At the Google Cloud Security Summit, Google shared more details about its AI security vision. The company launched an Intelligent Security Operations Center (SOC) that optimizes data pipelines, automates alert classification, and incident response through AI agents, streamlining detection engineering workflows. The new alert investigation agent is based on the experience of Mandiant analysts, capable of enriching incident information and providing response recommendations. Additionally, Google has introduced agent inventory and risk identification features in its Agent Builder tool, enhancing protection against prompt injection attacks and improving threat detection capabilities in the security command center.
During this week’s Google Cloud Virtual Security Summit, the company shared more details about its expanded vision for AI security protection, including deploying AI capabilities to improve resilience, launching new Intelligent SOC features, and safeguarding customers’ future AI development projects.
Google’s leadership stated that this represents an “unprecedented” opportunity for end-user organizations to redefine their security posture and reduce the risks associated with AI investments.
The company’s vision for the Intelligent SOC is an “integrated experience” where AI agents optimize data pipelines to streamline detection engineering workflows, automate alert classification, investigation, and response, allowing agents to coordinate their actions to support common goals.
Initially announced at the Google Cloud Next conference in April, the new alert investigation agent is now in preview for select users, reportedly enriching incident information, analyzing command line interfaces (CLI), and constructing process trees based on the work of human analysts from Google’s Mandiant division.
The generated alert summaries will come with recommendations provided for human defenders, and Google believes this could significantly reduce manual work and response times for defenders.
“We are excited about the new features being launched across our security product portfolio, which not only help organizations continue to innovate with AI but also leverage AI to protect their organizations’ security,” said Naveed Makhani, head of Google Cloud Security AI products, in an interview with Computer Weekly.
“One of the biggest security improvements we announced is within the AI protection solutions. As organizations rapidly adopt AI, we are developing new features to help them keep their projects secure,” Makhani added.
In this area, Google announced three new features in its Agentspace and Agent Builder tools today, aimed at protecting the AI agents developed by customers.
These features include new agent inventory and risk identification capabilities to help security teams better identify potential vulnerabilities, configuration errors, or suspicious interactions within their agents; improved protection against prompt injection and jailbreak attacks; and enhanced threat detection within the security command center.
Furthermore, Google has enhanced its Unified Security (GUS) product launched earlier this year, including security operations lab features that provide early access to experimental AI tools for threat analysis, detection, and response; dashboards for better visualization, analysis, and processing of security data; and the migration of security features from the Android version of the Chrome browser to Apple’s iOS system. Meanwhile, Trusted Cloud has received multiple updates in compliance, situational management, risk reporting, agent identity and access management (IAM), data protection, and cybersecurity.
AI Consulting Services
Based on Mandiant data showing that its human analysts are increasingly seeing customer demand for AI application cybersecurity guidance, Google will also introduce more AI-specific products within the overall solutions offered by Mandiant consultants.
“Mandiant consulting now offers risk-based AI governance, pre-deployment guidance for AI environment hardening, and AI threat modeling. Partnering with Mandiant can help organizations embrace AI technology while reducing security risks,” Google stated.
Q&A
Q1: What are the features of Google’s Intelligent SOC system?
A: Google’s Intelligent SOC system is an “integrated experience” that optimizes data pipelines through AI agents to streamline detection engineering workflows, capable of automating alert classification, investigation, and response, with agents coordinating actions to support common security goals.
Q2: What can the new alert investigation agent do?
A: The agent can enrich incident information, analyze command line interfaces, construct process trees based on the work of human analysts from Google’s Mandiant division, and generate alert summaries with recommendations to help defenders significantly reduce manual work and response times.
Q3: How does Google protect the security of AI agents developed by customers?
A: Google has launched three new features in its Agentspace and Agent Builder tools: agent inventory and risk identification capabilities to help identify potential vulnerabilities and configuration errors; improved protection against prompt injection and jailbreak attacks; and enhanced threat detection capabilities within the security command center.