Public Sector

Google Cloud and NASA: Testing robotic systems for deep space missions

Tue, 27 Oct 2026 04:00:00 +0000

As NASA advances its Artemis program to send astronauts on increasingly difficult missions to explore more of the Moon, build a sustained human presence there with a Moon Base, and build on their foundation for the first crewed missions to Mars, crew safety and Earth-independent autonomy are paramount. An astronaut on a future deep space mission to Mars could face severe operational challenges—including round-trip communication latencies of up to 44 minutes, making real-time medical guidance for crew nearly impossible.

Last year, Google Public Sector shared progress on the development of the Crew Medical Officer Digital Assistant (CMO-DA) - an automated Clinical Decision Support System (CDSS) designed to assist astronauts with real-time medical guidance in remote and isolated environments. Today, we are building on this innovation with the development of a proof-of-concept physical, robotic system that aims to support deep space missions and could assist astronauts during NASA missions.

Optimizing crew time and safety

The future Moon Base in the lunar South Pole region of the Moon is planned to support sustained human presence. Because every minute in space is a strictly limited resource, reducing the physical burden on astronauts to maximize their time for science and discovery is a top priority. To potentially address this challenge, NASA’s Human Research Program, Johnson Space Center Robotics Team, and the Jet Propulsion Laboratory (JPL) collaborated with Google Public Sector to develop a robotic system. By handling routine logistics, this system could free up astronauts to focus on what humans do best: complex science and discovery.

To maximize its utility for a lean crew, the robotic system is designed as a versatile "payload" handler capable of managing cargo, logistics, and equipment. When not needed for routine maintenance like organizing tools or securing compartments, it can pivot to medical support. For example, if an astronaut experiences severe back pain—a potential symptom of kidney stones—the robot could retrieve and prepare an ultrasound machine. This enables the human crew medical officer to focus entirely on analyzing the scan and treating the patient.

Adapting spatial awareness and vision-language-action models for robotic systems

Operating safely alongside humans in confined spacecraft is a complex challenge. Unlike factory robots in fixed, human-free environments, space systems utilizing Super Intelligence (SI) require flexible, human-directed tools to safely adapt to close quarters. Because they must also rely on limited sensory input like cameras, JPL is adapting satellite situational awareness intelligence tools—originally designed to track objects in orbit—to help the robotic system navigate and understand its 3D surroundings.

To test this safely at Johnson Space Center’s iMETRO facility, Google DeepMind’s MuJoCo simulator was used, which is an advanced physics engine that allows the SI to practice complex movements in a highly accurate virtual environment before touching real hardware. In a recent proof-of-concept technology demonstration, the robotic system was tasked with a complex "pick-and-place" maneuver to locate and move a medical bag. By implementing an "eye-to-hand" camera configuration for enhanced spatial awareness, the open-source Pi0 model—developed by Physical Intelligence on Google Cloud infrastructure— achieved an initial 85% baseline success rate in these early lab environments, providing a strong foundation for the next phase of rigorous training and safety refinement. Because vision-language-action (VLA) models connect language directly to physical movement, astronauts could direct the robotic system flexibly via standard English text prompts.

Space: the ultimate edge-computing environment

Processing these complex tasks requires significant computing power, which presents another hurdle: space is the ultimate edge computing environment. Spacecraft cannot rely on continuous connections to Earth-based data centers. To solve this, the Google team harnessed Google Cloud G4 instances to rapidly train the underlying models, fine-tuning the 4-billion parameter Pi0 model in just 2.5 hours. Crucially, they demonstrated that the fine-tuned models can then operate locally on compact, energy-efficient edge devices. Over the last two years, the team tested approximately 15 different edge computing devices to find ones that run efficiently on lightweight, low-power hardware required for future Mars missions.

Pioneering the future of crew safety and space exploration

Looking ahead, the ultimate goal is to build a robotic system that can execute a variety of tasks via simple voice instructions, under the astronauts’ direct supervision and command. For instance, the robot might be directed to assist with routine health monitoring—such as capturing basic vitals or simple ultrasounds—under the strict guidance of a human crew medical officer. This ensures astronauts receive the physical assistance they might not be able to perform by themselves, without ever replacing human decision-making.

This collaboration between Google Public Sector and NASA can help pave the way for increasingly difficult missions that push the bounds of scientific discovery.

Want to learn more about the value of Gemini to your mission? Register to watch our Google Public Sector Summit on demand or reach out to geminiforgov@google.com for more information.

_{Photo: (Oct. 9, 2026) --- Northrop Grumman’s Cygnus XL cargo spacecraft is pictured in the grip of the Canadarm2 robotic arm moments before its release into Earth orbit after a nearly six‑month stay attached to the International Space Station’s Unity module. The orbital outpost was soaring 263 miles above the Indian Ocean, off the coast of Madagascar, at the time of this photograph. Credit: NASA. Date Created:2026-10-09}

Google Public Sector increases partner investments for frontline adoption

Wed, 21 Oct 2026 13:00:00 +0000

Partnership is at the core of Google Public Sector’s mission to empower government agencies and education institutions with transformative, mission-aligned solutions. We recognize that we can only scale our impact through a thriving, highly capable partner community.

At today’s Partner Connect at Google Public Sector Summit, we are introducing enhanced partner initiatives focused on fostering deeper collaboration, supercharging frontline adoption, and expanding mission delivery capabilities across our valued partner network. These updates are centered around four pillars:

Enhanced partner incentives: We will reward partners who do the heavy lifting of pre-sales technical depth, solution design, and proof-of-concept execution through newly announced incentives and discounts.
Partner-Led User Success Program: We will support sustained frontline Gemini adoption led by our partners through three targeted investments.
- Training and enablement: Launching a new Forward Deployed Engineer (FDE) academy, a rigorous bootcamp designed to build elite, Google-trained FDEs inside partner’s practices.
- Pre-sales acceleration: Increasing our Pre-Sales Deal Acceleration Funds to directly co-invest in partner-led customer workshops and proofs of concept.
- Post-sales adoption: Expanding our investment pool to $45M in dedicated deployment and adoption funding, designed to pay for partner professional services to deploy Gemini across the entirety of the U.S. public sector for the first time—ensuring day-one operational readiness.
Backing builders and powering alliances: We know specialized missions require purpose-built software and scalable infrastructure.
- We are launching a new ISV Agent Factory to accelerate the development of specialized public sector agents.
- This is on top of our ISV ATO Accelerator which provides individual ISVs up to $1M in funding from Google to offset the cost of GovRAMP, FedRAMP, and DoD Impact Level accreditations.
Market-accelerating alliances: We are announcing a new Strategic Alliance with SHI to activate 400+ sellers across state, local, and education markets. At the federal level, Accenture Federal Services is announcing new Gemini Launchpads to help agencies move from agentic experimentation to mission execution, faster.

In the public sector, technology is never just about deployment; it is about the mission. Together with our partners, we are ensuring that our joint public sector customers have the mission-ready capabilities they need to lead on the front lines.

To operationalize these announcements, partner organizations are encouraged to engage in the programs below and access upcoming trainings:

Announcements and highlights from Google Public Sector Summit 2026

Tue, 20 Oct 2026 10:00:00 +0000

Today we are bringing together mission leaders and builders from across the public sector at the Google Public Sector Summit in Washington D.C. to explore a critical intersection: Where mission meets moonshot. Through our hands-on programming, we will offer inspiration as well as pragmatic steps for turning moonshot aspirations into secure, scaled, real-world outcomes.

From mapping the human genome to putting a human on the moon, public sector organizations have been at the helm of some of humanity’s most historic breakthroughs. Right now, public sector leaders are being asked to move faster than ever, amidst more complexity and uncertainty, often with fewer resources than the mission demands. To better understand these challenges and opportunities, we surveyed several hundred leaders from across the public sector with theCUBE and ECI Research. According to the findings, while 96.3% of agencies have deployed agents in some form, only 9% have achieved agency-wide adoption. The bottleneck isn’t a lack of vision or ambition—it is the systemic friction of legacy data silos and integration complexity. That is why so many organizations turn to Google; we deliver powerful technology that reduces the toil of getting started, minimizes the friction of integration, and provides the secure foundation for scale.

To that end, we are excited to share several new announcements and capabilities to support your missions and moonshots in the agentic era.

Introducing the Gemini agent

We recently announced the Gemini agent: your new single, universal agent for work. It can have all of your organizational context and can be used for everything from knowledge work to answering questions, and from content creation to coding, all from a single prompt box. At your direction, it can plan the work, use skills and tools, connect to your systems, and bring back something finished — inside the documents, the inbox, and the developer environments you already work in and give it permissions for. With your guidance, the agent chooses the best model for the job, employs built-in cost controls, and most importantly, reflects the security, administration, and governance controls established by your organization.

Introducing Gemini for government services

This morning we launched Gemini for government services in private preview, a purpose-built platform engineered for the security, governance, and workflow complexity of public sector missions. Built around the core promise of delivering "less paperwork, more public service," it provides an integrated, fully governed environment configured for rapid deployment across federal, state, and local agencies. By combining pre-built partner agents, secure connectors, and deterministic skills, the platform enables civil servants to securely link Gemini directly to existing case management, ERP, and agency collaboration systems of record without migrating their agencies’ sensitive data. Civil servants are empowered to automate repetitive, high-stakes tasks—such as public records requests, document intake validation, expense auditing, and policy research—all grounded in authoritative federal regulatory sources with verifiable citations. Learn more about Gemini for government services in our blog post.

Introducing Wiz agents in Wiz for Gov

The Wiz Red, Green, and Blue agents are now available within Wiz for Gov, Wiz’s FedRAMP Class D (High) certified environment. The expansion of the agent trio into Wiz for Gov accelerates remediation for critical public sector priorities, including Post-Quantum Cryptography (PQC). The Green Agent can assist in driving PQC readiness through a new risk type dedicated to weak cryptography that investigates whether an asset is quantum-vulnerable and assesses potential Harvest Now, Decrypt Later (HNDL) exposure. By leveraging the cryptographic visibility from code to runtime gained through the Wiz AI-APP, the Wiz Green Agent is able to help weigh real-world external reachability against data sensitivity enabling delivery of continuously updated, PQC-resistant fixes directly into developer workflows.

Wiz has also invested in several other initiatives intended to benefit the public sector. Scan for Good, a program launched jointly by Wiz and Google DeepMind, uses the Wiz Red Agent and Gemini 4 Argon, alongside Gemini 3.8 Flash Cyber, to provide no-cost security assessments designed to uncover high-risk vulnerabilities and exposures across eligible public services, critical infrastructure, and other under-resourced organizations. Wiz is also expanding capabilities for organizations navigating the new FedRAMP Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets. This includes operationalizing critical FedRAMP metrics, including Potential Agency Impact (PAIN), and validating likely exploitability (LEV) and internet reachability (IRV). These enhancements will assist organizations seeking to achieve or maintain FedRAMP certification with the automated reporting and prioritized risk assessment required.

Bringing enterprise search capabilities to Gemini on Google Distributed Cloud

For defense, intelligence, and national security agencies operating in classified environments, the challenge is not just analyzing vast volumes of sensitive data, it is doing so without compromising perimeter security. To help turn classified information into actionable intelligence, we are bringing enterprise search capabilities to Gemini on Google Distributed Cloud for air-gapped deployments. With this new capability, users gain an intuitive conversational interface to query, synthesize, and summarize records at machine speed, completely disconnected from the public internet. This launch brings Gemini 3.5 Flash models to on-premises air-gapped deployments, expands model flexibility with open models like Gemma, and delivers massive local compute through generally available NVIDIA Blackwell B300 GPUs.

Driving mission impact, together

Through partnership and powerful technology, organizations across the public sector are transforming how services are delivered, accelerating research and science, strengthening national security, improving healthcare delivery, and enhancing student outcomes. These organizations aren’t waiting for the future; they are actively building it right now.

America.gov is offering a streamlined "front door" that simplifies access to federal services online. Google is proud to be named a technology partner in this vital initiative, leveraging Gemini to help millions of Americans access critical public resources with greater speed and ease.
SUNY is tackling challenges with direct impact for communities across New York and beyond. Together, we are empowering researchers of all technical backgrounds to easily access and benefit from Google Cloud's advanced capabilities—bringing storage, high-powered computing, Gemini Enterprise, and more than 200 trusted models together into a seamless, centralized ecosystem.
The Department of Energy is accelerating breakthroughs in energy dominance, discovery science, and national security through the Genesis Mission. Gemini will support the full breadth of work - from the research bench to specialized user facilities – building a secure foundation that the DOE mission can depend on.
The U.S. Army is leading a sweeping modernization of its logistics infrastructure including non-tactical logistics networks, supply chain procedures, and organic industrial base sites. The Army's Strategic Capital Initiative will pair Google's secure cloud and FedEx's logistics expertise to build a more intelligent and connected supply chain network that helps reduce delivery times and ensures personnel receive the critical equipment where and when they need it.
The Department of War is supercharging daily operations and workflows with Gemini, giving 3 million personnel across the department access to a secure enterprise-grade platform. With Agent Designer, GenAI.mil users are quickly able to build their own agents using natural language to help streamline repetitive, multi-step tasks such as document creation and document reviews.
Case Western Reserve University is improving learning outcomes and accelerating research breakthroughs. They are leveraging Gemini for education campus-wide, transforming the experience of every scientist, staff member, and student. Tomorrow, they’re opening a new hub for discovery and innovation that leverages Google technology, and connects Google engineers with 300 university researchers across campus.

Google Public Sector: Your mission partner

The agentic era will not be defined by what technology can do, but by what we choose to build with it. So let’s meet this moment, let's re-imagine what’s possible, and let’s create impact — together.

Register early for Google Public Sector Summit On-Demand to be notified when the event’s content is published.
Learn how Gemini for government services can help transform critical workflows and advance your mission.
Request a demo to see how the Wiz Agents can help your agency meet today’s security demands at machine speed.
Catch the highlights from Google Public Sector Summit on our Linkedin page, schedule a 1:1 consultation with a Google team member or reach us at geminiforgov@google.com.

Introducing Gemini for government services

Tue, 20 Oct 2026 10:00:00 +0000

Earlier this month at Gemini at Work, we introduced the Gemini agent: a single, universal agent for work. It answers your questions, handles your knowledge work, creates your images and media, and writes and runs code. You give it objectives, not instructions, and come back to finished work. It plans the work, uses skills and tools, connects to your systems, and has the security, administration, and governance your organization requires.

Every industry runs on knowledge a general model does not have. Government work runs on statute, regulation, and agency guidance, across siloed legacy systems, under strict requirements for data sovereignty, compliance, and confidentiality. Too often that leaves civil servants on data entry and manual document review instead of the services citizens depend on.

Today we're bringing the Gemini agent to public service with Gemini for government services in preview, part of our new suite of purpose-built industry solutions. It adds skills built around government work, connections to the systems agencies already run, and specialized partner agents, with governance running underneath it all.

Five components of Gemini for government services

Developed alongside agency leaders, Gemini for government services provides an integrated, fully governed environment configured for rapid deployment across federal, state, and local agencies with five core components:

Skills for government work: Skills are reusable instructions and context, written by domain experts, that teach Gemini to run a specific task. Each one applies the statute, regulation, and agency guidance that govern that task, so an agency's standard operating procedures carry into the work Gemini supports.
Connectors to agency systems: Secure connectors link Gemini to the case management, ERP, HR, and collaboration systems agencies already run, along with authoritative federal data sources. Gemini queries each system in place, so no data is migrated, and access follows the identity and permission controls the agency already has.
Partner agents: Skills and connectors come together in agents, including pre-built agents from public sector software providers that agencies can deploy right away. They handle tasks like FOIA discovery and batch redaction under the same central governance, with a person approving each consequential step.
A governed control plane: Security and compliance teams get one place to set and enforce policy across every agent, including VPC Service Controls, CMEK, and Assured Workloads. Outputs are grounded in source documents, with citations, so reviewers can check where each answer came from.
An open partner ecosystem: Every agency works under a different statute and runs a different mix of systems. System integrators and public sector ISVs help agencies customize Gemini, connect it to what they already have, and scale it without lock-in.

Skills for government workflows

Gemini for government services helps automate and accelerate complex government operations, including:

Policy and regulatory research: Ask an operational or eligibility question and get an answer drawn from the CFR, the Federal Register, state administrative codes, and internal manuals, with page and paragraph citations. Where federal and state rules both apply, Gemini shows which one governs to empower agency decision makers.
FOIA record discovery: Gemini searches SharePoint, Drive, and email archives for records responsive to a FOIA or state Sunshine Law request. It organizes them into a review set for the records officer and agency counsel, shortening discovery that often takes weeks.
Redaction for public release: Gemini finds sensitive constituent data across a batch of documents, groups the findings so reviewers can clear them in passes, and proposes redactions labeled by statutory exemption. After a reviewer confirms, it produces the exemption log and audit-ready copies.
Vendor bid evaluation: Gemini checks multi-volume bids against RFP requirements, FAR guidelines, minimum mandatory criteria, and evaluation rubrics, and returns scoring justifications with citations. Contracting officers get a documented basis for each award decision.
Grant and program expense audits: Gemini checks invoices, receipts, purchase orders, and ledger entries against 2 CFR 200 Uniform Guidance and the terms of the award. It flags unallowable costs, missing documentation, and funding discrepancies with line-item citations, so problems surface while there's still time to fix them.
Document validation at intake: Gemini classifies and validates pay stubs, W-2s, utility bills, and leases when they arrive, checks the numbers for consistency, and flags missing signatures. Defects are caught before the application enters the queue, not weeks into the case.
Plain-language notices: Gemini turns policy memos and agency guidance into public notices, aligned to the Plain Writing Act of 2010, USDA-FNS standards, and Title VI language access guidance.

Open ecosystem of connectors across the government technology stack

Gemini for government services connects directly to core agency systems via secure connectors. Access is bound by existing role-based access controls, record-level permissions, and the trusted data controls inherited from each system — and nothing is migrated to make the connection work.

Federal regulatory and public data:

Federal Register: Tracks legislative actions, regulations, and executive orders as they post, so state and local teams see federal changes as they land.
regulations.gov: Tracks federal rulemaking dockets, public comments, and statutory agency response deadlines, keeping policy analysts ahead of incoming mandates.
eCFR (Electronic Code of Federal Regulations): Grounds answers in the governing regulation, with citations down to the paragraph.

Agency systems of record:

Oracle E-Business Suite: Gives agents permission-bound access to procurement, payables, and ledger transactions for expense auditing and award reconciliation.
Oracle PeopleSoft: Connects HR and personnel records under existing role-based controls, so workforce questions are answered from the system of record.
Salesforce: Enables conversational experiences across the Missionforce portfolio through headless integration with Gemini, including benefits, licensing, permitting, and contact center management.
ServiceNow: Automates IT, CRM, security, employee experience, and workflow records, so agents can track incidents, requests, and approval chains inside existing routing rules.

Productivity and collaboration:

Google Workspace: Connects with Google Docs, Gmail, Drive, and Sheets to analyze case communications and agency correspondence and surface internal files while enforcing agency access controls.
Microsoft 365 and SharePoint: Integrates with Word, Outlook, and SharePoint to triage inquiries and ground responses in mail and intranet repositories without breaking workflow context.

Third-party agents and implementation partners

Every agency operates differently. Through our open platform, agencies can deploy pre-built partner agents or work with system integrators to scale custom capabilities:

SZNS Solutions FOIA and public records discovery agent: Turns a plain-language request, a piece of correspondence, or a formal citizen inquiry into a scoped search across enterprise archives — bounded by custodian and date range, so a records officer narrows the set before any data moves. It exports responsive material into secure agency repositories and tracks delivery status, giving each request an auditable trail from intake to release.
SZNS Solutions document redaction agent: Works inside connected repositories — SharePoint and Drive among them — finding sensitive citizen data across a batch and grouping the findings so a reviewer clears them in passes rather than page by page. Each proposed redaction carries its statutory exemption, and once the reviewer confirms, the agent exports permanently redacted, audit-ready copies back to the system of record, with the processing never leaving the agency's cloud perimeter.
Systems integrators & tech partners: Strategic partnerships with Accenture Federal Services, Clutch, Dark Wolf, Daston, Deloitte, Egen, Game Plan Tech, Knexus, Onix, Resultant, SAIC, Slalom, and SZNS Solutions so agencies can customize, integrate, and scale these capabilities without vendor lock-in.

Developed alongside federal, state, and local government agencies

We are working closely with select federal and state agencies, including the State of Missouri and the U.S. Department of Health and Human Services to ensure these capabilities work in day-to-day agency operations.

"Our citizens expect the government to move at the speed of modern life, not the speed of paperwork. By automating routine work in our workflows, we're delivering faster, better services to Missourians." - Tim Marczewski, Director of AI and Innovation, State of Missouri Office of Administration.

Built on an enterprise-grade foundation

Gemini for government services runs on Google Cloud's secure foundation, and can be deployed using the Assured Workloads FedRAMP High Data Boundary, enforcing U.S. data residency and personnel controls. It works within the authorities, retention rules, and approval chains your agency already has.

Agency records, constituent data, institutional documents, custom agents, and model outputs stay private to your organization, and are never used to train or fine-tune Google's foundation models without your permission. Because we operate the full stack, from infrastructure and models through the application layer, we can tune performance and cost together — routing high-volume document parsing and routine records sweeps to fast, low-cost models and reserving high-reasoning models for complex policy analysis, so expanding what your teams can take on does not mean expanding spend at the same rate.

This is just the beginning

The launch of Gemini for government services represents another defining step in delivering on our promise to bring the best of Gemini to every professional, for every workflow, natively tailored to the way they work.

Gemini for government services is available in preview today, joining our purpose-built solutions for industries. We invite leaders at every level of government to explore how Gemini can transform their most critical workflows.

Cloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQC

Wed, 14 Oct 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for October 2026. Today, Stephanie Kiel explains the latest on our approach to post-quantum cryptography, and shares a new tool to help CISOs and executives prepare their organizations for PQC.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f3c13c50410>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

New Gemini Notebook can help CISOs and policymakers prepare for PQC

By Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Post-quantum cryptography (PQC) is one of the most urgent security shifts of the decade — and one of the easiest to tune out. For security leaders and policymakers, the research is dense, scattered across papers and engineering blogs, and can be challenging to turn into action.

To help, we're launching Prepare for Post-Quantum Cryptography, a public Gemini Notebook that brings Google's PQC research, engineering blogs, and migration guidance together in one place. Ask it questions, listen to an audio overview, or test yourself with flashcards, and quickly get up to speed on the quantum threat.

Why PQC matters now

Quantum computing is rapidly moving from theory to reality. Our Willow chip and Quantum Echoes algorithm mark substantial progress, and Google research estimates that breaking ECDLP-256 and RSA-2048 encryption — the public-key cryptography schemes protecting much of our online data — would require around 500,000 and 1 million imperfect quantum computer components (noisy qubits), respectively.

To help, we're launching Prepare for Post-Quantum Cryptography, a public Gemini Notebook that brings Google's PQC research, engineering blogs, and migration guidance together in one place.

This research has consequences now. It indicates that today’s online security is more vulnerable to future quantum computers than previously thought.

In Store Now, Decrypt Later attacks, adversaries may steal encrypted data now and wait to decrypt it once a sufficiently powerful quantum computer exists. Data that we’ve long considered sensitive — health records, financial data, intellectual property, and government secrets — is already at risk.

With continued advances in architecture, quantum algorithms, and quantum error correction shrinking future quantum hardware requirements, waiting to upgrade our digital locks is not a viable option. To help organizations stay ahead of the curve, Google has published a migration timeline noting our plans to transition to PQC by 2029, and we urge others to consider the same.

As the technology advances, policymakers should consider urging critical infrastructure owners and operators to recognize condensed timelines, and build PQC readiness into existing risk mitigation plans. We also recommend governments engage with global counterparts to promote a harmonized approach to standards development, and include technical and security experts in the building of policy and regulatory requirements focused on quantum safety.

Google's PQC expertise, in one notebook

The Prepare for Post-Quantum Cryptography notebook turns years of Google expertise into an interactive primer that anyone can use. It's built on curated Google sources covering the quantum era, quantum computing breakthroughs like Willow, Quantum Echoes, and surface code error suppression, industry PQC standards, Google's own deployments, and the latest research.

In the Gemini Notebook, you can:

Get answers grounded in Google's sources.
Listen to a podcast-style audio overview.
Test your PQC knowledge with flashcards.
Explore an interactive visual diagram of the quantum threat.
Read a concise briefing document.

Try these prompts

To get started, here are a few questions to ask the notebook:

For CISOs: "What should a CISO prioritize in the first 90 days of a PQC migration?"
For anyone new to PQC: "Explain store-now-decrypt-later in plain terms."
For developers: "How does hybrid ML-KEM key exchange work in Chrome?"

As with all generative AI, the notebook can make mistakes, so check its responses against the linked sources.

What's at stake

Previous cryptographic migrations, such as moving from SHA-1 or upgrading TLS, have taken a decade or more. Waiting for the availability of a cryptographically-relevant quantum computer before beginning the migration journey represents a significant security risk given the importance of public-key cryptography for securing digital essentials like web traffic, software updates, digital identities, and signatures.

For CISOs, we recommend that you start by:

Understanding where vulnerable cryptography lives in your organization.
Identifying and prioritizing data and systems most at risk from quantum threats, and developing a plan for addressing these risks.
Anticipate system-wide effects that PQC migration could have.
Building crypto-agility into your security plans, using learnings from past experiences like Heartbleed.

Additional detail on these recommendations is available in our previous blog post.

For the broader security community, the transition only succeeds if this knowledge is accessible to everyone — not just organizations with dedicated cryptography teams.

How Google is putting PQC into practice

We’ve been deploying PQC for years. Highlights include:

We also co-founded the Post-Quantum Cryptography Alliance at the Linux Foundation with industry leaders including Amazon Web Services, Cisco, IBM, and NVIDIA to support open-source tools like Open Quantum Safe.

Build a PQC notebook for your own team

Here’s how you can create a resource similar to our PQC Gemini Notebook, specific to your organization’s needs:

Curate trusted sources. Start with a focused set of authoritative research, standards, and guidance.
Write neutral prompts. Keep instructions factual so outputs stay grounded in your sources.
Add AI disclaimers and a welcome note. Tell readers what the notebook covers and remind them that AI can make mistakes.
Review all output with human oversight. Have experts check every artifact before you share it.

Start preparing today

The quantum transition has already started, but preparing your organization doesn't have to begin with a 100-page whitepaper. Start by understanding the threat, then assess your cryptographic inventory and build a migration roadmap.

You can get started with the Prepare for Post-Quantum Cryptography Gemini Notebook and share it with your team today. To learn more about Google Cloud’s approach to PQC, check out our dedicated Google Cloud PQC Resource Hub.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f3c1897dd10>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=Wpo-5ke9uvQ'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Securing enterprise agility in the machine-speed era: Learn what executives need to know about today’s threat landscape, how security teams should respond, and why Google AI Threat Defense can help. Read more.
Gemini 4 Argon available on Google Cloud: We’re making our new frontier model, Gemini 4 Argon, available for everyone on Google Cloud. Here’s how it can help boost the defender’s advantage. Read more.
Android's next-gen enclave for on-device AI: Learn about Android’s enclave architecture for personalized on-device AI experiences. Read more.
The Wiz Red Agent caught a Fortune 500 firm’s data exposure that other tools missed: Using an attacker’s mindset, the Red Agent found a public page exposing sensitive data in minutes. Read more.
Chrome's response to recent ccTLD registry hijacks: Following recent .gh, .sl, and .as ccTLD domain hijacks, Chrome immediately blocked unauthorized HTTPS certificates via CRLSets to protect users automatically. Read more.
Wiz Blue Agent POV: Investigating data theft across AWS and GitHub: See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling. Read more.
Introducing Wiz AI SAST: Application security that understands you: Find, validate, and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized in your existing security program. Read more.
Introducing WizOS Helm Charts to secure the Kubernetes supply chain: WizOS Helm Charts can help eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for Kubernetes. Read more.
What’s new in Wiz Service Catalog: Smarter discovery, governance, and service-level context can help build your service catalog faster, keep service context current, and give teams a clearer path from cloud risk to accountability. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f3c1897e090>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Vulnerability discovery and exploitation trends in the AI era: To counter the increased risk from rapid vulnerability discovery and exploitation, organizations should transition from unprioritized mass-patching to threat-intelligence-driven triage, combining targeted edge-defense with automated, agentic remediation. Read more.
Defending against active exploitation of Citrix NetScaler ADC and Gateway appliances: Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Here’s our containment and remediation guidance. Read more.
ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft: Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. Read more.
Proactively defend by hardening code pipelines and CI/CD infrastructure: Check out our actionable blueprint for software and platform architects designed to safeguard the software supply chain against threat vectors that are actively being exploited, third-party risks, and architectural vulnerabilities throughout the entire software development lifecycle. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here.
Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Nir Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Google Public Sector and SUNY launch AI-enabled platform to accelerate university research

Thu, 08 Oct 2026 12:00:00 +0000

Public research universities solve some of society’s most urgent challenges, but turning ideas into breakthroughs requires fast, secure access to cutting edge technology. In the agentic AI era institutions have an unprecedented opportunity to harness intelligent systems that can process massive datasets, run complex workflows, and dramatically accelerate the pace of scientific discovery.

Today at Gemini at Work, we’re announcing our collaboration with the State University of New York (SUNY) to launch the SUNY AI Platform, a secure AI and high-performance computing environment built on Google Cloud with Gemini Enterprise.

Initially available across nine of SUNY’s most research-intensive campuses, the platform is designed to help researchers move from hypothesis to discovery faster—and to help prepare New York’s students and workforce for an AI-driven economy.

Research with real-world impact

SUNY researchers are tackling challenges with direct impact for communities across New York and beyond. Their work includes improving weather prediction, detecting water quality issues, sequencing DNA for cancer treatments, and processing high-resolution brain scans to aid diagnosis.

To support that work, the SUNY AI Platform empowers researchers of all technical backgrounds to easily access and benefit from Google Cloud's advanced capabilities—bringing storage, high-powered computing, Gemini Enterprise, and more than 200 trusted AI models together into a seamless, centralized ecosystem. Rather than requiring individual teams and campuses to assemble these capabilities independently, researchers can work within a common foundation that helps simplify data analysis, enable collaboration across institutions, and apply consistent governance and responsible AI practices.

Equipping the SUNY community with AI-ready skills

Technology alone does not create impact; people do.

As part of this collaboration, SUNY is offering system-wide access to Google’s self-paced, industry-recognized AI credentials, available at no cost to students and faculty. Each course can be completed in 5-10 hours and requires no prior experience, helping learners build practical skills to write effective prompts, solve complex problems, and use AI tools responsibly. SUNY is also working to embed Google Career Certificates into academic programs so students can graduate with job-ready technical capabilities alongside their degrees.

Together, the SUNY AI Platform and these learning opportunities reflect a broader approach to AI adoption: pairing access to advanced technology with the skills and institutional capacity needed to put it to work responsibly.

To explore SUNY’s free AI learning tools and resources, visit suny.edu/google. Then read our case study here and watch our featured partnership video with Catherine Stollar Peters, SUNY’s Director of Research Data Strategy, to hear how academic leaders are using AI to transform education and the public sector.

You can also join us at the Google Public Sector Summit on October 20 to hear firsthand how leaders are using AI to transform organizations across the public sector.

Where mission meets moonshot: Join us at the Google Public Sector Summit 2026

Tue, 06 Oct 2026 07:00:00 +0000

Across the public sector, the question has shifted from “what’s possible?” to “how can we drive mission impact?” We’ll be answering this question at the Google Public Sector Summit on October 20th at the Ronald Reagan Building in Washington, D.C.

This year’s summit brings together public sector leaders, creators, and builders to architect what’s next and bridge the gap between ambitious innovation and secure, scaled execution. Together, we’ll explore how public sector organizations are harnessing Google’s secure, integrated AI stack—encompassing everything from planet-scale infrastructure to leading models and agentic platforms—to turn ambitious moonshot aspirations into real-world outcomes that drive mission impact.

The Google Public Sector Summit is a celebration of what’s possible when human ambition and powerful technology come together in support of mission. Keep reading for a preview of the event, and how to make the most of your onsite experience.

Opening Keynote: Where Mission Meets Moonshot

Get inspired during our opening keynote which will feature Karen Dahut, CEO of Google Public Sector, Thomas Kurian, CEO of Google Cloud, and Chris Hein, Field CTO of Google Public Sector. They will share real-world customer examples and live product demonstrations that showcase Google’s technology in action across the public sector. Attendees will also get the opportunity to hear from public sector leaders who are collaborating with Google and applying technology to transform missions and power moonshots.

General Session: Cloud Talks

Join Elizabeth Moon, Managing Director of Customer Engineering for Google Public Sector, as she hosts a series of talks that dive deeper into the critical pillars of public sector transformation including infrastructure, AI, and security. Hear from Rich Sanzi, VP of Engineering for Google Cloud, Michael Gerstenhaber, VP of Product Management for Gemini, and Sandra Joyce, VP of Google Threat Intelligence, as they share strategies for establishing an infrastructure foundation for the agentic era, building safely with Google’s platforms, and implementing proactive defense at planet scale.

Breakouts: Panel Discussions and Birds of a Feather

Hear from Google Public Sector executives, industry partners, and leaders across defense, federal civilian, higher education, and state and local government through a series of panels and birds of a feather discussions.

From fragmented to fluid: Connecting data to build the agentic future. Moderated by Tony Orlando, Managing Director of Partner and Specialty Sales, this session will explore how agencies can break down legacy data silos and build a unified, AI-ready data foundation. Speakers include Andrew Mapes, CDAO Principal Deputy Chief Digital and AI Officer, Dr. Neil Jacobs, NOAA Administrator and Undersecretary of Commerce for Oceans and Atmosphere, and Scott Alfieri, Accenture Global Lead for the Google Business Group. An additional speaker, Adarryl Roberts, DLA CIO, has been invited.
Automating defense: Securing the agentic era against complex threats. Moderated by Ron Bushar, Managing Director and Chief Security Officer, panelists will discuss how they’re applying autonomous AI and threat intelligence to protect dynamic environments at machine speed. Speakers include Justin Fanelli, U.S. Navy CTO, Jamie Wolff, DOE-NNSA CIO, Vice Admiral (Ret.) TJ White, Texas Cyber Command Chief, and Thomas Browning, Rhombus Power Senior Vice President of Strategic Capabilities.
The agentic era: Advancing missions and transforming the way we work. Moderated by Elizabeth Moon, this session will highlight how secure, cost-efficient agentic capabilities can scale impact and advance missions. Featured speakers include Barry J. Schindler, USPTO Acting Commissioner for Patents, Miro Humer, Case Western Reserve University CIO, and Todd Johnston, Deloitte Managing Director, AI & Engineering and Defense, Security & Justice AI/Analytics Leader.
Interactive Birds of a Feather discussions. Connect directly with a small group of peers and Google experts to address critical mission blockers, share best practices, and accelerate your agency's journey beyond the pilot stage. Join discussions across a range of topics including tokenomics, migration, and compliance.

Demos, Lightning Talks and Labs

Experience Google’s innovations through hands-on labs, Lightning Talks, and demos taking place in the Mission Exchange on the showfloor. Topics will include agentic threat defense, multimodal AI citizen services, and legacy database modernization with AI.

Attendees can also join two expert-led labs:

Getting Started with Gemini: This introductory lab will guide participants through the fundamentals of Gemini and Gemini Notebook to summarize documents, search data and streamline daily tasks. No technical background required.
Build Gemini Agents: From Prompt to Prototype: This lab will help you bring your real-world agency use cases to life by building an AI agent with Gemini, with support from Google Cloud specialists.

Throughout the day, we will host Lightning Talks, which are dynamic 20-minute presentations featuring live demos and interactive Q&A that take place on the showfloor. These talks feature partner and customer speakers and showcase the "art of the practical" through live, real-world solutions.

Closing Session: What’s Your Moonshot?

Join us for an inspirational closing session that I will be moderating. Together, we’ll define what a moonshot means for the public sector in the agentic era and share strategies for fostering a culture of courageous problem-solving and applying technology to supercharge human ambition and ingenuity.

Register for the Google Public Sector Summit

Beyond the personalized programming and practical hands-on experiences, attendees will leave the event with a customized action plan for driving impact in their organization. Register today for the Google Public Sector Summit to gain the strategies, skills, and inspiration to turn your moonshot aspirations into a reality. Join us as we build what’s next for the public sector, together.

Defending at machine speed: Securing the public sector in the agentic era

Tue, 29 Sep 2026 14:00:00 +0000

Over the last three decades in cybersecurity, I’ve witnessed major paradigm shifts — yet none match the velocity and complexity of today’s landscape. Attackers are now using AI to move at machine speed: accelerating intrusions, exploiting zero-day vulnerabilities, and rendering legacy defenses obsolete.

Reactive, manual security reviews can no longer keep pace with sophisticated and increasingly automated threats. Building true cyber resilience means shifting from reactive troubleshooting to a proactive defense — one where continuous posture validation and autonomous remediation are built directly into every workload from day one.

Public sector teams require a unified, structured approach to continuously scan, validate, and remediate software vulnerabilities. Google AI Threat Defense brings together the reasoning power of Gemini, deep multi-cloud visibility from Wiz, autonomous code remediation with CodeMender, and Mandiant frontline threat intelligence into a singular, continuous operational loop.

By securing the entire software lifecycle from code to cloud, this unified system enables agencies to continuously monitor and neutralize emerging threats at machine speed — safeguarding critical infrastructure, mission integrity, and public trust.

Real-world cyber defenses in action

Across state governments and higher education institutions, security and IT leaders are using Google’s AI and security solutions to secure highly dynamic environments, systems, and operations in the agentic era. Let’s take a closer look at how organizations across the public sector are automating defense and building resilience.

The State of Iowa: Under CISO Shane Dwyer, the state partnered with Google Public Sector to eliminate operational blindness, consolidating more than 20 separate security environments into a single, centralized security operations center (SOC). By ingesting large volumes of telemetry through Google Security Operations, Iowa established a unified operational view across its multi-cloud footprint — enabling its cyber personnel to move away from routine alert triage and focus on proactive threat defense and rapid incident remediation. Underway are several SOC process automation efforts that will continue to support the mission of reducing the overall workload and effectiveness of the SOC team.
The State of Connecticut: Connecticut faced an unsustainable, fragmented security model across its multicloud footprint. Under CISO Gene Meltser, the state transitioned to a unified, AI-driven operations center with Google Cloud. This agentic Security Operations Center (SOC) configuration allows Connecticut to apply automated cyber defenses across decentralized networks, neutralizing novel threats in near real-time before they reach production systems.
University of California, Riverside (UCR): Under CIO Matthew Gunkel, UCR Information Technology Solutions (ITS) built an integrated stack on Google Cloud to serve an academic community of more than 26,000 students, faculty, and researchers. The university implemented Google Security Operations and Security Command Center to establish a Zero Trust security architecture, while deploying Gemini Enterprise to automate IT support workflows, empower faculty, and give security analysts real-time assistive intelligence to resolve incidents at machine speed.
Arizona State University (ASU): Under CISO Lester Godsey, ASU addressed policy friction by consolidating 19 new security standards and existing university policies into an interactive, queryable AI assistant. To prepare future cyber defenders for the agentic era, ASU is launching a student-led SOC that provides hands-on training in orchestration, automation, and AI security through Google technology and ASU’s CreateAI platform.

Scaling public trust through active defense

In an operating environment shaped by machine-speed automation, true cyber resilience depends on embedding active, threat-informed defenses directly into every workload from day one. When public sector and higher education leaders empower their analysts with continuous visibility and intelligent security workflows, they can close critical exposure windows before adversaries can strike.

By replacing slow, manual reviews with automated defenses, security leaders can protect institutional integrity and ensure that the vital digital services supporting local communities, residents, and learners remain resilient, responsive, and secure.

Join us at our Google Public Sector Summit on October 20 where I’m moderating a breakout panel discussion, “Automating defense: Securing the agentic era against complex threats,” with security leaders who are fortifying critical missions. Register now.

Reimagining service delivery in the agentic era with Google Public Sector

Fri, 18 Sep 2026 16:00:00 +0000

State and local governments are driven by a shared mission to provide responsive, equitable, and accessible services. However, achieving this goal is often hindered by legacy technical debt, disconnected data, and heavy administrative burdens that slow down mission delivery.

This systemic fragmentation creates costly operational bottlenecks across the public sector, including:

Legacy data silos: Crucial caseworker information frequently resides in isolated repositories managed by separate departments.
Manual bottlenecks: Agency personnel spend a significant amount of time managing routine data entry and manual documentation.
Stakeholder and end-user friction: Users are often required to submit identical verification documents multiple times across different platforms because legacy systems cannot interoperate.

Today, agents can help break down silos, automate routine and manual tasks, and enable agency employees to focus on high value public services, and the deeply human work they were called to do.

AI is the number one priority for state CIOs

Across the public sector, AI has rapidly evolved from an experiment to a core part of the strategy. Reflecting on this shift, the National Association of State Chief Information Officers (NASCIO) State CIO top 10 annual report recently ranked AI as the number one priority for state CIOs for the first time. This reprioritization matters deeply for the future of state and local governance: as state agencies face mounting administrative backlogs, aging infrastructure, and shifting public expectations, CIOs recognize that intelligent automation is the central mechanism to increase staff capacity, streamline caseworker workflows, and deliver more responsive, equitable services to local residents.

As agencies move from AI pilots and experiments to full-scale adoption, the central question for many agencies becomes: How do we leverage AI to bridge the gap between existing legacy investments and modern service delivery?

Leveraging AI for mission impact

Google provides an integrated AI stack designed to remove the friction of manual systems integration, with a focus on speed, scale, and cost-efficiency. Let’s take a closer look at some public sector organizations who are partnering with Google Public Sector and putting AI to work:

Utah Department of Transportation (UDOT): Faced the monumental task of identifying and mapping more than 52,000 property parcels. Originally estimated to take 33.5 years of manual labor to complete, UDOT built a unified data platform on BigQuery, completing the entire project in less than one year and freeing engineers to focus on roadway safety.
City of Hartford: Set a national benchmark for inclusive governance by using AI to provide real-time, two-way translation in 80 languages across all public city meetings, expanding participation while achieving $1.3 million in structural cost savings.
City of Chattanooga: Centralized municipal crash and incident data using Google Cloud's AI and analytics tools, enabling city planners and public safety teams to identify high-risk corridors, optimize traffic signal timing, and prioritize infrastructure investments to make streets safer for residents.
Indiana Department of Transportation (INDOT): INDOT deployed Google Cloud’s AI and document analysis models to automate compliance auditing across dense procurement contract repositories and scale smart road infrastructure. Meeting tight 30-day compliance mandates without pulling licensed engineers from active field projects, the solution saved 360 hours of senior engineering labor while automating roadway asset detection to ensure safer, well-maintained highways for residents statewide.
City of Los Angeles: Facing the massive operational demand of hosting global events—including the 2026 World Cup, 2027 Super Bowl, and 2028 Olympic and Paralympic Games—the city is embedding Gemini directly into daily workflows across 45 departments and 27,500 employees. Serving as a force multiplier for municipal staff, the platform automates complex administrative tasks to amplify workforce capacity, accelerating service delivery and expanding multilingual support for over 15 million expected visitors and four million residents speaking more than 224 languages.
Maryland State: The state partnered with Google Public Sector to empower its 40,000-strong workforce using Gemini and Gemini Notebook within a secure, privacy-first cloud foundation. By lowering cognitive load and automating repetitive administrative tasks, agency teams built and deployed a clean water management application in just five weeks-saving thousands of staff hours and accelerating environmental oversight to deliver more responsive, sustainable public services to Maryland residents statewide.

Accelerate your AI journey with Google Public Sector

The agentic era is all about augmenting human capacity and empowering leaders and builders who make public service possible. Organizations across the public sector are leveraging Google Cloud’s integrated AI stack to redefine how they serve their stakeholders, empower their workforce, and advance their mission. At Google Public Sector, we are excited to partner with pioneering organizations as we build a more resilient, responsive, and connected government, together.

Join us at our Google Public Sector Summit on October 20 to hear from public sector leaders who are leveraging AI to re-imagine service delivery in the agentic era.

Cloud CISO Perspectives: Tips on securing the water sector in the AI era

Mon, 31 Aug 2026 16:00:00 +0000

Welcome to the second Cloud CISO Perspectives for August 2026. Today, Chris Sistrunk and Stephanie Kiel detail the critical issues facing the water sector, and actionable steps that OT operators can take to secure their infrastructure.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f3c180f4510>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Tips on securing the water sector in the AI era

By Chris Sistrunk, Practice Leader, OT, Mandiant Consulting, and Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Chris Sistrunk, Practice Leader, OT, Mandiant Consulting

Google Cloud’s threat intelligence teams have observed that threat actors are becoming bolder when targeting critical infrastructure amid geopolitical conflicts. Recently, we’ve seen increased targeting of water utilities' internet-connected programmable logic controllers in the U.S.

Stephanie Kiel, Head of Cloud Security Policy, Government Affairs and Public Policy, Google Cloud

Historically, cyber incidents haven’t usually disrupted operations, in part because water utility operators have long had manual override capabilities and established water-quality checks that kick in before water reaches consumers. Pumps and pipes fail routinely for reasons that have nothing to do with cyber threats.

However, they do require our urgent attention and a commitment to stronger security hygiene. Manual overrides provide a reliable safety net, but preventing cyber threats still requires a commitment to fundamental digital security — especially in the AI era.

We recommend a threat-informed, risk-managed response. The current state of water sector security is indicative that additional action should be strongly considered in light of the unique operational resilience that keeps these systems safe.

Actions water and wastewater utilities should consider

For resource-constrained utilities, the most effective defense is to focus on cybersecurity fundamentals. By prioritizing these fundamental practices, you can significantly harden your systems and transform your organization into a far more challenging and resilient target, causing even well-resourced threat actors to look elsewhere.

Inventory assets and assess exposure: Identify if your control systems are insecurely exposed to the internet, which often allows for the successful exploitation of vulnerabilities.
Basic security hygiene: Replace default credentials with strong passwords, and rigorously harden exposed access points, including firewalls.
Backups: Make sure that critical systems, including control systems, are safeguarded following the proven 3-2-1 backup rule (keep three copies of your data on two types of storage, with at least one copy stored off-site). Ensure critical spare equipment is on-hand to minimize downtime from cyberattacks.
Segmentation: Use network segmentation and multifactor authentication to ensure that remote access, when necessary, is strictly controlled. You should use read-only access where full control isn't required.
Emergency planning: Integrate cyber-incident planning into your existing all-hazards incident command system, including FEMA NIMS and Incident Command System for Industrial Control Systems, the same response structures you already use for physical pipe breaks, boil water alerts, and natural disasters.
Secure third-party and vendor access: As many water utilities do not manage their own IT or OT and rely on third-party system integrators, you should audit the remote connections used by the system integrators and maintenance contractors. You should ensure third-party vendors are held to rigorous access controls (such as MFA standards) and logging requirements.

These recommendations echo guidance from the American Water Works Association, the National Rural Water Association, the Water-ISAC, the Environmental Protection Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI.

Recommendations for IT and OT leaders: Bridging the governance gap

IT and OT leaders must work together to build a unified governance framework and should focus on making cyber-physical systems more resilient over the long term, a collective effort that spans government agencies, private sector organizations, and individuals. The goal is to build a future where these systems are secure, adaptable, and capable of recovering quickly from disruptions.

Although PLCs almost always sit outside standard software development practices, a robust approach to the software your organization uses can significantly enhance your overall security posture, such as those outlined in NIST’s Secure Software Development Framework (SSDF). They’re also good examples of leading indicators that can help you gauge your resilience, and to help you get started we’ve published a guide to evaluate leading indicators.

Manual overrides provide a reliable safety net, but preventing cyber threats still requires a commitment to fundamental digital security — especially in the AI era.

As technology evolves, it is critical to modernize security, transitioning from a reactive, manual model to an AI-augmented approach that keeps human expertise central to decision-making. This approach offers an unique opportunity to be a force multiplier for lean security teams.

To stay ahead of today’s threats, organizations must move beyond simple compliance checklists and adopt a more agile, threat-informed strategy that makes compliance a natural outcome of good security, rather than the primary goal.

The Mandiant Operational Technology (OT) Theory of 99 has become more relevant in the AI era. Although the funnel of opportunity has been significantly compressed, in intrusions that go deep enough to impact OT:

99% of compromised systems will be computer workstations and servers
99% of malware will be designed for computer workstations and servers
99% of forensics will be performed on computer workstations and servers
99% of detection opportunities will be for activity connected to computer workstations and servers
99% of intrusion dwell time happens in commercial, off-the-shelf computer equipment before any Purdue level 0-1 devices are impacted

As a result, there is often a significant overlap across tactics, techniques, and procedures used by threat actors who target IT and OT networks. However, the Theory of 99 underscores a significant defender's advantage in the AI era. By using advanced AI capabilities to secure the 99% of intermediary infrastructure, organizations can proactively neutralize threats and ensure robust protection for the critical 1% of physical operational processes.

AI for cyber defense

As we have shared before, AI capabilities offer the opportunity to shift the balance in network security in the favor of defenders. The defender’s advantage becomes even more important as malicious actors increasingly use AI capabilities across the attack lifecycle.

In the current threat environment, automating defenses can serve as a force multiplier for human security teams, enhancing decision-making and productivity to ensure critical exposures are addressed before they can be exploited. With careful planning, critical infrastructure providers can protect their physical assets while building a more resilient, threat-informed defense.

To effectively realize AI advantages for defense, you should integrate AI tools into systems in a structured, intentional way. It’s crucial that operators understand the unique vulnerabilities that AI introduces to physical processes, evaluate specific business uses that can benefit from security automation, and establish clear frameworks to continuously test and monitor. As part of our approach, we’ve developed the Secure AI Framework to help you achieve secure integration and deployment of AI capabilities, regardless of sector.

Most importantly, human oversight must remain central — meaning that AI should support decision-making, and safety practices need to be embedded directly into incident response plans.

What’s next for water security

Protecting water systems from malicious cyber threats is not just a technical challenge; it is a fundamental public safety imperative. Given that access to clean, reliable water is an essential service, we anticipate that federal, state, and local governments will increasingly shift from policy debate to decisive action to ensure the continuity of this critical public infrastructure in the face of cyber threats.

For example, the Office of the National Cyber Director in partnership with the State of Texas has just launched a pilot program to help protect water infrastructure providers from cyberattacks, and U.S. senators have already introduced a new bill in response to recent events.

Google is committed to helping you protect your cloud and hybrid cloud OT environments. To learn more about Google guidance on securing critical infrastructure, please visit our CISO Insights Hub.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f3c1858e290>), ('btn_text', 'Watch now'), ('href', 'https://x.com/googlecloud/status/2090213589558698309?s=20'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Empowering autonomous agents with advanced security governance: To be useful and secure, AI agents need access — and also guardrails. In our new State of AI infrastructure report, 79% of tech leaders cite security, governance, or operations as their most significant challenge to scaling inference. Read more.
The state of cloud risk 2026: Most security findings aren’t real attacker opportunities: Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise. Read more.
Introducing Google Cloud Fault Injection Testing in preview: When databases fail and network paths falter, you still need your mission-critical cloud services to stay online. Fault Injection Testing (FIT) can help you automate failure testing to ensure predictable behavior during disruptions. Read more.
How Wiz built AI-powered data discovery: Inside the multi-agent pipeline and feedback loops that turned a bucket scanner into a context engine. Read more.
Democratizing FinOps with Wiz: How the Wiz Cloud Cost automates cost allocation to power developer-led cost optimization and connect cost to business value. Read more.
Defend against agent risks with layered protections in Google Workspace Studio: Studio incorporates layered defenses to mitigate risks from threat actors and robust observability tools to help organizations adopt agents safely. Built on Google’s secure-by-design architecture, Studio combines native threat defenses with deep ecosystem visibility to secure multi-step agentic workflows. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f3c1858ee90>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Distinct clusters target individuals of interest to Russia: Google Threat Intelligence Group (GTIG) is tracking three suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace, governments, and think tanks across Europe and in the U.S. Read more.
Inside 90 days of attacks on AI infrastructure: Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft. Read more.
Version Control DFIR: A cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps: A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services. Read more.
Rust supply chain attack on arrayref: Significant overlap with DPRK campaigns: Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser's update cadence. Listen here.
Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Near Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Modernizing the skies: NOAA and Google Cloud collaborate to advance weather forecasting

Mon, 27 Jul 2026 14:00:00 +0000

The National Oceanic and Atmospheric Administration (NOAA) is embarking on a transformative journey to redefine how we understand and predict patterns in the Earth’s atmosphere that affect the weather we face every day. Today, we are proud to announce that Google Cloud was selected as the primary provider of high-performance computing (HPC) infrastructure for the Weather and Climate Operational Supercomputing System (WCOSS).

This program represents a pivotal shift for NOAA as it transitions from a more traditional, on-premises computing agency to cloud-first infrastructure—a major milestone as one of the first operational Numerical Weather Prediction (NWP) centers globally to move to the public cloud. By modernizing WCOSS on Google Cloud, NOAA is positioning the United States to lead global weather modeling through scale, speed, and reliability.

Google Cloud H4D VMs, powered by fifth-generation AMD EPYC™ processors, are serving as the primary computing backbone for NOAA on Google Cloud. Purpose-built for demanding, compute-intensive workloads like numerical weather prediction, H4D VMs provide the compute power and low-latency networking required to execute massive, tightly-coupled simulations.

To put this in perspective, if traditional computers are like a fleet of individual delivery vans navigating city traffic, H4D VMs operate like a synchronized convoy on a dedicated, multi-lane superhighway—sharing information instantly so they can work together as a single, massive engine. For the NOAA workforce, the move to cloud HPC provides a more streamlined, flexible environment, enabling meteorologists and researchers to quickly adapt future modeling innovations.

A foundation built on long-term collaboration

The partnership announced today is more than just a technological upgrade; it is the latest milestone in a long-term collaboration between NOAA and Google Cloud. For years, our teams have worked together to streamline and share petabytes of environmental data, track real-time wildfires, and advance marine conservation efforts. This work was anchored by the agency’s visionary leadership, which also drove a full transition to Google Workspace as its collaboration suite of choice in 2011.

The success of these early efforts paved the way for broader innovation. For example, NOAA Fisheries pioneered the development of a cloud compute accelerator pilot, giving scientists more flexible computing power they need, when they need it. NOAA also used Google DeepMind and Google Research’s WeatherNext model to predict Hurricane Melissa’s Category 5 landfall five days in advance, saving lives with early warnings and evacuations. These early pilot projects laid the groundwork for NOAA Fisheries to explore agentic AI applications powered by Gemini for Government.

As we look ahead, this collaboration is a testament to what is possible when government and industry align on a shared vision. By combining Google Cloud’s HPC capabilities with NOAA’s unparalleled scientific expertise, we can help improve forecast accuracy, positively impact public safety, and ensure that the United States remains at the forefront of global weather modeling for years to come.

Ready to see how cloud technology is transforming the public sector? Join us at the Google Public Sector Summit 2026 to hear more about how agencies like NOAA are advancing their missions.

Accelerating the frontiers of scientific discovery: Google’s $40M commitment to the Genesis Mission

Wed, 22 Jul 2026 13:30:00 +0000

Scientists today face challenges of extraordinary scale and complexity. From shaping and simulating the intricate dynamics of fusion plasma, to exploring the vast search space of new materials, to making sense of the exabytes of data pouring out of the world's most advanced experimental facilities. The demands on modern research are unprecedented. Frontier AI can help address these challenges, while accelerating groundbreaking scientific discoveries.

In December, we shared our commitment to the White House's Genesis Mission — the national effort to harness AI and double the pace of American scientific discovery within a decade. Since then, Google DeepMind (GDM) announced an early access program that provides AI for science tools to all 17 Department of Energy (DOE) National Laboratories, and Google Public Sector shared how Gemini for Government could serve as an AI backbone for the DOE.

Today, at the DOE Genesis Mission Summit 2026, we are expanding this by committing $40 million of AI tokens and cloud credits for researchers in support of the Genesis Mission.

Frontier AI tools for scientific discovery

Under this expanded commitment, we will first provide DOE’s Genesis Mission awardees in-kind access to GDM’s frontier AI for science portfolio, including:

AlphaEvolve — a Gemini-powered coding and discovery agent, for designing advanced algorithms.
AlphaFold 3 — a model for predicting the structure and interactions of proteins and other biomolecules.
AlphaGenome — a tool for understanding how variation in DNA, including the non-coding genome, shapes biology and disease.
WeatherNext — a state-of-the-art family of AI weather forecasting models for mapping weather conditions.
AlphaEarth Foundations — a foundational AI model for mapping and understanding our planet in unprecedented detail.

Second, we will provide Gemini for Government seats and tokens for one year to tens of thousands of users across the DOE National Laboratories’ operations, research, and management teams. This secure platform supports the full breadth of work from the research bench to the administration of specialized user facilities serving the entire scientific community, providing a single secure foundation that the DOE mission can depend on.

AI for science tools in action across the laboratory ecosystem

While we have a lot of work still to do, the practical impact of the Genesis Mission is already coming to life across the laboratory ecosystem.

At Pacific Northwest National Laboratory (PNNL), senior scientist Dr. Henry Kvinge is using AlphaEvolve to map out massive mathematical systems that are far too complex for humans to explore by hand. The AI uncovers hidden connections automatically, fast-tracking discoveries that would normally take researchers years to find.

“Modern math relies on abstraction, but combinatorics offers concrete models that make complex geometry and algebra easier to grasp. We’ve found that systems like AlphaEvolve are perfect for this search,” said Dr. Kvinge. “By leveraging the broad mathematical knowledge of LLMs, we can automate the exploration of countless angles. We’re still experimenting, but the discoveries are already shaping our future research.”

At the National Laboratory of the Rockies (NLR), researchers are utilizing Gemini to fundamentally change how they interact with physical laboratory hardware. Dr. Steven R. Spurgeon, a senior materials data scientist at NLR, leads a pioneering program in autonomous materials discovery.

"Our collaboration has allowed us to build an autonomous experimentation capability," said Dr. Spurgeon. "By deploying Gemini in our instruments, we cut microscope calibration time from over 90 minutes to about 13 minutes (eight times faster) and reduced the manual steps needed to focus an image from as many as 50 down to two. That's time and attention we've given back to the science itself, enabling genuinely autonomous workflows that observe, reason, and decide in real time. This has helped us explore parts of the material design space we simply could not have reached through manual operation alone."

Driving American innovation

The Genesis Mission represents an opportunity to transform research and science across America. By providing access to advanced AI tools, we aim to help scientists accelerate breakthroughs across critical energy, security, and scientific challenges. To learn more about how these AI capabilities can support your research initiatives, join us at the upcoming Google Public Sector Summit in October.

Key findings from the 2026 Public Sector M-Trends report and beyond

Mon, 13 Jul 2026 16:00:00 +0000

In 2026, the public sector is no longer defending a traditional perimeter. Instead, they are defending a complex web of interconnected trust relationships against adversaries that now operate at machine speed. We recently published the 2026 Public Sector Threat Landscape: M-Trends and Beyond report, which distills more than 500,000 hours of frontline incident investigations conducted by Mandiant in 2025, specifically tailored to the mission-critical needs of public sector leaders.

Key findings from the report and what they mean for the public sector

The most alarming trend in this year’s M-Trends data is the 22-second hand-off: the median time between an initial access broker establishing a foothold and the hand-off to a ransomware operator. This extreme compression of the attack cycle renders traditional, human-speed triage obsolete. When an infection on a municipal workstation can move to an encrypted network before a human analyst can even open a ticket, the strategic mandate for resilience must pivot toward machine-speed defense.

Additionally, the report uncovered several emerging "boundaries of trust" that adversaries are systematically exploiting:

The persistence paradox: State-sponsored espionage actors are pursuing multi-year persistence, with some remaining undetected for over five years. This "persistence paradox" directly challenges standard 90-day telemetry retention policies, often leaving agencies unable to quantify the full impact of a breach.
The virtualization stack: Attackers are moving "down the stack" to target the virtualization management plane. Techniques like "snapshot mounting" allow attackers to bypass guest-level security tools, creating snapshots of domain controllers to steal databases offline.
The SaaS domino effect: At the state and local levels, the reliance on third-party cloud tools has turned integrations into threat vectors. Exploiting non-human identities (NHIs) like service accounts and OAuth tokens allows a single compromise to trigger a chain reaction across an entire agency network.
The vishing surge: Voice phishing (vishing) has surged to 11% of global infections. These highly effective social engineering attacks target government help desks to reset passwords or enroll unauthorized devices. This proves that the ‘human element’—the administrative trust placed in help desk staff and IT administrators—is now a primary vector for establishing initial access.

A mandate for continuous verification

Looking ahead, resilience in the public sector will require more than a compliance checklist; it demands a cultural pivot to continuous verification—a security doctrine where trust is never assumed and must be constantly re-validated. Success is no longer just defined by the absence of a breach, but also by an agency’s ability to remain operational while under active attack. At Google, we provide the technical architecture to make continuous verification a reality through three core capabilities.

Identity as the new perimeter: Through Chrome Enterprise Premium, we replace traditional VPNs with context-aware access. We verify the user’s identity and the security posture of their device for every single application request, ensuring that access is only granted under the right conditions.

Agentic defense: We enable agencies to ingest and analyze massive telemetry datasets in real-time using Google Security Operations, which includes threat-centric case management, interactive, context-rich alert graphing, and automatic stitching together of entities. This allows for the "Machine-Speed" detection required to spot an adversary within the 22-second hand-off window, turning manual triage into automated, continuous monitoring. To stay ahead of these rapid shifts, this operational stack is directly infused with Google Threat Intelligence, exposing global actor infrastructure and matching internal telemetry with Mandiant’s frontline incident insights in real time.

At Google Cloud Next ‘26, we announced three new AI-powered autonomous agents within Google Security Operations: a Threat Hunting agent to proactively unearth hidden attack patterns, a Detection Engineering agent to automatically close telemetry coverage gaps, and a Third-Party Context agent to seamlessly enrich analyst workflows.

Hardened infrastructure: By moving "down the stack" with Security Command Center and leveraging our strategic partnership with Wiz, we offer deep visibility into the virtualization and cloud layers. This allows agencies to continuously verify the integrity of their hypervisors and cloud configurations, automatically detecting unauthorized "Snapshot Mounting" or configuration drifts that adversaries exploit for persistence. By hardening the administrative fabric—including identity and virtualization—and modernizing log retention to close the visibility gap, government leaders can move from a state of reactive triage to a future of context-aware resilience.

Google security in action

Google’s security technology comes to life across the public sector, where agencies are successfully shifting from manual triage to agentic defense, and accelerating their security transformation. The Pasco Sheriff’s Office transformed its security and operations, unifying siloed tools with Google Security Operations to boost efficiency, improve community safety, and champion secure AI for law enforcement. Meanwhile, the State of Connecticut moved from a fragmented operating model to a unified, proactive security posture using Google Security Operations to reduce forensic investigation times from months to mere hours and create a secure-by-design digital infrastructure for the future of public service.

Secure your future

Download the 2026 Public Sector Threat Landscape: M-Trends and Beyond report to explore the data and strategic recommendations for the latest insights and trends and what they mean for the public sector. Catch the replay of our Gemini for Government webinar to dive deeper into securing and governing an agent.

Gemini Enterprise for Education named a Commander in Tambellini StarChart™: 2026 AI Agents for Administrative Efficiency—Agent Platforms

Wed, 08 Jul 2026 15:14:00 +0000

The agentic AI era is here, transforming how higher education institutions innovate, operate, and fundamentally empower learners, faculty, and researchers. AI agents can deliver unprecedented efficiency, academic innovation, and mission effectiveness as institutions seek to diversify pedagogy, accelerate research, and automate campus operations.

That’s why we are proud to share that The Tambellini Group has named Gemini Enterprise for Education a Commander, the report’s highest category, in the Tambellini StarChart™: 2026 AI Agents for Administrative Efficiency—Agent Platforms, ranking first in innovation and usability. We believe this recognition underscores Google’s AI leadership position in the market, performant Gemini models, and agentic platform that is already being used to strengthen student support and drive new efficiencies across higher education.

The Tambellini StarChart states: "Gemini Enterprise for Education is differentiated by how much it brings together in one place. It combines Gemini models, agent-building tools, enterprise search, governance controls, and Google Cloud infrastructure in a single environment. For institutions that do not want to manage a mix of disparate tools, this creates a clearer path to building and managing AI services at scale."

Source: “StarChart™: 2026 AI Agents for Administrative Efficiency—Agent Platforms,” By Alpha Hamadou Ibrahim, PhD, April 2026

Drive impact with Gemini Enterprise for Education

Gemini Enterprise for Education brings together the best of Google’s AI-optimized cloud services, industry-leading Gemini models, and agentic solutions. It is a seamlessly integrated solution designed from the ground up for AI, built upon three core strengths:

A flexible, unifying foundation built on the Google Cloud stack: Gemini Enterprise for Education stands out because of the unmatched breadth of the surrounding Google Cloud stack. While many campuses are currently limited by siloed, single-task AI applications, Google’s platform enables institutions to establish a custom, unified architecture. In our view, this aligns with the report’s finding that Gemini Enterprise for Education "is best understood as part of a broader cloud AI environment rather than as a single packaged higher education application." By providing this holistic environment, the report notes that the platform offers "a familiar foundation for building conversational and agent-based services that can work across different interfaces, data types, and connected systems." We think this foundation gives institutions complete control to shape how agents are designed, integrated, and deployed across their campus.
Automating complex campus operations to shift focus to strategic oversight: Leveraging this flexible architecture, Gemini Enterprise for Education empowers institutions to handle complex administrative workflows and unify campus intelligence. By taking on multi-step tasks, AI agents allow institutions to shift their focus from manual administrative work to strategic oversight. We believe this is supported by the report’s analysis that the platform "can support administrative use cases such as advising, student support, and service operations" to "administrative efficiency across business, academic, and research operations." Tambellini also states that "simpler agents can be created through no-code tools, while more advanced use cases can be built through the Agent Development Kit and Agent Runtime," which we believe highlights the technical versatility of the platform, allowing campuses to easily design tailored solutions.
Empowering the entire campus with secure, governed AI agents: Beyond administrative efficiency, Gemini Enterprise for Education serves as the new front door to agentic AI for every student, faculty member, and researcher. Users are empowered to trade manual busywork for breakthroughs by deploying custom agents that provide 24/7 adaptive support for the academic journey. In our view, this is validated by Tambellini's focus on the platform’s connection to institutional data, stating that "agents can be grounded in sources such as productivity tools, content repositories, databases, and data platforms like BigQuery" and that features like "enterprise search and Deep Research extend this further by helping users find and synthesize information across connected internal sources." Crucially, as this technology scales, institutions are able to maintain trust. As the report highlights, "administrative controls, permission inheritance, role-based access, logging, and Model Armor help institutions manage access, oversight, and data protection within the same environment."

We believe our Commander placement in the Tambellini StarChart validates a decade plus of investments in AI, security and cloud to drive innovation and impact across teaching, learning and research.

Transforming campus operations

We are driving real-world impact across academia, helping them achieve enhanced operations and strategic progress. From automating complex campus workflows to advancing AI-enabled learning, our customers are seeing measurable benefits:

UC Riverside: UC Riverside implemented Gemini Enterprise for Education to provide a unified portal for agent experiences across its entire campus community of 25,000 students, faculty, and staff. For the personnel driving the university's mission, the focus is on augmentation. By using Google AI as a force multiplier, the ITS team is transforming how the university operates.
Purdue University: Purdue's broad AI strategy is centered on five core areas: learning with, learning about, researching, using, and partnering in AI. Google Cloud provides the flexible, AI-optimized tech stack needed to support this entire spectrum. Additionally, the platform, coupled with the creation of the new Google AI Hub space, is helping Purdue foster hands-on collaboration, automate campus operations, and advance AI-enabled education.

Build the agentic future with us

As higher education continues to evolve, agentic AI offers a path toward more resilient, efficient, and student-centered institutions. To explore how these capabilities are being evaluated across the sector and learn more about Google’s position as a Commander in the administrative efficiency category, download the report excerpt from The Tambellini Group.

Join us at the Higher Education Leader Series

We invite you to join fellow leaders and trailblazers at Google for Education’s Higher Education Leader Series to explore how technology and human-centric design come together to transform the university experience. We are hosting this event in Sunnyvale, CA, on July 16, and New York, NY, on July 30. Register here to secure your spot.

Google Cloud confirmed to offer a safer choice for EU public sector organizations with Dutch DPIA approval

Wed, 01 Jul 2026 16:00:00 +0000

At Google Cloud, we are committed to providing public sector organizations around the globe with cloud technology that is highly flexible, scalable, and built with market-leading standards for data protection, sovereignty, and security. We understand that for public sector organizations in the European Union, confidence in data protection is not just a preference — it’s a prerequisite.

Today, we’re excited to announce a major milestone that reinforces this commitment for Google Cloud.

Dutch government DPIA confirms strong privacy foundation for Google Cloud

We have successfully collaborated with SLM Rijk, the Dutch government's strategic vendor management agency, who completed their rigorous data protection impact assessment (DPIA) of Google Cloud.

This engagement confirms Google Cloud’s strong commitment to strengthening trust in its privacy posture across the Dutch public sector. Given that all the key points raised during the DPIA have been successfully addressed (see SLM Rijk’s summary here), and that their DPIA concluded that there are no known high data protection risks when the recommended measures are implemented, the Dutch central public sector is now officially enabled to use Google Cloud with a clear path from a privacy-assessment perspective.

Accordingly, we encourage Dutch central public sector prospects and customers to engage with us to learn more about Google Cloud.

More broadly, we believe this outcome provides a strong foundation for public sector organisations across the Netherlands and beyond, to confidently evaluate and adopt Google Cloud, unlocking modernization and digital transformation securely.

This achievement builds upon our strong track record in the region, including the successful completion of the Dutch DPIA on Google Workspace. This previous success affirmed the safe use of Workspace across the Dutch public sector and educational institutions. Together, these assessments demonstrate Google's continued commitment to helping public sector organisations meet their privacy, security, and compliance requirements while benefiting from the innovation and scalability of Google Cloud.

Continued support for all customers on their compliance journeys

We welcome independent assessments that help strengthen trust, transparency, and accountability. The Dutch government's DPIA process represents an important example of constructive collaboration between public institutions, independent experts, and cloud providers to advance privacy protections.

Google Cloud remains committed to helping customers meet their compliance obligations while providing secure, transparent, and privacy-conscious cloud services.

We will continue investing in privacy-enhancing technologies, transparency initiatives, and customer controls to support organisations across Europe and around the world.

We know first-hand that conducting DPIAs can be a complex task, and we remain firmly committed to helping our customers navigate DPIAs with resources at our comprehensive DPIA Cloud Resource Center.

Gemini for Government: Your blueprint for mission impact

Tue, 09 Jun 2026 17:00:00 +0000

The public sector has reached a critical inflection point. For years, organizations have explored what’s possible through isolated AI pilots and experimentation. Today, the question has shifted to “what creates impact?” where the focus is no longer on hypotheticals, but on achieving real productivity gains, improving services and outcomes, and advancing your mission - right now. Meeting this moment requires more than just a powerful model—it requires an integrated approach with the security, reliability, scale, and cost-efficiency that public sector missions require.

Today, public sector organizations are moving swiftly from AI assistants and chatbots to a full-scale agentic taskforce - here’s how they are doing it.

Building on a unified foundation

To move AI and agents into production at scale, you need to remove the friction of integration. Google Cloud offers a complete AI stack designed to work as one unified system. We believe this integrated stack is the engine for true transformation in the agentic era.

Let’s take a closer look at this integrated stack:

It all starts with the AI Hypercomputer — our purpose-built infrastructure foundation is optimized for the physics and scale of the agentic era, and powered by both GPUs and TPUs. We continue to invest in our portfolio and made several announcements at Cloud Next ‘26 including the launch of our eighth-generation TPU and updates to our cross-cloud infrastructure which includes new innovations across fluid compute, secure cross-cloud connectivity, the unified data layer and digital sovereignty.
We deliver research from Google DeepMind as well as frontier models to provide intelligence with speed and efficiency. We offer choice across Google’s leading models like our recently announced Gemini 3.5 alongside other open and third-party options.
Our agentic data cloud grounds your AI in trusted real-time organizational truth and context. We help you build a 'system of action' with our latest breakthroughs announced at Cloud Next ‘26 including the Cross-cloud Lakehouse and Knowledge Catalog.
With our agentic defense you get zero-trust protection that secures your entire AI lifecycle from code to cloud. To help you navigate the agentic era securely, we recently launched Google AI Threat Defense — an automated security system designed to help you continuously monitor for and stop AI-powered threats before they can impact your organization.
At Cloud Next ‘26 we unveiled Gemini Enterprise Agent Platform, our comprehensive platform to build, scale, govern and optimize agents with architectural rigor. This platform brings together model selection, model building, and agent building capabilities with new features for agent integration, development, orchestration, and security.
All of this comes together at the top with pre-built specialized agents and applications that are ready to transform your organization from day 1. We announced new capabilities at Cloud Next ‘26 including Workspace Intelligence - a secure and dynamic system that inherently understands complex semantic relationships within your Workspace apps (such as Docs, Slides, or Gmail), your active projects, your collaborators, and your organization's domain knowledge.

Delivering uncompromising security and control

For many public sector organizations, security is the mission. This new era of mission-ready and secure AI is defined by the ability to work across silos and legacy systems. IT system administrators have access to a built-in AI Control Dashboard—a single pane of glass to centrally visualize, secure, and audit the organization’s entire AI estate. Through Agent Registry, administrators maintain complete visibility into active agents and their grounded data sources, ensuring that every interaction stays within the strict guardrails of agency policy and security mandates. Model Armor provides comprehensive protections against prompt injection, sensitive data leaks, and harmful content. Built on a Zero Trust foundation, Gemini for Government includes FedRAMP High-authorized security and compliance features and is backed by a Data Privacy Guarantee stating that Google does not train its foundational models on customer data. At Google Cloud Next ‘26, we introduced new development tools to secure AI-generated code and mitigate the risk of shadow AI, and also shared how we are protecting AI and cloud apps across any infrastructure with Wiz.

Scaling agents across the organization

In order to realize AI’s true potential, it must be in the hands of your people — caseworkers, inspectors, analysts and more. Google Public Sector was proud to be the first technology provider to offer an enterprise AI tool, Gemini for Government, through GenAI.mil to more than three million civilian and military personnel. We recently introduced a new feature within Gemini for Government on GenAI.mil called Agent Designer which enables DoW civilian and military personnel to build their own agents to support unclassified work tasks.

With Agent Designer, non-technical users can build sophisticated AI agents using natural language through no-code interfaces. Our goal is to provide the tools to empower everyone in the organization to build and use agents that connect securely to existing systems and enterprise applications. This is all about using AI and agents to automate manual and time consuming tasks, improve productivity, and ensure you and your teams can apply your experience and judgment to the most critical aspects of your work.

Achieving tangible ROI

According to our recent ROI of AI in the public sector report, agentic and generative AI is already helping public sector teams get more done. According to our findings, 70% of public sector leaders report improved productivity from gen AI. Of those reporting productivity, 46% say employee productivity has at least doubled. This directly translates into faster response times, more efficient public services, and overall better outcomes. Gemini Deep Research Agent and NotebookLM are force multipliers for the public sector, transforming how complex research, deep work and analysis is conducted.

Your blueprint for mission impact

With Gemini for Government, you are able to move beyond AI exploration and pilots, to real world applications and agents - at scale. This is all about applying technology to amplify human capacity, accelerate strategic decision-making, and advance your mission.

Register to attend our Gemini for Government webinar on June 11 where we’ll dive deeper into how to leverage data, security, and an integrated AI stack. Whether you are looking to scale day-one use cases across your organization, empower your internal champions, or are just getting started, you will leave with a clear path forward to drive impact and advance your mission today.

How the University of Central Oklahoma is using AI to streamline analysis of complex criminal cases

Thu, 28 May 2026 19:00:00 +0000

In the high-stakes world of forensic science, time is the enemy of justice. The University of Central Oklahoma (UCO) Forensic Science Institute (FSI) was looking for an innovative AI solution that could help reduce the time required to analyze complex criminal case documents and construct clear timelines. In early tests, this solution, which can typically take criminal investigators months, has been demonstrated to significantly reduce this time.

This collaboration between Google Public Sector and UCO’s technology and forensic experts establishes a path for a new standard for accelerating the pursuit of justice across the country and provides powerful efficiency gains.

A new vision for the pursuit of justice

This project, which originated in an AI hackathon sponsored by the university’s CIO Sonya Watkins, centers on Google's NotebookLM, an AI research tool used by the university as a thinking partner for the review of complex criminal cases. Sonya Watkins, CIO, University of Central Oklahoma and I co-led the hackathon with the goal of rapidly identifying and prototyping high-impact solutions for the university, while providing the technical framework, and brought expertise in rapid prototyping to quickly translate complex criminal case requirements into a functional, evidence-backed digital application. During the hackathon, teams generated ideas, which were then stack-ranked using Gemini, based on potential impact and feasibility, quickly identifying the case timeline analysis as a high priority use case.

The enthusiasm is absolutely warranted. We’ve seen a process that was a months-long burden reduced significantly in our trials. The human expert remains the critical validator, but we're now equipping them with an exponential speed advantage. Sonya Watkins
CIO, University of Central Oklahoma

Building a scalable framework on a trusted foundation

The UCO team, including FSI Instructors Meagan Raddatz and Amber Fortney, have been meticulously working to ensure that the AI-generated timelines are forensically sound and meet stringent standards required for the federal and state justice systems.

Their ongoing work focuses on developing a repeatable case analysis framework using Google’s NotebookLM intended for potential future national adoption. This framework is engineered to ensure that every AI-generated conclusion is directly cited back to the original source document, a critical requirement for maintaining evidence integrity. By automating document analysis and creating a measurable process, UCO is setting a new national standard for how forensic institutes and law enforcement agencies can operate.

Our goal wasn’t just to solve our internal problem; it was to build a framework that other forensic institutes and law enforcement agencies could adopt seamlessly. By focusing on standardized processes and reliable citation, we believe we are creating a scalable solution that has the potential to significantly accelerate how evidence is processed nationwide, aiding the delivery of justice. Amanda Keesee
IT Director for Academic and Research Technology Center, University of Central Oklahoma

Bring AI-powered research to your institution at no cost

Bring AI-powered research to your campus with Gemini for Education to transform how your teams learn, work, and innovate. By exploring NotebookLM within the Gemini ecosystem, you can equip your researchers with the same tools driving UCO’s success in reducing complex data analysis from months to days, right now.

The agentic era: Architecting the blueprint for mission impact across the public sector

Tue, 19 May 2026 19:00:00 +0000

This is a new era — the agentic era – and the question is no longer, “what’s possible?” but rather, “what creates impact?” Today, organizations across industries around the world are swiftly moving from AI exploration and pilots to real-world use cases that drive impact, at scale. They are doing this with agents. In order to fully meet this moment, and seize the opportunities in this agentic era, we need leadership. To that end, I was honored to share the stage at Google Cloud Next with visionary leaders from the U.S. Food and Drug Administration (FDA), the U.S Department of Transportation (DOT) and the City of Los Angeles who shared how they are disrupting the status quo and driving lasting impact for their organizations and the people they serve. Let’s take a closer look at their stories.

The U.S. Department of Transportation: Strengthening the safety and reliability of our nation’s transportation systems

Pavan Pidugu, the Chief Digital and Information Officer at the U.S. Department of Transportation (DOT), is empowering staff with cloud-based productivity and collaboration tools as the first-cabinet level federal agency to fully transition their workforce away from legacy providers to Google Workspace with Gemini. “Twenty-two days. That’s what it took for us to create a production environment with Google Workspace,” Pavan asserted. In less than six months, the agency migrated more than one billion emails. This transition to Workspace has enabled staff to work smarter and faster, ultimately strengthening the safety and reliability of our nation’s transportation systems.

The U.S. Food and Drug Administration: Accelerating cures and meaningful treatments that benefit everyone

Jeremy Walsh, the Chief AI Officer at the U.S. Food and Drug Administration (FDA), is leveraging agentic AI to accelerate the delivery of life-saving cures, achieving a 80% AI adoption rate across its 18,000-person workforce. “By using AI agents to move the agency toward a real-time regulatory environment, the FDA is compressing decades-old workflows,” underscored Jeremy. While the traditional drug development process can take ten years, the agency now uses AI to analyze candidate data against vast historical datasets in minutes – shrinking 60-day filing reviews down to a matter of hours. This mission to halve the overall time to market for new drugs directly translates into saving more lives.

The City of Los Angeles: Building the technological foundation to serve residents and visitors

Ted Ross, the Chief Information Officer for the City of Los Angeles, is facing a massive logistical challenge: preparing for the 2026 World Cup, the 2027 Super Bowl, and the 2028 Olympic and Paralympic Games. With 15 million visitors expected for the Olympics alone, the city is scaling AI across its 45 departments and 27,500 employees. “The world is going to be looking at Los Angeles, and the reality is you need force multipliers,” Ted articulated. “You need tools like AI, which don’t replace our workforce, but amplify their ability to deliver world-class customer service and the essential functions to run events of this scale.” The City of Los Angeles is embedding Gemini directly into the tools employees use every day to deliver faster, more accessible services for visitors, as well as the city’s four million residents who speak more than 224 languages.

Your blueprint for agentic transformation

These leaders are creating the blueprint for agentic transformation by leveraging AI and agents as a force multiplier to empower their workforce, unlock new levels of productivity, and transform how services are delivered. As evident from these leaders, moving from exploration and pilots to full-scale adoption requires a thoughtful and strategic approach, centered on three critical pillars:

Empower leaders and teams to disrupt the status quo: Transformation requires a cultural shift where leaders and teams are empowered to disrupt the status quo, take calculated risks, and move with speed. As demonstrated by Pavan Pidugu of the DOT, the goal is to ignite a spirit where teams can harness technology to create results in days, not years.
Scale for lasting impact: Moving from AI pilots to agency-wide adoption requires bold leadership. Jeremy Walsh shared how the FDA is empowering its workforce – from reviewers to scientists – with AI and agents to protect public health and accelerate life-saving treatments. As Walsh articulated, agents act as force multipliers, moving the agency beyond document-heavy processes to a state where they can analyze all available data simultaneously. This approach allows the FDA to compress review timelines and solve mission-critical challenges at scale.
Prioritize human-centered adoption: Transformation is fundamentally a “people project” that succeeds by solving immediate employee pain points within existing tools. Ted Ross from the City of Los Angeles shared that by embedding AI into daily workflows, leaders can turn skeptics into champions through small wins that create organizational momentum. This approach raises the collective digital IQ, and ensures that the city can upskill their workforce while delivering faster, more accessible services for residents and visitors alike.

Your mission partner

We are so proud that Google Public Sector is the partner that organizations turn to as they move from AI pilots to total agentic transformation. We believe that bold leadership, coupled with our integrated stack built on a foundation of security, openness and scale, is what makes this kind of transformation possible. We invite you to register to attend our Gemini for Government webinar on June 11 where we’ll dive deeper into the blueprint for transformation and mission impact in the agentic era.

Smart moves: Building resilient transportation systems with Google AI

Wed, 13 May 2026 16:00:00 +0000

What does transportation mean to you? For some, it’s making sure the train is on schedule so they can get to work on time. Maybe it’s making sure you have time connecting between flights. Maybe it’s about a stress-free commute. For others it’s the pleasure of walking around our cities or biking on trails. We all have our own individual transportation story, and for the thousands of transportation agencies and the millions of people working in the transportation sector, their key mission is safety. We believe AI can fundamentally advance ‘Vision Zero’ - a goal to reduce fatalities in transportation, build and maintain resilient systems, connect people, while also planning for the future.

Building the blueprint for safe, resilient, and efficient transportation systems

From moving millions of commuters across a city or deploying critical supplies, Google is committed to being the partner that helps people move faster, safer, and more efficiently. Google’s investments in transportation include expanding its cloud solutions and developing new data and models to ‘see’ the world. Some of our latest transportation innovations include:

Road Management Insights (RMI): Google Maps now provides high-accuracy travel time, speed, disruption, and vehicle count data across road networks without the need for physical sensors. By leveraging RMI travel time data, agencies can identify incidents before the first emergency services call, analyze long-term congestion trends, improve urban planning, and identify safety hotspots and crash-prone areas.
Mobility AI Traffic Simulation API: Coming from Google Research, Mobility AI provides a powerful digital twin to help agencies visualize the future of their road networks. In this virtual environment, city planners can "test drive" infrastructure changes before a single cone is placed on the road. Whether it is Seattle optimizing traffic routes during major events or agencies proactively visualizing new bike lanes and road infrastructure to seek public feedback, watch how cities are using these simulations to build more efficient and resilient communities.
Preventing crashes before they happen: By combining AI simulations, machine learning models, advanced models, and RMI data, states like California and Hawaii are able to detect where crashes would take place before they even happen, which can help save lives.

I recently had the opportunity to sit down with three leading voices in transportation - Carlos Braceras, Executive Director, Utah Department of Transportation (DOT), Toks Omishakin, Secretary, California State Transportation Agency (CalSTA), and Anant Dinamani, Principal at Deloitte Consulting LLP. Together. We discussed ideas for building resilient transportation systems with AI and shared our blueprint for building safe, resilient, and efficient transportation systems of the future. Here are a few takeaways from our conversation.

The ultimate goal: Saving lives

The single most important goal for any transportation agency - safety. With roadway fatalities remaining high, the shift from reactive to proactive safety measures is paramount. Secretary Toks Omishakin of CalSTA highlighted California’s Roadway Safety Insights (RSI) tool, developed with Deloitte and Google Cloud. By integrating over 30 different datasets, RSI condenses weeks of analysis into minutes. The goal is to move beyond fixing intersections after crashes occur to predicting and mitigating risks before they happen.

Leveraging technology for safe and seamless journeys

Carlos Braceras of Utah DOT shared that he’s thinking about how we create the journey that people want to take - allowing people to go where they want, when they want and how they want - and doing it safely. He underscored the focus on saving lives and making people’s lives better. From our conversation, it’s clear that we’re at an inflection point in terms of the ability to make better and faster decisions, and build trust. Carlos emphasized that technology, including AI, is the crucial enabler here.

Getting your data ready for AI

This biggest challenge facing transportation agencies is siloed and fragmented data. According to Anant Dinamani of Deloitte Consulting LLP, we're at an inflection point - and the future is about integration. Agencies must rethink how they manage their data, and take a foundational step to create a single source of truth—this is essential to maximize the value of AI and agents. Anant stressed that progress will stall if we don't anchor everything on trusted data—understanding its origin, identifying potential bias, and ensuring secure integration - this is the key to realizing the full potential of AI.

Let’s build the future together

Register to attend our Best of Next Public Sector Webinar for a deep dive into the Next sessions and announcements that matter most to the public sector. Join us at ITS America in Detroit from June 9-12, where our experts will be on the ground to provide live demos and discuss how Google's AI-powered solutions can help build transportation systems of the future, right now.

The new era of SaMD: Why cloud infrastructure is the foundation for digital health in 2026

Wed, 13 May 2026 16:00:00 +0000

In the healthcare and life sciences industries, speed saves lives, but meeting regulatory requirements and other administrative burdens often pumps the brakes for manufacturers of software as a medical device (SaMD). These devices include AI image analysis for cancer detection, diagnostic mobile apps for viewing MRIs, and software that can calculate insulin dosages.

Today, the medical device industry stands at an inflection point. We’re moving from reactive diagnostics to proactive, prognostic learning systems. Modern SaMD is a composite system where clinical functionality emerges from the interaction of embedded firmware, mobile apps, and cloud-resident services.

This shift requires a fundamental reimagining of how we demonstrate a state of control. More than just an alternative to on-premises servers, cloud infrastructure has become a superior foundation for regulated medical software.

The regulatory landscape of 2026: FDA QMSR and the EU AI Act

The regulatory environment in early 2026 is defined by a shift toward international harmonization and risk-based oversight. For organizations operating globally, two major milestones dominate the compliance roadmap.

The FDA QMSR Transition
The FDA aligned the Quality Management System Regulation (QMSR) 21 CFR Part 820 with ISO 13485:2016 earlier this year, reinforcing the value of cloud-native patterns that automate document control and change management.

Under the new Inspection of Medical Device Manufacturers Compliance Program, the FDA has moved away from the old Quality System Inspection Technique (QSIT) subsystems in favor of a risk-based strategy that prioritizes areas including change control and outsourcing. In this model, digital retention and automated audit trails are now recognized as primary objective evidence, reducing the industry's reliance on manual paperwork.

The EU AI Act Applicability
As of August 2, the European Union AI Act enters the full applicability phase for high-risk obligations in AI systems. For SaMD manufacturers, these requirements introduce rigorous data governance, transparency, and human oversight for medical devices.

The shift to Compliance as Code

We believe that in a world of continuously updated device platforms, the manual administrative control model doesn’t scale. Instead, we should embrace Compliance as Code (CaC). Five years ago, CaC was a competitive advantage, but today it’s a regulatory necessity.

In this model, compliance is expressed programmatically and enforced declaratively in the system. Because controls are implemented as platform policies, change control can be enforced at the pipeline gate, and evidence is generated operationally as a continuous byproduct of how the system runs. Since the system can’t operate outside its defined controls, we’re able to produce a persistent, defensible record for regulators.

The technical blueprint: The three-plane model

To achieve this state of continuous audit readiness, we organize our architecture into three distinct planes. This separation clarifies the distinction between technical enforcement and regulatory accountability.

1. The data plane covers how clinical or device data moves through the system to deliver its medical purpose — whether that is physiological telemetry from a wearable or medical images for diagnostic analysis. In Google Cloud, this plane handles functional boundaries and ensures data integrity through encryption at rest and in transit. We use Customer Managed Encryption Keys (CMEK) and Key Access Justifications to ensure the manufacturer retains ultimate control over decryption events, a critical requirement for HIPAA and GDPR compliance.

2. The control plane is the governance layer. It defines identity, network boundaries, and configuration constraints. In the 2026 architecture, the control plane uses Zero Trust principles. Instead of relying on a network perimeter, access is granted through Identity Aware Proxy (IAP) after evaluating the user's identity, device security posture, and context. We also use the Organization Policy Service to programmatically prevent non-compliant configurations, such as the accidental creation of public data buckets.

3. The evidence plane is where technical operations meet regulatory proof. It captures immutable audit trails, build attestations, and monitoring history. By using tools like Binary Authorization and Artifact Registry, we can mathematically prove that only code that has passed all security and validation gates is allowed into production. This plane generates the software bill of materials (SBOM) and provenance metadata required by the FDA.

Scaling for the agentic enterprise

As AI matures from answering questions to reasoning and taking action, AI agents can assist with autonomous compliance monitoring, replacing weeks of manual review with continuous oversight while providing human-in-the-loop triggers for final quality sign-off.

Google's AI-optimized infrastructure provides the backbone for innovation, where nodes and pods start up faster and models load quicker, helping to ensure that SaMD agents are ready the moment a clinician or patient engages with the system. This responsiveness is essential for clinical scenarios where latency can affect patient outcomes.

Managing risk in the cloud

Adopting cloud infrastructure does not remove a manufacturer's responsibility for safety and performance. However, it changes the implementation model from shared responsibility to shared fate — where the cloud provider provides the technical primitives (like Assured Workloads for data residency) while the manufacturer configures them to implement their specific quality system.

As we detail in our new whitepaper, Building Software as a Medical Device (SaMD) on Cloud Infrastructure, shared fate provides a superior model to address common SaMD risks:

Policy drift: Enforcing organizational policies to prevent disallowed regions or weak IAM settings.
Audit visibility: Implementing non-repudiable Data Access Logs and Key Access Justifications (KAJ) to ensure every interaction with sensitive clinical data is captured as immutable evidence for long-term retention.
Supply chain integrity: Using cryptographically signed attestations to prevent unverified artifacts from reaching production.

You can read the full report here.