Google Cloud Unveils AI Threat Defense Built on Deep Enterprise Context

Google AI Threat Defense Brings AI-Native Security to Enterprises

Google Cloud has unveiled a new AI-powered cybersecurity platform, Google AI Threat Defense, built on deep enterprise context to help organizations detect, prioritize, remediate, and monitor cyber threats at machine speed. Introduced through its latest Cloud CISO Perspectives, the platform combines Gemini, Wiz, Mandiant, and CodeMender into a unified AI-native security framework.

Artificial intelligence is rapidly reshaping cybersecurity. While attackers are using AI to automate phishing campaigns, generate malware, create deepfakes, and even develop zero-day exploits, Google Cloud argues that defenders now possess a unique advantage through the deep operational context already available across enterprise environments.

According to Francis deSouza, Chief Operating Officer of Google Cloud and President of Security Products, the future of cybersecurity depends on AI-native platforms capable of understanding every asset, identity, application, workload, and developer workflow across an organization.

AI Is Accelerating Cyberattacks at Machine Speed

Cybercriminals have rapidly embraced artificial intelligence to improve both the speed and sophistication of attacks.

Google recently documented what it describes as the first known AI-created zero-day exploit, demonstrating how generative AI can assist attackers in discovering previously unknown software vulnerabilities. Although Google successfully prevented the exploit from being used before deployment, the incident highlights how AI is reshaping offensive cyber capabilities.

Even more concerning is how AI agents are reducing attack timelines.

According to Google, only one year ago attackers typically required nearly eight hours to move from the first stage of an attack to the second. Today, automated AI agents can complete that transition in just 22 seconds, leaving security teams with dramatically less time to detect and respond.

This evolution is changing the economics of cybersecurity.

Traditional manual investigations and fragmented security tools struggle to keep pace with autonomous attackers operating continuously around the clock. Organizations increasingly need AI-powered systems capable of responding at machine speed rather than relying solely on human intervention.

Why Deep Enterprise Context Gives Defenders the Advantage

For decades, cybersecurity has favored attackers because they only needed to find one successful weakness while defenders were expected to protect every possible attack surface.

Google believes AI fundamentally changes this equation.

Enterprise defenders already possess extensive operational context, including asset inventories, identity relationships, cloud infrastructure, application dependencies, runtime telemetry, development pipelines, and historical security events.

Previously, this information existed across dozens of disconnected security products.

Modern AI systems can now correlate these datasets into a single operational picture, allowing organizations to identify relationships and attack paths that individual security tools often miss.

This contextual intelligence enables AI to distinguish genuine business risks from low-priority alerts, reducing alert fatigue while accelerating investigation and remediation.

The Attacker Versus Defender Comparison

Google summarizes today's cybersecurity landscape by comparing the capabilities of attackers and defenders.

Google argues that AI allows defenders to finally capitalize on the operational knowledge they already possess, transforming context into a competitive security advantage.

Introducing Google AI Threat Defense

To operationalize this strategy, Google Cloud introduced Google AI Threat Defense, a platform that integrates several of Google's major security technologies into a unified ecosystem.

The platform combines:

• Gemini for advanced AI reasoning

• Wiz for cloud security posture management and attack path analysis

• CodeMender for AI-generated code remediation

• Mandiant for global threat intelligence and incident response

Instead of operating independently, these technologies continuously exchange contextual information to identify vulnerabilities, prioritize risks, recommend secure fixes, and monitor production environments.

The objective is to create an autonomous security lifecycle capable of preventing vulnerabilities before they reach production.

The Four Stages of AI Threat Defense

Google structures its AI-powered security strategy around four continuous stages.

1. Prepare

Preparation focuses on understanding an organization's complete attack surface before vulnerabilities emerge.

Using Wiz, organizations map:

• Internet-facing assets

• APIs

• Cloud workloads

• Runtime environments

• Identities

• Application dependencies

The Wiz Red Agent simulates attacker behavior to identify potential attack paths before adversaries can exploit them.

2. Scan and Prioritize

Traditional vulnerability scanners often overwhelm security teams with thousands of alerts.

Google replaces this model with AI-assisted prioritization.

Lighter AI models perform broad vulnerability scans, while Gemini's advanced reasoning capabilities analyze high-risk findings in greater depth.

This enables organizations to focus resources on vulnerabilities that present genuine business risk rather than every detected issue.

3. Remediate

Finding vulnerabilities is only part of the challenge.

Google integrates CodeMender directly into developer workflows through IDEs and command-line interfaces.

The platform can:

• Generate secure code fixes

• Recommend safer programming practices

• Support memory-safe migrations

• Accelerate vulnerability remediation

This reduces manual effort while enabling organizations to deliver secure software more quickly.

4. Monitor

Security does not end after deployment.

AI agents continuously monitor:

• Network activity

• Identity behavior

• Application telemetry

• Cloud infrastructure

• Runtime anomalies

When integrated with Google Security Operations, organizations can rapidly detect unknown threats and respond to zero-day attacks or vulnerabilities that cannot be patched immediately.

Morgan Stanley Demonstrates the Impact

Google highlights Morgan Stanley as an example of AI-powered security transformation.

Working alongside Google Cloud and Wiz, the financial institution implemented the four-stage AI Threat Defense framework to modernize its security operations.

According to Google Cloud, the results included:

• 99.9% reduction in mean threat detection time

• Detection reduced from approximately 45 minutes to under 90 seconds

• Proactive vulnerability management

• Continuous cloud security monitoring

• Reduced dependence on fragmented security tools

The case demonstrates how integrated AI security platforms can significantly improve operational efficiency while reducing response times for large enterprises.

Human Oversight Remains Essential

Although Google emphasizes autonomous AI agents, it does not advocate replacing human security professionals.

Instead, the company promotes a human-supervised AI model where specialized agents automate operational tasks while analysts retain strategic control.

Within Wiz, different AI agents perform distinct responsibilities:

• Red Agent performs automated penetration testing.

• Blue Agent investigates threats and assists incident response.

• Green Agent accelerates cloud remediation.

Human analysts continue overseeing critical decisions, validating AI recommendations, and maintaining governance across security operations.

This collaborative approach allows organizations to eliminate operational backlogs without sacrificing accountability or compliance.

Zero Trust Must Expand to AI

As organizations deploy more generative AI systems internally, Google warns that new risks are emerging from unauthorized AI deployments.

Employees increasingly download public models or deploy autonomous agents outside approved IT environments, creating what Google describes as shadow AI.

These activities can introduce risks such as:

• Shadow AI deployments

• Data poisoning

• Logic manipulation

• Governance failures

• Compliance violations

• Sensitive data exposure

To address these challenges, Google recommends extending Zero Trust principles to AI by enforcing approved architectures, monitoring AI workloads, validating identities, and applying governance policies throughout the AI lifecycle.

Security by Design, Not as an Afterthought

Google reinforces its long-standing philosophy that security should be embedded into infrastructure rather than added later.

According to the company, its secure-by-default architecture blocks nearly 15 billion unwanted emails every day while protecting billions of users across Google services.

The same philosophy underpins Google's AI strategy, where security controls are integrated directly into cloud infrastructure from the beginning instead of being added after deployment.

Additional Security Announcements

Google Cloud also highlighted several related security initiatives, including new integrations with Wiz, Mandiant research, FinOps guidance for AI-powered security operations, Infrastructure-as-Code security improvements, software-defined vehicle security, AI Bills of Materials through k8s-aibom, and expanded threat intelligence research covering AI coding assistants, residential proxy networks, and nation-state activity.

Google also published new threat intelligence research covering Russian influence operations, residential proxy network disruptions, AI coding assistant vulnerabilities, Turla malware research, and Active Directory Federation Services certificate security.

The Future of AI-Powered Cyber Defense

Artificial intelligence is reshaping cybersecurity on both sides of the battlefield. While attackers continue to automate exploits, phishing campaigns, and malware development, Google Cloud believes defenders possess the stronger long-term advantage because they control the one resource attackers never fully have: deep enterprise context.

By combining contextual intelligence, autonomous AI agents, cloud-native visibility, continuous monitoring, and AI-driven remediation into a unified platform, Google AI Threat Defense aims to help organizations move beyond reactive security toward proactive, machine-speed defense.

As AI adoption accelerates across enterprises, Google Cloud believes cybersecurity will increasingly rely on AI-native platforms that combine deep enterprise context, automation, and human oversight. If that vision proves successful, the defender's greatest advantage may no longer be speed alone, but the ability to transform organizational context into real-time security intelligence.