secure, AI agents need access — and also guardrails. In our new State of AI infrastructure report, 79% of tech leaders cite security, governance, or operations as their most significant challenge to scaling inference. Read more.
The state of cloud risk 2026: Most security findings aren’t real attacker opportunities: Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise. Read more.
Introducing Google Cloud Fault Injection Testing in preview: When databases fail and network paths falter, you still need your mission-critical cloud services to stay online. Fault Injection Testing (FIT) can help you automate failure testing to ensure predictable behavior during disruptions. Read more.
How Wiz built AI-powered data discovery: Inside the multi-agent pipeline and feedback loops that turned a bucket scanner into a context engine. Read more.
Democratizing FinOps with Wiz: How the Wiz Cloud Cost automates cost allocation to power developer-led cost optimization and connect cost to business value. Read more.
Defend against agent risks with layered protections in Google Workspace Studio: Studio incorporates layered defenses to mitigate risks from threat actors and robust observability tools to help organizations adopt agents safely. Built on Google’s secure-by-design architecture, Studio combines native threat defenses with deep ecosystem visibility to secure multi-step agentic workflows. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f8c2532cd90>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Distinct clusters target individuals of interest to Russia: Google Threat Intelligence Group (GTIG) is tracking three suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace, governments, and think tanks across Europe and in the U.S. Read more.
Inside 90 days of attacks on AI infrastructure: Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft. Read more.
Version Control DFIR: A cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps: A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services. Read more.
Rust supply chain attack on arrayref: Significant overlap with DPRK campaigns: Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here.
Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Near Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Simplify your resilience testing strategy with Fault Injection Testing

Wed, 26 Aug 2026 16:00:00 +0000

When databases fail and network paths falter, you still need your mission-critical cloud services to stay online. Yet guaranteeing high availability has become increasingly difficult because of the complexity of modern distributed systems.

To help you maintain availability and reliability during adverse events, we’re announcing Fault Injection Testing in preview. Fault Injection Testing is designed to help developers and architects automate failure testing to ensure predictable behavior during disruptions.

By deliberately introducing faults into your environment, you can verify your safety mechanisms before an actual outage impacts your customers.

Why native resilience testing matters

Unlike in self-hosted data centers, cloud applications offer less direct access to underlying infrastructure to facilitate failover testing.

Without native tools to prove your application can survive a failure, you risk a critical gap in your reliability strategy that exposes you to several risks:

Damaged trust and reputation: Frequent failures or poor performance lead to customer dissatisfaction and long-term damage to your brand's image.
Compliance and regulatory penalties: For many industries, particularly financial institutions, failing to prove disaster recovery capabilities can lead to non-compliance, audits, and fines.
Migration delays: Large-scale migrations often stop when teams cannot verify that critical applications will remain stable during a zone failure.

How Fault Injection Testing works

Fault Injection Testing allows you to run experiments by creating experiment templates. These templates act as blueprints, defining the specific fault to be injected and the resources that will be targeted for the experiment.

In this public preview, you can test two primary failure scenarios:

Failover Cloud SQL: This fault triggers a failover of a high availability Cloud SQL instance from the primary zone to a standby zone.
Degrade application traffic: This allows you to selectively add latency and HTTP error codes through an Application Load Balancer.

Before any fault is injected, Fault Injection Testing performs an automated dry run. This read-only simulation checks your permissions and provides an up-to-date list of every resource that will be affected.

Once you verify the scope, you can manually start the injection. The duration you defined in the template will run its course, and the faults will be reverted at the expiration of the timer.

During the experiment, you can verify that your application is behaving as you planned. If things do not go as planned, you can use the stop and revert capability to immediately halt the experiment and begin restoring resources to their normal state.

During preview, we recommend as a best practice to use Fault Injection Testing (FIT) in a non-production environment. Preview is an opportunity to get early access to learn how the service fits and complements your existing testing practices, and to provide us with your feedback to improve the product as well!

Built for the enterprise

Partners like KeyBank and Servier are already using Fault Injection Testing to validate their deployments. By using native fault injection, these organizations can approximate demanding failure scenarios — such as zonal outages — to help ensure their services remain stable.

Get started with Fault Injection Testing

Fault Injection Testing is available through the Google Cloud console, the gcloud CLI, and REST APIs.

Request preview access: Talk to your Google Cloud Account Team to add your project to the preview.
Enable the API: Search for "Fault Testing API" in your Google Cloud console and select enable.
Assign roles: Ensure your team has the roles/faulttesting.operator role to configure and run experiments.
Run your first dry run: Create a template for a Cloud SQL or load balancer resource in a non-production environment and execute a dry run to see the potential impact.

For more details on implementation, talk to your account team, or view the User Guide for Fault Injection Testing.