Google Cloud Unveils 'Agentic Defense' Platform Leveraging Wiz Acquisition to Combat AI-Driven Attacks

Google Cloud is making a significant strategic shift in its cybersecurity approach, launching a new "agentic defense" platform designed to automate threat detection, investigation, and remediation. This initiative is heavily influenced by Google's recent $32 billion acquisition of cloud security leader Wiz, integrating its advanced capabilities into Google's existing security operations stack.

The core of this new strategy lies in intelligent security agents that leverage artificial intelligence to proactively identify and neutralize threats. Google argues that the escalating pace of AI-driven attacks necessitates a move from human-led to AI-led cyber defense. Francis deSouza, Google Cloud’s COO and president of security products, highlighted the alarming trend where the time from initial breach to threat actor handoff has collapsed from hours to mere seconds, making human intervention impractical.

Wiz, known for its rapid growth and innovative graph-based analysis correlating cloud assets, identities, vulnerabilities, and exposures, provides Google with a powerful cloud-native security platform. This acquisition complements Google's existing AI, threat intelligence, and incident response features, creating a more comprehensive and automated defense system. The integration means Wiz Defend detections are now flowing directly into Google Security Operations and Mandiant Threat Defense, streamlining incident response.

Google has already begun integrating Wiz's attack surface management (ASM) with its own Threat Intelligence (TI). This synergy allows Wiz to enrich detections in real-time with Google TI when ingesting telemetry from Google Cloud. Prioritized exposure data is then pushed directly into Security Operations (SecOps) playbooks, enabling Security Operations Center (SOC) teams to investigate and respond to cloud-native risks without switching between disparate tools.

This agentic defense platform builds upon Google's "AI Threat Defense" launched earlier, combining its Gemini AI modeling platform with Wiz's scanning, simulation, and remediation capabilities. The goal is to counter AI-powered threats by leveraging Gemini's reasoning and code remediation features, alongside Wiz's contextual risk prioritization. Google emphasizes its unique "chips-to-code-to-cloud" security stack, which includes its own AI infrastructure, global cloud presence, custom processors with GPUs, and now, the Wiz platform for agent delivery.

Central to this new framework are enhanced agents for Google Security Operations and the new Wiz AI Application Protection Platform (AI-APP). AI-APP is designed to discover, evaluate, and protect AI applications throughout their lifecycle, from AI-generated code and models to the cloud and edge environments where they operate. This includes support for various AI development platforms and studios, aiming to provide security teams with AI-powered tools to secure their entire environments.

Google also introduced the Wiz AI-BOM tool, which automatically generates inventories of AI frameworks, models, and development tool extensions, extending the concept of Software Bill of Materials (SBOM) into the AI domain. The company's unified Security Operations platform, combining Chronicle SIEM and Siemplify SOAR, now treats agents and AI applications as a core part of the enterprise attack surface, integrating AI agents for improved threat detection and response.

The overarching strategy is to create a security ecosystem where AI agents actively defend against AI-powered adversaries. By embedding agents directly into cloud infrastructure and SecOps workflows, Google aims to provide near-instantaneous threat mitigation and reduce the burden on human analysts, allowing them to focus on more complex threats. This proactive, AI-driven approach is positioned as the future of cloud security in an increasingly automated threat landscape.