Google is trying to turn AI security from alerting into repair
Google Cloud has unveiled a new platform called AI Threat Defense, pitching it as a faster way to identify, prioritize, and patch security weaknesses in enterprise systems. The platform combines technologies from Gemini, cloud security firm Wiz, DeepMind’s Codemender, and Google-owned Mandiant, with the goal of moving beyond the traditional model of generating long lists of alerts and instead producing fixes that can be tested and applied more quickly.
The timing is not accidental. As stronger AI systems begin to find software and configuration flaws faster, defenders are under pressure to compress the response cycle. In the source report, Google’s answer is a multi-part workflow: Wiz scans for exposed servers, credentials, APIs, and other vulnerable systems; agents simulate which flaws are actually exploitable; Gemini analyzes code; Codemender rewrites vulnerable code or modernizes older codebases; and tests are automatically generated before changes ship. During live operations, Google Security Operations agents can also help hunt active attacks.
What makes the platform notable
The most important design choice may be Google’s explicit use of multiple AI models rather than betting on one model to do everything. According to the report, Google says performance varies widely by task: one model may be better at application logic, another at cloud configuration, another at binary analysis. Cheap models can handle continuous scanning while more advanced frontier models focus on the highest-value systems.
That matters because it reflects a maturing view of AI operations. In security, accuracy and triage are as important as raw capability. A platform that mixes models by cost and specialty is trying to behave more like a practical SOC workflow than a generalized demo. It also suggests that the company sees AI security as an orchestration problem, not just a model problem.
What AI Threat Defense combines
- Gemini for code analysis.
- Wiz for cloud risk assessment and exposure discovery.
- DeepMind’s Codemender for writing and testing patches.
- Mandiant expertise drawn from real-world cyber incidents.
- Traceability showing which model produced which patch.
Why patch automation is becoming urgent
The source report argues that newer AI systems are changing the threat picture because they can uncover weaknesses faster than manual processes can keep up. In that environment, the old workflow of detecting a flaw, filing a ticket, prioritizing it, assigning an engineer, waiting for a patch, and then validating the change can become too slow for high-value systems. AI Threat Defense is aimed squarely at that bottleneck.
Codemender is the clearest example. Rather than stopping at vulnerability identification, it steps into the development environment, replaces vulnerable code, and even rewrites some older code into memory-safe languages. The platform then generates tests to check the patch before release. That is a significant step because many security products are strong at seeing problems but weak at helping organizations resolve them in production workflows.
The strategic angle
There is also an acquisition story embedded here. Google bought Wiz in 2025, and AI Threat Defense shows how the company intends to use that asset: not as a standalone scanner, but as part of a broader AI-native security stack. Combined with Gemini and Mandiant, it gives Google Cloud a more vertically integrated pitch to enterprise customers that want cloud visibility, incident intelligence, code-level reasoning, and automated remediation from one vendor family.
The practical test, however, will be trust. Automated patching in enterprise systems can save time, but it also raises the cost of mistakes. Organizations will want evidence that the platform can distinguish theoretical vulnerabilities from exploitable ones, propose safe code changes, and preserve application behavior under pressure. Google’s inclusion of automatic test generation and patch traceability appears designed to answer exactly those concerns.
If the platform works as advertised, it would represent a meaningful shift in security operations: from AI as an assistant that explains risk to AI as an agentic layer that helps close exposure directly. In an era of faster attacks and larger software footprints, that is the transition many defenders are trying to make.
This article is based on reporting by The Decoder. Read the original article.
Originally published on the-decoder.com