At the Google Cloud Security Summit, Google argued that passive defense no longer works in the agentic era. As both a frontier lab and the operator of what it calls the world’s most comprehensive threat intelligence network, Google says it sees how large language models are engineered and how adversaries target them in the wild. With autonomous agents now part of the software supply chain, ungoverned adoption can lead to critical security incidents, so Google is rolling out controls to help organizations build securely, secure systems, and defend at machine speed.

For the development lifecycle, Google is embedding real-time guardrails in the IDE, unifying asset graphs across code and IAM, and verifying models to catch logic flaws before code merges. The preview release of CodeMender, an autonomous code-security agent, adds secure autonomous remediation: vulnerability verification and exploit simulation run inside an OS-level sandbox or isolated VM, with human-in-the-loop checks for local write and command execution. CodeMender also introduces flexible scanning modes so teams can scan a specific folder, a full repository, or only files changed since the last scan. It works with multiple models, including Gemini 4 Argon, which Google says can identify previously unknown vulnerabilities and generate tested patches. One cited example is Wiz using Argon plus other models to find and help remediate core PHP vulnerabilities affecting 70% of websites; Argon contributed to finding the vulnerability, developing a likely exploit path, detecting attacks, and validating the patch. Since the CodeMender preview became available in July, hundreds of customers have used it. Thales Group’s CTO reports the potential to reduce vulnerability discovery time by over 95% while keeping expert validation under human oversight, and IDC notes that nearly 40% of enterprises add vulnerabilities faster than they can remediate them.

For production workloads, Google Cloud is delivering a unified ‘agents everywhere’ framework so agents running on Gemini, GKE, Cloud Run, the new Agent Compute Engine, or across multi-cloud environments are bound by the same enterprise controls. New identity, network, and content controls include Auth Manager, now generally available, which centralizes credential management in a Google-managed vault governed by IAM and automates OAuth 2.0/PKCE flows and token refresh. Agent Identity JWT support, in preview, provides OIDC tokens so agents can authenticate across AWS, Azure, on-premises backends, and MCP servers without static API keys. Identity-based VPC Service Controls add IAM role support (GA) and Workload Identity Federation for GKE (preview) to enforce identity-based perimeter boundaries. Model Armor‘s custom topic detector, in preview, lets organizations define prompt-based rules to keep agent conversations focused and compliant for healthcare, insurance, and retail. Also announced: Cloud NGFW advanced malware sandbox (GA, enabled by Palo Alto Networks WildFire), project-level resources for Cloud NGFW (GA), and Cloud Armor managed rules (preview) backed by Thales Imperva’s threat intelligence scanning 1.5 trillion monthly web requests.

On the defense side, Google describes modern SOCs as needing autonomous investigation, detection, and response: continuous monitoring feeds telemetry into the Wiz Security Graph, Google Threat Intelligence is codified into defensive model runtime logic, agentic threat hunts reconstruct process trees in real time, and autonomous agents present mitigation actions for human sign-off. Mandiant Transformation Services is offered to help teams modernize operating models and workforce skills.

The post also details deeper Wiz integrations. Wiz protects autonomous applications from code to runtime by mapping applications, agents, and infrastructure. Wiz AI SAST, in preview, uses agentic reasoning to surface complex business logic flaws and correlates code weaknesses with infrastructure context from the Wiz Security Graph, with remediation available via Green Agent and CodeMender. Wiz Defend and Google Security Operations now share a data model, including a Wiz Content Pack, Wiz Blue Agent investigation analysis, bi-directional syncing, and Wiz Defend integration with Google Threat Intelligence. Scan for Good, a joint Google DeepMind and Wiz initiative, pairs autonomous technology with human researchers to help under-resourced public services, critical infrastructure, and non-profits; in its first month, Argon helped more than 50 such organizations find and remediate critical exposures.

Google closes by framing its responsibility as disrupting adversaries at the source: tracking bad actors targeting Google Cloud environments and disabling their infrastructure, engineering defensive architectures with Google DeepMind, and feeding frontline threat intelligence back into model alignment and classifier training. This article is an announcement of these capabilities, with many components explicitly in preview or GA status.