Google Cloud Unveils Agentic Security Framework at Summit 2025

Google Cloud has introduced a new approach to enterprise defense, shifting cybersecurity from a reactive support function to an AI-integrated operation. Unveiled at the Google Cloud Security Summit 2025, the concept of “agentic security” positions artificial intelligence as a frontline partner designed to detect, investigate, and mitigate cyberattacks alongside human analysts.

The Demand for Proactive Cybersecurity Solutions

Modern enterprise security teams face mounting pressure from tool fatigue and overwhelming data volumes. Security operations centers (SOCs) deploy numerous tools that generate endless streams of alerts and logs, forcing analysts to manually correlate fragmented data. This manual triage slows response times and increases burnout.

Simultaneously, threat actors operate with unprecedented sophistication. As noted by Pete Burke, federal field CISO at CDW Government, attackers now leverage AI to scale their operations, automate exploits, and obscure their tracks. The asymmetry between manual defense workflows and automated attack methods necessitates a structural shift in cybersecurity frameworks.

Deploying AI as a Security Ally

Google’s agentic security model integrates Gemini, the company’s flagship AI, directly into the Google SecOps platform. Rather than functioning as a standalone tool, Gemini acts as an extension of the security team, processing natural language queries to accelerate investigations.

When analysts detect suspicious activity, they can query the system to correlate logs, summarize behaviors, and identify known threat group tactics. The AI processes these requests and delivers guided response options, such as quarantining affected servers or blocking IP addresses at the firewall. This workflow automates repetitive data gathering, allowing analysts to prioritize strategic decision-making and threat hunting.

Core Infrastructure: Security Command Center and AI Protection

The foundation of this defensive posture is the Security Command Center (SCC), which centralizes visibility across the Google Cloud ecosystem.

Model Armor and AI Protection

Defending enterprise AI models requires dedicated infrastructure. Google’s AI Protection suite secures the entire AI lifecycle, with Model Armor acting as a primary safeguard. Model Armor actively screens input prompts and outputs to block prompt injections, jailbreaks, and sensitive data leaks.

Jay DePaul, Chief Cybersecurity and Technology Risk Officer at Dun & Bradstreet, emphasized the operational benefits, stating that Model Armor delivers robust protection while integrating seamlessly into the Security Command Center for a unified security posture.

Agentic IAM: Securing Autonomous AI

As organizations deploy autonomous AI agents, governing their access becomes critical. Agentic IAM provides an identity and access management framework tailored for AI. It enables administrators to provision unique identities for AI agents, enforce granular access policies, and maintain end-to-end observability over their actions within cloud environments.

Gemini’s Specialized Security Roles

Gemini operates across multiple specialized domains to enhance threat intelligence and incident response:

• Security Operations: Provides a conversational interface for building investigation playbooks and querying large datasets.
• Threat Intelligence: Integrates with Mandiant’s frontline expertise to deliver instant summaries on threat actors and tactics. Features like Code Insight analyze malicious scripts in plain text, reducing the need for manual reverse engineering.
• Security Command Center: Automatically prioritizes misconfigurations and vulnerabilities, summarizing potential impacts and recommending remediations before exploitation occurs.

Securing the AI Lifecycle with SAIF

Google’s strategy emphasizes securing both enterprise networks and the AI models that operate within them. The Secure AI Framework (SAIF) establishes guidelines for building, deploying, and managing AI safely. It maps out emerging risks like data poisoning and model theft, prescribing specific mitigations.

To operationalize this framework, Google introduced an expanded AI agent inventory feature that automatically discovers AI deployments across enterprise environments. Organizations can also engage Mandiant Consulting for pipeline security assessments and simulated red-team attacks to stress-test AI defenses.

Shifting to Proactive Defense

The integration of AI into cybersecurity operations democratizes advanced threat analysis, equipping junior analysts with the context needed to investigate complex incidents. Features like Compliance Manager and Data Security Posture Management automate regulatory adherence and data governance, while AI-powered Risk Reports utilize virtual red teams to simulate attacks and expose vulnerabilities proactively.

As cyber threats accelerate, agentic security establishes a collaborative dynamic where AI processes massive signal volumes in real time, allowing human defenders to execute strategic interventions with speed and precision.