Inside Google AI Threat Defense: The Platform Battling 22-Second Cyberattacks

The speed of modern cyberattacks has rendered traditional manual defenses obsolete. Three years ago, adversaries took about eight hours to move from breaching a system to handing off access. Now, that window has collapsed to 22 seconds . To counter this, Google Cloud launched AI Threat Defense on May 27, 2026—an always-on, automated platform designed to find, validate, and patch vulnerabilities faster than AI-accelerated attackers can exploit them .

This isn't just a single tool; it's a strategic fusion of Google's most powerful security assets. The platform combines the reasoning power of Gemini AI, the cloud security posture management of Wiz, the automated code-remediation capabilities of CodeMender, and the frontline threat intelligence of Mandiant. The result is a system that aims to close the window of exposure before an attack can even begin.

The Four Operational Stages of AI Threat Defense

Google AI Threat Defense operates through a continuous four-stage framework, moving from preparation to autonomous monitoring.

1. Prepare: Reduce the Attack Surface Before the First Strike

In the preparation stage, the Wiz security platform maps an organization’s entire environment, including exposed applications, cloud infrastructure, APIs, user identities, and runtime environments. Crucially, a built-in penetration-testing agent then simulates attacks to determine which of these exposures are actually exploitable, allowing teams to proactively reduce the reachable attack surface .

2. Scan and Prioritize: A Multi-Model Deep Dive

A single AI model can’t spot every type of vulnerability. For the scan and prioritize stage, the platform deploys a fleet of AI models. Lighter, faster models provide broad coverage across the environment, while more powerful frontier models—delivered through the Gemini Enterprise Agent Platform—perform deep, contextual analysis on high-risk systems such as internet-facing applications and authentication logic. This multi-model approach examines application logic, cloud configurations, binary code, and exploitability to prioritize the threats that matter most .

3. Remediate: Automated Code Fixes with an Audit Trail

Once a critical vulnerability is identified, speed to a fix is everything. CodeMender, an agent developed by Google DeepMind, generates verified patches directly inside a developer’s IDE or CLI. It works in concert with Wiz and Antigravity to replace vulnerable code, rewrite legacy components in memory-safe languages, and analyze risky library dependencies. Before any patch is merged into production, the platform automatically generates tests to verify the fix and tags patched libraries in source control, providing a complete audit trail .

4. Monitor: Continuous Threat Hunting at Machine Speed

The final stage hands over to a collection of specialized AI agents within Google Security Operations. These agents handle persistent tasks including threat detection, alert triage, investigation, and proactive threat hunting across network, identity, and application telemetry. To further lock down the environment, hardened container images are built, signed, and verified on a daily basis to limit the runtime attack surface long-term .

How the Key Components Form a Unified Defense System

The power of AI Threat Defense lies in how these individual components orchestrate their specific functions into a single, cohesive workflow.

• Wiz is the eyes and ears of the operation, providing continuous visibility into cloud security posture, mapping complex attack paths, and using its pen-testing agent to validate which risks are genuinely exploitable .
• Gemini AI acts as the central reasoning and code-generation engine. It powers everything from the deep analysis in the scan stage to generating the logic that CodeMender uses to create a fix .
• CodeMender is the hands-on remediator, taking the validated vulnerabilities and Gemini’s reasoning to write and test secure, memory-safe patches directly in a developer’s workflow .
• Mandiant provides the strategic brain, supplying frontline threat-intelligence playbooks and expert guidance on critical tasks like managing surges in zero-day vulnerabilities or securely retiring legacy products .

The workflow is elegantly linear: Wiz finds what is exposed and exploitable, Gemini and CodeMender validate and fix the underlying code, and Mandiant provides the operational playbook to guide the response, all continuously monitored by Google Security Operations agents .

The Partner Ecosystem: Bringing AI Defense to the Enterprise

Google Cloud is not expecting enterprises to operationalize this platform alone. A robust launch partner ecosystem is already in place to deliver high-fidelity security workflows out of the box .

• Check Point Software Technologies joined as a launch partner, integrating its AI Defense Plane with the Gemini Enterprise Agent Platform. This integration provides enterprises with full visibility into their AI agent estate, pre-deployment controls, and runtime guardrails—essential for safely scaling agentic AI use .
• SentinelOne earned the title of 2026 Google Cloud Partner of the Year for Security: Google Threat Intelligence. The award underscores a deepening collaboration that combines SentinelOne’s endpoint detection and response (EDR) and AI security capabilities with Google’s threat intelligence and cloud-scale infrastructure .
• A broader cohort of security partners, including BBVA which is using the Triage and Investigation agent in live production, has been announced to build seamless integrations for Google Security Operations, ensuring SOC teams can adopt the new agentic workflows quickly .