Google Unleashes Always-On AI Security Platform to Counter Automated Attacks

Google Cloud has unveiled a new autonomous security platform designed to keep pace with AI-powered cyberattacks—threats that now scan for weaknesses and chain exploits in minutes. Dubbed AI Threat Defense, the system combines Google’s Gemini models, cloud-mapping tech from Wiz, automated repair agents from CodeMender, and threat intelligence from Mandiant into a single, always-operational loop.

The platform follows a four-step playbook Google developed internally: Prepare, Scan and Prioritize, Remediate, and Monitor. It’s the result of years of acquisitions and internal builds, including the $32 billion purchase of Wiz in March 2026. Wiz provides live exposure maps across clouds, APIs, identities, and runtimes, while its Red Agent simulates attack paths. Mandiant contributes real-world incident data and helps craft response plans for legacy systems. Gemini and CodeMender handle deep code analysis and generate verified fixes that push directly into developer tools.

Rather than relying on raw severity scores, the platform prioritizes risks based on actual exploitability and business impact. Multiple AI models run in parallel to catch more flaws—lightweight models scan continuously, while heavier ones focus on high-risk targets. Wiz filters findings into a prioritized risk map. CodeMender then generates patches, tests them automatically, and tags libraries for traceability. Wiz’s Green Agent pushes remediation into production, and Mandiant guidance helps teams retire old code without breaking operations.

Continuous monitoring closes the loop with autonomous agents hunting runtime anomalies. Google Security Operations integrates for detection and response, and hardened container images shrink the initial attack surface.

“By combining the contextual risk prioritization of Wiz, the code remediation capabilities of CodeMender, the intelligence of Gemini, and the frontline expertise of Mandiant, we provide the architecture needed to match the speed of the adversary,” wrote Francis deSouza, COO and president of security products at Google Cloud.

Industry analysts see promise but also raise questions. A May 28 report from The Futurum Group noted the platform covers the full vulnerability lifecycle but flagged integration risks, multicloud reach outside Google Cloud, and governance around autonomous patches. Early partners like Accenture, Deloitte, PwC, Netenrich, and TENEX.AI will handle deployments and help align with existing toolchains.

Enterprises with heavy AWS or Azure workloads will watch how well the autonomous remediation works beyond Google Cloud. Developer teams will test CodeMender alongside their preferred AI coding tools. Security leaders will track audit trails for every AI-generated patch. The platform touches code, cloud posture, and operations at once—and clear ownership for autonomous changes will be critical in production.