Loading story…
Google Cloud unveiled an agentic defense strategy that combines Wiz, Gemini, Mandiant, and Google Security Operations to automate threat detection, investigation, and remediation. The company said the approach is designed to counter attackers' growing use of AI, citing Mandiant data showing the average time from initial breach to access handoff has fallen to 22 seconds. Google also tied the strategy to broader code and application security efforts, including CodeMender, an AI agent for code security, and new protections such as Wiz AI Application Protection Platform and AI-BOM.
The announcement places Google more directly in the fast-growing market for AI-driven and agentic SOC platforms, where vendors including CrowdStrike, Microsoft, Palo Alto Networks, and SentinelOne are also pushing automation-heavy security operations. Google said it has integrated Wiz attack surface management with Google Threat Intelligence and added SecOps agents for triage, threat hunting, and detection engineering, while rivals such as CrowdStrike are promoting agentic MDR and an agentic SOC model to help enterprises scale managed detection and response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
As part of the strategy announcement, Google said it integrated Wiz attack surface management with Google Threat Intelligence and expanded its portfolio with Wiz AI Application Protection Platform, AI-BOM, and new SecOps agents for triage, threat hunting, and detection engineering.
Google Cloud announced an agentic defense strategy combining Wiz, Gemini, Mandiant, and Google Security Operations to automate threat detection, investigation, and remediation.
CrowdStrike published a blog post describing how its services and Agentic MDR can help organizations implement an agentic SOC model.
Google DeepMind published a blog post introducing CodeMender, an AI agent focused on code security.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcecrowdstrike.com
Open sourcedeepmind.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security and technology outlets highlighted a growing shift from *GenAI copilots* toward **agentic AI**—systems that can take actions autonomously or semi-autonomously—alongside warnings that governance and oversight are not keeping pace. Commentary in SC Media argued that as enterprises orchestrate hundreds or thousands of agents, traditional *human-in-the-loop* review becomes a scaling bottleneck, pushing organizations toward **human-on-the-loop** monitoring and policy-based exception handling; separate SC Media analysis cautioned CISOs to temper “hype vs. reality” expectations around agentic AI in SOC use cases due to reliability and oversight concerns. Related coverage emphasized adjacent AI risk themes, including research/analysis calling for AI systems to be constrained by values such as fairness, honesty, and transparency, and reporting on “shadow AI” contributing to higher insider-risk costs as employees use unsanctioned tools and workflows. Several items focused on operational and data-security implications of AI-enabled automation. Security Affairs described AI-assisted incident response as a way to accelerate investigations by correlating telemetry across tools, enriching alerts, and producing summaries faster than manual analyst workflows, while a SecuritySenses segment similarly framed AI as best suited for summarization/enrichment and repetitive tasks, with deterministic decisions retained by humans and with attention to securing agent communications (e.g., OWASP guidance for agents). CSO Online reported a specific AI-adjacent exposure risk: a **Google API key change** characterized as “silent” that could expose *Gemini* AI data, and also noted concerns that personal AI agents (e.g., “OpenClaw”) could be influenced by **malicious websites**. Other references in the set were unrelated to this AI/agentic-operations theme (e.g., ransomware impacting a Mississippi healthcare system, China-linked espionage using Google Sheets, legal rulings on personal data, and general conference/event or career items).
Jun 29, 2026
Google completed its **$32 billion all-cash acquisition of Wiz**, an Israeli cloud security company, marking Google’s largest acquisition to date. Wiz is expected to join **Google Cloud** while maintaining its brand and a stated commitment to securing customers across multiple cloud environments; Google positioned the deal as an investment to improve cloud security across cloud and AI platforms. Reporting also notes Google previously explored acquiring Wiz for **$23 billion** before talks later resumed and culminated in the agreed transaction. Separate reporting highlighted that the Wiz deal cleared multi-jurisdiction regulatory review, including approvals by **U.S. regulators** and the **European Commission** without restrictions, with remaining approvals in other countries described as imminent ahead of closing. Another item in the set—about Kevin Mandia’s new startup Armadin raising **$189.9M** for autonomous AI-agent security—does not relate to the Wiz acquisition and is a distinct venture funding story rather than part of the Google–Wiz transaction.
Jun 29, 2026
Google Threat Intelligence Group said it disrupted what it believes is the first observed cybercriminal campaign to use AI to develop a working zero-day exploit, preventing a likely mass-exploitation event against an unnamed open-source web administration tool. The flaw was a semantic logic issue in a Python script that allowed two-factor authentication bypass with valid credentials, and Google said the exploit code showed strong signs of LLM assistance, including heavily annotated Python, educational docstrings, textbook formatting, and even a hallucinated CVSS score. Google notified the vendor before the exploit was deployed at scale, and researchers assessed with high confidence that the code was generated with meaningful help from an AI model other than Gemini. Google said the case reflects a broader shift as threat actors industrialize generative AI across the attack lifecycle, from vulnerability research and exploit validation to malware development, obfuscation, reconnaissance, and social engineering. The company linked this trend to activity from China-, North Korea-, and Russia-aligned operators, and highlighted examples including **PROMPTSPY**, an Android backdoor that used the Gemini API to interpret device interfaces and automate clicks and swipes, as well as supply-chain compromises tied to repositories associated with **Trivy**, **Checkmarx**, **LiteLLM**, and **BerriAI**. Google said it has disabled malicious Gemini-linked assets and urged organizations to harden CI/CD pipelines, protect tokens, and scrutinize AI-related dependencies and abuse infrastructure.
Jun 29, 2026