Google Cloud today showcased a major expansion of its cybersecurity portfolio, centered on agentic artificial intelligence and deeper threat intelligence integration.

The announcements, made at the RSAC conference in San Francisco, see Google aggressively advancing a unified, AI-driven security platform designed to operate at machine speed as cyber threats become faster, more automated and more sophisticated.

As part of that push, Google also repeated today that it has completed its acquisition of Wiz Inc., a company known for its agentless approach to identifying risks across cloud environments. Google plans to integrate Wiz’s technology into its broader platform to create an AI-ready security solution that spans multicloud infrastructure to simplify security operations for organizations while enabling faster detection and response to threats.

Agentic SOC

Building on that foundation, leading the list of announcements is a strategy described as an “agentic security operations center” powered by its latest Gemini AI models. Google is introducing adaptive AI agents that can investigate alerts, synthesize intelligence and assist in remediation workflows in real time, which replace the need to rely on static playbooks.

The new Triage and Investigation agent is designed to autonomously analyze alerts, gather supporting evidence and deliver reasoned verdicts to help security teams reduce response times and cut through growing volumes of false positives. The new agent is now available in preview within Google Security Operations.

Google is also extending its agentic approach by allowing customers to build their own enterprise-ready security agents through support for Model Context Protocol servers. The capability removes the need for organizations to host their own MCP client infrastructure to deliver unified governance and control over custom agents, with general availability expected in early April.

Countering AI attackers

The push toward agentic AI comes as Google highlights a rapidly evolving threat landscape in its newly released Mandiant M-Trends 2026 report.

The report details how attackers are reducing the window for defenders to respond from hours to as little as 22 seconds. Adversaries were also found to be moving beyond experimentation of AI to deploying adaptive tools and autonomous agents capable of modifying their own behavior during attacks.

To counter the shift identified in the Mandiant report, Google is placing greater emphasis on integrating frontline threat intelligence directly into security workflows.

Google Threat Intelligence is seeing upgrades today, with new agentic capabilities that shift the burden of data synthesis and initial artifact triage to a specialized suite of AI agents built with the newest Gemini models. With the upgrades, analysts can now move beyond the “cognitive limit” of manual research to focus on what matters most in their unique environment.

To move teams further from manual triage to agentic defense, Google is also introducing dark web intelligence in Google Threat Intelligence. The new service sees Google Threat Intelligence Group analysts help provide essential context that grounds Gemini’s capabilities, with the capability building on this expertise while using the newest Gemini models to autonomously build a nuanced profile of an organization.

Securing AI systems

Along with detection and response improvements, Google today also announced that it is expanding its capabilities for securing AI systems.

New features include AI Protection in Security Command Center, service that works with Vertex AI to detect threats targeting AI agents and updates to Model Armor that are designed to defend against risks such as prompt injection, sensitive data leakage and tool manipulation. Another new release, Enhanced Sensitive Data Protection, adds new AI-powered classification capabilities to better identify and safeguard critical information.

Beyond securing AI systems, Google is also expanding protections across its broader cloud and enterprise infrastructure.

The company also previewed external exposure management within Security Command Center, which provides an outside-in view of cloud environments that identifies exploitable vulnerabilities and maps the network paths that enable potential attacks.

Google’s Cloud and Chrome Enterprise offerings are also getting new updates today to strengthen policy enforcement and data protection across distributed environments. New features include new firewall policy controls, expanded web application security features and enhanced protections for enterprise browser usage, particularly in environments involving virtual applications and unmanaged devices.

With the announcements today, Google is betting that as attackers increasingly leverage AI to accelerate and scale their operations, defenders will need equally advanced tools that can operate continuously, adapt to new threats and reduce reliance on manual processes.

Photo: SiliconANGLE