Google LLC today rolled out a sweeping set of security updates at Google Cloud Next ’26, including three new artificial intelligence agents in Google Security Operations and a major expansion of Wiz Inc. coverage across rival clouds and agent-building platforms.

The announcements span agentic defense, cloud workload protection, identity, data security and the company’s reCAPTCHA-derived fraud platform.

The updates and new releases come as new research from the Google M-Trends 2026 report found that the time between an initial intrusion and handoff to a secondary threat actor has collapsed from eight hours three years ago to just 22 seconds. “The AI era demands a new security era,” Francis deSouza, chief operating officer of Google Cloud and president of security products, said in a blog post announcing the updates.

Leading the list of announcements are three new Security Operations agents that are entering preview alongside an existing Triage and Investigation agent that Google says processed more than 5 million alerts in the past year, cutting a typical 30-minute manual analysis to 60 seconds.

A new Threat Hunting agent is designed to proactively look for novel attack patterns and stealthy adversary behavior that bypass traditional defenses, while a Detection Engineering agent identifies coverage gaps and creates new detections for specific threat scenarios. The third agent, a Third-Party Context agent, enriches analyst workflows with data pulled from external content sources.

Google also said remote Model Context Protocol server support for Google Security Operations is now generally available, with direct MCP client access from the Security Operations chat interface in preview.

Dark web intelligence has been added to Google Threat Intelligence in preview, with internal testing showing 98% accuracy when analyzing what the company described as millions of daily external events.

New partner integrations for Google Security Operations include Darktrace plc, Gigamon Inc. and SAP SE.

Wiz expansion

Wiz, the Israeli cloud security firm Google acquired earlier this year, is expanding its coverage to Databricks Inc. and to a clutch of agent-building platforms, including Amazon Web Services Inc.’s AgentCore, Google’s own Gemini Enterprise Agent Platform, Microsoft Corp.’s Azure Copilot Studio and Salesforce Inc.’s Agentforce.

Wiz has also added integrations with Google Cloud Apigee, Cloudflare Inc.’s AI Security for Apps and Vercel Inc.

Several new Wiz capabilities also target the AI-native development lifecycle.

A planned integration with Lovable AB will run Wiz scans inside the platform, surfacing vulnerabilities and misconfigurations in Lovable’s built-in security view. Inline AI security hooks plug into integrated development environments and agent workflows to evaluate prompts and scan generated code before it is committed and a dynamic AI Bill of Materials inventories AI frameworks, models and IDE extensions across an environment to surface shadow AI tools.

Agent identity, fraud defense and Chrome controls

Google is wrapping new governance tooling around agent deployments through what it calls the Gemini Enterprise Agent Platform.

The platform includes Agent Identity, which provides agents with unique identities and scoped delegation and Agent Gateway, which enforces policy on agent-to-agent and agent-to-tool connections, with awareness of MCP and the Agent2Agent protocol.

Another feature, Model Armor, offers runtime protection for model and agent interactions and is integrating in preview with Agent Gateway, Agent Runtime and LangChain.

The company’s reCAPTCHA service is being rebranded and relaunched as Google Cloud Fraud Defense, now generally available, with agent-specific capabilities for distinguishing humans, bots and AI agents coming in preview.

In Chrome Enterprise, a new AI-aware extension for threat detection is entering preview, while shadow AI reporting that flags employee use of unsanctioned web-based AI applications will reach general availability soon.

Data, network and SCC updates

Google Confidential Computing is being extended in partnership with Nvidia Corp. to G4 virtual machines featuring Nvidia RTX PRO 6000 Blackwell Server Edition graphics processors and to C4 Confidential VMs running Intel Corp.’s TDX on 6th-generation Xeon processors.

Other additions include a Confidential External Key Manager, KMS Quantum Safe Key Imports for post-quantum cryptography and general availability of the Secret Manager Agent Development Kit.

Cloud NGFW is gaining an advanced malware sandbox later this year powered by Palo Alto Networks Inc.’s Advanced Wildfire, while Cloud Armor has new managed rules from Thales Group’s Imperva aimed at Layer 7 application attacks.

Security Command Center is adding runtime visibility to surface unmanaged agentic workloads on Cloud Run and Google Kubernetes Engine, with the enhanced standard tier now including data security posture management, compliance and vulnerability management at no additional cost.

Christopher Kissel, research vice president at International Data Corp., said organizations using AI-augmented security operations are seeing measurable gains. “These operational improvements translate into significant business outcomes, such as shorter disruption periods, lower incident-related costs and improved executive confidence in security posture and decision-making,” Kissel noted.

Image: Google