Google Cloud’s new security AI will explain how you’ve been breached

Google Cloud has unveiled a raft of new generative AI tools that will provide security practitioners with detailed insights into how their organization could be breached. 

Announced at the RSA conference, the Google Cloud Security AI Workbench is described as an “industry-first extensible platform”, powered by a specialized security-specific large language model (LLM) known as ‘Sec-PaLM’.

“This new security model is fine-tuned for security use cases, incorporating our unsurpassed security intelligence such as Google’s visibility into the threat landscape and Mandiant’s frontline intelligence on vulnerabilities, malware, threat indicators, and behavioral threat actor profiles,” said Sunil Potti, VP of Google Cloud Security. 

Security Command Center AI 

A key feature within this announcement is the launch of Security Command Center AI, a premium version of Google Cloud’s existing Security Command Center service which is integrated within the new AI Workbench. 

Google said this can provide security operators with “near-instant analysis of findings and possible attack paths”. 

This enhancement to Security Command Center Premium could help organizations: 

The inclusion of AI-generated explanations for attack paths and methods could prove vital to security practitioners, Potti said. 

It’s said they can provide easily-digestible information in real time to reduce toil on operators and greatly enhance their ability to react to ongoing security incidents. 

“Security Command Center will translate complex attack graphs to human-readable explanations of attack exposure, including impacted assets and recommended mitigations,” he said. 

Potti added that this will also provide AI-powered risk summaries for security, compliance, and privacy findings for Google Cloud. 

Cloud security for ‘non-specialists’ 

A key message Google Cloud pushed during its address at RSA was that by embedding generative AI into cloud security operations, it believes complexity will be greatly reduced.

Google said that the integration of Security Command Center features and the new AI Workbench will empower “non-security specialists to handle security tasks that were previously out of reach due to lack of specialized knowledge”.

This could represent a marked shift in how organizations handle cloud security, opening up responsibility to a wider range of practitioners and alleviating stress on frontline security operators, the company said. 

“Security Command Center Premium can discover, identify, and recommend remediations for hundreds of cloud misconfigurations, software vulnerabilities, and external threats,” Google Cloud said in a statement.  

“Integration with Security AI Workbench will provide straightforward explanations of findings so security and non-security specialists can help keep their organization safe.” 

AI-generated summaries coming through Command Center Premium will, once again, aim to offer easily-digestible answers to key security questions, tips on remediation for ongoing incidents, and assess security risks within cloud environments.  

Generative AI in cyber security 

The rollout of generative AI security tools by Google Cloud follows the launch of Microsoft’s Security Copilot last month, and once again pits industry heavyweights Microsoft and Google against each other in the ongoing generative AI contest. 

Microsoft Security Copilot uses GPT-4 generative AI to provide users with prompt-based security detection and remediation functionalities, and was met with great excitement upon launch. 

However, while Google appeared to have been ‘beaten to the punch’ by Microsoft with the Copilot launch, the integration of generative AI security tools within Google Cloud - a key service for the tech giant - could mark a significant tipping point for the company in an increasingly competitive cloud landscape.