Cloud Blog

Announcing our 2026 Google Cloud Partners of the Year

Tue, 21 Apr 2026 19:00:00 +0000

Google Cloud is honored to present the 2026 Partner of the Year winners!

These awards recognize partners who have displayed a commitment to excellence by leveraging Google Cloud technology to deliver innovative solutions that drive customer success. This group represents a breadth of industries and countries, showcasing the power of collaboration to produce impactful results and revolutionize work worldwide.

Please join the entire Cloud community in congratulating our winners for the following categories:

Global

These awards honor global partners that exemplify excellence in their category, driving innovation and delivering industry-leading solutions with Google Cloud.

Artificial Intelligence

Recipients in this category have helped customers leverage AI to achieve outstanding success through Google Cloud.

Data

Winning partners in this segment have expertly deployed new Google Cloud data analytics or database solutions to help customers extract actionable insights from their data, create valuable inputs for AI, and fuel business transformation.

Infrastructure Modernization

Partners receiving these awards have helped their customers modernize their infrastructure by leveraging Google Cloud, resulting in increased agility, scalability, and cost-efficiency.

Security

This category honors partners that have effectively implemented Google Cloud's security solutions, safeguarding their customers' data and infrastructure from evolving threats.

Google Workspace

Recipients in this segment excel in driving sales and delivering outstanding services for Google Workspace, empowering customers with innovative solutions that transform collaboration and productivity.

Services & Industry Solutions

These award winners have leveraged Google Cloud to create comprehensive and compelling solutions that made a significant impact in an industry across multiple regions.

Technology & Business Applications

Honorees in this category are being recognized for building innovative global technology and application solutions on Google Cloud, solving complex business challenges, and driving significant impact across industries.

Country

This segment celebrates partners that have demonstrated exceptional expertise in leveraging their services and solution capabilities to drive sales and deliver outstanding outcomes for Google Cloud customers in marquee markets.

Marketplace

These winning partners have excelled in delivering innovative solutions through Google Cloud Marketplace, significantly accelerating customer adoption and driving business growth for joint customers.

Public Sector

Recipients in this category have provided exceptional service and enabled the success of their public sector customers by innovating, building, and delivering the right combination of Google Cloud solutions.

Talent Development

Winners in this segment have shown a commitment to growing and promoting their team's cloud skills through training, upskilling, and reskilling their workforce on leading-edge cloud technology with Google Cloud certifications.

Training

Partners receiving this honor have provided exceptional training services and enabled customer success by innovating, building, and delivering the right combination of Google Cloud solutions through learning.

Other categories: Distribution, Geospatial, and Social Impact

These awards recognize partners who have delivered exceptional results in specialized domains—from leveraging geospatial technologies for location-based insights, to driving market expansion through distribution, to creating meaningful social impact via innovative community-focused initiatives.

Congratulations once again to our 2026 Google Cloud Partner of the Year winners. Thank you for your invaluable contributions and continued partnership. Here’s to another award-worthy year of collaboration in the cloud.

Building the foundation for AI across the public sector through our partner ecosystem

Tue, 21 Apr 2026 19:00:00 +0000

The demand for AI within the public sector has never been higher. Practitioners and CXO’s are looking for ways to harness AI to improve mission outcomes, enhance security, and streamline operations. However, the path to bring this technology to the public sector is often met with hurdles, from complex compliance requirements, procurement barriers, and the limitations of legacy environments.

At Google Public Sector, we are closing the gap between commercial-grade innovation and public sector mission requirements by empowering an ecosystem where partners can build, certify, and sell solutions faster than ever before. Today, we are excited to share new initiatives that bridge the gap between innovation and implementation. We are focused on what matters most: empowering the growth of every partner, aligning our teams, and making it easier to bring solutions to public sector customers.

Empowering the next generation: A new federal AI startup accelerator in collaboration with NVIDIA

The first step in this journey is ensuring the next generation of startups can navigate the federal landscape. At the heart of this momentum is the Google Public Sector federal startup accelerator program, the inaugural cohort launched in collaboration with NVIDIA. Specifically designed for AI-focused ISVs in the federal market, this initiative provides startups with engineering support and direct access to Google Cloud and NVIDIA’s compute power to solve the government’s toughest challenge.

We are proud to kick off this program with our initial cohort of pioneering companies including USAI.IO, Rhombus Power, Aalyria, and Trase. These organizations represent the cutting edge of AI innovation and we are thrilled to support their journey. To learn more about the program, please complete the interest form.

Google Public Sector ISV ATO Accelerator program

Access to technology is only half the battle; the other half is the rigorous security standards required to deploy it. One of the obstacles for any ISV entering the federal space is achieving Authority to Operate (ATO). To address this, Google Public Sector has expanded its ATO Accelerator program to offer up to $1M in funding for eligible ISVs. This financial backing, combined with dedicated engineering, ensures that mission-critical AI tools aren’t sidelined by FedRAMP and Impact Level (IL) paperwork, but are instead moved quickly into the hands of practitioners who need them the most. To fast track deployment, eligible ISV’s can learn more and apply for the Google Public Sector ISV ATO Accelerator program.

Modernizing procurement in partnership with Carahsoft

Scaling innovation also requires a modern approach to procurement. In partnership with Carahsoft, we are launching the Distributor Channel Private Offer (DCPO) on our Google Cloud ISV Marketplace. This is a 2-tier model that allows partners to resell a vast catalog of solutions from providers such as Palo Alto Networks and Red Hat, while helping customers maximize their enterprise agreements.

Get involved

We are excited to continue building the future together. Join our partner ecosystem today

From keynote to the terminal: Join our Next ‘26 developer livestreams

Tue, 21 Apr 2026 16:00:00 +0000

The main stage at Google Cloud Next is where the vision is set. This year, we’re bridging the gap between those massive "Cloud-scale" announcements and your local terminal.

We are thrilled to announce the Next ‘26 developer livestreams, a daily broadcast live from the show floor at Google Cloud Next. We aren't just reporting the news, we’re deconstructing it into actionable demos and immediate workflows before the keynote seats are even cold.

What to expect

Real-time demos that turn inspiration into versioning.
Energy from the show floor delivered straight to your screen.
Interviews with the builders, community leaders, and disruptors moving at light speed.

Schedule

Day 1: From the Next ‘26 main stage to the terminal
When: Wednesday, April 22, beginning at 11 AM PT

Immediately following the opening keynote host Jason Davenport kicks things off with special guests including Acquired's Ben Gilbert and David Rosenthal to get their reaction to the day’s announcements. Then we dive into the hardware and platforms powering the next wave of AI with Addy Osmani, Shubham Saboo, Philip Kelly of Baseten, Yasmeen Ahmad, and other surprise guests.

Day 2: Next ‘26 Developer keynote deep-dive
When: Thursday, April 23, beginning at 12 PM PT

Fresh off the Developer Keynote, we’re taking the tech to the terminal. We’ll be live-coding agentic workflows and testing new announcements in real-world scenarios.

Host Stephanie Wong will sit down with Michele Catasta (President & Head of AI at Replit). We’ll also feature a "hot off the press" breakdown with Google Cloud’s Sarah Kennedy and Ricky Robinett, plus a security deep dive with Ankur Kotwal and Wiz’s Salman Ladha. And hear from LangChain’s Harrison Chase, and conversations with Googlers Kevin Moore and Ines Envid, and more!

Where to watch

Don’t just watch the news — build it with us. We’ll be streaming live across all your favorite platforms. Bookmark the links below and set your reminders now!

Replays will be available on-demand.

Next digital pass

To make sure you don't miss any of the action, claim your complimentary digital pass today. Stream select breakout and Spotlight sessions, catch the big keynote announcements as they drop, and enjoy short-form videos – all from wherever you happen to be. Plus, your digital ticket unlocks special offers once Next wraps up. Register now!

What’s next after Next? Stay agent-ready with GEAR

The conversation around AI agents is moving fast. Want to stay in the loop? Join the Gemini Enterprise Agent Ready (GEAR) program and get access to curated news and learning materials from the experts at Google.

GEAR up to get the most out of AI learning at Google Cloud Next ‘26

Tue, 21 Apr 2026 15:00:00 +0000

Our new GEAR program, powered by Google Skills, equips every professional with the hands-on AI training needed to build and launch enterprise-ready agents at scale. Anyone can join GEAR for access to AI training and more, including:

35 monthly learning credits to use towards courses and hands-on labs in Google Skills
Discord community access to connect with peers
Curated agentic news and resources from Google
Google Cloud customers can join the Get Certified program to prepare for Google Cloud certifications at no cost

If you really want to get hands on with GEAR, we’re excited to share that it will also have a major presence at Google Cloud Next ‘26. We’ve integrated GEAR throughout the event, making it easy for you and your teams to build skills on site and jumpstart your GEAR journey through new mini-labs, learning paths, and hands-on workshops from the experts at Google.

Next learning experiences you can’t miss

Next will feature the latest new GEAR learning paths, available on Google Skills, including: Introduction to Agents and Google’s Agent Ecosystem; Develop Agents with Agent Development Kit (ADK); Deploy Production-Ready Agents; and Scale Agents Across the Enterprise.

We also have a collection of exciting areas where you can engage with GEAR programming.

The Skills Challenge: Your on-the-ground gamified experience. With more than 20 activities designed to help you get the most out of Next, you can join thousands of players, rise up the leaderboard, and earn exclusive swag.
Google Skills Zone: Choose your own learning adventure. Drop in for 10- to 15-minute mini-labs, complete an AI Boost Bites lesson to gain new AI skills, or deep dive into technical workshops inspired by our premium learning services and Google Skills content.
Real-world, immersive sessions: Step into specialized two-hour labs where you’ll build analytics agents to analyze sports data from Major League Baseball or McLaren. Everything you learn can be applied to your own business challenges, too.
Breakouts: Join our expert-led sessions and panel discussions featuring real-world customer stories. Don’t miss these stand-out sessions (you can even add them to your Next agenda):
- AI upskilling strategies from the world's most innovative retailers featuring Wayfair and Woolworths
- Scale your workforce with AI: Real-world lessons with Salesforce, Palo Alto Networks, and EVERSANA
- Building an agent-ready workforce
- Bridging the gap: Scaling AI readiness with Google certifications

“GEAR does a great job introducing developers to the fundamentals of building AI agents and agentic systems. As someone working with enterprise platforms, I especially appreciate how it helps developers move beyond simple prompts to think in terms of tools, workflows, and scalable agent architectures.” – Jitendra Gupta, Google Developer Expert

Jumpstart your learning with GEAR and Google Skills today

Don't wait until Google Cloud Next. Stop prototyping and start shipping, today. Sign up for GEAR to get no-cost access to agentic training and more on Google Skills.

Introducing the Builders Hub from the Google Developer Program

Tue, 21 Apr 2026 13:26:00 +0000

Today’s developer experience is often spread across dozens of consoles, documentation pages, and sites to stay informed. We know that the friction of jumping between surfaces can slow down the most important part of your day: building.

To solve this, we are introducing Builders Hub within Google Developer Program as a new centralized service designed to provide developers with a unified entry point, a workbench for projects, and resources—including personalized suggestions for community engagement and learning.

Whether you are a vibe coder, an AI Builder, or a professional developer, Builders Hub has something to offer you. Learn more about how the new Builders Hub helps you move faster.

A Frictionless "Front Door"

Getting started should be measured in seconds, not hours. Builders Hub eliminates onboarding complexity by providing a unified activation point for all Google developer tools.

Unified Project Dashboard: Access and view all of your Google Cloud, Firebase and AI Studio projects and apps from a single destination. You can now see at a glance exactly which services are enabled across your entire environment without hopping between separate consoles.

Personalized Learning & Interests: Receive tailored recommendations and compatible interest suggestions based on the specific services you’ve selected. Builders Hub understands your tech stack and serves up the most relevant learning paths to help you master new tools faster.

The Integrated Workbench: Build While You Learn

We’re moving beyond static documentation. The new Builders Hub introduces an interactive environment where learning and execution happen side-by-side, allowing you to focus on innovation.

Integrated Credits & Seamless Execution: Unlock Google Cloud credits directly within a Codelab to get started with zero friction. This seamless flow allows you to spin up real environments immediately, so you can learn by doing without the traditional operational toil of manual billing or account setup.

Showcase Your Proficiency with Badges: Every milestone counts. Unlock and showcase digital badges that highlight your specific achievements and skill sets. These credentials allow you to prove your proficiency to the global community and potential employers.

Grow With Your Career

With Builders Hub, Google Developer Program is no longer just a place to start—it’s where you build a legacy. We’ve expanded the Hub to prioritize community and professional recognition, giving you the tools to turn your technical proficiency into career-defining milestones.

Discover Local Communities & Events: Connect with other builders in your backyard. The Hub now features a dedicated discovery engine for communities and local events, making it easier than ever to build your network and find your tribe.

The Pulse of Google Developers: Stay connected with an integrated feed of upcoming events and recent blog posts from across all of Google’s developer channels, curated directly within your workbench.

Get Started

The transition to agentic, AI-driven development requires a new set of tools and a more integrated experience. Builders Hub is built to be your workbench for this next era.

Access the new Builders Hub today by signing into Google Developer Program at builders.google!

Evolving Media CDN for the world’s most demanding broadcast and streaming workloads

Fri, 17 Apr 2026 17:30:00 +0000

Editor’s note: In this post, we share joint insights from Raj Gulani, Director of Product Management for Network Experiences, and Dan Rayburn, Industry analyst with 30-plus years of experience covering streaming media.

In our combined experience observing and building within the media industry, one truth remains constant: the landscape is always evolving. Audience expectations for flawless, broadcast-quality streaming have become the undisputed baseline, while the scale of global live events continues to push the technical boundaries of content delivery.

From our shared perspective, the most successful platforms are no longer defined solely by their ability to handle massive scale. Instead, they are distinguished by their evolution — how they adapt to solve the complex operational and financial challenges that broadcasters and streaming services face every day. This post offers a joint look at some of these key industry demands and how platforms are innovating to meet them.

The need for scale, flexibility, and efficiency

The need to support massive audiences during live global events like the Super Bowl, FIFA World Cup, and IPL is a given. In response to this clear industry trend, content delivery networks (CDN) must continuously scale their infrastructure to support peak traffic demand. We’ve seen this firsthand with Google Cloud’s Media CDN, which shares infrastructure with Youtube, has had to actively respond to customer capacity needs with infrastructure presence in relevant regions, especially for live events.

Beyond raw capacity, however, a more nuanced story is unfolding around the need for greater architectural flexibility and more predictable cost models. We believe the focus has rightly shifted to providing smarter tools that help manage traffic, improve performance, and control costs. Here are a few examples of this:

Flexible caching architectures: One of the key challenges in global delivery is minimizing latency and cost. The introduction of features like flexible shielding – supported today in South Africa, the Middle East, and the US – is a direct answer to this. Such features allow traffic to be managed within a region, avoiding the performance and cost penalties of fetching content from a distant origin.
Solving for interoperability: As workflows become more complex, platforms need to be better integrated. We have seen a focus on addressing common origin compatibility issues through tactical engineering solutions. Examples include adding support for HEAD requests, increasing maximum segment sizes to 25MiB to accommodate 4K/8K content, and enabling multi-part range requests. These kinds of updates are crucial for ensuring a platform works with a customer’s existing infrastructure, not against it.
The shift to predictable cost models: In a maturing industry, operators need financial predictability. The move toward offering monthly savings plans, which provide TCO benefits for a committed level of use, is an important step beyond pure pay-as-you-go pricing models.
The critical need for broadcast-grade visibility: In our analysis of streaming operations, a lack of real-time visibility is a recurring point of failure. For a major live event, customers cannot wait for next business day response times and require more immediate intervention to ensure the live event runs flawlessly — it’s a fundamental requirement. The use of tools like monitoring as a service (MaaS) during major live events highlights the industry's shift toward proactive, data-driven operations. By providing a "broadcast operating center" view into everything from origin health to end-user quality of service, such tools empower engineering teams to identify and mitigate potential problems before they impact the audience.
A shared outlook on the future: The evolution of content delivery platforms is a clear indicator of the media industry's priorities. The focus is increasingly on providing data-driven scaling, sophisticated operational tooling, and tangible architectural and financial benefits. This move toward solving specific, complex challenges demonstrates a maturing market, and it’s a direction we both believe is critical for the future of broadcasting and streaming.

For technical leaders looking to benchmark their current infrastructure against these trends, exploring modern edge architectures is a logical next step. You can learn more about implementing flexible caching and broadcast grade visibility by visiting the Media CDN documentation.

What’s new with Google Cloud

Fri, 17 Apr 2026 16:00:00 +0000

Want to know the latest from Google Cloud? Find it here in one handy location. Check back regularly for our newest updates, announcements, resources, events, learning opportunities, and more.

Tip: Not sure where to find what you’re looking for on the Google Cloud blog? Start here: Google Cloud blog 101: Full list of topics, links, and resources.

aside_block: <ListValue: []>

Apr 13 - Apr 17

We're excited to announce the Public Preview of Datastream’s metadata integration with Knowledge Catalog. This is the first step in our vision to provide a centralized, "single pane of glass" for all Datastream assets. The enhancement automatically synchronizes Streams, Connection Profiles, and Private Connections, eliminating data silos. It enhances discoverability, allowing you to search for Datastream assets using the same interface as BigQuery tables. Centralized governance is also provided, making your real-time data estate more transparent and easier to manage.
Upgrading Apigee OPDK to 4.53 with OS Modernization
Modernize your infrastructure using Google’s official, sequential upgrade path. Our Technical expert, Rakesh Talanki outlines how to upgrade Apigee OPDK to v4.53 while migrating to a supported OS (RHEL 8.x/9.x). This guide covers the "build-out" methodology, including multi-data center syncing, to ensure a stable, zero-downtime transition

Read the guide
Cloud Run Worker Pools and CREMA: Powering Serverless AI at Scale
Google Cloud has announced the General Availability of Cloud Run worker pools, a new resource type designed specifically for pull-based, non-HTTP workloads. Unlike traditional Cloud Run services that scale based on request traffic, worker pools provide an "always-on" environment for background tasks like processing message queues or running large-scale AI inference. To support this, Google Cloud also open-sourced the Cloud Run External Metrics Autoscaler (CREMA). Built on KEDA, CREMA enables queue-aware autoscaling for worker pools, allowing them to dynamically scale based on external signals like Pub/Sub backlog or Kafka lag.
Apigee Model Context Protocol (MCP) now Generally Available
Expose enterprise APIs as MCP tools for agentic AI applications with the General Availability of MCP in Apigee. This update allows developers to transform APIs into AI-ready tools using OpenAPI Specifications, removing the need for local MCP servers or additional infrastructure. With managed endpoints and semantic search in API hub, you can now provide AI agents with secure, governed access to enterprise data at scale.

Explore the MCP overview

Apr 6 - Apr 10

Community TechTalk: Powering Retail Agents with ADK, UCP & Apigee X
Move beyond basic chatbots to secure, transactional AI experiences. Join our Community TechTalk on April 16 to learn how Apigee X and Gemini build a "Trust Layer" for AI shopping assistants using UCP standards. We’ll demonstrate how to block prompt injections with Model Armor and implement cost governance via token limits to secure the path from discovery to purchase.

Register for the TechTalk
Implement multimodal capabilities in your AI agents
Explore three new reference architectures for building sophisticated multi-agent AI systems that can process and analyze multimodal data. To analyze disparate multimodal data and produce a high-confidence classification, see Classify multimodal data. To create a fluid conversational AI that processes audio and video streams in real time, see Enable live bidirectional multimodal streaming. To consolidate fragmented multimodal data into a searchable knowledge graph, see Multimodal GraphRAG resource orchestration.
Automate SecOps workflows with an agentic AI system
To accelerate incident response and reduce manual toil for your security team, you need a system that can automate remediation playbooks. Our new reference architecture helps you build an AI agent that orchestrates complex triage and investigation workflows across disparate security tools, such as SIEM, CSPM, and EDR, from a single interface. See the full guide to orchestrate security operations workflows.

Mar 30 - Apr 3

ASEAN Webinar | April 30: Mastering Agentic Governance at Scale with GCP
As AI agents move from experimental pilots to core enterprise functions, governance is the critical next step. Join Google Cloud experts Shilpi Puri & Wely Lau for a webinar on April 30th at 11:00 AM SGT to learn how to architect a secure AI Management layer. We’ll explore developing governed MCP endpoints, managing tool access to enterprise data, and operationalizing AI with robust audit logs. The session includes a live demo of these frameworks in action on Google Cloud.

RSVP here.

Mar 23 - Mar 27

Turn your API sprawl into an agent-ready catalog
As organizations scale, APIs often become scattered across multiple gateways, creating "blind spots" that hinder AI adoption. To solve this, we’ve introduced two new capabilities for Apigee API hub: a new integration with API Gateway to automatically centralize API metadata into a single control plane, and a specification boost add-on (now in public preview). This add-on uses AI to enhance your API documentation with the precise examples and error codes that AI agents need to function reliably.

Read the full blog post to get started.
Webinar | April 16: AI Command & Control
As AI agents move from experimental pilots to core enterprise functions, governance is the critical next step. Join Google Cloud expert Satyam Maloo for a webinar on April 16th at 11:00 AM IST to learn how to architect a secure AI Management layer. We’ll explore developing governed MCP endpoints, managing tool access to enterprise data, and operationalizing AI with robust audit logs. The session includes a live demo of these frameworks in action on Google Cloud.

RSVP here.
Modernizing and Decoupling Event Ingestion with Apigee
In modern cloud-native architectures, decoupling producers from consumers is critical for building resilient systems. While Google Cloud Pub/Sub provides a scalable backbone, exposing it directly to external clients can introduce security and management overhead. This new guide explores how to leverage Apigee as an intelligent HTTP ingestion point. Learn how to handle security, mediation, and traffic control before messages reach your internal bus using the PublishMessage policy or Pub/Sub API.

Read the full guide.

Mar 16 - Mar 20

Gemini-powered Assistant in BigQuery Studio Gets Context-Aware Upgrades
The Gemini-powered assistant in BigQuery Studio has been transformed into a fully context-aware analytics partner, supporting your entire data lifecycle. The new capabilities include intelligent resource discovery, which uses Dataplex Universal Catalog search to find resources across projects and deep dive into metadata using natural language. You can now automate tasks, such as scheduling production-grade queries directly through the chat interface, and instantly troubleshoot long-running or failed jobs with root cause analysis and cost control auditing.

Explore the full range of what the assistant can do.

Mar 9 - Mar 13

Want to use Gemini to develop code and don't know where to start?
This article includes a couple of examples of developing code with Gemini prompts; it identified changes that were needed to be made to get the code working. The article also refers to other examples that are available on github.

Mar 2 - Mar 6

Introducing Gemini 3.1 Flash-Lite, our fastest and most cost-efficient Gemini 3 series model. Built for high-volume developer workloads at scale, 3.1 Flash-Lite delivers high quality for its price and model tier. Gemini 3.1 Flash-Lite can tackle tasks at scale, like high-volume translation and content moderation, where cost is a priority. And it can also handle more complex workloads where more in-depth reasoning is needed, like generating user interfaces and dashboards, creating simulations or following instructions.

Starting today, 3.1 Flash-Lite is rolling out in preview to enterprises via Vertex AI and developers via the Gemini API in Google AI Studio.
TechTalk: Implementing Device Authorization Grant (RFC 8628) for Apigee
Learn how to authorize "headless" devices like Smart TVs or AI agents that lack keyboards and browsers. Join our Community TechTalk on March 19 (5PM CET / 12PM EDT) to go under the hood of Apigee X/Hybrid. We’ll cover the real-world mechanics of state management, polling, and human-in-the-loop security patterns for devices and autonomous agents.

Register for the TechTalk

Feb 23 - Feb 27

Pro-level image generation gets faster and more accessible with Nano Banana 2
Nano Banana 2 is our state-of-the-art image generation and editing model. It delivers Pro-level image generation and editing at the speed you expect from Flash — making the quality, reasoning, and world knowledge you loved about Nano Banana Pro more accessible. Learn more about the model here.

The Intelligent Path to Compliance: Transforming Regulatory QC with Google Cloud
Reducing "Refuse to File" (RTF) risks and submission cycle times is critical for life sciences leaders. Google Cloud’s Regulatory Submission Semantic QC Auditor leverages Gemini and RAG architecture to transform Quality Control from a manual burden into an active, intelligent workflow.

By automating semantic cross-referencing, narrative coherence checks, and dynamic guidance-based auditing, this solution ensures rigorous accuracy and auditability. Operating within a secure GxP-ready environment, it empowers teams to detect subtle inconsistencies and generate remediation plans without sacrificing data privacy.

Learn more.
Stop typing, start interacting! The Gemini Live Agent Challenge is here. Build immersive agents that can help you see, hear, and speak using Gemini and Google Cloud. Compete for your share of $80,000+ in prizes and a trip to Google Cloud Next '26!

Submissions are open from February 16, 2026 to March 16, 2026. Learn more and register at geminiliveagentchallenge.devpost.com

Feb 9 - Feb 13

Introducing Gemini 3.1 Pro on Google Cloud.
3.1 Pro is a noticeably smarter, more capable baseline for complex problem-solving. We’re shipping 3.1 Pro at scale, building upon our goal to help you transform your business for the agentic future. Learn more about the model’s capabilities here. Gemini 3.1 Pro is available starting today in preview in Vertex AI and Gemini Enterprise. Developers can access the model in preview via the Gemini API in Google AI Studio, Android Studio, Google Antigravity, and Gemini CLI.
Automate Storage Compatibility with GKE Dynamic Default Storage Classes
Managing storage across mixed-generation VM clusters in GKE just got easier. With the new Dynamic Default Storage Class, Google Kubernetes Engine automatically selects between Persistent Disk (PD) and Hyperdisk based on a node's specific hardware compatibility. This abstraction eliminates the need for complex scheduling rules and manual pairing, ensuring your volumes "just work" regardless of the underlying infrastructure. By defining both variants in a single class, you reduce operational overhead while maintaining peak performance and cost-efficiency across your entire cluster.

Explore automated disk type selection
Community TechTalk: AI-Powered Apigee Development with strofa.io
Join the Apigee community on February 26 for a deep dive into strofa.io. Guest speaker Denis Kalitviansky will demonstrate how this new AI-powered tool automates and orchestrates Apigee development, from local emulators to large-scale hybrid environments. Discover how to scale your API management and streamline team collaboration using the latest in AI-driven automation.

Register now to reserve your spot.

Jan 26 - Jan 30

Simplify API Governance with Native OpenAPI v3 Support
Eliminate integration debt and accelerate deployment velocity with the General Availability of OpenAPI v3 (OASv3) support for API Gateway and Cloud Endpoints. You no longer need to downgrade modern specifications to OASv2. Instead, you can now define API contracts and enforce critical policies—including telemetry, quotas, and security—using native Google-specific extensions directly within your OASv3 files. This update ensures your APIs are secure by design while remaining fully compatible with the modern developer ecosystem and Google Cloud’s AI services.

Get started with OpenAPI v3 on API Gateway and Cloud Endpoints.

Accelerate API Testing with the New Open Source API Tester
Start validating your APIs with API Tester, a simple, YAML-based Test Driven Development (TDD) framework. Designed for the Apigee community, this tool allows you to write human-readable tests, run them instantly via a web client or CLI, and perform deep unit testing on Apigee proxies. With native support for JSONPath assertions and Apigee shared flows, you can verify everything from payload data to internal variables like proxy.basepath without leaving your terminal.

Explore the API Tester guide and start testing your proxies today.
Secure Sensitive Data with Kubernetes Secrets in Apigee hybrid
Enhance security in Apigee hybrid by accessing Kubernetes Secrets directly within your API proxies. This hybrid-exclusive feature keeps sensitive credentials within your cluster boundary and prevents replication to the management plane. It supports strict separation of duties: operators manage secrets via kubectl, while developers reference them as secure flow variables—ideal for high-compliance and GitOps workflows.

Implement Kubernetes Secrets in your hybrid proxies.
See the Console in a Whole New Light: Dark Mode is Now Generally Available in Google Cloud
Elevate your cloud management workflow with Dark Mode, now generally available in the Google Cloud console. We have delivered a modern, cohesive, and accessible experience reimagined for maximum comfort and productivity—especially during extended working hours and low-light environments. Dark Mode can be enabled automatically based on your operating system's preference, or manually through the Settings -> Appearance menu.

Switch to Dark Mode today to enjoy a modern, comfortable, and productive environment!
Apigee X Networking: PSC or VPC Peering?
Deciding how to connect Apigee X? Watch this video to compare Private Service Connect and VPC Peering. We break down northbound and southbound routing, IP consumption, and how to reach targets on-prem or in the cloud. Learn to simplify your architecture and avoid common networking "gotchas" for a smoother deployment.

Watch the video.

Jan 19 - Jan 23

Bridge the Gap: Excel-to-API Conversion in Apigee Portals
Give your customers more ways to connect! This new article by Tyler Ayers explores how to extend the Apigee Integrated Portal to support direct Excel file uploads. By leveraging SheetJS and custom portal scripts, you can enable users to upload spreadsheets, preview data, and submit it directly to your APIs, all without writing a single line of integration code themselves. It’s a powerful way to simplify onboarding for those who aren't yet API-ready.

Learn how to build it.
Elevate your applications with Firestore’s new advanced query engine
We have fundamentally reimagined Firestore with pipeline operations for Enterprise edition. Experience a powerful new engine featuring over a hundred new query features, index-less queries, new index types, and observability tooling to improve query performance. Seamlessly migrate using built-in tools and leverage Firestore’s existing differentiated serverless foundation, virtually unlimited scale, and industry-leading SLA. Join a community of 600K developers to craft expressive applications that maximize the benefits of rich queryability, real-time listen queries, robust offline caching, and cutting-edge AI-assistive coding integrations.

Learn more about Firestore pipeline operations.

Create Expert Content: Deploying a Multi-Agent System with Terraform and Cloud Run

Fri, 17 Apr 2026 08:56:00 +0000

In support of our mission to accelerate the developer journey on Google Cloud, we built Dev Signal: a multi-agent system designed to transform raw community signals into reliable technical guidance by automating the path from discovery to expert creation.

In the first three parts of this series, we laid the essential groundwork by establishing its core capabilities and local verification process:

In part 1, we standardize the agent's capabilities through the Model Context Protocol (MCP), connecting it to Reddit for trend discovery and Google Cloud Docs for technical grounding. In part 2, we built a multi-agent architecture and integrated the Vertex AI memory bank to allow the system to learn and persist user preferences across different conversations. In part 3, we verified the full end-to-end lifecycle locally using a dedicated test runner to ensure that research, content creation, and cloud-based memory retrieval were perfectly synchronized.

If you’d like to dive straight into the code, you can clone the repository here.

Deployment to Cloud Run and the Path to Production

To help you transition from this local prototype to a production service, this final part focuses on building the production backbone of your agent using the foundational deployment patterns provided by the Agent Starter Pack. We will implement the essential structural components required for monitoring, data integrity, and long-term state management in the cloud. You will learn to implement the application server and helper utilities needed for a production-ready deployment before provisioning secure, reproducible infrastructure with Terraform.

While the Dockerfile packages your agent's code and its specialized dependencies, such as Node.js for the Reddit MCP tool, Terraform is used to build the platform it lives on. Terraform automates the creation of your Artifact Registry, least-privilege service accounts, and Secret Manager integrations to ensure your API keys remain protected.

By the end of this part, you will have a standardized application framework deployed on Google Cloud Run and a roadmap for graduating your prototype through continuous evaluation, CI/CD and advanced observability.

Production Utilities and Server: Building the System's Body

In this section, you implement the structural components required for monitoring and long-term state management in the cloud.

The Application Server: Initializing the FastAPI server and establishing a vital connection to the Vertex AI memory bank.
Implementing Telemetry: Enabling 'Agent Traces' for visibility into internal reasoning.

The Application Server

The fast_api_app.py file serves as the vital entry point for your agent, transforming the core logic into a production FastAPI server that acts as the "body" of your system. When deploying to Cloud Run, this server is essential because it provides the necessary web interface to listen for incoming HTTP requests and dispatch them to the agent for processing. Beyond basic serving, its most critical role is establishing a connection to the Vertex AI memory bank by defining a MEMORY_URI, which allows the ADK framework to persist and retrieve user preferences across different production sessions. Additionally, the application server initializes production-grade telemetry for real-time monitoring.

Go back to the dev_signal_agent folder.

code_block: <ListValue: [StructValue([('code', 'cd ..'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd130>)])]>

Paste the following code in dev_signal_agent/fast_api_app.py:

code_block: <ListValue: [StructValue([('code', 'import os\r\nfrom fastapi import FastAPI\r\nfrom google.adk.cli.fast_api import get_fast_api_app\r\nfrom google.cloud import logging as cloud_logging\r\nfrom vertexai import agent_engines\r\nfrom dev_signal_agent.app_utils.env import init_environment\r\n\r\n# --- Initialization & Secure Secret Retrieval ---\r\n# We now unpack the SECRETS dictionary returned by our updated env.py\r\nPROJECT_ID, MODEL_LOC, SERVICE_LOC, SECRETS = init_environment()\r\nlogger = cloud_logging.Client().logger(__name__)\r\n\r\n# Access sensitive credentials from the SECRETS dictionary \r\n# These keys stay in memory and are NOT injected into os.environ\r\nREDDIT_CLIENT_ID = SECRETS.get("REDDIT_CLIENT_ID")\r\nREDDIT_CLIENT_SECRET = SECRETS.get("REDDIT_CLIENT_SECRET")\r\nREDDIT_USER_AGENT = SECRETS.get("REDDIT_USER_AGENT")\r\nDK_API_KEY = SECRETS.get("DK_API_KEY")\r\n\r\n# --- Configuration & Sessions ---\r\nAGENT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\r\n# Non-sensitive configuration uses environment variables \r\nBUCKET = os.environ.get("AI_ASSETS_BUCKET") \r\nUSE_IN_MEMORY = os.environ.get("USE_IN_MEMORY_SESSION", "").lower() in ("true", "1")\r\n\r\n# --- MEMORY BANK CONNECTION ---\r\ndef _get_memory_bank_uri():\r\n if USE_IN_MEMORY: return None, None\r\n # We use \'dev_signal_agent\' as the display name for the Vertex AI memory bank\r\n name = os.environ.get("AGENT_ENGINE_MEMORY_BANK_NAME", "dev_signal_agent") \r\n existing = list(agent_engines.list(filter=f"display_name={name}"))\r\n ae = existing[0] if existing else agent_engines.create(display_name=name)\r\n uri = f"agentengine://{ae.resource_name}"\r\n print(f"DEBUG: Connecting to Memory Bank: {uri} (display_name={name})")\r\n return uri, uri\r\n\r\nSESSION_URI, MEMORY_URI = _get_memory_bank_uri()\r\n\r\n# --- Initialize FastAPI with ADK ---\r\napp: FastAPI = get_fast_api_app(\r\n agents_dir=AGENT_DIR,\r\n web=True,\r\n artifact_service_uri=f"gs://{BUCKET}" if BUCKET else None,\r\n allow_origins=os.getenv("ALLOW_ORIGINS", "").split(",") if os.getenv("ALLOW_ORIGINS") else None,\r\n session_service_uri=SESSION_URI,\r\n memory_service_uri=MEMORY_URI, # <--- Connects the Memory Bank\r\n otel_to_cloud=True, # <--- Enables production telemetry\r\n)\r\n\r\nif __name__ == "__main__":\r\n import uvicorn\r\n # Standard Cloud Run port is 8080 \r\n uvicorn.run(app, host="0.0.0.0", port=8080)'), ('language', 'lang-py'), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd8b0>)])]>

Implementing Telemetry

In a production environment, visibility into your agent's reasoning is critical. We leverage the built-in observability features of the Google ADK by setting the otel_to_cloud=True flag in our application server. This single parameter handles the majority of the instrumentation automatically, exporting "Agent Traces" directly to the Google Cloud Console. These traces provide a "visual waterfall" of the agent's operation, including individual agent thought processes, LLM invocations, and MCP tool calls.

Monitoring vs. Targeted Evaluation

It is essential to understand that production tracing is subject to sampling to balance performance and cost. Because Cloud Run captures only a subset of requests, not every individual user interaction will be visible.

System Traces (Monitoring): Used to analyze behavior "at large," such as identifying latency bottlenecks or system timeouts.
Reasoning Traces (Evaluation): High-quality evaluation mandates targeted trace capture. This means calling the agent specifically for a test case where you know you will evaluate that particular request in full detail.

Viewing the Trace

To see your traces, navigate to the Trace Explorer in the Google Cloud Console and filter for your service (e.g., dev-signal). Clicking a specific Trace ID opens a Gantt chart that allows you to distinguish between cognitive reasoning failures (wrong decisions) and physical system issues (timeouts).

For advanced configurations, refer to the following documentation:

Infrastructure as Code: Provisioning Secure Cloud Resources

We utilize the infrastructure-as-code patterns provided by the Agent Starter Pack's security-first design. The starter pack builds the professional platform required to automate the creation of least-privilege service accounts and robust secret management in seconds.

Using Terraform ensures that your entire Google Cloud environment - from IAM roles to Secret Manager versions - is defined in reproducible, secure code. We break our infrastructure into the following logical blocks:

Resources & Variables: Define the specific project, region, and sensitive API secrets used by the agent.
Core Infrastructure: Enable essential APIs and provision a private Artifact Registry to host your agent's container images.
Identity & Access Management (IAM): Configure specialized Service Accounts that strictly follow the Principle of Least Privilege to ensure your system remains secure.
Secret Management: Securely ingest API credentials into Google Secret Manager for protected runtime access.
Cloud Run Configuration: Define the container environment, resource limits, and automated secret injection for the final deployment.

To begin provisioning, return to the root folder of your project (dev-signal) and create the necessary deployment directories:

code_block: <ListValue: [StructValue([('code', 'cd ..\r\nmkdir deployment\r\ncd deployment\r\nmkdir terraform\r\ncd terraform'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd580>)])]>

Terraform Resources and Variables

The variables.tf file defines the configurable parameters for your deployment, allowing you to customize the infrastructure without altering the underlying logic. It includes variables for the project_id, the deployment region (defaulting to us-central1), and the service_name for your Cloud Run instance. Furthermore, it defines a secrets map used to securely ingest sensitive API credentials—such as Reddit and Developer Knowledge keys—into Google Secret Manager for runtime access. This modular approach ensures your production environment remains reproducible, secure, and adaptable across different projects.

Paste the following code into deployment/terraform/variables.tf:

code_block: <ListValue: [StructValue([('code', 'variable "project_id" {\r\n description = "The Google Cloud Project ID"\r\n type = string\r\n}\r\nvariable "region" {\r\n description = "The Google Cloud region to deploy to"\r\n type = string\r\n default = "us-central1"\r\n}\r\nvariable "service_name" {\r\n description = "The name of the Cloud Run service"\r\n type = string\r\n default = "dev-signal"\r\n}\r\nvariable "secrets" {\r\n description = "A map of secret names and their values (e.g., REDDIT_CLIENT_ID, DK_API_KEY)"\r\n type = map(string)\r\n default = {}\r\n}\r\nvariable "ai_assets_bucket" {\r\n description = "The GCS bucket for storing AI assets"\r\n type = string\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd9a0>)])]>

Core Infrastructure Logic

We define our infrastructure in logical blocks. Here is what each part does:

1. Enable APIs: Ensures the project has the necessary services active (Cloud Run, Vertex AI, etc.). We use disable_on_destroy = false to prevent accidental data loss if the Terraform is destroyed.

Paste the following code into deployment/terraform/main.tf:

code_block: <ListValue: [StructValue([('code', 'resource "google_project_service" "services" {\r\n project = var.project_id\r\n for_each = toset([\r\n "run.googleapis.com",\r\n "artifactregistry.googleapis.com",\r\n "cloudbuild.googleapis.com",\r\n "aiplatform.googleapis.com",\r\n "secretmanager.googleapis.com",\r\n "logging.googleapis.com"\r\n ])\r\n service = each.key\r\n disable_on_destroy = false\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd760>)])]>

2. Artifact Registry: Creates a private Docker registry to store our agent's container images.

code_block: <ListValue: [StructValue([('code', 'resource "google_artifact_registry_repository" "repo" {\r\n location = var.region\r\n project = var.project_id\r\n repository_id = "dev-signal-repo"\r\n description = "Docker repository for Dev Signal Agent"\r\n format = "DOCKER"\r\n depends_on = [google_project_service.services]\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd790>)])]>

3. Service Account & IAM: Adhering to the Principle of Least Privilege - This is a critical security step. In accordance with the Principle of Least Privilege, we avoid using the default compute service account and instead provision a dedicated user-managed service account (dev-signal-sa). By designating this as the Cloud Run service identity, we can grant it only the minimum necessary permissions—specifically roles/aiplatform.user, roles/logging.logWriter, and roles/storage.objectAdmin. This granular access control ensures that the agent has the exact permissions required to interact with Vertex AI and Cloud Storage without over-granting access to other sensitive cloud resources, significantly reducing the potential impact of a compromised account. Learn more best practices for using service accounts securely.

code_block: <ListValue: [StructValue([('code', 'resource "google_service_account" "agent_sa" {\r\n project = var.project_id\r\n account_id = "${var.service_name}-sa"\r\n display_name = "Dev Signal Agent Service Account"\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd7f0>)])]>

4. Secret Management: This handles your API keys securely. It creates secrets in Google Secret Manager and gives the agent's Service Account permission to access them at runtime.

code_block: <ListValue: [StructValue([('code', 'resource "google_secret_manager_secret" "agent_secrets" {\r\n project = var.project_id\r\n for_each = toset(keys(var.secrets))\r\n secret_id = each.key\r\n replication {\r\n auto {}\r\n }\r\n depends_on = [google_project_service.services]\r\n}\r\n\r\nresource "google_secret_manager_secret_version" "agent_secrets_version" {\r\n for_each = toset(keys(var.secrets))\r\n secret = google_secret_manager_secret.agent_secrets[each.key].id\r\n secret_data = var.secrets[each.key]\r\n}\r\n\r\nresource "google_secret_manager_secret_iam_member" "secret_accessor" {\r\n project = var.project_id\r\n for_each = toset(keys(var.secrets))\r\n secret_id = google_secret_manager_secret.agent_secrets[each.key].id\r\n role = "roles/secretmanager.secretAccessor"\r\n member = "serviceAccount:${google_service_account.agent_sa.email}"\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd1f0>)])]>

5. Cloud Run Configuration:

Security Best Practice: To satisfy production security standards, our main.tf grants the Service Account the secretmanager.secretAccessor role. Our Python application then uses the Secret Manager SDK to pull these credentials directly into local memory at runtime, ensuring they never touch the container's environment configuration

code_block: <ListValue: [StructValue([('code', '# 6. Cloud Run Service Deployment\r\nresource "google_cloud_run_v2_service" "default" {\r\n project = var.project_id\r\n name = var.service_name\r\n location = var.region\r\n ingress = "INGRESS_TRAFFIC_ALL"\r\n\r\n template {\r\n service_account = google_service_account.agent_sa.email\r\n \r\n containers {\r\n image = "us-docker.pkg.dev/cloudrun/container/hello" # Placeholder until first build\r\n \r\n env {\r\n name = "GOOGLE_CLOUD_PROJECT"\r\n value = var.project_id\r\n }\r\n env {\r\n name = "GOOGLE_CLOUD_LOCATION"\r\n value = "global"\r\n }\r\n env {\r\n name = "GOOGLE_GENAI_USE_VERTEXAI"\r\n value = "True"\r\n }\r\n env {\r\n name = "AI_ASSETS_BUCKET"\r\n value = var.ai_assets_bucket\r\n }\r\n\r\n resources {\r\n limits = {\r\n cpu = "1"\r\n memory = "2Gi"\r\n }\r\n }\r\n }\r\n }\r\n \r\n traffic {\r\n type = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"\r\n percent = 100\r\n }'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cda90>)])]>

Provision the Infrastructure

Before we can deploy our code, we need to provision the Google Cloud infrastructure we just defined.

Initialize Terraform: This downloads the necessary provider plugins. Run this in deployment/terraform folder:

code_block: <ListValue: [StructValue([('code', 'terraform init'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd9d0>)])]>

Create a Variables File:

Paste this code in deployment/terraform/terraform.tfvars and update it with your project details and secrets.

code_block: <ListValue: [StructValue([('code', 'project_id = "your-project-id"\r\nregion = "us-central1"\r\nservice_name = "dev-signal"\r\nai_assets_bucket = "your-bucket-name"\r\nsecrets = {\r\n REDDIT_CLIENT_ID = "your_client_id"\r\n REDDIT_CLIENT_SECRET = "your_client_secret"\r\n REDDIT_USER_AGENT = "your_user_agent"\r\n DK_API_KEY = "your_dk_api_key"\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd520>)])]>

Plan configuration: This allows you to review the changes before they are applied. Run this in the deployment/terraform folder:

code_block: <ListValue: [StructValue([('code', 'terraform plan -out=plan.tfplan'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cdac0>)])]>

Apply Configuration: Once you have reviewed the plan and confirmed it does what you want, run:

code_block: <ListValue: [StructValue([('code', 'terraform apply plan.tfplan'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d35cd160>)])]>

Deployment: Containerization and the Cloud Build Pipeline

In this final stage of the build process, we package our agent's "body" and "brain" into a portable, production-ready container. This ensures that every component - from our Python logic to the Node.js environment required for the Reddit MCP tool - is bundled together with its exact dependencies.

We utilize a Dockerfile to define this environment and a Makefile to orchestrate the deployment pipeline. When you trigger the deployment, Google Cloud Build takes your local source code, builds the container image according to the Dockerfile, and stores it in the private Artifact Registry created earlier by Terraform. Finally, the pipeline automatically updates your Cloud Run service to serve traffic using this fresh image, completing the journey from local code to a live, secure cloud workload.

Paste this code in dev-signal/Dockerfile:

code_block: <ListValue: [StructValue([('code', 'FROM python:3.12-slim\r\n\r\n# Install Node.js and npm for MCP tools (like reddit-mcp)\r\nRUN apt-get update && apt-get install -y \\\r\n curl \\\r\n && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \\\r\n && apt-get install -y nodejs \\\r\n && npm install -g reddit-mcp \\\r\n && apt-get clean \\\r\n && rm -rf /var/lib/apt/lists/*\r\n\r\nRUN pip install --no-cache-dir uv==0.8.13\r\n\r\nWORKDIR /code\r\n\r\nCOPY ./pyproject.toml ./README.md ./uv.lock* ./\r\nCOPY ./dev_signal_agent ./dev_signal_agent\r\n\r\nRUN uv sync --frozen\r\n\r\nEXPOSE 8080\r\n\r\nCMD ["uv", "run", "uvicorn", "dev_signal_agent.fast_api_app:app", "--host", "0.0.0.0", "--port", "8080"]'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d07cde50>)])]>

The Makefile automates the build and deploys.

Paste this code in dev-signal/Makefile:

code_block: <ListValue: [StructValue([('code', 'PROJECT_ID ?= $(shell gcloud config get-value project)\r\nREGION ?= us-central1\r\nIMAGE_REPO ?= dev-signal-repo\r\nIMAGE := $(REGION)-docker.pkg.dev/$(PROJECT_ID)/$(IMAGE_REPO)/agent:latest\r\n\r\n# Deploy via Cloud Build & Container\r\ndocker-deploy:\r\n\t@echo "? Building and deploying to $(PROJECT_ID) via Cloud Build..."\r\n\tgcloud builds submit --tag $(IMAGE) --project $(PROJECT_ID) .\r\n\tgcloud run services update dev-signal \\\r\n\t\t--image $(IMAGE) \\\r\n\t\t--region $(REGION) \\\r\n\t\t--project $(PROJECT_ID) \\\r\n--labels dev-tutorial=dev-signal-agent'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d07cd970>)])]>

Deploy Application

Now that our infrastructure is ready, we can build and deploy the application code.

Run the following command from the root of your project:

code_block: <ListValue: [StructValue([('code', 'make docker-deploy'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d07cdb20>)])]>

What happens when you run this?

Build: Google Cloud Build takes your local code and the Dockerfile, builds a container image, and stores it in the Artifact Registry.
Deploy: It updates the Cloud Run service defined in Terraform to use this new image.

When the deployment completes, you should get a message like this:

Service [dev-signal] revision [dev-signal...] has been deployed and is serving 100 percent of traffic.

Service URL: https://dev-signal-...-.us-central1.run.app

Verification: Accessing and Testing Your Deployed Agent

Since production services are private by default, this section covers how to grant permissions and access the agent securely.

Managing IAM Permissions: Granting the necessary run.invoker role to authorized users.

Secure Access via Cloud Run Proxy: Using the gcloud proxy to interact with your live service.

Granting User Permissions

Before you can invoke the service, you must grant your Google account the roles/run.invoker role for this specific service. Run the following command:

code_block: <ListValue: [StructValue([('code', 'gcloud run services add-iam-policy-binding dev-signal \\\r\n --member="user:$(gcloud config get-value account)" \\\r\n --role="roles/run.invoker" \\\r\n --region=us-central1 \\\r\n --project=$(gcloud config get-value project)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d07cd6d0>)])]>

Launch the Proxy

Now, access your private service securely via the proxy:

code_block: <ListValue: [StructValue([('code', 'gcloud run services proxy dev-signal \\\r\n --region us-central1 \\\r\n --project $(gcloud config get-value project)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d07cd400>)])]>

Visit http://localhost:8080 to chat with your deployed agent! See a possible test scenario in part 3 of the series.

Summary

Congratulations! You have successfully built Dev Signal.

What we covered:

Tooling (MCP): You connected your agent to Reddit, Google Docs, and a Local Image Generator using the Model Context Protocol.
Architecture: You implemented a Root Orchestrator managing specialized agents (Scanner, Expert, Drafter).
Memory: You integrated Vertex AI memory bank to give your agent long-term persistence across sessions.
Production: You deployed the entire stack to Google Cloud Run using Terraform for secure, reproducible infrastructure.

You now have a solid foundation for building sophisticated, stateful AI applications on Google Cloud.

How WPP accelerates humanoid robot training 10x with G4 VMs

Thu, 16 Apr 2026 16:00:00 +0000

Editor’s note: Today we hear from Perry Nightingale, SVP of Creative AI at WPP about the workflow that cuts training time for humanoid robots from days to minutes — plus access to the open-source code to do it yourself.

Robots are pushing the boundaries of what content creators and directors can capture. These technologies have become critical in the film industry because they open up new possibilities for controlled camera moves in locations where traditional methods would be unsafe or infeasible.

We’ve found that the programming for these robots is arguably as technical and complicated as the shoots they’re being tested on. To achieve our goals, we needed a hardware stack that was equally advanced as the robots we’d be programming. In this post, we explore how WPP used the new G4 VM instance powered by NVIDIA RTX PRO 6000 Blackwell on Google Cloud, which is a great fit for the unique challenges of training physical AI.

While robotics is always a complex task, especially in the environments we were working in, thanks to the unique software stack we were using, we were able to reduce training cycles from 24 hours down to less than one.

Below, we detail the specific reinforcement learning (RL) workflow, the challenges of the "sim-to-real" gap, and the infrastructure that makes it possible.

The lessons learned here apply far beyond entertainment. Our process for mastering complex, natural movement on a film set can be replicated across industries to overcome the massive computational complexity of training robots.

Where we started: redefining the agency model

WPP is one of the world’s largest marketing organizations, handling $70 billion of media for enterprise clients. For us, building AI into our production workflows meant fundamentally redefining the agency model, both in terms of processes, relationships, and tools. Notably, we launched WPP Open last year, our proprietary AI operating platform, where we’re able to take the best of Gemini’s multimodal intelligence, along with other models, and incorporate them directly into every creative step.

The results were immediate. For one of our clients, Verizon, we built an AI-infused promo pipeline that delivered 15 videos in 70% less time, with 50% to 70% efficiency gains across the production cycle. WPP Open has proven so effective for our teams, we’ve begun offering it to our clients, so they can tackle projects in new ways and we can collaborate faster and better.

WPP Open has also challenged and inspired us to look for more ambitious applications of AI. With the latest advancements in Google Cloud’s AI Infrastructure, we saw an opportunity to tackle more complex problems at the cutting edge of creative development.

Why teach a robot to dance?

Our robotics work started with teaching a machine to dance — and not just because we knew a dancing robot would make for a compelling demo. Dance, along with martial arts, is generally accepted as the cutting edge of complex human motion. Mastering these complex movements is a critical step toward achieving natural robotic motion.

For our benchmarking project, we trained our robot to perform a dance sequence captured in a previous project with Universal Music Group.

The workflow

To achieve this complex motion, we needed a workflow that could iterate fast.

We captured human motion with the OptiTrack mocap system and retargeted it to an official OpenUSD digital twin of the robot. This is a complex engineering challenge: a human has over 200 degrees of freedom compared to just 29 on a robot. So our team needed to remap the human skeletal data to the far more constrained physical structure of our robot, creating a sophisticated 3D model.

MuJoCo, an open source physics engine by Google DeepMind, was a critical piece of simulation software that validated our accuracy continuously, in real-time.

The workflow then moves to reinforcement learning. In our previous environment using single on-premises GPUs, training took ten hours. This time, we used G4 VMs, together with the NVIDIA Isaac Sim image on Google Cloud Marketplace. Google Cloud’s unique innovations, such as… with G4 enabled us to utilize a P2P topology that moves data directly between GPUs without the bottleneck of central processing.

Using Google Cloud’s AI Hypercomputer, we saw speed increases in excess of 10x, taking training times down to less than one hour.

Over the training run, the digital twins of the robots are rewarded for getting closer to the intended motion sequence while under the simulated effects of physical gravity, momentum, friction, and small simulated “pushes” that might be expected forces in the real world.

As the simulation training begins, the robots fall almost instantly (top). After about 3 billion simulations, the robots have learned the complex dance sequence (bottom).

Bridging the "sim-to-real" gap

The "sim-to-real" gap is one of the toughest challenges in robotics. A policy that works perfectly in the above workflow often fails in the physical world due to unmodeled physics or sensor noise. A foot might land differently due to small changes in carpet friction or a gap in the floor.

We ran billions of simulations to develop the reinforcement learning model, which was then condensed into an ONNX policy and deployed to the robots. These policies take real-time observations from the robot — IMU data, joint positions, etc. — and return the necessary movements.

Through high-volume simulation, the humanoid learned how to respond to these small changes and determine what move to make next to keep the sequence on track. Again, we used MuJoCo for critical real-time validation, ensuring that the robot's ability to adapt in simulation translated to safety and stability in the real world.

What’s Next

To accompany this project, Unitree has released their in-house reinforcement learning code as a sample project on GitHub. Alongside the NVIDIA Isaac Sim image on Google Cloud Marketplace, this means almost instant access to advanced robotic motion research.

Check it out for yourself:

Explore: Unitree Robotics RL on GitHub
Deploy: NVIDIA Isaac Sim on Google Cloud Marketplace
Learn more: G4 VM Instance Documentation

Go from blank slate to analysis with BigQuery Studio notebook gallery templates

Thu, 16 Apr 2026 16:00:00 +0000

For many data professionals, the most daunting part of a new project isn't the complexity of the data or the sophistication of the model, it’s the "blank slate." Staring at an empty notebook while creating a data cleaning pipeline from scratch, or searching for the best way to run time-series forecasting can stall your momentum before the real analysis even begins.

Today, we’re excited to announce the general availability (GA) of the BigQuery Studio notebook gallery. This curated collection of pre-built templates is designed to help you bypass the setup phase and jump straight into discovery.

Quickly browse through the notebook gallery and launch a template with a single click.

Move past the blank slate with curated templates

BigQuery Studio notebooks bring the power of Colab Enterprise directly into the BigQuery UI, providing a smooth transition between SQL-based data prep, Spark-powered processing, and Python-based analysis. The notebook gallery supports this unified experience with templates tailored to different skill sets and objectives.

For SQL developers: Many users are comfortable with SQL but want to explore the expanded capabilities of a notebook environment. Templates in the gallery demonstrate how to use SQL cells to load data and then use visualization cells for no-code charts, making it easier to share insights without writing extensive Python.
For data scientists: Python and Spark users can find ready-to-use workflows for data cleaning, transformation, and advanced ML development using BigQuery DataFrames and Spark libraries. These templates follow best practices, so that your code stays efficient and takes full advantage of BigQuery's distributed engine.

Choose the right template for your project

The gallery is organized to help you find the right starting point for your specific goals, from data analysis and visualization to building advanced data science workflows.

If you're starting your journey with BigQuery Studio notebooks, the gallery offers several introductory templates:

Introduction to notebooks in BigQuery Studio: A high-level tour that covers SQL cells, visualization cells, Python-based visualizations, and running AI predictions.
Getting started for SQL users: A guide for those comfortable with SQL who want to make queries dynamic with Python variables and visualize findings, without writing complex code.
Getting started for Python users: A workflow focused on using BigQuery DataFrames to clean, merge, and analyze datasets.
Getting started with Spark: A hands-on guide to launching serverless Apache Spark sessions in BigQuery Studio to join, analyze, and visualize BigQuery data using Spark SQL and Python.

For seasoned notebook users, you can leverage specialized templates to handle complex analytical workflows:

Generative AI & Multimodal Analysis: Unify structured and unstructured data. Use the Analyze multimodal data in BigQuery template to apply Gemini models to images or audio files and return insights directly as SQL results.
Machine Learning Development: Accelerate the ML lifecycle with the Exploratory data analysis with BigQuery DataFrames template, which uses BigFrames to perform feature engineering and model training at scale. For distributed workloads, the E-commerce purchase predictions with Apache Spark ML template provides a complete, serverless workflow for training predictive models on BigQuery data.
Data Pipelines & Transformation: Master data reliability and real-time streaming. Use the Data Quality and Profiling with BigFrames template for cleaning datasets, or the Real Time Data Export to Pub/Sub template for operationalizing data with continuous queries.

The introduction to notebooks template is a great one to open for any new project as it covers the major features of BigQuery Studio notebooks.

Access the gallery in your workflow

You can find the gallery directly in the BigQuery Studio console:

1. From the welcome page: Navigate to the "Welcome to BigQuery Studio" page and click View notebook gallery.

2. From the asset menu: Click the (+) icon to create a new asset, select Notebook, and then choose All templates.

The gallery allows you to filter by task, such as data transformation or predictive analysis, so you can find the specific workflow that matches your goals. When you find the right template, you can open a read-only version to preview it and then click a button to add a copy to your project.

Get started

Open the notebook gallery in BigQuery Studio today to find a template for your next project.

Open the gallery: Explore the curated collection in the BigQuery console.
Read the documentation: Learn more about how to use these templates in our official guide.

What’s new with Google Data Cloud

Thu, 16 Apr 2026 16:00:00 +0000

April 13 - April 17

We announced we are reintroducing Data Studio to play a significant role in the AI era, expanding from data visualizations and reports to host BigQuery conversational agents and data apps built in Colab notebooks.
We announced BigQuery Graph is now available in preview, offering an easy-to-use, highly scalable graph analytics solution, empowering data professionals to model, analyze and visualize massive-scale relationships in an entirely new way.

April 6 - April 10

We introduced Conversational Analytics for Looker Embedded environments, enabling users to add natural language experiences to their own custom data-driven applications, powered by Gemini.
We expanded Looker’s capabilities for faster ad-hoc analysis, with the introduction of self-service Explores, enabling you to bring your own data to Looker’s semantic layer and gain instant access to insights in a governed data environment.

March 23 - March 27

We showed you how you can scale your reads with Cloud SQL autoscaling read pools. This feature allows you to provision multiple read replicas that are accessible via a single read endpoint and to dynamically adjust your read capability based on real-time application needs.
Our customers are leveraging the full power of Conversational Analytics and Looker to drive major business and technical breakthroughs in the AI era. Companies like Telenor, Pet Circle, Fluent Commerce, Lighthouse Intelligence, Wego, and ROLLER are turning data into insights and actions, grounded by Looker’s semantic layer.

March 16 - March 20

We introduced an enhanced Gemini assistant in BigQuery Studio, transforming the agent from a code assistant into a fully context-aware analytics partner.

February 23 - February 27

We introduced managed and remote MCP support for Google Cloud databases, including AlloyDB, Spanner, Cloud SQL, Bigtable and Firestore, to power the next generation of agents. This announcement extends the ability for AI models to plan, build, and solve complex problems, connecting to the database tools our customers leverage daily as the backbone of their work environment.
We outlined how you can build a conversational agent in BigQuery using the Conversational Analytics API to help you build context-aware agents that can understand natural language, query your BigQuery data, and deliver answers in text, tables, and visual charts.

February 16 - February 20

Our customers are leveraging the full power of Looker to drive major business and technical breakthroughs. Companies like Arrive, Audika, Carousell, Framebridge, GumGum, Intel, Overdose Digital, Ocean Network Express, Subskribe and Promevo are leveraging Looker’s newest AI-driven capabilities, including Conversational Analytics, to transform data to insights and actions, and empower their entire organization with a single source of truth, powered by Looker’s semantic layer.

February 2 - February 6

Join us on March 4 for our webinar, Win Your AI Strategy with Cloud SQL Enterprise Plus, to learn how to power your generative AI workloads with 3x higher performance and 99.99% availability. Register today to discover how to build a scalable, enterprise-grade foundation for your most demanding AI applications.

January 26 - January 30

We introduced Conversational Analytics in BigQuery, which allows users to analyze data using natural language. Conversational Analytics in BigQuery is an intelligent agent that generates, executes and visualizes answers grounded in your business context directly in BigQuery Studio, making data insights for data professionals more conversational.
We outlined how data products have become the foundation for AI agents, providing the context needed to make autonomous agents reliable and trusted for real business use, backed by organized business logic and semantic understanding.
We highlighted how you can supercharge data analytics workflows, and outlined Google Cloud’s AI agent offerings for data engineering, data science, and development tools, so you can integrate agentic workflows in your applications, empower your teams and speed discovery.

January 19 - January 23

We have fundamentally reimagined Firestore with pipeline operations for Enterprise edition. Experience a powerful new engine featuring over a hundred new query features, index-less queries, new index types, and observability tooling to improve query performance. Seamlessly migrate using built-in tools and leverage Firestore’s existing differentiated serverless foundation, virtually unlimited scale, and industry-leading SLA. Join a community of 600K developers to craft expressive applications that maximize the benefits of rich queryability, real-time listen queries, robust offline caching, and cutting-edge AI-assistive coding integrations.
Introducing Google Cloud SQL on MSSQLTips: We are highlighting a new technical guide published on MSSQLTips titled "Introducing Google Cloud SQL." This article serves as an essential resource for SQL Server administrators and developers exploring Google Cloud's fully managed database service. It provides a detailed overview of Cloud SQL capabilities, including high availability, security integration, and the seamless transition of on-premises SQL Server workloads to the cloud, making it an ideal resource for those planning their migration strategy.
We are excited to announce the Public Preview of Microsoft Entra ID (formerly Azure Active Directory) integration with Cloud SQL for SQL Server. Designed to tackle the challenge of identity sprawl in multi-cloud environments, this integration allows organizations to govern database access using their existing Microsoft identity infrastructure. Key benefits include centralized identity management, enhanced security features like Multi-Factor Authentication (MFA), and simplified user administration through direct group mapping. This feature is available for SQL Server 2022 and supports both public and private IP configurations.

January 12 - January 16

Google-built JDBC Driver for BigQuery is now available in Preview
We are excited to announce the launch of the new, Google-built JDBC driver for BigQuery. This new open-source driver provides a direct, high-performance connection for Java applications to BigQuery and is developed entirely in-house by Google. Download a new driver and connect your Java application to BigQuery.
Troubleshoot Airflow tasks instantly with Gemini Cloud Assist investigations: Cloud Composer just got smarter. We are excited to announce that Gemini Cloud Assist investigations are now available directly within Cloud Composer 3. Instead of manually sifting through raw logs, you can now simply click "Investigate" on a failed Airflow task. Gemini analyzes logs and task metadata to identify failure patterns—such as resource exhaustion or timeouts—and provides actionable recommendations driven by Gemini Cloud Assist to resolve the issue. This integration shifts the debugging experience from manual toil to automated root cause analysis, significantly reducing the time required to restore your pipelines. Learn more about AI-assisted troubleshooting.

Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever

Thu, 16 Apr 2026 14:00:00 +0000

Introduction

Advances in AI model-powered exploitation have demonstrated that general-purpose AI models can excel at vulnerability discovery, even without being purpose-built for the task. Eventually, capabilities such as these will be integrated directly into the development cycle, and code will be more difficult to exploit than ever; however, this transition creates a critical window of risk. As we harden existing software with AI, threat actors will use it to discover and exploit novel vulnerabilities.

Faced with this scenario, defenders have two critical tasks: hardening the software we use as rapidly as possible, and preparing to defend systems that have not yet been hardened.

As noted in Wiz’s blog post, Claude Mythos: Preparing for a World Where AI Finds and Exploits Vulnerabilities Faster Than Ever, now is the time to strengthen playbooks, reduce exposure, and incorporate AI into security programs. The following blog provides an overview of the evolving attack lifecycle, how threat actors will weaponize these capabilities, and a roadmap for modernizing enterprise defensive strategies.

aside_block: <ListValue: [StructValue([('title', 'Webinar: Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever'), ('body', <wagtail.rich_text.RichText object at 0x7f64d0293be0>), ('btn_text', 'Register now'), ('href', 'https://www.brighttalk.com/webcast/18282/666651?utm_source=gcs-blog&utm_medium=blog&utm_campaign=mythos'), ('image', None)])]>

Exploits in the Adversary Lifecycle

Historically, the discovery of novel vulnerabilities and the subsequent development of zero-day exploits required significant time, specialized human expertise, and resources. Today, highly capable AI models are increasingly demonstrating the ability to not only identify vulnerabilities but also help generate functional exploits, lowering the barrier to entry for threat actors. Continued advancements in these capabilities will increasingly make exploit development achievable for threat actors of all skill levels, significantly compressing the attack timeline. GTIG has already observed threat actors leveraging LLMs for this purpose as well as the marketing of this capability within AI tools and services advertised in underground forums.

A significant shift in the economics of zero-day exploitation will enable mass exploitation campaigns, ransomware and extortion operations, and an increased volume of activity from actors who previously guarded these capabilities and used them sparingly.

Accelerated exploit deployment is a trend we’ve already been observing among advanced adversaries. In our 2025 Zero-Days in Review report, we noted that PRC-nexus espionage operators have become increasingly adept at rapidly developing and distributing exploits among otherwise separate threat groups. This has significantly shrunk the historical gap between public vulnerability disclosure and widespread mass exploitation, a trend we expect to continue.

This evolving landscape will almost certainly result in meaningful shifts over the coming year:

Scaling Defenses for Machine-Speed Threats

We have long anticipated that AI models would become capable of vulnerability discovery—which is why we’ve been using AI tools like Big Sleep, CodeMender, and OSS-Fuzz to proactively find and fix vulnerabilities over the years.

Now as threat actors leverage AI to significantly multiply their offensive output, enterprise defenders cannot rely on human-speed patching protocols to keep up. When organizations are confronted with an AI-enabled surge in vulnerabilities, traditional security tooling and manual triage will fail to keep pace.

Attempting to absorb this exponential increase in workload using legacy processes will result in severe overload and burnout for security and development teams. The question is no longer just about proactive scanning and adherence to traditional patching SLAs; it is about whether organizations are empowering their workforce with the automation needed to eliminate manual toil. To prepare for this reality, organizations must integrate AI defensively, shifting the role of the security practitioner from manual investigator to strategic coordinator.

A Modern, AI-Integrated Defensive Roadmap

In order to modernize the traditional vulnerability roadmap, organizations must incorporate automation and prioritize resilience.

Organizations are no longer defending against purely human-speed exploitation. AI-enabled adversaries can identify, chain, and weaponize weaknesses faster than traditional vulnerability management programs were designed to respond. A modern roadmap should therefore emphasize automation, resilience, and continuous validation.

This roadmap is organized in two parts. The first outlines advanced modernization priorities for organizations that are ready to evolve their security programs to achieve defense at AI enabled speeds. The second provides foundational guidance for organizations that are still building core vulnerability management capabilities.

Advanced Modernization Priorities

Secure Your Code

Organizations have historically focused on patching and securing tangible assets like laptops, servers, and network infrastructure. In today’s threat landscape, that same discipline must be applied to source code, code libraries, and the systems used to build and deploy it.

Code repository platforms should be tightly protected and accessible only through trusted internal networks, managed identities, or other strongly controlled access paths. Organizations should proactively scan for secrets within their codebase that may be weaponized by adversaries and eliminate any practice of storing sensitive credentials in plaintext.

Similarly, organizations are still accountable for vulnerable code from their supply chains, and they must proactively plan for and defend against attacks through exploitation of compromised code libraries. This creates a conflict with updating versions and repositories immediately against holding onto known and trusted versions.

Accordingly, security controls should cover build runners, CI/CD pipelines, and other automated execution mechanisms, which are increasingly attractive targets for threat actors. AI-enabled scanning tools can help teams detect critical vulnerabilities faster and uncover groups of weaknesses that may appear minor on their own but could be chained together for exploitation.

Organizations should leverage frameworks like Wiz SITF to map their SDLC threat model and identify "attack chains" where minor, isolated weaknesses are combined by AI to create a critical breach. Additionally, one-time static or dynamic scanning is no longer sufficient. Organizations should deploy emerging commercial and open-source agentic solutions to review code and mitigate flaws before they can be exploited.

Move to Automated Security Operations

Traditional dashboards and static detection rules will struggle under the volume of automated attacks. Security operations need to become more dynamic, with a clear path toward an agentic SOC.

Legacy models are often reactive and constrained by manual workflows, By deploying specialized AI agents such as Google Cloud’s Triage and Investigation Agent and Gemini in Google Security Operations, teams can automate alert triage, analyze suspicious code without manual reverse engineering, correlate signals across multiple tools, and generate response playbooks in real time. This allows analysts to spend less time on repetitive investigation and more time on high-value decisions, helping the SOC respond to AI-enabled attacks at AI speed.

Reduce Attack Surface

Organizations should design networks with a zero trust approach and focus first on reducing exposure across internet-facing systems, critical infrastructure, control planes, and trusted service infrastructure.

Network segmentation and identity-based access controls should be in place so that if an edge device is compromised through a zero-day exploit, the blast radius is limited and easier to contain.

Maintain Continuous Asset Discovery and Posture Management

Unidentified assets are a major blindspot for organizations and a critical weakness that AI-enabled threat actors are able to exploit with increasing efficiency. Static spreadsheets and manual asset tracking are no longer a viable and scalable strategy.

Security teams need a continuously updated, automated inventory covering endpoints, servers, public-facing systems, network infrastructure, AI systems, cloud environments and ephemeral assets like Kubernetes pods. Dynamic asset discovery is critical for reducing blind spots and shadow AI. The more seamlessly known assets can be fed into downstream security tooling, the more accurate and effective frontline detection and response will be.

Expand Automated Scanning Coverage

Automated vulnerability scanning should cover every major operating system in use, including Windows, macOS, and Linux, across both endpoints and servers.

Reduce blind spots and maintain continuous, comprehensive visibility into vulnerabilities. Where possible, that visibility should feed directly into automated remediation pipelines.

Enhance Network Device Patching and Limit Connectivity

Organizations need a highly automated, repeatable process for identifying missing firmware and security updates on network devices and for scheduling maintenance efficiently. Network infrastructure has long been a preferred target for sophisticated threat actors, and AI will only accelerate the discovery of weaknesses in these often-overlooked systems.

Organizations should use perimeter controls to block unnecessary outbound connections from internal network devices. Any attempt by those devices to communicate externally should be investigated to determine whether it is required for normal operations or signals something more concerning. Proactively, organizations should baseline what outbound connections are normal, in order to alert against anomalies.

Formalize Emergency Remediation SLAs

AI may help accelerate patching, but emergency response still depends on clear human processes.

Organizations should define remediation SLAs based on severity, exposure, and asset criticality, and those expectations should be aligned across security, IT, and business stakeholders. When a vulnerability is being actively exploited in the wild, teams need a pre-approved, low-friction process to apply temporary mitigations, such as restricting public access or isolating affected systems, while permanent fixes are validated. Extremely critical business processes should each have secondary systems that can deliver the same objectives with different underlying technology. By having alternatives and fall backs for these processes, organizations give themselves more options to address emergency remediation while minimizing potential business disruption.

Secure AI Agents and Implement SAIF

As organizations deploy AI agents, they also create a new attack surface that must be protected.

Organizations should adopt frameworks such as Google’s Secure AI Framework (SAIF) to guide the secure deployment of AI models and applications. Tools like Google Cloud Model Armor or similar industry solutions can also serve as a protective layer for large language model environments by screening inputs and outputs for prompt injection, jailbreak attempts, and Google Cloud Sensitive Data Protection can prevent sensitive data leakage. Locking down connections that AI systems can establish such as MCP, with fine grained IAM roles is critical to prevent from insecure plugin use threats.

Defensive AI systems cannot become another point of compromise, and they should be secured accordingly.

Foundational Vulnerability Management Priorities

Not every organization starts from the same baseline. The priorities above assume a relatively mature security program with established tooling, ownership, and operational capacity. For organizations with limited or inconsistent vulnerability management capabilities, the first step is to build a reliable foundation before pursuing advanced AI-enabled operating models.

The Current Reality of Vulnerability Management

Vulnerability management programs vary widely based on the maturity of an organization’s overall security program. In more mature environments, vulnerability management is highly automated: in-scope vulnerabilities are identified, routed to the appropriate IT, infrastructure, or application owners, and automatically validated once remediation is complete.

In less mature environments, the opposite is often true. Vulnerability management may be inconsistent, narrowly scoped, and focused primarily on the highest-profile zero-days. Tracking may still rely on local spreadsheets, systems may be overlooked, and even trusted service infrastructure assets such as Active Directory domain controllers may remain unpatched.

Such organizations need to immediately modernize and elevate their vulnerability management programs. Most organizations were already unable to remediate every vulnerability across their technology stack, and the rise of AI-enabled threats worsens that reality, increasing the urgency of building programs that are automated, measurable, tracked, and validated.

Achieving that outcome is challenging. It requires coordination across the three foundational pillars of any security program: people, process, and technology. A prioritized and phased approach is outlined as follows.

Foundation Step #1 — Baseline Current State

Begin with the tools, processes, and coverage already in place. Scan everything currently in scope, identify Critical and High findings, and remediate them according to agreed urgency and service levels. At the same time, establish a process for tracking vulnerabilities that are being actively exploited in the wild, along with the emergency patching actions they may require. This phase should also confirm that system owners have defined maintenance windows and the operational support needed to meet remediation SLAs.

Foundation Step #2 — Expand System Scanning Coverage

Broaden vulnerability scanning across all major operating systems in use, including Windows, macOS, and Linux, for both endpoints and servers. Additionally, expand coverage to include other network attached systems, including the network devices themselves.The objective is to reduce blind spots and ensure vulnerability visibility extends across the environment, rather than covering only isolated segments.

Foundation Step #3 — Confirm Asset Inventory and Ownership

Maintain a simple, accurate inventory of key asset classes, including endpoints, servers, public-facing systems, network infrastructure, and specialized devices such as medical equipment where applicable. Every asset should have a clearly defined owner responsible for remediation coordination, exception handling, and lifecycle accountability.

Foundation Step #4 — Establish Standard Program Reporting

Create a consistent reporting cadence that gives stakeholders a clear view of program health and risk. Reporting should include scanning coverage by asset class, top Critical and High vulnerabilities, public-facing exposure, patch compliance, SLA performance, and documented exceptions or risk acceptances. The goal is to produce reporting that drives decisions, not just dashboards that provide visibility.

Foundation Step #5 — Prioritize Public-Facing and High-Risk Vulnerabilities

Identify the attack surface and prioritize vulnerabilities affecting internet-exposed systems, critical infrastructure, and assets that present the highest likelihood of exploitation or business impact. Remediation should be tracked against defined deadlines, with clear escalation paths when timelines are at risk. Where possible, internet-exposed systems should be engineered for automatic patching.

Foundation Step #6 — Develop a Specialized Process for High-Sensitivity Devices

For device classes that require additional coordination, such as medical devices, industrial control systems, or other operational technology, create a streamlined process for identifying vulnerabilities, coordinating with vendors or support teams, and applying compensating controls when patching is not feasible. These assets often require a different remediation model than standard IT systems.

Foundation Step #7 — Formalize Remediation SLAs and Exception Handling

Define remediation SLAs based on severity, exposure, and asset criticality, and ensure they are understood across security, IT, and business stakeholders. Just as importantly, establish a formal exception process for situations where remediation cannot be completed within the required timeframe. Exceptions should be documented, risk-assessed, approved by the appropriate stakeholders, and reviewed on a recurring basis.

How Google Can Help

In today’s cybersecurity landscape, we’re not just defending against human attackers, but also against tactics supercharged by AI tools. To counter these machine-speed threats, Google provides a comprehensive, AI-integrated defensive ecosystem:

Google Threat Intelligence: To combat the unprecedented volume of AI-generated exploits, Google Threat Intelligence enables a proactive 'assume breach' mentality. By fusing Mandiant’s codified frontline adversarial behaviors with Google’s global visibility of the threat landscape, security teams can move beyond static indicators to hunt for the subtle, non-linear behaviors characteristic of novel attacks. As both security noise and true threats escalate, the platform helps organizations better prioritize security resources based on active threats. By cutting through this growing noise to focus on what is truly important, security teams save time, ultimately empowering them to disrupt the adversary’s lifecycle long before they can reach their objective.
Mandiant Security Consulting Services: Mandiant AI Security Consulting Solutions can help organizations design and operationalize this architecture. This includes helping organizations speed the identification and remediation of vulnerabilities through code reviews, mature their secure software development lifecycles (SSDLCs), and modernize the overall vulnerability management programs to handle the anticipated influx of vulnerabilities with greater efficiency and resilience.
Agentic SecOps: Google SecOps provides the foundation for an agentic security operations center. This allows teams to augment workflows with agents, combining dynamic AI with deterministic automation. Users can embed agents like the Triage and Investigation agent directly into workflows to accelerate response times. This agent autonomously investigates alerts, gathers evidence, and provides verdicts with clear explanations. This enables automated decision-making and remediation, freeing analysts to focus on high-priority threats rather than false positives. Orchestrating responses becomes more efficient as friction is reduced. Additionally, customers can build enterprise-ready security agents with remote Model Context Protocol (MCP) server support.
Mandiant Threat Defense (MTD): To augment internal teams, Mandiant Threat Defense leverages frontline intelligence and AI-enabled telemetry to proactively hunt for and disrupt advanced, machine-speed threats.
Wiz: Organizations can maintain continuous asset discovery and dynamic posture management, ensuring they can rapidly identify and reduce their attack surface across complex, multi-cloud environments.Wiz uses AI agents, powered by environmental context, to democratize security, prioritize remediation, and proactively reduce the attack surface. Wiz continuously integrates the latest AI models to streamline vulnerability detection and response, and its Model Context Protocol (MCP) server enables security teams to use Wiz’s deep context and risk analysis in agentic workflows. The foundational strategy of Wiz connects cloud, code, and runtime, and employs three key agents:

Shift Right (Red Agent): Scans the entire attack surface with an AI-powered attacker, using contextual information (cloud, workload, code analysis) to discover immediately exploitable risks.
Shift Left (Green Agent): Helps customers identify root causes (cloud-to-code) and automatically deploy fixes using pre-built Wiz skills, and upcoming integrations with CodeMender to self-heal code bases.
Detect and respond (Blue Agent): Automates the investigation of AI-enabled attacks at the speed of AI, allowing SOC teams to rapidly triage suspicious behavior and utilize runtime protection tools to detect exploitation.

Google Cloud Model Armor: To secure the AI agents organizations deploy, Google Cloud Model Armor acts as a specialized LLM firewall, proactively screening inputs and outputs to block prompt injections and sensitive data leaks.

Outlook and Implications

The cybersecurity community has the opportunity to serve as the voice of reason: the best response is proactive, disciplined preparation, not panic. While access to the publicly known, most capable frontier models is currently restricted to responsible actors, the availability of these technologies to a broader audience is inevitable. For defenders, this signals a surge in vulnerability management demands. The traditional window between a vulnerability’s disclosure and its active exploitation in the wild has already largely vanished; the primary concern now is the sheer number of exploits organizations will have to defend against simultaneously. Furthermore, the traditional concept of severity is shifting. In a landscape where AI agents can chain together multiple low-level vulnerabilities, the practical impact difference between a remote code execution (RCE) flaw and a seemingly benign local-only exploit is rapidly disappearing.

To build on the foundational steps above, organizations can work with Mandiant to plan, prioritize, and implement an AI-enabled cyber defense strategy. AI gives security teams powerful new ways to understand their environments, automate remediation at scale, and strengthen workforce capabilities. By adopting AI-integrated defenses today, organizations can better prepare for the speed, scale, and sophistication of tomorrow’s adversaries.

Acknowledgement

This post wouldn't have been possible without numerous experts across Mandiant and GTIG. We specifically would like to thank Omar ElAhdan, Chris Linklater, Austin Larsen, Jared Semrau, Dan Nutting, John Hultquist, and Kimberly Goody for their contributions to this blog post.

Building the agentic future: A spotlight on Google Cloud’s media & entertainment partner ecosystem

Thu, 16 Apr 2026 13:15:00 +0000

As we gather in Las Vegas for NAB Show 2026, the industry conversation has shifted. We are no longer asking if AI works; we’re now focused on how it scales. The era of AI experimentation is over — production-grade execution is here.

At Google Cloud, we believe no studio or broadcaster should have to build this future in isolation. Our mission is to provide the agentic platform and AI and cloud tools that allow our partners to innovate at the speed of ideas — from the tools used in the edit suite, to the technology that delivers video to millions of viewers worldwide.

Enhancing production: From manual tasks to intelligent assistants

Modern creative workflows are often slowed down by manual technical tasks. Google Cloud is working with ecosystem leaders to integrate advanced AI capabilities directly into the core of production software, so creators can focus on their artistry, not tedious tasks. With AI acting as a proactive assistant within the creative suite, production teams can significantly reduce the time between a raw idea and a finished frame.

Avid: With the launch of Content Core on Google Cloud, Avid is delivering a truly cloud-native studio. And by integrating multimodal AI search into Media Composer, editors can find the exact frame they need using natural language, turning hours of logging into seconds of discovery.
Backlight: Backlight makes complex media workflows simple for teams of all sizes, from production through monetization. Built on Google Cloud with the Video Intelligence API, Backlight's Iconik platform automatically adds searchable metadata upon upload. Customers see up to 50% shorter production cycles and save up to 60% on storage by deeply understanding their media libraries, reducing duplications, and optimizing asset placement.
Brahma.ai: Brahma AI, an enterprise AI content platform, is powering high-fidelity digital likenesses across retail, entertainment, and healthcare, making them interactive and intelligence-driven within a secure and governed framework.

Unlocking content value: From static archives to active assets

Data is only as valuable as the insights you can extract from it. Our partners, listed on the Google Cloud Marketplace, are using generative media models to transform massive, static archives into searchable, revenue-generating engines. By making every frame discoverable, we’re helping media companies turn decades of history into immediate opportunities.

Ateme: Ateme helps simplify global distribution with its new generative AI-powered subtitling solution, which can significantly reduce the manual labor of localizing different media types.
Perfect Memory: Perfect Memory helps customers turn traditional storage into a context-aware knowledge engine. The platform understands the relationships between athletes, historical events, and emotional nuances — transforming massive media archives into an intelligent library that lets creative teams instantly surface the perfect content for any story.
VionLabs: Working with companies like Cineverse, Plex, and Crunchyroll, Vionlabs uses AI to analyze and index content libraries — making video assets more accessible and enabling metadata generation. By understanding the specific mood and aesthetic of each scene, Vionlabs helps streaming platforms move beyond basic genre tags toward more nuanced, sentiment-driven content discovery and marketing.

Scaling global reach: From simple streams to audience growth

To succeed today, media companies must provide a smooth viewing experience and easy payment options. Our ecosystem provides the tools to grow a company’s reach and maximize the value of every subscriber through reliable, high-quality delivery.

Bending Spoons: By leveraging the global scale of Google Cloud, Bending Spoons’ properties such as Brightcove and Vimeo are delivering professional-grade tools for large enterprises, SMBs, the next generation of creators, and more. Its platforms ensure that high-quality video production and distribution are accessible to everyone, from global brands to independent storytellers.
Bitmovin: Bitmovin enables streaming services to scale efficiently while delivering a premium experience across the widest range of devices. By combining real-time observability with AI-driven insights, media teams can proactively optimize engagement and monetization. Furthermore, Bitmovin’s advanced encoding ensures superior visual quality at lower bitrates, supporting everything from high-demand Video on Demand (VOD) to massive, 24/7 live events.
Evergent: Evergent automates complex billing and monetization workflows for AI-powered revenue management. Media and telecommunications companies can use Evergent’s tools to maximize subscription growth and improve long-term customer retention through personalized and agile payment offers.
Harmonic: Harmonic is helping major broadcasters like Grupo Globo modernize their operations. By integrating new digital broadcast capabilities into their cloud-based streaming solutions, Harmonic provides leaders with a faster, more efficient path to manage video processing and delivery at a massive scale.

Ensuring reliability: From infrastructure to a foundation of trust

High-quality content requires a high-performance foundation. We are partnering with infrastructure leaders to ensure that even the most complex global broadcasts remain stable, secure, and responsive.

Zixi provides the broadcast-grade transport and workflow automation needed to move professional video across any network. By offering centralized control and complete visibility into the delivery process, Zixi ensures that leaders like Fubo can manage high-stakes, broadcast-quality live events without the risk of a signal drop.

Visit the ecosystem in action

The strength of our ecosystem is its integration across all aspects of the media and entertainment landscape. From the cameras, to the cloud, to the viewers' screens, these partners represent the future of a more creative, efficient, and agentic media industry.

Visit the Google Cloud Booth (West Hall, #W2731) at NAB Show from April 19-22 to see many of these partners in action through live demonstrations and theater sessions.

Claude Opus 4.7 on Vertex AI

Wed, 15 Apr 2026 18:30:00 +0000

Today, we’re announcing the general availability of Claude Opus 4.7 on Vertex AI.

What’s new: Anthropic’s newest Opus model delivers advanced performance across coding, long-running agents, and professional tasks. As an upgrade from Claude Opus 4.6, Opus 4.7 works better through ambiguity, is more thorough in its problem solving, and follows instructions more precisely. Opus 4.7 also features improved vision skills, high-resolution image input for better accuracy on complex documents and charts, and expanded memory capabilities for tasks that span longer horizons.

Why it matters for your business: By pairing Opus 4.7 with Vertex AI, your business can build, scale, and govern agents on a platform that provides the optimized infrastructure, agentic tooling, and unified security controls needed to run AI workloads with confidence.

How to access: Opus 4.7 is generally available on Vertex AI. You can also access the model through Google Cloud Marketplace. Explore our sample notebook and visit our pricing documentation for comprehensive pricing and regional availability details.

Rapidly build, scale, and govern agents with Claude on Vertex AI

Vertex AI provides a unified platform to efficiently scale Claude-powered apps and agents, optimize performance, and maintain strict governance.

Maximize performance with low latency and high throughput: Vertex AI's infrastructure handles the intensive demands of frontier models, helping to lower latency and deliver high throughput for your Claude workloads.
Scale agents: Deploy and govern your Claude agents on serverless infrastructure with Vertex AI Agent Engine.
Improve reliability: Reserve capacity for your Claude models by utilizing Provisioned Throughput. You can also leverage the global endpoint, which uses dynamic routing to maximize availability. Alternatively, you can utilize the new U.S. or EU multi-region endpoints when your deployment requires guaranteed data processing within a specific geography.
Govern the full stack with confidence: Protect your Claude on Vertex AI workloads with Google Cloud’s secure-by-design controls. Use Model Armor to block agentic runtime threats and Security Command Center for unified visibility into your AI security posture.

Hear from our customers

See how leading organizations are already leveraging the powerful combination of Claude and Google Cloud to drive business impact.

“The combination of Claude and Vertex AI helps us empower millions of merchants with our AI-enabled commerce assistant, Sidekick. There’s been a lot of merchants that we’ve talked to that say Sidekick ‘feels like a lifeline for small businesses’ and helps them ‘come out on top’.” – Andrew McNamara, Director of Applied AI, Shopify

Read the story

“In addition to stability, security, and versatility, Vertex AI also ensures that input-output pairing remains consistent across versions as soon as a new Claude model release becomes available. This further accelerates our ability to test, onboard, and use Claude at scale.” – Chen Wang, CTO, Fifth Dimension

Read the story

“With Claude running on Vertex AI, we saw a 20% to 30% increase in code development velocity. Running Claude on Vertex AI not only accelerates development projects, it enables us to hardwire security into code before it ships.”– Gunjan Patel, Director of Engineering, Office of the CPO at Palo Alto Networks

Read the story

“Our AI agent is made more powerful through Claude models running on Vertex AI. This integration allows us to easily connect with other Google Cloud services, like Cloud Run, to work together behind the scenes to help customers turn their ideas into apps.” – Amjad Masad, Founder and CEO, Replit

Read the story

“Claude in combination with Vertex AI, delivers stability and reliability for our customers when it comes to building code for complex multi-step tasks and executing tool calls.” – Amitay Gilboa, CEO, spring.new

Read the story

“Getting a model as powerful as Anthropic's Claude on Vertex AI is a win-win that makes life so much easier. We get a model that excels at tool calling on a comprehensive platform that integrates with our core Google Cloud workloads like GKE and Cloud Run — that's the magic.” – Justin Watts, Distinguished Engineer, TELUS

Read the story

Multi-region endpoints are available for Claude on Vertex AI

Wed, 15 Apr 2026 16:00:00 +0000

Today, we’re announcing U.S. and EU multi-region endpoints for Claude on Vertex AI are available in public preview. By pooling capacity across multiple regions, these endpoints dynamically route requests to help improve reliability, while ensuring your data processing remains within your preferred geography to meet your compliance needs.

Available in the U.S. and EU, this approach allows you to deploy with the resilience of a more distributed architecture without sacrificing your data residency requirements. Please visit our Vertex AI documentation for detailed instructions and to start building today.

What are multi-region endpoints and when should you use them?

When using Claude on Vertex AI, you previously had two choices:

Regional endpoints (e.g., us-central1): Keep data and processing within a single specific location. Best for low latency.
Global endpoints: Route traffic anywhere in the world where capacity is available. Best for maximum capacity and lowest cost.

Multi-region endpoints serve as the "middle ground". They allow Vertex AI to automatically shift traffic between different regions within a single geography (for example, moving traffic between us-central1 and us-east4).

When is a multi-region endpoint the right choice?

Data residency compliance: Your organization requires that data stays within the U.S. or EU, but you want to avoid being tied to a single region.
Enhanced reliability: You want to protect your application against a single-region outage or capacity constraint without sending traffic globally.
Simplified traffic management: Instead of managing failover logic between regional endpoints — like us-central1 and us-west1 — yourself, the multi-region endpoint handles it automatically.

Comparing your endpoint options

Feature	Global endpoint	Multi-region endpoint	Regional endpoint
Availability	Maximum (global failover)	High (multi-region failover)	Dependent on single-region capacity (multi-zone failover)
Data residency	No data residency guarantees	Restricted to a specific geography (e.g., U.S., EU)	Restricted to a specific region (e.g., Iowa)
Latency	Variable (based on global routing)	Optimized within the geography	Lowest (if the user is near the region)
Quota	Independent global quota	Shared geography-based quota	Region-specific quota
Models Supported	Claude Opus 4.7 Claude Opus 4.6 Claude Sonnet 4.6 Claude Opus 4.5 Claude Sonnet 4.5 Claude Haiku 4.5 Claude Opus 4.1 Claude Opus 4 Claude Sonnet 4 Claude 3.7 Sonnet	Claude Opus 4.7 Coming soon: Claude Opus 4.6 Claude Sonnet 4.6 Claude Opus 4.5 Claude Sonnet 4.5 Claude Haiku 4.5 Claude Sonnet 4	Claude Opus 4.7* Claude Opus 4.6 Claude Sonnet 4.6 Claude Opus 4.5 Claude Sonnet 4.5 Claude Haiku 4.5 Claude Opus 4.1 Claude Opus 4 Claude Sonnet 4 Claude 3.7 Sonnet Claude 3.5 Haiku *Select regions and consumption modes

Full support for prompt caching

Multi-region endpoints fully support prompt caching. When a request is sent to a multi-region endpoint, Vertex AI attempts to route it to the specific region where your prompt is already cached to ensure the lowest possible latency and cost. If that specific region is under heavy load, the system intelligently balances the request to the next available region within that geography to maintain uptime.

Best practices

To maximize performance, we recommend using multi-region endpoints as your default for production workloads that require residency within the U.S. and EU.

Monitor quotas: Multi-region endpoints use their own quota pools, separate from single-region quotas.
Consistency: For the best caching performance, stick to one location (e.g. US multi-region) per workload.
Pricing: Multi-region endpoint requests follow the standard Claude on Vertex AI pay-as-you-go pricing model. Prices may vary across locations, and are generally lower on global endpoints.

How to get started

Integrating multi-region endpoints for Claude models requires a simple change to your configuration.

Step 1: Ensure you have enabled a supported Claude model in your Vertex AI project.

Step 2: Update your API base URL or location variable. Instead of a specific region like us-central1, use the multi-region identifier us or eu.

Example cURL:

Bash

code_block: <ListValue: [StructValue([('code', 'export MODEL_ID="claude-opus-4-6"\r\nexport PROJECT_ID="YOUR_PROJECT_ID"\r\n\r\ncurl -X POST \\\r\n -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \\\r\n -H "Content-Type: application/json" \\\r\n"https://aiplatform.us.rep.googleapis.com/v1/projects/${PROJECT_ID}/locations/us/publishers/anthropic/models/${MODEL_ID}:rawPredict" \\\r\n -d \'{\r\n "max_tokens": 300,\r\n "messages": [\r\n {\r\n "role": "user",\r\n "content": [\r\n {\r\n "type": "text",\r\n "text": "Why is the sky blue?"\r\n }\r\n ]\r\n }\r\n ],\r\n "anthropic_version": "vertex-2023-10-16"\r\n }\''), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64d5588d60>)])]>

Cloud CISO Perspectives: How CISOs can pursue technical and cultural resilience (Q&A)

Wed, 15 Apr 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for April 2026. Today, Thiébaut Meyer and Lia Wertheimer from Google Cloud’s Office of the CISO share Thiébaut’s conversation with Matt Rowe, chief security officer, Lloyds Banking Group, on how security leaders can simultaneously pursue technical and cultural resilience.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f64d3844b50>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How CISOs can pursue technical and cultural resilience (Q&A)

By Thiébaut Meyer, Director, and Lia Wertheimer, Program Manager, Office of the CISO

Thiébaut Meyer, Director, Office of the CISO

In cybersecurity, we have long operated under a dangerous assumption: that the "always-on" nature of the role is a badge of honor. We treat the CISO as a biological shock absorber, expected to sustain high-performance output amidst a state of permanent volatility. But as the pace of change continues to accelerate, we are reaching a tipping point where this reliance on individual effort is no longer a sustainable strategy — it is a structural fragility.

Lia Wertheimer, Program Manager, Office of the CISO

To address the constant reactivity mode and the compounding demands placed on security leaders and their teams, we must move beyond a focus on personal grit and toward a dual mandate of resilience. This requires an honest look at where our technical structures and our human cultures intersect.

True resilience is more than a single initiative. It’s the intersection of two distinct disciplines:

Operational resilience: This is the technical “shift down,” a process of radical consolidation and simplification that can reduce the noise of fragmented tools to build a secure-by-default foundation. It’s about creating a technical environment that is robust enough to survive shocks — without constant manual intervention.
Cultural resilience: This is the organizational "safe system of work" that focuses on the mindset, behaviors, and psychological safety required to keep a team effective under pressure. This system can help a team adapt and thrive even when the technical systems are under fire (or on fire.)

When these two resilience strategies align, we move from a state of "chaos coordination to a sustainable operating model.

We sat down with Matt Rowe, chief security officer, Lloyds Banking Group, to explore how to pursue this alignment at a recent CISO Community event in Madrid. While our technical discussions at the event focused on shifting down the stack to manage sprawl, Matt offered a masterclass in the human side of the equation. We compared notes on how to scale these performance insights into a functional department that can endure the long game.

The following transcript has been lightly edited.

Thiébaut Meyer: We often talk about the CISO’s endurance as a personal burden to carry, but you’ve argued that we need to bake that resilience into the very fabric of the security function. In my view, high performance and resilience are inseparable — can you talk about how you see that relationship playing out in a high-stakes environment?

Matt Rowe, chief security officer, Lloyds Banking Group

Matt Rowe: I couldn't agree more, Thiébaut. I see them as two sides of the same coin. This is a tough gig: The stakes are high and the pace is relentless.

There’s a Haitian proverb: "Behind the mountains, more mountains." In cybersecurity, that’s our daily reality. Resilience at the team level is about creating the conditions where people can keep climbing those mountains without losing their intrinsic motivation.

Thiébaut Meyer: I’ve observed a tug-of-war in our industry. We treat the CISO as a biological asset that must be ‘fueled’ for 24/7 performance, yet the mission often demands an unsustainable fusion of the leader’s identity with the role itself. How do you think we move toward a model where the organization, not the individual, is the shock absorber?

Matt Rowe: I think we need to have three things in balance: the needs of the individual, the needs of the team, and the needs of the company. While wellness is the engine, the team dialogue should be about how we get from good outcomes to great outcomes. We can’t just focus on the individual in a vacuum, we have to show how their unique strengths ladder up to the team's success.

Thiébaut Meyer: Like many CISOs, I’ve spent my fair share of time on that continuous treadmill where you feel there isn't a second to breathe. I’ve personally found that if we don't force a pause, the team will eventually break. How are you building that into your own operating model?

I’m a firm believer that psychological safety isn't something you can just delegate. You have to model it yourself, especially when things go wrong.

Matt Rowe: You have to artificially create moments of pause and recovery. Because the mountains are endless, the leader must set the cadence. We have to get people inspired to have great impact and create conditions where people are striving to do even better.

When there is more to do than time allows, the answer is disciplined prioritization. It’s an opportunity to get really good at saying "not now," so the team can focus on what actually moves the needle.

Thiébaut Meyer: I’m a firm believer that psychological safety isn't something you can just delegate. You have to model it yourself, especially when things go wrong. How do you approach modeling psychological safety at a large organization?

Matt Rowe: For me, it starts with transparency. People need to see me being challenged and observe how I react. It’s about making it obvious that being brave — speaking up, or questioning a process — is what we value. We have to create proof points where people who operate with psychological safety are seen as the role models.

Thiébaut Meyer: We’ve both seen the risks of security teams becoming silos or even fortresses against the rest of the organization. How do you ensure a resilient team remains a business enabler?

Matt Rowe: You have to embed the team’s objectives directly into business priorities. If the company’s mission is to provide lending to small businesses, our mission is to enable them to get those products to market faster and safely.

When the team sees themselves as stewards of the business mission, it changes the mindset from one of security versus the business to one of shared resilience.

Learn more about building resilient organizations

Building a resilient organization is a continuous journey. As we navigate the mountains ahead, protecting our teams starts with protecting the people behind the roles.

Seize the reset moment: Use consolidation as a catalyst to demystify complexity. Reducing the tool stack is the first step toward reducing the mental load on your team.
Be like water: Adopt a mindset of flexibility. The most resilient organizations are those that can make quick, flexible decisions.
Mandate the pause: In an environment of endless mountains, the leader's primary job is to set the cadence of recovery and enforce disciplined prioritization.
Architecture over effort: Resilience isn't about being tough enough to handle adverse situations, it’s about being more intentional with our technology, our team design, and our shared mission so that we can achieve our goals and avoid burning out.

While it’s a full house at Google Cloud Next in Las Vegas, you can still be part of the action by registering for a complimentary digital ticket to access select sessions.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f64d3844610>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=t1_yE8IWT_Y'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

How Google Does It: An inside look at cybersecurity: Learn how Google approaches some of today's most pressing security topics, challenges and concerns, straight from Google experts. View the collection.
Raising the security baseline: Essential AI and cloud security now on by default: To support the next generation of AI innovators, we are offering on by default essential AI security and cloud security in Security Command Center Standard. Read more.
Guardrails at the gateway: Securing AI inference on GKE with Model Armor: Here’s how to secure AI inference on Google Kubernetes Engine with Model Armor and high-performance storage. Read more.
Google Cloud named a Leader in The Forrester Wave™: Sovereign Cloud Platforms, Q2 2026: Google Cloud has been named a Leader in The Forrester Wave™: Sovereign Cloud Platforms, Q2 2026, validating our portfolio of choice approach. Read more.
See beyond the IP and secure URLs with Google Cloud NGFW: Announcing domain filtering with a wildcard capability in Cloud NGFW Enterprise, providing increased security and granular policy controls. Read more.
VRP 2025 year in review: How did Google’s vulnerability reward program do in its 15th year? $17 million awarded, more than 40% over the previous year. Read more.
Google Workspace’s continuous approach to mitigating indirect prompt injections: We’re sharing more detail on the continuous approach we take to improve the layered architecture of our indirect prompt injection defenses, and to solve for new attacks. Read more.
Protecting cookies with Device Bound Session Credentials: A significant step forward in our ongoing efforts to combat session theft, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f64a024cbe0>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

M-Trends 2026: Data, insights, and strategies from the frontlines: Grounded in over 500,000 hours of frontline incident investigations conducted by Mandiant globally in 2025, M-Trends 2026 provides a definitive look at the TTPs actively being used in breaches today. Read more.
iOS exploit chain DarkSword adopted by multiple threat actors: Google Threat Intelligence Group (GTIG) has identified a new full-chain exploit that uses zero-day vulnerabilities to compromise iOS devices, and has observed multiple commercial surveillance vendors and suspected state-sponsored actors using it in distinct campaigns. Read more.
vSphere and BRICKSTORM Malware: A defender's guide: To help organizations stay ahead of the risks documented in recent BRICKSTORM research from Google Threat Intelligence Group (GTIG), we’ve created this guide to help you focus on essential hardening strategies and mitigating controls necessary to secure critical assets. There’s also an automated script to help you apply some of the guidance. Read more.
North Korea-nexus threat actors abused compromised Axios NPM package in supply chain attack: GTIG is tracking an active software supply chain attack targeting Axios, a popular node package manager (NPM). We attribute this activity to UNC1069, a financially-motivated North Korea-nexus threat actor active since at least 2018. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Can AI-native MDR fix broken SOC workflows: Tenex.AI’s Eric Foster and Bashar Abouseido discuss the impact of AI on security operations center workflows, and how best to measure its success, with hosts Anton Chuvakin and Tim Peacock. Listen here.
Why we keep failing at supply chain security: Have we reached the point where our security tooling is actually our largest unmanaged attack surface? Dan Lorenc, founder and CEO, Chainguard, chats about how convenience impacts supply chain security, with hosts Anton and Tim. Listen here.
Defender’s Advantage: Using Google Threat Intelligence to hunt adversaries on the dark web: Host Luke McNamara sits down with Google Threat Intelligence experts Jose Nazario and Brandon Wood on the new dark web and underground monitoring capabilities, and how AI is fundamentally changing the way defenders track adversaries. Listen here.
Behind the Binary: What happens when botnet operators show up in court: Host Josh Stroschein is joined by Pierre-Marc Bureau from Google’s Threat Analysis Group (TAG) to unpack the unprecedented takedown of the Glupteba botnet, from reverse engineering binaries to a surreal showdown in New York courtroom. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

Cool stuff Google Cloud customers built, April edition: BMW big on SLMs, MLB’s Scout Insights AI, personalized resort experiences

Wed, 15 Apr 2026 16:00:00 +0000

AI and cloud technology are reshaping every corner of every industry around the world. Without our customers, who are building the future on our platform, there would be no Google Cloud. In this regular round-up, we dive into some of the exciting projects redefining businesses, shaping industries, and creating new categories.

For our latest edition, we learn why BMW Group is experimenting with small language models (SLMs); catch AI-powered commentary from Major League Baseball; hit the slopes with Vail Resort’s AI concierge; build an intelligent grid with CTC Global; witness how ID.me created secure global scale; and see how Manhattan Associates supply chain tools now handle 1 billion daily API calls.

Be sure to check back next month to see how more industry leaders and exciting startups are putting Google Cloud technologies to use. And if you haven’t already, please peruse our list of 1,001 real-world gen AI use cases from our customers.

BMW tests the big potential of small models

Who: As one of the world’s leading providers of premium cars and motorcycles, BMW Group is always at the forefront of automotive technology. This ethos pushed the company to test what type of AI language models are ideally suited to driving situations, where access to cloud-based LLMs isn’t always possible.

What they did: BMW Group wanted to explore the potential of small language models (SLMs), which could run within the limited hardware on a vehicle. Finding the right trade-off between size and capability requires careful optimization, and the sheer volume of viable combinations renders manual searches for the optimal configuration an incredibly tedious, if not impossible, undertaking. To overcome this challenge, BMW and Google built automated, reproducible workflows through executable pipelines using Vertex AI.

Why it matters: The path from a general-purpose LLM to a specialized SLM isn’t straightforward. Every choice — from type of quantization to characteristics and contents of the fine-tuning domain-specific dataset — affects the quality and efficiency of the final model. This creates an exponential range of configurations, each with different trade-offs. It’s a great example of using AI to scale an optimization problem for other AI.

Learn from us: “With automated pipelines, we can rapidly adapt models to our domain and rigorously test and evaluate them against domain-specific benchmarks. This allows us to iterate and optimize models in hours rather than days.” – Dr. Céline Laurent-Winter, vice president, Connected Vehicle Platforms at BMW Group

MLB Scout Insights: AI-powered color commentary

Who: Major League Baseball is famous for its colorful announcers. Now, MLB is bringing more baseball color straight to your pocket, and Gemini is helping give it a voice.

What they did: Each season, millions of baseball fans use the MLB app and tap over to the Gameday feature for live, up-to-the-pitch action across more than a dozen games. Starting this season, the league launched MLB Scout Insights in Gameday, which uses Gemini models to quickly scan decades of game and player data, cross-references it with situational game scenarios, and then delivers game-relevant context during key matchups.

Why it matters: Given the sport’s storied history, 162-game regular season, and global reach, baseball fans are among the most sophisticated and passionate out there. To keep them engaged with Gameday and the MLB app, the league wanted to deliver insights that truly felt meaningful and interesting. Building the tool meant answering a rather squishy question: What makes an insight actually insightful, not just an accurate fact, and how can an AI learn that distinction? The answer came from some clever “surprisal” analysis.

Learn from us: "With Scout Insights, every fan can feel like the smartest person in the stands, at the water cooler, or on the couch. It’s about deepening connections to the game, and sharing that passion with others. That’s the magic of sports, and we’re making more of it possible with the magic of AI." – Josh Frost, senior vice president of product & Matt Graser, director of engineering, Major League Baseball

Vail Resorts makes personalized AI assistance easy

Who: Vail Resorts operates some of the most iconic and beloved mountain destinations in the world, including Whistler Blackcomb, Park City Mountain, Stowe, and Crested Butte.

What they did: Vail Resorts launched My Epic Assistant during the 2024-2025 snow season, and expanded it this year to add even more AI-powered chat features powered by Google’s powerful Gemini models. The result is an agentic guide to the slopes that can help skiers and snowboarders decide on the right season pass, share the latest snow report, check on lesson preparations, or suggest a good stop for cocoa.

Why it matters: Vail Resorts wanted more than a chatbot; they wanted a digital concierge that understands the nuance between a powder day at Whistler and a family trip to Beaver Creek. As the company implemented and refined personalization, improved search, summary capabilities, and conversational flow within My Epic Assistant, the app has delivered a 45% reduction in escalation to human agents since launch.

Learn from us: "Utilizing tooling from Google Cloud, we could lean into agentic design patterns that gave us a way to unlock natural, personalized conversations. These boosted customer satisfaction, while reducing the need for manual intent design. These tools also let us combine flexibility and control to enable the assistant to respond fluidly but always within the boundaries of our brand, policies, and product strategy.”— The Vail Resorts technical team

CTC Global turns the smart grid into an intelligent one

Who: CTC Global is a leading manufacturer of advanced transmission conductors and power lines. While many nodes in the grid contain IoT sensors, it recognized a literal gap in the transmission lines themselves.

What they did: CTC’s new GridVista platform threads fiber-optic cable into its high-strength carbon fiber composite core, and connects these to monitoring technology built with AI and monitoring technology from Google Cloud and Tapestry. With GridVista, CTC can turn every inch of transmission into a smart sensor.

Why it matters: GridVista gives CTC grid operators an accurate and reliable view of what’s happening across the entire line — based on actual, real-time data from the entire length of the conductor, not point estimates from a static model of line conditions or the occasional clamped-on sensor. This means they can significantly improve safety, manage costs, increase the line’s capacity to transmit power, and enhance reliability with more precise insights about events that might trigger an outage.

Learn from us: “This awareness allows for a grid that can truly sense its own health in real time and provide unprecedented awareness of conditions on the entire line. Whether that’s real time storm impacts, ice load, wind load, branches on the wire, or temperatures on or under the line. The GridVista system truly represents next generation capabilities. ” — J.D. Sitton, CEO, CTC Global

ID.me reduces risk while scaling past 160 million users

Who: ID.me is transforming digital identity security for the modern era, offering a single login that lets you easily prove you’re you across a wide range of platforms and wallets.

What they did: ID.me currently serves more than 160 million users, including as many as 40,000 at any time, so they can prove their identity online as easily as flashing their driver’s license in person. Over the last two years, ID.me migrated more than 50 terabytes of data across 15 database instances to Google Cloud with minimal downtime. They also introduced a two-tier architecture with Cloud SQL supporting its smaller and more standard services, while AlloyDB runs heavier workflows that form the backbone of the ID.me platform.

Why it matters: AlloyDB AI has allowed ID.me to scale its systems to handle 10X-20X of what was possible before — and at a lower price to boot. That responsiveness and reliability led the U.S. federal government to recognize ID.me for its role in preventing large-scale fraud within national systems.

Learn from us: "We’ve been able to scale both our infrastructure and trust. With a platform that’s faster, smarter, and built to handle portable identity at massive scale, we’re one step closer to our goal: a secure, digital way to prove who you are, wherever you need it, that works everywhere you need it." — Kevin Liu, Cloud Platform Architect, ID.me

Manhattan Associates powers more than a billion daily API calls

Who: Manhattan Associates is a global leader in supply chain and omnichannel commerce solutions, offering tools and platforms that reach more than 2 billion people across 20 billion consumer touchpoints.

What they did: Manhattan Associates modernized its Manhattan Active SaaS platform by migrating from legacy Oracle and DB2 systems to Google Cloud databases. Each capability of Manhattan Active now runs as an independent, containerized service orchestrated by Google Kubernetes Engine (GKE). Data flows through Pub/Sub into BigQuery for real-time analytics, while Cloud Logging and Cloud Monitoring deliver observability at scale.

Why it matters: With its new microservices-first design, Manhattan gained the agility to evolve faster and the confidence that mission-critical operations would remain resilient across regions. With Cloud SQL and BigQuery, the company now processes more than a billion daily API calls with average response times of less than 150 milliseconds. This evolution supports hundreds of thousands of monthly active users across tens of thousands of stores and distribution centers. The new platform also created the foundation for Manhattan’s Agentic AI suite, which includes prebuilt agents — like the Intelligent Store Manager and Labor Optimizer — that coordinate real-time decisions across store and distribution center operations.

Learn from us: "Operationally, the platform has become more elastic and efficient. The system automatically handles hundreds of thousands of scaling events per day, ensuring performance remains consistent during peak surges without expensive overprovisioning." — Narayana Reddy Kothapu, Senior Director, Manhattan Associates & Rajkumar Ramani, Technical Director, Manhattan Associates

Guide to prompting Gemini 3.1 Flash TTS (text-to-speech)

Wed, 15 Apr 2026 15:00:00 +0000

Today, Gemini 3.1 Flash TTS, our latest text-to-speech model, is available on Google AI Studio and Vertex AI. It delivers precise controllability and expressivity, empowering developers and enterprises to build advanced AI-speech applications.

The new TTS model introduces a high level of controllability by allowing you to steer the delivery using 200+ audio tags. We'll share how to get strong results from the model, whether you are building accessible gaming soundtracks, banking systems, or audiobooks. Learn more about the model here.

What you will learn:

Model overview
Voice style instructions
The core prompting framework for audio tags
Directing expression and pacing
Use cases: accessibility and inclusive design, creative and entertainment, enterprise use cases

1. Model overview

Gemini 3.1 Flash TTS is available on Google AI Studio and Vertex AI in public preview.

The model delivers high-fidelity speech and precise control across 70+ languages. These core optimizations bring advanced control to style, accent, pacing and expressivity to major markets.

Audio generated by Gemini 3.1 Flash TTS is watermarked with SynthID, a watermark woven directly into the audio output to help identify AI-generated content.

2. Voice style instructions

To begin, choose a baseline voice from the 30 available prebuilt voices and a target language from over 70+ supported options and regional variants. This selection serves as the foundation for your audio output.

Once you have your base voice and language, you can use natural language instructions to add stylization. Whether you need a specific regional accent, a professional narrator’s tone, or a more casual, conversational vibe, simply describe the style you want to achieve.

Finally, you can now embed audio tags directly into your text prompt to trigger specific pacing and expressiveness to generate your audio.

3. The core prompting framework for audio tags

With Gemini 3.1 flash TTS, we are introducing audio tags as an intuitive way to guide vocal style, pace, and delivery. By embedding natural language commands directly into the text input, you can steer AI-speech output with high levels of granularity.

The formula: [pacing tag] + spoken text + [expressive tag] + spoken text + [pause tag] + spoken text

All inline tags must be enclosed in square brackets, such as [whispers] or [happy]. Insert these tags exactly where you want the transition to occur. Ensure tags are separated by text or punctuation to avoid system errors. Do not place two tags directly next to each other. Accents should be triggered by style prompts, not by the language setting.

Please note that the tags are in English only, but English-language tags can be combined with text in other languages.

French language example:

[cautious] L'ombre avança lentement dans la pièce silencieuse. [whispers] Le document secret devait être caché ici. [short pause] Mais où? [gasp] Soudain, un bruit sourd résonna dans le couloir [panic] Il fallait sortir d'ici immédiatement.

4. Directing expression and pacing

Gemini 3.1 flash TTS supports 200+ audio tags to prompt expressive voices.

Most commonly used tags include: [determination], [enthusiasm], [adoration], [interest], [awe], [admiration], [nervousness], [frustration], [excitement], [curiosity], [hope], [annoyance], [amusement], [aggression], [tension], [agitation], [confusion], [anger], [positive], [neutral], [negative], [whispers], and [laughs].

Pacing and stylistic controls: you can use pacing tags like [slow] or [fast] to control the speed of the delivery. To pace out your information and let dramatic moments land, use tags like [short pause] or [long pause].

Non-verbal vocalizations: the model can produce realistic non-verbal audio. You can insert tags like [laughs] or [whispers] to add texture to the audio output.

Use cases

1. Accessibility and inclusive design

Text-to-speech technology plays a vital role in making digital spaces accessible. Gemini 3.1 Flash TTS provides highly contextual, clear audio for individuals who rely on screen readers or augmentative and alternative communication devices.

Gaming soundtracks and descriptions

For players navigating game menus, audio descriptions need to be clear, inviting, and easy to follow.

[enthusiasm] You have selected the twilight forest level. [interest] This area features hidden artifacts and new challenges. It includes an expansive map, challenging puzzles, and a specialized survival kit.

Media and TV audio descriptions

When providing audio descriptions for television or film, the synthetic voice can match the energy of the scene, utilizing tags like whispers or sound effects to enhance the experience without distracting from the primary audio.

[neutral] The scene fades in on a dimly lit diner. [whispers] A person in a trench coat sits alone in the corner booth, nervously checking their watch. [neutral] They look up sharply as the diner door swings open.

2. Creative and entertainment use cases

For audio publishers and content creators, the model applies context-aware pacing based on the natural flow of the text. You can stack pacing and expressive tags to build suspense and drama in a narrative format.

Audiobooks

A narrator setting the scene, followed by a character speaking with a distinct style.

[cautious] step carefully around the glowing runes on the floor. [anxiety] one wrong move and the entire temple collapses. [relief] we finally found the crystal. [awe] it is more brilliant than the stories described. [alarm] wait, the light inside is turning red. [panic] run for the exit!

Tip: For long-form content, manual tagging can be inefficient. You can use Gemini 3.1 Flash-Lite to programmatically annotate your text before passing it to the Gemini 3.1 Flash TTS model. Try this demo here.

3. Enterprise and business use cases

For enterprise applications, precision and tone are critical. Here is how to use pacing and expressive tags to handle day-to-day business operations.

Banking

When dealing with sensitive information like credit card fraud alerts, the model can transition from a serious, professional tone to a helpful, positive resolution.

[neutral] Hello. This is an automated fraud prevention alert from Horizon bank. [seriousness] We detected unusual activity on your card ending in [slow] 4 3 2 1. [positive] If you recognize a charge of eighty-five dollars at City electronics, please press one.

Urgent automated notifications

Use pacing tags to emphasize the urgency of an action required by the customer.

[neutral] Hello. This is an automated message from City airways. [short pause] Your flight, [slow] C A 4 2 7, has been updated. [positive] It is now departing at 8:45 AM from Gate B 12. [fast] Please proceed to the gate immediately, as boarding will begin in five minutes.

How to get started today

You can start building with Gemini 3.1 Flash TTS in our core developer products:

Vertex AI: The model is available in preview on Vertex AI. Build Gemini 3.1 Flash TTS into your applications with the scale, security, and enterprise-readiness of Google Cloud.
Google AI Studio: For rapid prototyping and experimentation, the model is available in Preview in AI Studio. Explore the new audio playground interface to test the expressive controls.

To dive deeper into the best practices, explore the following resources:

The German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape

Wed, 15 Apr 2026 14:00:00 +0000

Written by: Jamie Collier, Robin Grunewald

Germany has reclaimed its position as a primary focus for cyber extortion in Europe. While data leak site (DLS) posts rose almost 50% globally in 2025, Google Threat Intelligence (GTI) data shows that the surge is hitting German infrastructure harder and faster than its regional neighbors, marking a significant return to the high-pressure levels previously observed in the country during 2022 and 2023.

Cyber Criminals Pivoting Back to Germany

Germany moved to the forefront of European data leak targets in 2025. Following a 2024 period where the UK led in DLS victims, this pivot reflects a resurgence of the intense pressure observed across German infrastructure during 2022 and 2023.

This targeting is not a result of the overall number of companies within Europe, as Germany has fewer active enterprises than France or Italy. Instead, its sustained appeal to extortion groups is driven by its status as an advanced European economy with an increasingly digitized industrial base.

Figure 1: Percentage of data leaks affecting European nations in 2025

The speed of this escalation is particularly notable. Following a relative cooling of activity in 2024, Germany saw a 92% growth in leaks in 2025—a growth rate that tripled the European average.

Figure 2: The number of German victims listed in data leak sites grew 92% in 2025 compared to 2024

While several factors influenced European ransomware trends in 2025, a striking contrast emerged in leak volumes. While shaming-site postings for UK-based organizations cooled, non-English speaking nations (particularly Germany) witnessed a surge. This shift reflects a convergence of several factors. The continued maturation of the cyber criminal ecosystem, including the use of AI to automate high-quality localization, is further eroding the historical protection offered by language barriers. However, this "linguistic pivot" is also supported by a shift in victim profiles. As larger "big game" targets in North America and the UK improve their security posture or utilize cyber insurance to resolve incidents privately, threat actors appear to be pivoting toward the "ripe markets" of the German Mittelstand (discussed in further detail later in this post).

Google Threat Intelligence Group (GTIG) has also observed multiple cyber criminal groups post advertisements, seeking access to German companies and offering a proportion of any extortion fees obtained from victims. For example, dating back to November 2024, the threat actor known as Sarcoma has targeted businesses across several highly developed nations, including Germany.

Figure 3: A forum post by an actor seeking a partnership to target German victims

While the 2025 data marks a record year for German leak volume, it is important to contextualize these figures with a degree of caution. Relying solely on DLS numbers can be misleading, as threat actors typically only post victims who refuse to initiate or complete extortion negotiations. Public reporting on the decline in ransom payment rates may be partially fueling the steady increase in shaming site posts as a secondary pressure tactic. Consequently, while the surge in Germany remains a critical trend, these metrics should be viewed as one component of a broader, more complex threat landscape.

The Diversifizierung of the Cyber Criminal Ecosystem

2025 was characterized by significant turbulence in the cyber criminal ecosystem, driven by internal conflicts and aggressive law enforcement actions against dominant "big game" operations like LOCKBIT and ALPHV. The resulting vacuum at the top of the ransomware market has led to a more crowded field of agile, mid-tier DLS brands. In Germany, this rebalancing is highly visible: as established brands receded, a wider pool of competitors emerged to absorb the market share.

Figure 4: German victims on data leak sites rose sharply in 2025

Following the disruption of LockBit, groups such as SAFEPAY and Qilin have gained significant prominence within the German landscape. SAFEPAY, in particular, claimed breaches of 76 German companies in 2025—accounting for 25% of all German victim posts that year. Meanwhile, Qilin tripled its operational tempo in Germany during Q3 2025. While this increase aligns with Qilin's broader global uptick in activity, their consistent focus on German targets (including 13 victims posted already in early 2026) demonstrates that their presence in the German landscape grows in lockstep with their global expansion.

Figure 5: Leaked data of a German company (name redacted) by SafePay

No Such Thing as Too Small: Targeting of the Mittelstand

There is a persistent myth that small businesses are "too small" to be targeted, a perception often fueled by the fact that large global corporations often dominate cyber crime headlines. However, the 2025 data tells a different story: organizations with fewer than 5,000 employees accounted for 96% of all ransomware leaks in Germany. While this figure largely aligns with the structural composition of the German economy, it underscores a concerning disconnect between public perception and actual targeting patterns. While "big game" hits make the news, the high volume of leaks among medium- and small-sized victims proves they are highly attractive targets for cyber criminals—often because they lack the extensive security personnel and specialized resources of their larger counterparts.

The targeting of the Mittelstand creates a significant secondary risk for large German enterprises and multinationals. While a major corporation may have robust defenses, its broader ecosystem of suppliers and contractors often manages sensitive data or maintains privileged network access. To address these systemic gaps, large enterprises must evolve from passive monitoring to a proactive third-party risk management framework, implementing vendor tiering and enforcing multifactor authentication to neutralize the lateral movement favored by modern cyber criminals.

Figure 6: Size of victim organizations found on data leak sites

Targeting Beyond the Assembly Line

Germany's industrial base remains the primary focus for cyber criminals with manufacturing accounting for 23% of all dark web leaks in 2025. However, the German cyber criminal landscape is characterized by its variety, with legal & professional services (14%), construction & engineering (11%), and retail (10%) all targeted.

The most notable shift in the 2025 data is the growth within the legal & professional services sector. This increase is likely intentional: these firms represent high-value targets because they serve as trusted custodians of sensitive client data, including intellectual property, financial strategies, and M&A plans. This allows cyber criminals to extract significant extortion payments beyond their primary victim and gain downstream leverage over an entire client base.

Figure 7: Data leak victims in Germany by industry

Outlook

The data from 2025 reveals that the recent surge in German leaks is not an isolated incident, but a return to the high-pressure levels previously observed in 2022 and 2023. This resurgence reflects a more volatile and linguistically diverse European threat landscape going into 2026. The 92% growth in German leaks, tripling the European average for 2025, proves that non-English-speaking nations remain a primary target for global extortion groups.

The disruption of established brands like LockBit has rebalanced the ecosystem into a crowded field of agile data leak sites, such as SafePay and Qilin. These groups appear to be hitting Germany in lockstep with their global expansion, identifying the Mittelstand and German professional services as high-volume, target-rich environments. As threat actors continue to exploit complex supply chains, smaller organizations will remain critical pivot points for those aiming at the top of the industrial stack.

Recommendations to assist in addressing the threat posed by ransomware are captured in our white paper, Ransomware Protection and Containment Strategies: Practical Guidance for Endpoint Protection, Hardening, and Containment.

Introducing BigQuery Graph: Unlock hidden relationships in your data

Tue, 14 Apr 2026 16:00:00 +0000

Today, we're thrilled to announce that BigQuery Graph is now available in preview. With BigQuery Graph, we’ve built an easy-to-use, highly scalable graph analytics solution for data engineers, data analysts, data scientists, and AI developers, empowering them to model, analyze and visualize massive-scale relationships in an entirely new way.

As data changes and grows, it’s important to understand how different entities such as people, places, and products relate to one another. After all, data is more meaningful when we know how entities are interconnected. With traditional SQL, to find a "friend of a friend of a friend" requires multiple nested JOIN operations, which are usually challenging to read and write, and the performance degrades exponentially at scale. Finding the "blast radius" of a supply chain disruption during a storm requires multi-hop traversals, a full-scale graph analysis. To better solve this challenge, data is often modeled as a graph representation of the physical world around us, which can be better at finding complex and hidden relationships than traditional relational data structures.

Graph challenges faced by enterprises across industries

Graph technology has been broadly used across industries for fraud detection, recommendation engines, supply chain management, knowledge graph applications, and many others. However, users face some major challenges in adopting graphs:

Data silos and maintenance overhead: Having to store and maintain graph data in a standalone graph database creates data silos, data inconsistency, additional cost — not to mention extra operational overhead.
Lack of graph expertise: Adopting graph technologies often requires learning a new language, paradigm, and potentially a new database. At the same time, organizations’ investment in SQL expertise are less relevant.
Performance and scalability concerns: Many standalone graph databases work well when traversing the graph from a handful of nodes, but struggle to scale to billions of entities as business demands grow.

BigQuery Graph addresses many of these challenges by supporting:

Built-in graph query experience: A more intuitive graph query language (GQL) allows you to find patterns and traverse relationships among disparate data sets, based on the newest ISO GQL standard.
Unified relational and graph data models: Tight integration between graph and relational data models allows you to choose the best tool to model the data on a single source of truth without data duplication or data movement. Full interoperability between graph queries and SQL allows you to continue to leverage existing SQL skills, while taking advantage of the expressiveness of graph queries.
Graph over structured and unstructured data: Rich AI functions, vector and full-text search capabilities are supported with BigQuery Graph, allowing you to use semantic meaning, keyword search on graphs, bridging the gaps of structured and unstructured data.
Graph visualization: You can easily explore, investigate, and explain how your data is connected in an intuitive graph format using BigQuery Studio notebook and Jupyter Notebook.
Industry-leading ease of use, performance and scalability: BigQuery Graph is built upon BigQuery's serverless, scalable, cost-effective and distributed analytics engine that can scale to billions of nodes and edges.
Integration with Spanner Graph: This provides a unified graph schema and graph query language that serve a full spectrum of real-time (Spanner Graph) and batch graph needs (BigQuery Graph). You can also build a virtual graph by combining the latest data from Spanner and historical data from BigQuery without data movement using federated queries.
Chat with your graph: Very soon, you will be able to chat directly with graphs with the Conversational Analytics Agent (stay tuned).

Common BigQuery Graph use cases

BigQuery Graph opens up a realm of possibilities across industries for building intelligent applications:

Financial fraud detection: Analyze complex relationships among users, accounts, and transactions to identify suspicious patterns and anomalies, such as money laundering and irregular connections between entities, which can be difficult to detect using relational databases.
Customer 360: Track customer relationships, preferences, and purchase histories. Gain a holistic understanding of each customer, enable personalized recommendations, targeted marketing campaigns, and improved customer service experiences.
Social networks: Capture user activities and interactions and use graph pattern matching for friend recommendations and content discovery.
Manufacturing and supply chain management: Use graph patterns for efficient stockout analysis, cost rollups, and compliance checks by modeling parts, suppliers, orders, availability, and defects in the graph.
Healthcare: Capture patient relationships, conditions, diagnosis, and treatments to facilitate patient similarity analysis and treatment planning.
Transportation optimization: Model places, connections, distances, and costs in the graph, and then use graph queries to find the optimal route.

BigQuery Graph in the real-world

Many customers across industries have leveraged BigQuery Graph to solve real-world business challenges. Here are a few examples of how they are putting these capabilities into practice:

BioCorteX: drug discovery

"Understanding disease isn't about collecting more data; it’s about understanding the relationships within that data. By leveraging pathway search in BigQuery Graph at a massive scale, reaching depths of 7+ hops, we are finally able to see more of the human metabolism map. This level of scale is what allows us to move beyond trial and error, identifying the precise biological levers that need to be pulled to cure complex diseases. We aren't just guessing anymore, we’re emulating life at the speed of compute." - Nik Sharma, CEO and Cofounder, BioCorteX

Curve: fraud detection

"By implementing BigQuery Graph, we have successfully moved away from the previous limited sql-based approach to a more scalable solution for fraud detection network analysis. This has allowed us to detect sophisticated fraud networks by uncovering hidden connections between seemingly unrelated accounts and transactions. This transition from traditional relational queries to graph-based analytics has showcased measurable business impact with ~£9.1M of savings. This shift has not only improved the precision of fraud detection but has also provided a scalable foundation for protecting the ecosystem without adding significant operational overhead." - Francis Darby, VP Data & ML, Curve

Virgin Media 02: fraud detection

"At Virgin Media O2, we are constantly evolving our defenses to stay ahead of increasingly sophisticated fraud networks. We’ve added a powerful new layer to our already robust fraud alerting system. Using BigQuery Graph, we can now execute complex 4-hop queries that map the hidden relationships between accounts, devices, and activities. This deeper visibility allowed us to identify networks of suspicious addresses. This doesn't just catch fraud; it acts as an early warning system, flagging new connections to known risk networks before they can cause damage." -- Jonathon Ford, Director Data Applications, Virgin Media O2

How to use BigQuery Graph

BigQuery Graph is more than just a new feature; it's a new way of thinking about data, empowering you to ask bigger questions, uncover deeper insights, and solve your most challenging problems.

You can get started in three simple steps:

Step 1: Create graph schemas on top of the relationship tables using DDL with a single copy of data.

Create a finance graph by mapping relational tables into “Account”, “Person”, "Loan" nodes and their relationships “Transfers”, “Owns”, "Repays" via edges.

code_block: <ListValue: [StructValue([('code', 'CREATE PROPERTY GRAPH graph_db.FinGraph\r\nNODE TABLES (\r\n graph_db.Account KEY(id),\r\n graph_db.Person KEY(id),\r\n graph_db.Loan KEY(id)\r\n) \r\nEDGE TABLES (\r\n graph_db.Transfers \r\n KEY (id, to_id, timestamp) \r\n SOURCE KEY (id) REFERENCES Account (id)\r\n DESTINATION KEY (to_id) REFERENCES Account (id), \r\n graph_db.Owns\r\n KEY (id, account_id, timestamp) \r\n SOURCE KEY (id) REFERENCES Person (id)\r\n DESTINATION KEY (account_id) REFERENCES Account(id),\r\n graph_db.Repays\r\n KEY (id, loan_id, timestamp) \r\n SOURCE KEY (id) REFERENCES Person (id)\r\n DESTINATION KEY (loan_id) REFERENCES Loan(id)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64a36a0c10>)])]>

Step 2: Use intuitive SQL/GQL to traverse data relationships and find hidden connectivities.

Find the accounts owned by Jacob and the loans he repays from those accounts:

code_block: <ListValue: [StructValue([('code', 'GRAPH graph_db.FinGraph\r\nMATCH\r\n (person:Person {name: "Jacob"}) \r\n -[own:Owns]->(account:Account)\r\n -[repay:Repays]->(loan:Loan)\r\nRETURN\r\n account.id AS account_id,\r\n loan.id AS loan_id'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64a36a0940>)])]>

Combine vector search with graph traversals to find fraudster-like accounts and their transfer activities within 1-6 hops:

code_block: <ListValue: [StructValue([('code', "DECLARE similar_account_to_fraudster DEFAULT ((\r\n SELECT array_agg(base.id)\r\n FROM VECTOR_SEARCH(TABLE graph_db.Account, 'embedding',\r\n (SELECT * FROM graph_db.Account WHERE id=102), 'embedding', \r\n top_k => 6)\r\n));\r\nGRAPH graph_db.FinGraph\r\nMATCH\r\n (person:Person)-[own:Owns]->\r\n (account:Account)-[transfer:Transfers]->{1,6}\r\n (to_account:Account)\r\nWHERE to_account.id IN \r\n UNNEST(similar_account_to_fraudster)\r\nRETURN\r\n person.id AS person_id,\r\n account.id AS src_account,\r\n to_account.id AS to_account"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f64a36a0820>)])]>

Step 3: Visualize graph results to detect connectivity of disparate data in a more intuitive way in BigQuery Studio notebook.

If you are looking for a specialized graph visualization tool, BigQuery Graph has integrated with industry leading partners including G.V(), Graphistry, Kineviz, Linkurious. They allow you to see a visualization of BigQuery Graph query results outside the Google Cloud console.

Ready to get started?

The future of data analysis is connected. With BigQuery Graph, you have the power to unlock that connectivity and transform your business into actionable insights grounded with your enterprise knowledge. Start exploring today and unleash the power of your data's interconnected relationships!

Visit the BigQuery documentation: find overview and quickstart guide.
Explore tutorials: get hands-on experience with BigQuery Graph through tutorials.
Share your feedback: join our community, and get your questions answered via bq-graph-preview-support@google.com.
Related blogs:

Cloud Blog

Announcing our 2026 Google Cloud Partners of the Year

Global

Artificial Intelligence

Data

Infrastructure Modernization

Security

Google Workspace

Services & Industry Solutions

Technology & Business Applications

Country

Marketplace

Public Sector

Talent Development

Training

Other categories: Distribution, Geospatial, and Social Impact

Building the foundation for AI across the public sector through our partner ecosystem

Empowering the next generation: A new federal AI startup accelerator in collaboration with NVIDIA

Google Public Sector ISV ATO Accelerator program

Modernizing procurement in partnership with Carahsoft

Get involved

From keynote to the terminal: Join our Next ‘26 developer livestreams

What to expect

Schedule

Where to watch

Next digital pass

What’s next after Next? Stay agent-ready with GEAR

GEAR up to get the most out of AI learning at Google Cloud Next ‘26

Next learning experiences you can’t miss

Jumpstart your learning with GEAR and Google Skills today

Introducing the Builders Hub from the Google Developer Program

A Frictionless "Front Door"

The Integrated Workbench: Build While You Learn

Grow With Your Career

Get Started

Evolving Media CDN for the world’s most demanding broadcast and streaming workloads

The need for scale, flexibility, and efficiency

What’s new with Google Cloud

Apr 13 - Apr 17

Apr 6 - Apr 10

Mar 30 - Apr 3

Mar 23 - Mar 27

Mar 16 - Mar 20

Mar 9 - Mar 13

Mar 2 - Mar 6

Feb 23 - Feb 27

Feb 9 - Feb 13

Jan 26 - Jan 30

Jan 19 - Jan 23

Create Expert Content: Deploying a Multi-Agent System with Terraform and Cloud Run

Deployment to Cloud Run and the Path to Production

Production Utilities and Server: Building the System's Body

The Application Server

Implementing Telemetry

Monitoring vs. Targeted Evaluation

Viewing the Trace

Infrastructure as Code: Provisioning Secure Cloud Resources

Terraform Resources and Variables

Core Infrastructure Logic

Provision the Infrastructure

Deployment: Containerization and the Cloud Build Pipeline

Deploy Application

Verification: Accessing and Testing Your Deployed Agent

Granting User Permissions

Launch the Proxy

Summary

How WPP accelerates humanoid robot training 10x with G4 VMs

Where we started: redefining the agency model

Why teach a robot to dance?

The workflow

Bridging the "sim-to-real" gap

What’s Next

Go from blank slate to analysis with BigQuery Studio notebook gallery templates

Move past the blank slate with curated templates

Choose the right template for your project

Access the gallery in your workflow

Get started

Announcing AI-first Colab notebook experience for Google Cloud

What’s new with Google Data Cloud

April 13 - April 17