Google Cloud Security

Stop running the same manual threat triage queries every morning. ⏱️🛡️ This week for #GoogleTIMondays, we’re breaking down how to use Flows (Public Preview) in Google Threat Intelligence. Automate your daily investigations and feed fresh telemetry directly into your detection pipelines. 🤖 Ask Agentic: Schedule multi-step AI investigations using custom prompts or pre-built templates (like Threat Actor Activity Analysis). Review session histories anytime in your workspace. 🔍 Saved Searches: Stream up to 10,000 newly matched IoCs per execution directly into your pipeline—running silently in the background with zero chat overhead. 🔌 GTI API: Move beyond the UI. Trigger these workflows programmatically via REST endpoints to enrich alerts directly within your SIEM/SOAR playbooks. Build your first automated Flow today under the Agentic tab in GTI. 💬 How is your team accelerating threat investigations? Drop your strategies in the comments.

📣 Big news! We are proud to announce that Google has been named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026. Today’s cyber threats move fast, and security teams require high-fidelity intelligence and actionable context to anticipate adversary moves before an attack unfolds. In this recent evaluation, Google received the highest possible score (5.0) across 9 distinct criteria! A huge congrats to the teams that made this happen! 👏 Get the full rundown from Jayce Nichols and Emiliano Martinez Contreras, and access the Forrester report: https://goo.gle/4y2twZG

Securing Fortune 500 financial data requires strong perimeters 🔒. But troubleshooting those perimeters shouldn't slow down your team. BlackLine uses Google Cloud VPC Service Controls to mitigate data exfiltration risks and protect sensitive customer data. The best part? By leveraging our new policy intelligence tools, their infrastructure team can now investigate blocked API requests in minutes ⏱️—no complex SQL queries needed to dig through logs. Read the full customer story from BlackLine's Jimmy Huang and Google Cloud's Pratik Bhangale to see how they did it. 🔗 https://goo.gle/3VjQJIm

Frontline adversaries don't wait for multi-victim correlation—and defenders shouldn't have to either. In this week’s #GoogleTIMondays, Google Threat Intelligence is delivering Single Target Operations: verified intrusion missions from Mandiant Managed Threat Defense (MTD) published in under 24 hours, not weeks. Here is how Single Target Operations accelerate frontline threat hunting and SOC response: ⏱️ Sub-24-Hour Velocity: Access real-world intrusion profiles and an instant 2-year backfill of Mandiant frontline missions. ⚔️ Full Attack Progression: Trace adversary behavior end-to-end—from initial delivery to payload staging and command-and-control beaconing. 💻 Tactical Telemetry: Hunt with raw host command lines, behavioral TTPs, and MITRE ATT&CK mapping. 🔗 Closed-Loop SecOps: Pivot from alerts in the Google SecOps Emerging Threats Center directly into full GTI Operation profiles in one click. Turn frontline incident casework into enterprise-wide defense in minutes. ⚙️ Explore Operations: Navigate to Threat Intelligence → Campaigns and filter by Single Target Operation. 📄 Full release notes & changelog: https://goo.gle/3VtZHTq

Security operations shouldn't mean drowning in regex and manual triage. Here are three practical ways AI and automation are transforming Google SecOps—from ditching manual log parsers, to scaling SOAR, to validating threat coverage in minutes. Swipe through the highlights → (Links to all three resources are in the comments 👇)

🤝 Security is a team effort. Martin Schöpper, Group CISO at ZEISS Group, highlights a critical reality for the future of cyber defense: protecting your organization means looking far beyond your own perimeter. It requires building strong networks and collaborating across industries to secure our shared global supply chains. But as Martin notes, winning this race also means fundamentally changing how we operate. When human collaboration is backed by the right technology, defenders gain a decisive edge. Google AI Threat Defense helps power that shift, equipping security teams to predict threats and deploy fixes at machine speed. Hear more from Martin in the video below, and explore how to transform your security operations for the future. 🔗 https://goo.gle/4h1wfvk

⏱️ Six hours. That’s all it took for an adversary to compromise a cloud environment, build a custom attack system, and harvest thousands of credentials—all driven by AI. Our latest GTIG AI Threat Tracker details how attackers are shifting from basic prompting to autonomous operations: • Multi-agent frameworks that scan, adapt, and troubleshoot in real time with zero human oversight. • Direct theft of proprietary models, source code, and developer credentials. • Malware hidden in open-source tools with extreme text designed to trigger safety refusals in automated LLM code reviewers. • Hijacking enterprise cloud environments to run unauthorized, high-performance compute workloads. 🛡️ How does Google defend against these threats? We proactively disrupt these malicious campaigns by disabling the assets and accounts associated with this activity. We also feed these frontline threat insights directly to Google DeepMind to harden model classifiers, enabling them to automatically refuse to assist with these types of attacks. 📄 Read the full report: https://goo.gle/4hgxAj1

Keeping up with 25,000+ annual CVEs can quickly turn into a lot of noise. 🧑💻😵💫 Target Technology Watchlists help cut through the firehose by alerting you ONLY on the vulnerabilities that affect your specific tech stack and are actively being exploited. 🎯 Less time sorting through generic alerts, more time focusing on what needs attention. 🔍 Swipe for the details 👇 #GoogleTIMondays