Cloud Blog

PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap

Tue, 11 Aug 2026 16:00:00 +0000

Securing infrastructure and services against a future cryptographically-relevant quantum computer has been a goal for Google for a decade, and we’ve dedicated ourselves to help developers by advancing open standards that can benefit everyone. As post-quantum cryptography (PQC) has matured, we’ve been rolling it out in our infrastructure for internal and customer-facing services.

Today, we're sharing our updated Google Cloud roadmap to migrate to PQC by 2029.

Our strategy: Secure by design

We’ve based our PQC migration strategy on the Google Quantum Threat Model, prioritizing protection across three key domains:

Mitigating Store Now, Decrypt Later (SNDL) risks: Protecting today's encrypted data from being harvested and decrypted by a future quantum computer.
Ensuring integrity against forgery: Strengthening digital signatures to prevent attackers from falsifying data and identity.
Enhancing foundational capabilities for cryptographic agility: Building flexible systems that can easily adopt new cryptographic standards with minimal engineering effort as cryptographic standards evolve.

We’re actively transitioning internal infrastructure and customer-facing services to PQC algorithms far ahead of regulatory deadlines.

We are also deploying PQC solutions across our Sovereign Cloud initiatives, such as Google Cloud Dedicated (GCD) and Google Distributed Cloud (GDC), in collaboration with our partners. Similarly, our strategy allows us to progress on integrating post-quantum protections across our AI services to secure the next generation of cloud workloads.

These efforts are fundamental pillars of our overarching strategy to achieve full post-quantum readiness across Google Cloud. As this landscape evolves, we will continue to refine and update our deployment schedules.

Visualization of our Google Cloud PQC roadmap. Our efforts converge in 2029, and extend beyond it.

We plan to achieve full PQC readiness by 2029, when our efforts converge. We anticipate continuing those efforts into the 2030s to support broader industry guidance and evolving global standards. These standards include CNSA 2.0 and the transition paths defined in NIST IR 8547, which anticipate the final deprecation of legacy, quantum-vulnerable algorithms between 2030 and 2035.

Immediate progress: 2026 milestones

Leadership in the quantum era requires deployment at global scale. We have achieved foundational milestones that provide immediate protection for our customers:

API endpoint readiness: Google Cloud API endpoints now offer quantum-safe key exchange, protecting incoming traffic from future decryption. These endpoints include google.com and *.googleapis.com, and both have implemented NIST-standardized ML-KEM (FIPS 203) in hybrid mode.
Load balancers PQC support: Application and proxy load balancers now support quantum-safe hybrid key exchange (X25519MLKEM768) for TLS 1.3. Initially available on an opt-in basis, this allows our customers to perform validation, while minimizing impacts to their existing applications.
Quantum-safe certificate experimentation at scale: We’re collaborating with the IETF PLANTS Working Group to produce a public key infrastructure (PKI) standard that minimizes impact to your operations teams. Chrome and Cloudflare have started experimenting with Merkle Tree Certificates to address challenges using PQC signatures for WebPKI, and we have been sharing insights with the standards working group.
Cloud KMS PQC algorithms: NIST standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) for your encryption and signing keys are now generally available.

The roadmap to 2029

We’ve established specific customer-centered journeys for Google Cloud to achieve quantum readiness that allow us to prioritize our quantum-safety initiatives. By adopting this risk-based approach, we focus on the core journeys our security experts have identified as most vulnerable to the potential impacts of quantum computing.

Risk-based prioritization for core quantum readiness user journeys.

These scenarios offer diverse platform perspectives to ensure global enablement across our services to meet you where you are.

For each risk domain, we provide a roadmap for key products and services organized by domain, although the services highlighted are not exhaustive lists. We project most services will meet their respective domain's target completion date, though specific product timelines may be adjusted if necessary to account for evolving engineering requirements and any third-party dependencies.

Domain 1: Store Now Decrypt Later (SNDL) mitigation

This domain focuses on addressing vulnerabilities in asymmetric encryption where a future cryptographically-relevant quantum computer (CRQC) could decrypt data captured today.

We’re enabling incremental progress for our customers based on their typical journeys.

Securing your customer workloads: Offer quantum-confidential TLS 1.3 handshakes for your Google Cloud services and configured load balancers to protect user sessions.
Securing administrator and developer flows: Protect the admin pathways used to manage your cloud environment against SNDL. This includes services such as Cloud VPN and Interconnect. For developers, these include client libraries, SDKs, and Tink, our open-source cryptographic library.
Securing data pipelines: Safeguard the confidentiality of data transfers for our analytics and storage platforms. PQC is essential to ensure that sensitive intellectual property and customer data flowing through these systems cannot be captured today and decrypted by a future quantum-capable adversary.

Roadmap
We are targeting these changes for 2027.

Journey	Benefits	Representative services
Store now decrypt later mitigation (End of 2027)
Securing your customer workloads	Quantum-safe ingress: Protects your cloud perimeter using standardized post-quantum algorithms.	Application and proxy load balancing [2026 (Completed)]
Securing admin and developer flows	Secure operations: Validates that your management and deployment stack meets emerging cryptographic standards.	Quantum-confidential ALTS [2025 (Completed)]
		API endpoints [2026 (Completed)]
		Cloud VPN, Cloud Interconnect, GCE OS Login, Cloud SDK, gCloud CLI, GKE service mesh, and client libraries [2026/2027]
Securing data pipelines	Confidential data transfers: Protect sensitive intellectual property and customer data against quantum attackers.	Cloud Storage SDK, Storage Transfer Service, BigQuery CLI, Data Transfer Service [2026/2027]

Domain 2: Integrity and non-repudiation

This domain addresses quantum-proofing of digital signatures and attestations to safeguard against forgery that could compromise data integrity and authenticity.

Securing the software supply chain: Ensure that only trusted, untampered images with quantum-resistant attestations run in production to help prevent a quantum attacker from altering builds. This includes services like Binary Authorization, Cloud Build, and Assured Open Source Software.
Issuing quantum-safe certificates: Transition the public key infrastructure (PKI) including our internal and external certificate authorities (CAs) to support ML-DSA certificates and where meaningful, SLH-DSA certificates. This transition will follow Internet Engineering Task Force (IETF) standardization efforts that are currently in development. We’re actively contributing to these efforts, and we’re also conducting several large-scale experiments:

Address large PQC signature sizes that can impact the performance of certificate chain validations through novel approaches like Merkle Tree Certificates for Web PKI.
Support ML-DSA/SLH-DSA (pure PQC)-based certificates in private CA solutions such as Certificate Authority Service (CAS).
Add quantum-authentication in addition to our internal traffic protocol ALTS that already supports PQC for confidentiality. You can learn more technical details on our approach to digital signatures and Public Key Infrastructure here.

Protecting identity and access: Ensure authentication mechanisms like service account keys and tokens (JWT/OAuth) are resistant to quantum forgery.

Roadmap
We are targeting completion of these milestones by 2028. We also are mindful of ongoing standardization efforts particularly in the field of certificates. Google is actively contributing to quantum-safe certificate standards, and we are committed to help the industry overall meet those deadlines.

Domain / Journey	Benefit	Representative services
Integrity and non-repudiation (End of 2028)
Securing the software supply chain and signature services	Quantum-safe software attestations: Prevents unauthorized build tampering by ensuring only trusted images run in production.	Binary Authorization, Access Approval (AXA) [2026]
		Assured OSS [2027]
Issuing quantum-safe certificates	Quantum-safe standardized trust: Safeguards the authenticity of your internal and external communications against quantum-calculated certificate forgery.	Quantum-authentic ALTS [2026/2027]
		Private CA (Certificate Authority Service) [2027]
		Google Trust Service: Merkle Tree Certificates [2028]
		Roll out of PQC certificates across Google Cloud products and infrastructure [2027/2028]
Protecting identity and access	Governed identity: Eliminates the risk of adversarial credential fabrication with NIST-standardized signatures for auditable integrity.	Cloud IAM [2028]
		Infra-wide rollout of quantum-safe authentication and access [2027/2028]

Domain 3: Foundations and key management

Cryptographic agility is the foundation of our PQC migration. Our ongoing investment in this area drives our end-to-end strategy for key management, libraries, and infrastructure changes.

Foundational key management and libraries: Enable NIST-approved algorithms through Cloud KMS and libraries like BoringSSL and Tink.

Note that Cloud KMS achieved general availability for the NIST standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA), and is in the process of enabling quantum-safe key import.

Hardware-backed cryptographic services: Secure physical foundations using quantum-resistant roots of trust. This includes PQC as part of our Confidential Computing offerings and Cloud Hardware Security Module (HSM).
Key sovereignty and partner solutions: Enable PQC orchestration for Google Workspace Client-side Encryption (CSE) and External Key Managers (EKM). Collaborate with partners to support PQC on-premises key providers.

Roadmap
We are targeting completion of these milestones by 2028.

Domain / Journey	Benefit	Representative services
Foundations and key management (End of 2028)
Foundational key management and libraries	Standardized quantum-safe keys: Provides the NIST-approved building blocks to help migrate your applications.	ML-DSA and SLH-DSA in KMS, ML-KEM and Hybrids in KMS [2025 (completed)]
		Quantum-safe Key Import (BYOK) [2026]
Hardware-backed cryptographic services	Silicon rooted hardware: Anchors your security in quantum-safe hardware roots of trust.	Confidential Compute (including attestation and vTPM) [2028]

		Quantum-Safe Cloud HSM (FIPS 140-3 L3) [2028]
Key sovereignty and partner solutions	Cryptographic provenance: Provides control and provenance of your keys where you need them.	External Key Management [2028]
		Partner enablement (key providers and sovereignty solutions) [2028]

A shared responsibility for quantum safety

Security has long been a collaborative partnership with our customers.

Google’s responsibility — Security of the cloud: We manage the transition to a quantum-safe infrastructure, including our network and encryption in-transit, global front-ends, and the ALTS protocol.

This responsibility encompasses the end-to-end PQC transition of our servers, ensuring that the underlying hardware and operating systems are secured against quantum threats. We maintain hardware integrity through quantum-safe, open-source silicon foundations such as Caliptra v2.1, TPM 2.0 v185, and OpenTitan. The latter is the first open-source silicon root of trust and already supports quantum-secure boot.

While we are working toward our 2029 target, hardware transition to PQC involves both active replacement, where feasible, and natural equipment replacement cycles. Our phased approach ensures stability, though the timeline for some physical components may extend beyond 2029.

Customer’s responsibility — Security in the cloud: Organizations must manage their own applications, including updating client-side software to negotiate PQC handshakes and managing the lifecycle of your asymmetric keys.

In addition, you should update your Google Cloud service configurations with quantum-safe settings and policies.

Our path forward, together

Building momentum toward quantum readiness requires immediate, practical action. We recommend starting with these three steps:

Inventory: Identify your cryptographic resources (such as keys and certificates) using Cloud Asset Inventory and solutions such as Wiz’s cryptography and PQC readiness. When you map cryptographic resource usage across your organization, you can more accurately define and prioritize your migration backlog.
Update: Ensure your development and Site Reliability Engineering teams are using software that supports PQC algorithms such as BoringSSL, Chrome, and SDKs. This update ensures your internal workflows are prepared to negotiate quantum-safe connections by default as we enable them at the edge.
Validate: Test the behaviors of your existing application using our quantum-safe APIs and load balancers. Validating your workflows today will identify architectural bottlenecks before they impact your primary production environments.

Google Cloud is committed to managing the complexity of this transition so you can achieve your regulatory and compliance commitments, while focusing on innovation. We are just beginning to share our progress as we work to empower our customers to lead in the post-quantum landscape.

To learn more about our PQC approach, please visit our post-quantum cryptography (PQC) hub.

Looker’s semantic layer governs Gemini Enterprise data for user trust

Tue, 11 Aug 2026 16:00:00 +0000

For organizations deploying AI agents at scale, there’s often a critical divide between structured and unstructured data. While large language models (LLMs) excel at parsing text documents, emails, and PDFs, they can struggle when presented with raw enterprise databases. Meanwhile, standard natural-language-to-SQL (NL2SQL) models often guess how database schemas fit together, which can lead to unpredictable queries, inconsistent metrics, and AI hallucinations that erode user trust.

Gemini Enterprise brings the best of Google AI to every employee through an intuitive chat interface that acts as a single front door for AI in the workplace. And now, Looker’s governed semantic layer serves as the trusted foundation for structured data within Gemini Enterprise, enabling trusted self-service business intelligence for all Gemini Enterprise users. With this integration, Looker analysts and admins can publish conversational agents natively into their Gemini Enterprise environments via the Agent-to-Agent (A2A) protocol. Now, organizations can provide their AI-accelerated taskforce with robust and trusted tools, powered by real-time analytics, that they can explore in natural language in addition to their daily workspace workflows. Making it easy to offer conversational agents in Gemini Enterprise expands discoverability and promotes a data-driven culture, while reducing friction to adoption.

Bringing a semantic foundation to structured and unstructured data

By combining Looker’s semantic layer with Gemini Enterprise, you can query both structured databases and unstructured documents in plain English, all in one place. Instead of jumping between dashboards and other tools to understand your numbers, teams can instantly connect hard metrics with real-world context to solve problems and make decisions faster.

Publishing Looker agents for consumption in Gemini Enterprise

Minimize AI hallucinations

If you ask the typical AI chatbot to calculate "revenue" or "churn rate" against an unstructured cloud database, it has to guess which tables to join, which filters to apply, and which timestamps to trust. This can result in different people asking the same question, only to get completely different answers.

Looker’s semantic layer eliminates this guesswork, serving critical context to Gemini Enterprise in the form of codified data, allowing the agent to give deterministic, predictable responses.

code_block: <ListValue: [StructValue([('code', '[ Gemini Enterprise Chat UI ] \r\n │\r\n (A2A Protocol / NLP)\r\n ▼\r\n [ Looker Governed Agent ] ──► Generates Deterministic SQL\r\n │\r\n [ Looker Semantic Layer ] ──► Business-Approved Definitions & Logic\r\n │\r\n ▼\r\n [ Enterprise Data Cloud ] ──► (BigQuery, AlloyDB, Spanner, etc.)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1160d519a0>)])]>

When a Gemini Enterprise user requests a business KPI in Gemini Enterprise, the request is routed directly to a Looker agent. The semantic layer generates deterministic, precise SQL based on version-controlled business logic. This helps ensure when an executive asks for "Revenue," they get the exact, governed enterprise metric — not a guess.

Robust governance and secure access management

Data governance and security are critical when introducing AI to enterprise data warehouses. Organizations can’t risk corporate information being loosely ingested, indexed, or exposed outside of strict permissions.

Looker’s integration with Gemini Enterprise is built on a zero-risk pass-through architecture, processing the data, but not writing to persistent storage. Gemini Enterprise does not ingest, replicate, or store your underlying database records. Instead, the integration operates safely and securely over the A2A protocol, following these core tenets:

OAuth authorization: In order to interact with a Looker agent within Gemini Enterprise, end users provide a secure, one-time OAuth consent. This binds their Gemini session to their specific Looker credentials.
Strong governance enforcement: Because the architecture relies on live pass-through queries, Looker’s existing row-level and column-level access controls are maintained.
Strict security isolation: If a user does not have permission to view, say, sensitive regional payroll or financial rows within the Looker platform, the Looker agent actively restricts that data in the Gemini environment. Should an agent be published to the Agent Gallery to simplify discovery, it still does not bypass the security controls that you established.

Technical capabilities and enterprise readiness

Deploying Looker agents natively into Gemini Enterprise via the A2A protocol doesn't just make it smarter — it makes it more interactive and interoperable, without sacrificing security. Here are some of the features you’ll find in this release.

Rich visual interactivity: support for charts

They say a picture is worth a thousand words. When users interact with Looker agents inside Gemini Enterprise, the platform goes beyond textual explanations and provides native, interactive data charts. If a user asks for a visual trend—such as monthly sales performance or regional distribution—the Looker agent maps the database response with rich, presentation-ready visualizations directly inside the universal chat box.

Note: If you published Looker agents in Gemini Enterprise prior to Looker release 26.12, we recommend updating or refreshing them to take advantage of these enhanced visualization capabilities.

Interoperability with first- and third-party agents

Looker agents published to Gemini Enterprise can understand context across different agents and data sources. Leveraging standard communication frameworks, these agents can securely share structured, governed insights with other first-party Google Cloud agents like the Deep Research Agent or external third-party agents to create structured workflows. This enables complex multi-agent orchestration, where an enterprise operational agent can pull data from a Looker agent to feed into a separate productivity or supply-chain workflow.

Looker-based user authentication

To preserve enterprise governance, this integration implements a robust, identity-centric authentication model. Users are required to provide a one-time OAuth consent, binding their active Gemini Enterprise session securely to their underlying Looker credentials. This helps ensure that every conversational query hitting your databases is authenticated at the user level, enforcing pre-existing Looker permission structures, row-level data access filters, and column-level masking rules — no exceptions.

Trusted data in Gemini Enterprise

The future of work is agentic. Gemini Enterprise provides a single, secure architecture to deploy a global digital task force,empowering your business with the best of Google AI for developers, employees, and customers.

The integration of Looker with Gemini Enterprise not only brings trusted data analytics to business users but also adds rich interactivity, visual charts, and data storytelling directly into their everyday workspace. As business users embrace this agentic new way of working, they aren't just getting text answers; they are getting presentation-ready visualizations that bring operational metrics to life and deliver complex insights.

To get started, learn how to publish your data agents in Gemini Enterprise to make your agent’s predefined context and analytics available to your entire organization.

Accelerate PostgreSQL migrations using Gemini in Database Migration Service

Tue, 11 Aug 2026 16:00:00 +0000

Imagine this scenario: Your team decides to migrate a core application from an existing commercial database like Oracle or SQL Server to open source PostgreSQL or a fully managed service such as AlloyDB for PostgreSQL.

The initial phase goes smoothly. Schemas convert, tables populate, and data migration pipelines transfer terabytes of data in hours. The project looks ahead of schedule.

Then your team hits the bottleneck.

Buried inside the existing databases are hundreds of stored procedures, complex triggers, and custom functions written in proprietary SQL dialects like PL/SQL or T-SQL. These routines contain years of critical business logic handling transaction validation, order processing, and custom reporting.

Suddenly, your modernization project halts. Translating thousands of lines of procedural logic demands specialized dual-dialect expertise, months of manual rewriting, and high risk of conversion errors. This code translation represents the "last mile" bottleneck of database migration and is the most complex part of migrations.

Thankfully, recent advancements in AI provide a solution to the last mile problem. Database Migration Service (DMS) includes AI-assisted code conversion powered by Gemini. By bringing generative AI directly into your migration workflow, you can convert stored procedures, triggers, and custom functions into PostgreSQL PL/pgSQL code faster and with higher accuracy.

The stored procedure conversion challenge

Commercial database engines rely on vendor-specific syntax for stored procedures, user-defined functions, package bodies, and conditional logic. Converting this logic to PostgreSQL PL/pgSQL requires mapping variable definitions, exception handling blocks, cursor loops, and built-in functions.

When migrating complex enterprise schemas with hundreds of stored procedures, manual code conversion often demands months of engineering effort. Database teams must parse legacy logic line by line, re-implement conditional branches, and verify data type conversions between engines.

AI-assisted code conversion in DMS

Gemini in Database Migration Service accelerates this conversion work directly inside the Google Cloud console. DMS provides automated schema conversion alongside AI-generated code suggestions that explain structural differences between the source dialect and PostgreSQL.

The service presents converted PL/pgSQL code side-by-side with original source code, allowing database teams to review, edit, and validate suggestions in real time.

Figure 1: Database Migration Service interface displaying side-by-side code conversion and Gemini inline explanation.

Why integrated AI matters

Most AI apps and tools from major vendors have the ability to generate and convert code, including SQL code. However, converting enterprise databases demands far more than snippet translation offered by generic AI chat tools. Gemini in Database Migration Service offers several key advantages:

Full schema context: Rather than evaluating code snippets in isolation, Gemini in DMS analyzes your entire database context, including table relationships, data types, dependent views, and cross-procedure references across the whole migration project.
Enterprise security and privacy: Code conversion runs strictly within your Google Cloud project boundaries and IAM governance, protecting proprietary business logic and intellectual property.
Integrated execution workspace: DMS eliminates manual copy-pasting across hundreds of files. You can review side-by-side diffs, inspect inline AI explanations, edit code, and deploy validated PL/pgSQL routines directly to target databases within a single console.
Deterministic accuracy and AI compilation: DMS pairs deterministic compiler rules for 1:1 mappings (such as standard DDL transformations, scalar functions, and well-defined syntax conversions) with Gemini contextual synthesis for complex procedural blocks—guaranteeing exact, predictable translation without model drift.

Converting Oracle PL/SQL to PostgreSQL

Consider an Oracle PL/SQL stored procedure that calculates customer order totals and applies tier-based discounts using proprietary NVL and DECODE functions. In the original workflow, you must manually map NVL to COALESCE, rewrite DECODE statements as standard CASE expressions, and adjust exception blocks like WHEN NO_DATA_FOUND THEN.

When you run a migration assessment in DMS, Gemini analyzes the source procedure and produces native PostgreSQL PL/pgSQL code:

Source: Oracle PL/SQL

code_block: <ListValue: [StructValue([('code', 'CREATE OR REPLACE PROCEDURE calculate_discount (\r\n p_customer_id IN NUMBER,\r\n p_discount OUT NUMBER\r\n) AS\r\n v_total NUMBER := 0;\r\nBEGIN\r\n SELECT NVL(SUM(amount), 0) INTO v_total\r\n FROM orders WHERE customer_id = p_customer_id;\r\n \r\n p_discount := DECODE(TRUE, v_total > 10000, 0.15, v_total > 5000, 0.10, 0.05);\r\nEXCEPTION\r\n WHEN NO_DATA_FOUND THEN\r\n p_discount := 0;\r\nEND;\r\n/'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1157f889a0>)])]>

Target: PostgreSQL PL/pgSQL (Converted by Gemini in DMS)

code_block: <ListValue: [StructValue([('code', 'CREATE OR REPLACE FUNCTION calculate_discount (\r\n p_customer_id NUMERIC,\r\n OUT p_discount NUMERIC\r\n) RETURNS NUMERIC AS $$\r\nDECLARE\r\n v_total NUMERIC := 0;\r\nBEGIN\r\n SELECT COALESCE(SUM(amount), 0) INTO v_total\r\n FROM orders WHERE customer_id = p_customer_id;\r\n\r\n p_discount := CASE\r\n WHEN v_total > 10000 THEN 0.15\r\n WHEN v_total > 5000 THEN 0.10\r\n ELSE 0.05\r\n END;\r\nEND;\r\n$$ LANGUAGE plpgsql;'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1157f887c0>)])]>

Along with the generated SQL, Gemini provides an inline explanation detailing why NVL was converted to COALESCE and how the Oracle DECODE function was converted into an explicit CASE block in PostgreSQL.

Figure 2: End-to-end database code conversion pipeline powered by Gemini in DMS.

Maintain full schema control and validation

Security, transparency, and code accuracy remain central to database modernization. Gemini in DMS operates strictly within your established Google Cloud security boundaries, keeping your code private to your project.

To ensure reliability, the conversion and validation process follows a structured workflow:

Automatic schema context pulling: When you set up a DMS conversion workspace, the service automatically parses your entire source database metadata—including table schemas, data types, foreign key constraints, and cross-procedure dependencies. Gemini references this project-wide context during code generation, eliminating the need to manually supply dependent object definitions.
Automated syntax and dependency validation: As code is generated, DMS runs a validation parser against target PostgreSQL syntax rules. Objects are assigned validation status indicators (e.g. Converted, Warning, or Action Required) to quickly highlight routines requiring manual review.
Interactive evaluation state: You maintain full control over every schema change. Within the conversion workspace, you can inspect side-by-side diffs, review inline AI explanations, and edit PL/pgSQL code directly before applying changes to your target database.
Staging deployment and verification: Once code passes workspace validation, you can apply the converted schema and functions to a target staging instance (e.g. Cloud SQL or AlloyDB) for functional execution and performance testing prior to production cutover.

Streamlining database modernization

AI-assisted code conversion in Database Migration Service helps database teams convert legacy database logic in days rather than months. Instead of spending precious time rewriting code from scratch, database administrators and application developers can shift their focus to adding new functionality, testing performance, and modernizing applications.

If you’d like some good examples of common Oracle and SQL Server conversion scenarios and how DMS converts them to PostgreSQL, check out our recent video series, Gemini taught me PostgreSQL.

Say goodbye to database migration headaches and let Gemini teach you how to seamlessly convert legacy database logic.

Get started with Database Migration Service

To start your database conversion, launch a migration assessment in the Database Migration Service console (https://console.cloud.google.com/dms) or read our heterogeneous migration guide (https://cloud.google.com/database-migration).

Expanding connectivity in the Americas: Introducing Alisios, Canoa, and OlaLuz subsea cables

Tue, 11 Aug 2026 10:00:00 +0000

The global digital economy relies on robust, resilient, and highly secure infrastructure to support everything from daily internet use to telehealth and scientific research breakthroughs. Today, Google is announcing a major expansion of our global network infrastructure in the Americas with three new subsea cable systems — Alisios, Canoa, and OlaLuz. These systems, alongside a new branch for the Firmina cable and previous investments in Curie, Nuvem, and Sol, form Americas Connect.

The Alisios subsea cable system will connect the Dominican Republic, Panama, and Chile. The cable is named after the vientos alisios — the Spanish term for the trade winds that blow across the tropics and the Caribbean, historically used by sailors to navigate between continents. The name "Alisios" nods to the flows of data that will navigate these new subsea routes to connect communities.

Furthering regional connectivity, Canoa is a new subsea cable system connecting the Dominican Republic to Bermuda. Canoa comes from the Taíno word for canoe, harkening to the longstanding maritime culture in the Caribbean and North Atlantic. When combined with the Nuvem and Sol cable systems, the Canoa cable will enable a highly reliable and resilient connection from Latin America and the Caribbean directly to Europe and North America.

The OlaLuz subsea cable system will connect the Dominican Republic directly to Florida. The name "OlaLuz" combines the Spanish words for "wave" (ola) and "light" (luz), referencing the waves of light that carry data along the cable on the ocean floor. This new route significantly strengthens network capacity between the Caribbean and the U.S. East Coast, providing a pathway that enhances resilience for the region.

To further strengthen network diversity, Google is also introducing a new branch of the Firmina subsea cable that will land directly in the Dominican Republic. Originally built to connect North and South America, this new branch extends Firmina’s high-capacity reach and brings additional network connectivity to the Caribbean.

Reach, reliability and resilience

With its diverse subsea cable routes to geographically separated cloud regions, Americas Connect improves the reach, reliability and resilience of connectivity infrastructure.

Pacific Coast: In the Pacific, a subsea ring will create redundant paths connecting Chile to Panama with a third link from Panama to the U.S. West Coast, providing connectivity to Google Cloud regions in Chile, Los Angeles, and Las Vegas.

Caribbean Sea: In the Caribbean, the Alisios cable from Panama to the Dominican Republic will interlink with a ring from the Dominican Republic to the U.S. East Coast and Google Cloud regions in South Carolina and Virginia.

Atlantic Ocean: The Canoa subsea cable from the Dominican Republic to Bermuda will interlink with the Nuvem and Sol cables, while cable rings to both the United States and Europe provide connectivity to the Google Cloud regions on the U.S. East Coast (South Carolina and Virginia) and Europe (Madrid).

“As we welcome the announcement of the Alisios, OlaLuz, and Canoa subsea cable systems, the Dominican Republic is pleased to continue partnering with Google to bolster digital connectivity and innovation as part of Americas Connect. Our participation in the Caribbean and Latin America telecommunications network allows us to join our partners in strengthening connectivity across the Americas, serving as an integral node in this expanding digital ecosystem. Our shared vision supports a leap forward in the DR government’s quest to bridge the digital divide, foster local talent, and drive tech-based economic opportunity for our people. This milestone is yet another piece of our collaboration with Google propelling the Dominican Republic into a new era of global digital integration.” - Luis Rodolfo Abinader Corona, President of the Dominican Republic

“We are delighted to welcome this new Google project and take pride in the fact that Panama is considered a strategic location for this subsea infrastructure. The announcement of the new subsea cables marks a transformative milestone and aligns with Panama’s Digital Hub Initiative and the digital infrastructure pillar of the National Digital Strategy. We recognize that building a more prosperous future requires this kind of transformative infrastructure. It fosters opportunities for both our country and the region, propelling us into a new era of secure and competitive global integration. By strengthening regional connectivity, we accelerate our efforts to bridge the digital divide, cultivate local tech talent, and drive high-tech economic growth. Building on this momentum, we look forward to continuing our collaboration with Google on other strategic initiatives to ensure that digital transformation benefits the citizens of Panama.” - José Raúl Mulino, President of Panama

“We are pleased to welcome Canoa as the first subsea cable system to connect Bermuda directly to the Dominican Republic. It follows the Nuvem and Sol landings, and the expansion of the Bermuda Digital Exchange Port announced in June 2026. The name carries a maritime heritage that moved people and goods across these waters long before any cable did. This connection creates new digital pathways and partnerships between Bermuda and the Caribbean Community, while strengthening resilience for Bermudian households and businesses. We are encouraged that global infrastructure leaders such as Google continue to choose Bermuda. This investment reflects growing confidence in our island as a trusted digital gateway and strategic landing point in the Atlantic.” - The Hon. Alexa N.H. Lightbourne, JP, MP, Minister of Home Affairs, Government of Bermuda

“The new Alisios submarine cable, which will connect Chile, Panama, and the Dominican Republic, will be a strategic milestone, as it will strengthen our country’s position as a digital leader in Latin America. Beyond this technological achievement, this infrastructure will translate into direct benefits for our citizens. Providing faster, more resilient, and more secure connectivity would undoubtedly boost local businesses, foster economic growth, and bring the opportunities of the global digital economy directly into the homes of millions of Chileans.” - Louis de Grange, Minister of Transportation and Telecommunications and Minister of Public Works, Government of Chile

With these new investments, Google continues to pave the way for a more connected and open global cloud network centered on increasing reach, reliability, and resilience for all. New systems can further facilitate future connectivity through strategically placed branching units, mirroring the approach of our Pacific Connect initiative to ensure the network and our partners can grow alongside the needs and opportunities of the region.

Introducing the Developer Device Platform for agentic mobile app development

Mon, 10 Aug 2026 22:00:00 +0000

Most enterprises connect with their customers through a device. Whether it’s using a mobile app to order a product, contact customer service, view content, or manage their account, the customer experience depends on how well an app can run locally on the customer’s device.

For this reason, building and testing applications across a wide variety of devices is critical for any enterprise launch that involves locally running components. However, procuring and hosting devices at scale is expensive and complex, and tests are often flaky, inconclusive, or just difficult to debug. This leaves many developers to test launches on the physical phones in their pockets and hope the results apply to most devices.

To solve this challenge, today we are excited to announce the public preview launch of Developer Device Platform (DDP) on Google Cloud. DDP is a fully managed cloud platform that provides instant, on-demand access to multiple hardware profiles across real physical devices and high-concurrency virtual emulators. DDP represents an evolution of Firebase Test Lab for Cloud developers, and is also the first device platform built for agentic development. With DDP, developers can now utilize their preferred agents to vibe code apps, run tests, debug, and optimize performance across devices efficiently and quickly.

Build and test your apps to guarantee performance

In the standard mobile development lifecycle, developers iteratively build new features, run QA tests to ensure performance across a variety of target devices, and ship the optimized and debugged feature to production for their users. Developer Device Platform offers two main functions to accelerate this cycle:

Interactive debugging with Device Streaming: With our Device Streaming API, developers can directly access an emulator or physical device of their choice, and vibe code, iteratively test, debug and interact with the app remotely. Device streaming makes it simple to dive into your customer experience, and scroll and click in real time, all while also monitoring performance on the real device hardware.

Parallel testing with Device Run: With our Device Run API, developers can write tests as part of their CI/CD pipelines and run them in parallel across hundreds of different devices at once. With the results, developers can pinpoint and debug specific device issues, and ship code to production with confidence that it will run across device tiers.

Accelerate mobile app development with DDP agent skills and efficient tests

The rise of coding agents in mobile development specifically opens up new possibilities when paired with physical devices. Coding agents can interact and test on the real hardware, helping them take advantage of unique phone screen sizes (e.g., foldable phone UI) and specialized hardware (e.g., CPUs vs GPUs).

Developer Device Platform will soon integrate with Android Studio and Android CLI, giving you direct access to physical devices via Device Streaming API. The DDP agent skill will also allow you to work with the AI coding agents of your choice to accelerate development. With DDP agent skill, coding agents can:

Execute multi-step user journeys independently
Spot visual artifacts
Analyze real-time chip performance on-device
Validate fixes to hardware specific bugs and/or optimize for unique phone features

In addition to these agentic capabilities, DDP also enables developers to package apps and launch parallelized tests with smart sharding, giving you access to results across hundreds of devices in minutes. With smart auto-retries, DDP also retries specific tests that fail within your shards, helping you get past errors faster without rerunning your entire suite of tests.

Start building with Developer Device Platform today

Starting August 12, Developer Device Platform is available in public preview to all Google Cloud users. During public preview, users are charged based on a pay-per-minute model so you pay only for the active testing minutes you consume, with rates differing for emulator vs physical devices.

We can’t wait to see how Developer Device Platform can help mobile developers across Google Cloud accelerate their development and take advantage of the growing number of unique device features and on-device AI possibilities.

How Malachyte solves retail’s cold-start problem with managed real-time AI

Mon, 10 Aug 2026 16:00:00 +0000

What’s the best way to recommend products to little-known users?

We’ve spent our careers trying to solve this problem for major companies like Spotify and Priceline, and it’s why Sidd founded Malachyte, an AI-powered ecommerce recommendation platform. These days, consumers have come to expect content that feels personalized and relevant, and online services competing for their attention have no choice but to do this exceptionally well.

Malachyte was inspired by some unique insights into how advanced AI models, and large language models in particular, could be applied in new ways to old challenges like personalization and recommendations.

As Malachyte set out to win potential customers’ business, we needed secure, scalable, reliable and, above all, leading-edge AI infrastructure to continue building the personalization algorithm we had always envisioned. By utilizing Google Cloud tools like Bigtable and Managed Service for Apache Kafka, Malachyte has been able to help some of its retailers double and sometimes even triple their sales.

This is the story of how we built it, and the ways any founder can use services like these to start deploying AI foundation models in new ways.

How Malachyte lifted sales for their users

For Malachyte, the aha moment was discovering that it could use neural networks with attention mechanisms — the same concept powering large language models — to personalize retail search and product pages. This approach is what enables LLMs to derive meaning from the relative order of items in a sequence, in their case the order of words and syllables in a sentence. When it comes to a retail website or app, what Malachyte wanted to capture was the sequence of customer interactions with the site.

What if we predicted the next thing a user wants on an ecommerce website just like LLMs predict the next word in a sentence?

A pre-GPT language model might have tried to look at a specific sequence of words or even fragments of words (what we now know of as tokens), but those earlier models wouldn’t examine what happens if the words were in the comparable order but weren’t contiguous or were re-arranged. The breakthrough came — in part through Google’s work on transformers — when LLMs gained the ability to understand complex and long-range dependencies within a sequence of items.

This more sophisticated method has delivered dramatic results — both for the proliferation of gen AI in general, and for Malachyte’s application of the technology.

To make this work in practice, Malachyte creates a vector of everything known about a visitor when they arrive on a site. Most users are visiting for the first time, so little is known about them. This is what’s known as the “cold start” problem. The trick is to use every interaction with a user to refine this vector. Each new addition to the vector, like a click or a query, does two things: it drives a prediction about the next thing the user wants, and it provides more information about the user.

Malachyte’s platform then updates the user vector and the prediction at the same time. This not only enhances the understanding of the individual user and their preferences, it also improves the overall model with the anonymized user data. With every inference, the context of both the average and the specific shopper grows.

The company further innovates by not just using attention-based neural networks but combining that with updating user profiles 100 milliseconds at time.

Malachyte’s recommendation and search agents populate the next page’s search results or recommendation carousels based on what users clicked on previous pages.

To be sure, this idea isn’t in itself new. Retailers have long used collaborative filtering recommendations systems to identify similar users and items that required massive sets of interaction history. These models typically required a lot of data, including third-party cookie-based profiles and demographics.

By focusing on the sequence of interactions in a session, retailers can achieve far more personalization — with less required data or spend — than by focusing only on a user’s profile. As a bonus, retailers can now offer their users more privacy by not relying on long-term cookie data.

This works because of the model structure and multimodal vectors that encode everything they know about a user, including browser data, click history and searches. The output, too, is multimodal: The same model can be applied to on-site search product pages, category pages, and add-to-cart carousels.

To make this work, each product in the catalog is embedded into the same space as the user vector, which gets updated and subsequently moves the vector closer to relevant products and further from those that aren’t. The neural network computing the embedding is being continuously trained across retailers who work with Malachyte, improving the quality for everyone. The system effectively becomes a data cooperative with each retailer's user helping make the model smarter for everyone.

A user session represented as a vector in a space of products.

To make this delivery for every user at every inference in 100 milliseconds, Malachite found real benefits in building onGoogle Cloud’s real-time AI stack.

With this system, every behavioral event streams into a Managed Service for Apache Kafka cluster. Rather than queuing for a future training job, each event immediately becomes an update to the user’s profile in Bigtable. The Kafka cluster allows the customer’s front-end to persist, so the user session signals quickly with little worry about how they fit into the user vector.

Bigtable allows Malachyte’s services to look up and update the right user vectors, and it and Kafka operate at the order of 10 milliseconds per step, which allows the entire recommendation loop to complete with no disruption to the user experience.

The three layer real-time AI architecture: a retailer’s website, Malachyte’s AI models and serving front ends, and context management infrastructure.

In addition to a fast core, a second layer of product catalog updates, inventory signals, and retailer-specific dimensional data keeps product data up to date. This flows through Cloud Pub/Sub, which offers globally accessible REST APIs that enable connections retailers can use without deep integration work. Malachyte agents run on Google Kubernetes Engine (GKE), with model inference on Google Compute Engine (GCE).

Continuous ingestion of external data, such as product catalog updates, operates through Pub/Sub’s global messaging system.

With its migration to Google Cloud’s AI architecture, Malachyte demonstrated that production AI inference and training are about more than GPUs and storage. They require real-time continuous learning infrastructure that includes a fast key-value store, a streaming layer, and a managed messaging system, all integrated with the foundation model architecture.

This approach also shows that even a small team like Malachyte’s can have a big impact in an industry. It just needs access to powerful infrastructure and core AI managed services.

Try it for yourself

Looking to shake up your industry or stay ahead of the competition like Malachyte? Try Managed Service for Apache Kafka, Cloud Pub/Sub, and Bigtable. New customers can receive $300 in Google Cloud credits.

ClusterNetworkPolicy in GKE: Balancing control and autonomy for your microservices

Mon, 10 Aug 2026 16:00:00 +0000

Managing network security in a multi-tenant Kubernetes environment typically requires balancing two distinct needs: developers need their microservices to communicate effectively, while platform and security teams must maintain compliance, prevent lateral movement, and establish cluster-wide guardrails.

Historically, the standard Kubernetes NetworkPolicy has been the primary tool for this. While effective for single-namespace isolation, standard NetworkPolicy is scoped strictly to individual namespaces and designed around developer self-service. When cluster administrators attempt to use it for global security enforcement, it can lead to policy conflicts and operational challenges.

To address this, we introduced ClusterNetworkPolicy (CNP), an open-source standard developed by the Kubernetes SIG-Policy Working Group (WG), to Google Kubernetes Engine (GKE). Designed for scale, CNP is a cluster-wide resource that allows administrators to manage network security centrally, providing a mechanism for those responsible for global security to implement consistent, non-bypassable policies.

Read on for technical details about CNP, some common use cases, an example policy, and how to get started.

Structuring policies with tiers

A core capability of ClusterNetworkPolicy is its hierarchical tier system. Rather than attempting to reconcile flat, conflicting peer rules simultaneously, CNP establishes a deterministic, top-to-bottom evaluation hierarchy:

The admin tier: The highest precedence level. Rules here are enforced before any other policies.
The network policy tier: The standard namespace level, where developers manage their specific application policies.
The baseline tier: The lowest precedence, establishing the cluster’s default behavior when no other policies apply. This can be overridden using namespace scoped policies.

This tiered structure helps align network security with organizational roles. Using standard role-based access control (RBAC), you can manage the admin tier to enforce compliance mandates, while platform teams can use the baseline tier to set a default "deny-all" zero-trust posture across the cluster. At the same time, developers can write standard network policies for their applications without overriding core security mandates.

This deterministic, top-to-bottom evaluation method resolves conflicts between different teams' policies. The admin tier introduces an explicit Pass action. This allows security teams to inspect traffic against global rules and then delegate the final Accept or Deny decision down to the developer's namespace policy, facilitating both central oversight and distributed management.

Common network security scenarios

This tiered architecture translates complex security requirements into centralized rules. Here are common scenarios where ClusterNetworkPolicy provides a practical solution:

Isolating sensitive workloads: You can apply an admin-tier global deny rule to isolate specific namespaces — such as those used for payment processing or compliance data — from the rest of the cluster. This action overrides any permissive developer policies that might otherwise expose these environments.
Protecting core services: To prevent configurations that might disrupt internal operations, administrators can create an admin-tier global allow rule for critical services like kube-dns. This allows these services to remain accessible regardless of any misconfigured namespace policies.
Managing external egress: By utilizing IP address range matching, egress traffic can be controlled at the cluster level. This functionality allows you to explicitly restrict or permit access to corporate intranets or external IP ranges, serving as a safeguard against unauthorized data exfiltration.

Example scenario

Consider a common enterprise requirement: Application workloads across all namespaces must be permitted to reach central platform infrastructure (such as shared authentication and telemetry services), while access to sensitive environments — like a restricted vault namespace — is strictly prohibited. Meanwhile, routine microservice traffic is delegated to developer-managed, namespace-scoped policies.

ClusterNetworkPolicy makes this straightforward. A platform administrator simply defines an admin-tier guardrail centrally:

code_block: <ListValue: [StructValue([('code', 'apiVersion: policy.networking.k8s.io/v1alpha2\r\nkind: ClusterNetworkPolicy\r\nmetadata:\r\n name: platform-isolation-guardrail\r\nspec:\r\n tier: Admin\r\n priority: 10\r\n subject:\r\n # Target all application tenant namespaces, excluding system and core infrastructure\r\n namespaces:\r\n matchExpressions:\r\n - key: kubernetes.io/metadata.name\r\n operator: NotIn\r\n values: ["kube-system", "shared-services", "restricted-vault"]\r\n egress:\r\n # 1. Mandate access to central shared platform services\r\n - name: allow-shared-services\r\n action: Accept\r\n to:\r\n - namespaces:\r\n matchLabels:\r\n kubernetes.io/metadata.name: shared-services\r\n\r\n # 2. Enforce strict block on accessing the restricted vault namespace\r\n - name: block-restricted-vault\r\n action: Deny\r\n to:\r\n - namespaces:\r\n matchLabels:\r\n kubernetes.io/metadata.name: restricted-vault\r\n\r\n # 3. Explicitly delegate all remaining traffic to developer namespace policies\r\n - name: delegate-remaining-egress\r\n action: Pass\r\n to:\r\n - namespaces: {}\r\n - networks:\r\n - 0.0.0.0/0\r\n - ::/0'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f11606e9df0>)])]>

Extending open-source foundations

Instead of building this functionality as proprietary extensions, we worked with the Kubernetes community to design the ClusterNetworkPolicy API (policy.networking.k8s.io), distinguishing it from the namespace-scoped NetworkPolicy API (networking.k8s.io). Furthermore, we collaborated closely with the Cilium community to build its implementation of the API.

Because it is built on open-source standards, GKE helps ensure that security configurations remain portable across different environments. The ClusterNetworkPolicy API natively supports tier selection, enabling clear and deterministic policy evaluation. This approach lets administrators enforce robust security guardrails while maintaining the operational flexibility that development teams depend on.

ClusterNetworkPolicy on GKE elevates workload network security — shifting operations from namespace-scoped rules to unified, cluster-wide governance. It is currently in preview in version 1.36 and later. To learn more and get started, check out:

Google named a Leader in The Forrester Wave™: AI Platforms, Q3 2026

Mon, 10 Aug 2026 16:00:00 +0000

At Google Cloud, we help organizations of all sizes build and operationalize complex agentic workflows with total confidence. By combining world-class AI research with an open, fully integrated AI platform, we give customers the flexibility to innovate and the foundation to deliver measurable business value.

At the center of it all is Gemini Enterprise, a unified platform designed to power the agentic enterprise, meet builders where they are, and deliver enterprise trust by default.

We believe this integrated approach is why Google has been named a Leader in The Forrester Wave™: AI Platforms, Q3 2026 report, and received the highest score in the Strategy category.

Powering the Agentic Era

As agents become embedded across every part of the business, organizations need a unified platform. Gemini Enterprise serves as the front door to AI for your entire organization, removing the silos between business users, developers, and IT leaders by connecting them all with shared, universal context.

Gemini Enterprise Agent Platform is the foundation that enables technical teams and IT leaders to safely, securely, and cost-effectively build and deploy production-grade agents. Any agent built in Agent Platform can be deployed across your entire workforce through the Gemini Enterprise app, putting custom agentic capabilities directly into the hands of every employee.

By unifying enterprise data, frontier model capabilities, developer tooling, and IT operations under one roof, Gemini Enterprise empowers teams to transform products, services, and complex agentic tasks while maintaining centralized control every step of the way.

See how Mars accelerates their marketing campaigns from months to weeks with Gemini Enterprise

Meeting builders where they are

No two development teams build agents in the same way. Some work in coding environments, others rely on low-code tools, and many organizations use a mix of models. Gemini Enterprise is built for that reality. We offer a platform tailored to every team's skill set, enabling high-code developers to build complex agentic systems while giving business and operational teams low-cod and no-code tools to rapidly design and test agent behaviors. And with access to over 200 native and third-party models, alongside pre-built agent templates, engineering teams can move from prototype to deployment with speed.

True enterprise AI should extend far beyond text. Gemini Enterprise is multi-modal by design, meaning it natively understands, reasons across, and generates text, code, audio, image, and video inputs in a single workflow. By securely connecting this multi-modal intelligence to your enterprise data wherever it lives, your engineering teams can turn this information into contextual business experiences.

See how Kohl’s uses Gemini Enterprise to turn data analysis into active conversations and deliver personalized customer experiences

Enterprise trust, built in

Trust is foundational to AI adoption, which is why Agent Platform is built with enterprise-grade governance, security, and observability by default. To help you scale with confidence, Agent Platform features built-in guardrails, continuous evaluation, and real-time tracking for costs, latency, and token usage. This operational transparency gives organizations the control they need to safely expand agentic workflows across the business. Builders can also leverage capabilities like Knowledge Catalog to establish a universal context engine across the enterprise, aggregating metadata with zero-copy federation to improve agent accuracy.

See how TELUS uses Gemini Enterprise to turn data silos into an Agentic Data Cloud, driving real-time, proactive customer experiences.

Looking ahead

We believe this recognition reflects our commitment to delivering an open, scalable, and powerful AI platform. As agentic systems reshape how enterprise software is built, Gemini Enterprise will continue to provide the foundation developers need to build with confidence.

Want to dive deeper into the report? Access the full Forrester Wave™: AI Platforms, Q3 2026 report here.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.

How WPP operationalizes platform and data engineering for AI marketing

Mon, 10 Aug 2026 16:00:00 +0000

Between chaotic levels of market fragmentation and economic volatility, marketing and communications agencies can no longer rely on the human intuition they’ve traditionally used to win clients and optimize their ad spend. WPP is replacing that guesswork with an AI-powered view of shifting market dynamics, giving brands predictive certainty that lets them invest with confidence while moving at the speed of the market. That’s the value of WPP Open, its agentic marketing system.

But before it could begin applying sophisticated AI models to power those insights, WPP had to overcome a critical engineering challenge: the marketing data that made up the models was fragmented across hundreds of global agencies. While this dynamic made it nearly impossible to deploy AI tools efficiently and securely, access to models was only part of the equation. And until it built a reliable way to ingest, clean, and serve data to those models, WPP couldn’t unlock the true potential of generative AI.

To solve this, WPP partnered with Google Cloud to construct a unified data backbone and custom platform engineering path. Now, by standardizing its serverless compute patterns and data processing workflows, WPP is able to securely deploy targeted marketing campaigns in days instead of months.

Architecting a centralized, service-based data foundation

An important part of this effort was accelerating data availability and centralizing management. To do this, WPP adopted a service-based project structure for its current production environment. Rather than isolating every workload into separate silos, its engineering team centralized Google Cloud Storage (GCS) and BigQuery into dedicated, shared data projects, while also segregating the compute and processing workloads into distinct processing projects.

This structure simplified the core team’s user experience and ensured that all data consumers interacted with a unified source of truth. Because data from WPP’s various product lines lives in shared infrastructure, it was essential that security be strictly enforced at a granular level. By directly applying identity and access management (IAM) controls at the individual GCS bucket and BigQuery dataset levels, the company’s teams only see the data they’re authorized to access.

At the same time, raw data from various partners lands in dedicated GCS buckets in order to keep the raw inputs organized and isolated. From there, Managed Service for Apache Spark executes custom Apache Spark jobs to cleanse, normalize, and canonicalize information into standardized cohort definitions (SCDs). By utilizing a serverless architecture combined with Kubeflow for pipeline orchestration, WPP’s data engineering team avoided the overhead that often results from managing cluster infrastructure. This allowed them to focus entirely on the data transformation logic fueling the downstream GCS and BigQuery layers that ultimately feed the company’s audience & performance AI models.

What made our collaboration with Google Cloud successful was the balance they struck between uncompromising professionalism when it comes to best practices and timely delivery of incredibly pragmatic, real-world solutions.- Jonas DahlbaekSenior Data Engineering Lead, WPP

Standardizing data into unified cohorts

When raw data enters WPP’s processing zone, its platform converts it into SCDs that become core concepts used throughout the framework for keying purposes. These are based on five keys: age, gender, geo, product, and interest. But these underlying data definitions are fluid and continuously canonicalized to reflect evolving marketing concepts. As a result, this uniform structure allows WPP to join and aggregate data on a global scale without exposing sensitive underlying particulars or relying on shared identifiers.

The platform's core processing engine was built in type-safe Scala to ensure comprehensive visibility and compliance This custom framework tightly controls how data is transformed, and it inherently supports full source traceability while guaranteeing that every data point within the curated datasets can be traced back to its origin. This is a crucial level of traceability when building enterprise AI applications, as data scientists and auditors must understand exactly what information feeds into the models, even as WPP concurrently prepares to transition to Google Cloud Knowledge Catalog for automated, enterprise-wide data governance in the future.

Working with Google Cloud has been instrumental in accelerating and standardizing our engineering efforts. In a world where massive volumes of fragmented data present a daily challenge, having the right infrastructure is paramount to thriving in the AI age and helps our developers and AI marketers alike.
-Suleman KhanProduct Manager for OI & Google Partnerships, WPP

Standardizing the enterprise software lifecycle

For WPP, even with all these steps in place, processing data is only half the battle. To serve applications and manage the underlying infrastructure, the company’s platform engineering team developed a suite of reusable and centralized GitLab continuous integration and continuous deployment (CI/CD) templates. With this, WPP reduced the cognitive load on individual development teams and ensured that all deployments met strict corporate security standards.

These templates manage various enterprise workloads autonomously. The suite includes universal Cloud Run templates for full-stack web applications and batch data processing and scheduled pipelines. It also includes a deploy-only template for multi-stage workflows and a Cloud Run functions deployment template for event-driven microservices.

Implementing zero-rebuild promotion

Rebuilding container images in a production environment can introduce unnecessary risk and the potential for configuration drift. In order to maintain environmental consistency, WPP embraced a "build once, deploy many" methodology that applied cross-project IAM logic and Google Cloud Artifact Registry configurations.

As part of this process, developers build and test container images in the development environment. Once those exact, immutable container images are validated, they’re promote directly to production. This zero-rebuild promotion ensures total parity across deployment stages and eliminates unexpected production behaviors. The CI/CD templates also facilitate progressive traffic migration, which allowed teams to route a small percentage of traffic to new revisions before initiating a full rollout.

Immutable deployments. Traceable data. Unshakable trust. When you know exactly what goes into your AI, you can ship at the speed of light.
- Ranjith K PoldasAssociate Director , Devops (I&P), WPP Media

Automating security and intelligent networking

With this modern architecture, enterprise security acts as a foundational enabler for WPP, so it integrated Wiz security scanning directly into the pre-push phase of the CI/CD pipeline to catch vulnerabilities before code merges. The company also utilized Google Cloud Identity-Aware Proxy to enforce zero-trust access across its internal applications.

To further simplify operations, WPP adopted templates with intelligent virtual private cloud (VPC) logic. This configuration automatically identifies and resolves networking conflicts between legacy VPC connectors and modern Direct VPC access. This automated networking prevents deployment failures and accelerates the release cycle.

Monitoring operational health and driving ROI

Because a resilient platform foundation requires deep observability, WPP’s engineering team now monitors strict operational metrics instead of relying solely on deployment frequency. The team tracks request latency across p50, p95, and p99 percentiles, alongside 4xx and 5xx error rates. It also monitors container startup times to mitigate cold starts, while tracking overall CPU and memory utilization. This granularity ensures that both data pipelines and serverless infrastructure always remain highly available.

"Navigating a transformation of this scale across multiple complex workstreams—spanning data engineering, platform infrastructure, and AI integration—required more than just alignment; it demanded deep, mutual trust. Working as true partners, Google Cloud and WPP moved in lockstep to deliver production-ready platform capabilities on time."Yang Yue , Program Manager , Google Cloud

For WPP, operationalizing its data and AI stacks at this velocity provided the necessary infrastructure for its advanced workloads, and the business impact was clear and quantifiable. By building this dual foundation, the company reduced creative and strategy time from four weeks to just three hours. It also saw a 70% gain in production efficiency, a 33x increase in content volume, and a 2.8x increase in campaign return on investment. In short, by partnering with Google Cloud and implementing a broad suite of products and tools, WPP was able to quickly realize a significant ROI and boost productivity, efficiency, reliability, and security across the company.

Zero-code, low-cost data ingestion: New BigQuery DTS capabilities

Fri, 07 Aug 2026 17:00:00 +0000

In a fast-paced digital economy, data is your most critical engine. Yet, many enterprises find themselves trapped in a costly paradox, spending over 100 hours a week building and fixing fragile, in-house ETL pipelines or wrestling with unpredictable third-party tools.

Trusted by thousands of customers every single day, BigQuery Data Transfer Service (DTS) eliminates this engineering burden. As a fully managed, zero-code data movement solution, BigQuery DTS automates data ingestion into BigQuery allowing your teams to transition from pipeline maintenance to strategic data science in minutes.

Expanding the ecosystem: New connectors and capabilities

We are rapidly expanding our integration landscape to eliminate data silos across databases, ads and marketing platforms. Here are the latest additions and enhancements

Open Lakehouse ingestion

Direct ingestion into Apache Iceberg managed tables (Preview): You can now ingest data from common sources such as Google Cloud Storage, Amazon S3, and Azure Blob Storage directly into Iceberg managed tables. This enables you to maintain full multi-cloud storage cross-compatibility with other query engines while leveraging BigQuery's top-tier performance tuning.

Next-gen agentic architecture

Fully managed remote Model Context Protocol (MCP) Server (Preview): This allows your developers to connect their AI application and agents to DTS allowing them to programmatically discover data sources and configure/execute transfers on the user's behalf.

Enterprise and relational databases (supports both full or incremental transfers)

Microsoft SQL Server (Preview): Easily centralize transactional tables, schemas, and operational data directly into your analytical environment in BigQuery.
PostgreSQL(GA) and MySQL (GA): Automates data delivery and simplifies the replication of high-volume web and application workloads into your central data warehouse within minutes. Supports data replication from on-premise environments, CloudSQL, and other clouds.

E-commerce and growth marketing

Shopify(Preview): Automates the extraction of granular order histories, inventory logs, and customer profiles straight into your analytical schema.
Klaviyo(Preview): Extracts detailed email and SMS engagement logs (such as clicks, sends, and opens) to build precise multi-channel lifecycle attributes.
HubSpot(Preview) : Syncs pipeline, contact tracking, and inbound marketing metrics to keep your revenue operations teams aligned.
Mailchimp(Preview): Automatically moves campaign performances and audience list attributes directly into your data warehouse.

Migration connectors

Snowflake(GA): Migrate your data from Snowflake with features like incremental transfer, auto schema detection, private connectivity and support for migrating data residing on all three major clouds (Google Cloud, AWS, and Azure)

Enhancement to major connectors

ServiceNow, Salesforce, and Oracle: Enhanced with native incremental update support to speed up large-scale pipeline refreshes for enterprise CRM, ITSM, and financial workflows.

Why you should choose BigQuery Data Transfer Service

Moving data across an enterprise architecture shouldn't require complex compromises between cost, management overhead, and pipeline health. BigQuery DTS delivers unique advantages across three pillars:

1. Unbeatable cost efficiency

Zero Ingestion Costs for major sources: Data ingestion at no-charge for all first-party Google sources (except Google Play), including Google Ads, Google Analytics 4, Campaign Manager, YouTube and Google Cloud Storage. Ingestion cost are also free for Amazon S3, Azure Blob Storage, Amazon Redshift, and Teradata
Low consumption-based rates for third-party SaaS: Ingestion from 3rd-party sources are entirely on a flexible consumption model. Compute fees run less than 6 cents per slot-hour in major regions. Because pricing scales with compute footprint rather than row volume, depending on your source data compression format and available network bandwidth, you can efficiently transfer massive data volumes.

2. Frictionless security and native management

Eliminate middlemen servers and external security and API configurations. BigQuery DTS fully integrates with Cloud IAM. Data transfers instantly inherit your destination dataset’s Column-Level Security, Row-Level Security, and Customer-Managed Encryption Keys (CMEK) without extra configuration overhead. Your streams flow securely inside the native Google Cloud perimeter.

3. Industry-leading performance and resilience

When you manage data at enterprise scale, downtime means lost business. BigQuery DTS provides a highly resilient ingestion footprint backed by a strict Google Cloud Service Level Agreement (SLA). The system delivers a monthly uptime percentage of >=99.99%, guaranteeing your analytics, automated pipelines, and operational dashboards update reliably.

Ready to transform your data operations?

Stop letting manual ingestion scripts limit your growth. Join the thousands of companies relying on Google's native cloud lakehouse data movement architecture to build a modern, scalable data stack.

Try the platform out today: Navigate directly to the BigQuery Data Transfer Service console, pick your connector, and deploy your first automated transfer in just a few clicks!

What connectors should we build next?

We are constantly expanding our native integration library based on your business needs. What sources are you currently forced to extract manually? Are there specific relational databases, NoSQL engines, or regional SaaS platforms you need to replicate next? Let us know with a feature request.

Please file feature requests via the public issue tracker.

Unifying Structured and Unstructured Data Insights with BQ Search Innovations

Fri, 07 Aug 2026 16:00:00 +0000

Modern enterprises possess a vast amount of unstructured data, yet they frequently encounter significant challenges in managing and extracting value from it. Historically, unlocking the insights hidden within PDFs, audio files, images, and unstructured text required a fragmented architecture: moving data out of your warehouse, stitching together complex LLM pipelines, and managing disparate search indexes.

BigQuery has worked with many enterprises to make sense of their unstructured data sources. For example, consider an advanced healthcare company managing thousands of clinical trial documents in PDF form. BigQuery helps unlock insights from these documents through a simple, five-step lifecycle: Access, Process, Ground, Relate, and Activate.

In this post, we are highlighting three major milestones focused heavily on the "Ground" phase of this framework:

General Availability (GA) of Autonomous Embedding Generation
General Availability (GA) of AI.SEARCH with massive single-query performance gains
Public Preview of Hybrid Search

Let’s dive into how these features work together to simplify your AI architecture, using a real-world clinical trial research platform as an example.

Simplify Pipelines with Autonomous Embedding Generation (GA)

Building a retrieval-augmented generation (RAG) pipeline or search application usually requires managing complex, asynchronous embedding infrastructure. You have to handle retries, error logging, and pipeline orchestration every time a new record arrives.

With the General Availability of Autonomous Embedding Generation, BigQuery manages this entirely for you. By simply defining a column in your schema, BigQuery asynchronously and continuously generates embeddings as new data is ingested. You have the flexibility to choose external models (like Vertex AI text-embeddings) or natively utilize Gemma embedding models directly within BigQuery.

How it works in practice:

Imagine you are building a research platform analyzing clinical trial PDFs stored in Google Cloud Storage. After extracting the study titles and disease areas into a table, you can automatically embed those titles:

code_block: <ListValue: [StructValue([('code', "CREATE OR REPLACE TABLE mydataset.clinical_trials\r\n(\r\n trial_id STRING,\r\n study_title STRING,\r\n study_embedding STRUCT<result ARRAY<FLOAT64>, status STRING>\r\n GENERATED ALWAYS AS (AI.EMBED(\r\n study_title,\r\n connection_id => 'myconnection',\r\n endpoint => 'text-embedding-005'\r\n ))\r\n STORED\r\n OPTIONS( asynchronous = TRUE )\r\n);"), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1160777790>)])]>

BigQuery eliminates the need for complex third-party vector databases by managing

enterprise-scale processing with one configuration. This autonomous embedding generation keeps data synchronized automatically as source text changes, removing the need for manual machine learning pipelines. This integrated approach streamlines workflows for dynamic datasets and reduces the operational burden of maintaining custom data scripts.

Finally, with this GA launch, Autonomous Embedding Generation now also supports generating embeddings natively over images using ObjectRefs, unlocking true multimodal search and analytics.

Natural Language Search at Scale with AI.SEARCH (GA)

To truly enable conversational analytics agents and snappier user experiences, your underlying search infrastructure needs to be intuitive and performant.

Once your data is seamlessly embedded, you need an efficient way to query it. Today, we are announcing the General Availability of AI.SEARCH(). This function provides a streamlined, natural-language-focused search experience, allowing you to easily find semantically related records without generating embeddings in your search path. In pairing this with the Autonomous Embedding Generation, we leverage the same embedding model used in your dataset for easier use.

Furthermore, as part of efficiency investments in the last year, we have heavily optimized AI.SEARCH for single-query execution. For online applications and single-query searches (those most common in agentic searches), we have observed up to a 133x gain in slot efficiency..

This means you can serve highly concurrent, user-facing natural language searches directly out of BigQuery faster and more cost-effectively than ever before.

code_block: <ListValue: [StructValue([('code', 'SELECT base.trial_id, base.study_title, distance\r\nFROM\r\n AI.SEARCH(\r\n TABLE mydataset.clinical_trials,\r\n \'study_title\',\r\n "What treatments are available for advanced tumors?"\r\n );'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f11607775e0>)])]>

Unifying Keyword and Vector with Hybrid Search (Public Preview)

Semantic (vector) search is incredibly powerful; for example, the query above will successfully return conceptually related terms like "chemotherapy." However, semantic search isn't always enough. What if a researcher is searching for a specific, highly technical immunotherapy drug designation like "MK3475"? Because this alphanumeric string lacks broad semantic meaning, pure vector search might struggle to rank it correctly.

By merging lexical search with existing semantic capabilities, BigQuery's hybrid search allows for data retrieval based on both keyword similarity and underlying meaning. This approach unites the conceptual depth of semantic vector search with the pinpoint accuracy of lexical matching, utilizing algorithms such as Reciprocal Rank Fusion and BM25. The result is a significant boost in search precision and a reduction in LLM hallucination costs through the reranking of results based on keyword frequency and semantic relevance. Users can implement this via the AI.SEARCH and VECTOR_SEARCH functions by employing the hybrid mode or lexical_search_columns parameters. Furthermore, performance can be optimized by extending vector indexes to include keyword data, which accelerates the lexical search process.

You can now perform hybrid searches effortlessly using the AI.SEARCH() function by simply setting the mode to HYBRID:

code_block: <ListValue: [StructValue([('code', 'SELECT base.trial_id, base.study_title, distance\r\nFROM\r\n AI.SEARCH(\r\n TABLE mydataset.clinical_trials,\r\n \'study_title\',\r\n "Cancer treated by MK-3475",\r\n mode => \'HYBRID\'\r\n );'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1160777cd0>)])]>

To speed up these hybrid queries at scale, you can easily extend your CREATE VECTOR INDEX DDL to include the keyword columns you want to use for the lexical portion of the search, natively combining your indexes.

Building an End-to-End Unstructured Data Analytics Platform

The search and embedding features launching today are part of a much broader vision. We are building an end-to-end unstructured data analytics platform. One common type of unstructured data is documents, and BigQuery now provides the complete toolset to manage this workflow from end to end:

Access: Enable zero-ETL workflows by querying unstructured PDFs and documents directly where they live in Google Cloud Storage using Object Tables.
Process: Utilize embedded AI capabilities like AI.PARSE and AI.CHUNK_DOC (coming soon) for layout-aware chunking (perfect for RAG), AI.GENERATE for entity extraction/summarization, and AI.CLASSIFY to instantly categorize records using foundational models directly in your SQL pipelines.
Ground: Build highly accurate context using Autonomous Embeddings and Hybrid Search. Hybrid search combines the conceptual understanding of semantic vector search with the exact precision of lexical keyword matching By reranking results based on both semantic relevance and keyword frequency, you drastically increase search precision and drive down LLM hallucinations.
Relate: Uncover hidden multi-hop insights by mapping extracted entities (like Sponsors, Trials, and Drugs) into a BigQuery Graph—no specialized graph database required.
Activate: Bring it all together with BigQuery's Conversational Analytics agents. Using functions like AI.AGG, you can chat directly with your complex data, generate visualizations, and perform trend analysis at massive scale.

With unstructured data as a first-class citizen in BigQuery, you can finally bridge the gap between your raw documents and conversational AI.

Ready to get started?

Explore the Code: Check out the complete end-to-end clinical trials demonstration in our Document Analytics on BigQuery GitHub Repository.
Read the Docs: Dive into the official documentation for Autonomous Embeddings and Hybrid Search to start building your own unified data pipelines today.

How Google Cloud detects, contains, and protects against emerging threats

Fri, 07 Aug 2026 16:00:00 +0000

At Google Cloud, securing your data and business systems is our foundational commitment. We empower our customers with the tools, governance, and infrastructure needed to securely deploy workloads and maintain long-term trust.

We approach security from a shared fate model, and we continuously work to proactively identify and mitigate potential threats before they can compromise your data and misuse your infrastructure.

Understanding the risk: How bad actors attempt to exploit cloud workloads

Hyperscale cloud platforms like Google Cloud offer massive compute capacity, high-speed networking, and cutting-edge AI engines, but these same core strengths also make us high-value targets for malicious actors seeking service disruption, financial gain, or exploit cloud resources.

By tracking active adversary techniques, Google’s specialist security teams actively monitor and defend across several areas.

AI workload exploitation: As organizations rapidly adopt AI tools and systems, including Gemini Enterprise Agent Platform, threat actors target unsecured API keys and leaked access tokens. Common attack patterns include using stolen credentials for unauthorized distillation attacks and reselling access tokens on third-party marketplaces. We track consumption rates, account standing, and access context to catch these anomalies early.
Cryptocurrency mining: Malicious actors often use stolen credentials to spin up virtual machines (VM) for illicit cryptomining. While Google Cloud respects customer privacy and does not inspect internal VM processes, we can accurately infer mining activity by analyzing infrastructure telemetry — such as distinctive CPU and memory utilization spikes and rapid VM creation rates.
Exfiltrated credentials and supply chain attacks: Developers occasionally commit secrets and API keys to public source repositories where automated scrapers harvest them in seconds. Exposed credentials also stem from supply chain attacks against local development environments or managed cloud workloads.
Account takeover (ATO): Adversary-in-the-middle (AITM) techniques — such as sophisticated phishing and session cookie theft — can grant unauthorized users administrative control. Once inside, adversaries establish persistence, move laterally, and execute downstream abuse like resource hijacking or data exfiltration.

Without proper containment, these attacks can lead to operational disruptions, compromised system integrity, and unchecked resource misuse — such as runaway costs — creating substantial friction for impacted users.

Mitigating risks: Tailored containment in action

Detecting a threat is only half the battle; maintaining business continuity by containing it without interrupting your legitimate operations is critical. Google Cloud deploys tailored mitigation strategies based on the nature of the threat.

Granular containment and throttling: When anomalous traffic indicates AI abuse or cryptomining, we apply targeted throttling measures. This isolates malicious activity while preserving legitimate corporate traffic.
Collaborative triage for complex workloads: In AI environments, malicious API calls are often interlaced with critical business operations. In these scenarios, our Cloud Abuse and Cloud Support teams collaborate directly to isolate and inspect specific traffic vectors.
Localized identity isolation: To prevent lateral movement, localized containment protocols can be systematically applied across compromised user identities and Google Workspace domains.
Targeted suspensions as a last resort: Our primary objective is to enforce containment at the most granular resource level possible. However, if platform integrity or customer financial exposure is severely threatened, we may temporarily suspend specific projects, backed by a clear appeal process.

Additionally, to stop attacks at the root, Google actively partners with public repository hosters through initiatives like GitHub Secret Scanning to catch exposed credentials immediately and trigger proactive warnings before exploitation occurs.

Communicating risk: Proactive transparency and log visibility

During a security event, time-to-awareness is everything. We provide a robust suite of tools and channels to ensure your key security stakeholders receives actionable visibility:

Cloud Abuse Event Logging: Provides a 30-day window into security and abuse notifications with resource-level granularity. These logs can be ingested directly into your SIEM product for automated orchestration and response.
Proactive support cases and abuse notifications: When critical abuse is detected, automated email notifications and high-touch support cases are generated to open an immediate channel for resolution and best-practice sharing.
Cloud Audit Logging and anomaly spending alerts: Audit logs monitor unexpected resource changes that point to an ATO, while automated billing alerts notify key stakeholders of sudden spend spikes driven by compromised workloads.
Essential Contacts: To ensure notifications reach the right people instantly, Google Cloud allows you to maintain a dedicated directory of designated contacts across security, billing, and operations.

Customer action plan: Hardening your environment

We handle the security of the underlying infrastructure, yet your organization remains resilient only through proactive hygiene on your side of our shared fate partnership.

To minimize risk exposure across your user accounts, service accounts, and API keys, we recommend implementing these foundational defenses.

Mandatory identity protection: Enforce multi-factor authentication (MFA) and 2-Step Verification (2SV) across all user accounts and Google Workspace domains without exception to prevent AITM cookie theft and phishing attacks. Ensure that you use Device Bound Session Credentials (DBSC) for your Google Workspace accounts to bind a user's session to their specific device.
Secure service accounts and API keys: Treat keys and tokens as top-tier secrets. Never embed API keys in source code or public repositories. Use keyless authentication where possible, rotate keys regularly, and follow strict governance for service account management.
Enforce least privilege and perimeter defense: Use Identity and Access Management (IAM), VPC Service Controls (VPC-SC), and Context-Aware Access (CAA) to restrict access so identities only have the exact permissions required for their specific function.
Configure Essential Contacts and billing alerts: Set up detailed billing alerts to identify unauthorized spending before costs rise, and conduct quarterly reviews to keep your Essential Contacts directory current.
Regular resource hygiene: Conduct periodic audits of your organization to identify and decommission unused resources, legacy billing accounts, and dormant user accounts. Pay special attention to groups or service accounts with elevated permissions to ensure your attack surface remains as small as possible.

Continuous vigilance together

Google continuously monitors platform health to detect anomalous usage patterns before they impact your workloads.

Ultimately, maintaining a secure environment is a partnership built on shared fate. While we take every precaution to prevent bad actors from gaining a foothold, protecting your organization requires equal dedication on your end. By applying robust access controls, staying vigilant, and adopting security best practices, together we can keep your workloads secure and resilient.

Explore key resources to harden your environment:

GOL! How TelevisaUnivision streamed the FIFA World Cup to millions with Google Cloud

Fri, 07 Aug 2026 16:00:00 +0000

Live sports broadcasting represents the ultimate stress test for digital media infrastructure, where operational success or failure is measured in milliseconds and observed live by millions of viewers simultaneously. During the 2026 FIFA World Cup, the stakes reached a high for TelevisaUnivision, the leading Spanish-language media conglomerate. With Mexico serving as both a primary host nation and a core contender on home soil, fan engagement created unprecedented demand across Latin America and TelevisaUnivision's ViX streaming platform.

For a marquee broadcaster like TelevisaUnivision, high-stakes events carry direct, long-term brand and reputational implications. Audiences demand uninterrupted, pristine access to every critical moment of play. Playback interruptions during a key goal, login latency at kickoff, or degraded stream resolutions immediately impact customer satisfaction, risking subscriber churn and brand dilution. When streaming tier-1 global sports events, technical execution directly impacts consumer trust, requiring an absolute commitment to zero-downtime availability and flawless performance on the part of the provider.

Why TelevisaUnivision selected Google Cloud

Navigating Latin America's complex networking ecosystem, which is marked by heavy ISP fragmentation and cross-border transit bottlenecks, required more than a standard vendor relationship. TelevisaUnivision needed a strategic partner willing to make joint investments in network capacity, infrastructure resiliency, and custom feature development. TelevisaUnivision selected Google Cloud's Media CDN based on two foundational differentiators: its architecture, and Google Cloud’s customer focus.

Platform architecture

Media CDN provided a resilient, globally distributed infrastructure built specifically to absorb massive live-stream traffic spikes while protecting origin infrastructure. Core architectural advantages included:

In-ISP deep edge caching: Media CDN embedded cache nodes deep within local ISP networks across Mexico and Central and South America, placing video segments within a single network hop of viewers.
Direct ISP peering: By establishing direct peering connections with major regional telecommunications operators such as América Móvil and Telefônica, the architecture completely bypassed congested international transit routes.
Dedicated capacity reservations: TelevisaUnivision reserved live event capacity with dedicated allocated headroom in-region. This isolated livestream traffic from "noisy neighbor" risks and comfortably absorbed peak traffic surges.
Sub-millisecond sessions with Valkey 9.0: To handle massive traffic spikes during the World Cup, TelevisaUnivision migrated its session store to Memorystore for Valkey 9.0, operating as serverless microservices on edge compute. This architecture delivered sub-millisecond response times for critical authentication and entitlement checks, while providing automatic scaling to process peak API traffic without the need for manual capacity reservations.

Obsession for customer success

Beyond technical capabilities, TelevisaUnivision chose Google Cloud for its joint co-engineering model and deep operational alignment.

Joint 24/7 war rooms: For all 104 matches, TelevisaUnivision engineers and Google Cloud specialists operated side-by-side in unified command centers.
Proactive monitoring as a service: Google Cloud’s Customer Reliability Engineering teams provided round-the-clock proactive monitoring and automated alerting.
Joint operational authority: Combined teams performed extensive pre-tournament stress tests and simulated failovers. During live matches, unified telemetry empowered joint leads to dynamically route traffic and adjust CDN configurations instantly as regional ISP congestion emerged.

Summary

The strategic partnership between TelevisaUnivision and Google Cloud during the 2026 FIFA World Cup established a new benchmark for global sports broadcasting. Across 39 consecutive days of tournament execution, TelevisaUnivision reported that the joint infrastructure delivered:

Total matches broadcast	104 live matches
Platform availability	100% platform availability (0 downtime)
Cumulative viewership	675 million views across TelevisaUnivision & ViX

By uniting localized edge delivery, sub-millisecond serverless compute, and dedicated operational co-engineering, TelevisaUnivision and Google Cloud solidified a battle-tested blueprint for executing marquee live streaming events at record global scale.

What’s new with Google Cloud

Fri, 07 Aug 2026 16:00:00 +0000

Want to know the latest from Google Cloud? Find it here in one handy location. Check back regularly for our newest updates, announcements, resources, events, learning opportunities, and more.

Tip: Not sure where to find what you’re looking for on the Google Cloud blog? Start here: Google Cloud blog 101: Full list of topics, links, and resources.

aside_block: <ListValue: []>

Aug 3 - Aug 7

Navigate data sovereignty and AI innovation with hybrid cloud
For enterprises facing strict compliance rules, keeping sensitive data on-premises often means missing out on cutting-edge AI. Data from the 2026 State of AI Infrastructure report reveals that 52% of IT leaders are adopting hybrid cloud strategies to bridge this gap. Our latest blog post explores how Google Distributed Cloud (GDC) helps organizations deploy connected or air-gapped models to run advanced AI entirely within secure environments—mitigating geopolitical risks without sacrificing innovation. Read more.
SAP and Google Cloud Launch BDC Connect for BigQuery
For years, enterprises have struggled with the cost, risk, and complexity of moving mission-critical SAP data into advanced analytics platforms. The general availability of SAP Business Data Cloud (BDC) Connect for BigQuery marks a turning point. By introducing revolutionary zero-copy, bi-directional data sharing, this new capability seamlessly bridges SAP systems with Google Cloud's powerful data and AI ecosystem. Instead of wrestling with manual data duplication and lost business context, organizations can now eliminate silos, dramatically lower their analytics costs, and rapidly deploy trustworthy, agentic AI solutions grounded in real-time operational reality. Read the full announcement to learn how to transform your data strategy.
Google Cloud Cortex Framework version 7 is now generally available!
This release helps you modernize your data architecture for AI agent readiness, enabling you to quickly deploy, customize, and extend robust data products while simplifying orchestration and reducing infrastructure overhead. It provides data product accelerators for SAP-sourced data to build trusted, high-quality data products ready for advanced analytics and agentic use cases. The Framework integrates with Google Cloud products including BigQuery, Dataform, Knowledge Catalog, and Gemini Enterprise Agent Platform. Learn more in our announcement blog, technical documentation, or try a demo deployment today.
From API Management to AI Gateway with Apigee
Massive LLM adoption unlocked automation but exposed critical vulnerabilities, from unpredictable token costs to security risks like prompt injection. Without central management, organizations face accelerated technical debt. Learn how to transform Apigee into an enterprise AI Gateway to centralize governance. This architectural roadmap details how to utilize semantic cache to optimize token costs, implement prompt protection policies for security, and productize tools using the emerging MCP standard.

Read the full architectural roadmap on the Apigee Community Hub
Centrally govern enterprise AI traffic with Apigee AI Gateway
Manage, track, and secure model communication across your entire infrastructure from a single pane of glass. In a new video walkthrough, Principal Architect Tyler Ayers demonstrates how Apigee AI Gateway simplifies agentic governance. Learn how to transparently proxy model traffic, log real-time token counts, and apply runtime security quotas without impacting your developer workflow.

Watch the Apigee AI Gateway demo
Maximize Provisioned Throughput Utilization
Sudden traffic micro-spikes can exceed per-second quotas, triggering 429 errors or forcing overflow into shared resource pools. A new architectural guide demonstrates how to build a serverless "shock absorber" using Cloud Run and Google Cloud Tasks. By decoupling request ingestion from execution, this queue-based pattern flattens volatile traffic bursts and smoothly drips requests to Gemini at your exact quota rate, maximizing Provisioned Throughput utilization while eliminating job failures during peak usage. Read the step-by-step setup guide.
Eliminate security blindspots in agentic tool interactions
Unmonitored agentic tool calls via the Model Context Protocol (MCP) can introduce critical security risks to your enterprise architecture. Join our technical deep dive on Thursday, August 13, to discover how to position Apigee as a centralized security gateway. Featuring the new ParsePayload policy and payload operations groups in API Products, this session demonstrates how to enforce granular tool filtering, manage execution quotas, and scale secure agent ecosystems without impeding developer velocity.

Register for the August 13 Community TechTalk

Jul 27 - Jul 31

Data Cloud and Apigee CDMX: The AI Agent Evolution | August 12, 2026
Enterprise AI demands evolution beyond basic conversational assistants. To generate real value, AI models must connect with the organization's core systems and live data sources. Join us this August 12 at Google CDMX for the exclusive event AI Evolution: Powering Tomorrow's Enterprise. Learn how to design an agile and secure ecosystem by unifying the power of Gemini, Apigee, and data agent technologies through practical demonstrations led by Google Cloud engineers.

Secure your spot for the in-person session in Mexico City Register now!
Vast Edge, built on GCP, launches the first live recovery interface for cloud backups, enabling IT teams to inspect backup contents in real time. This transforms backups from a blind, log-based process into an interactive platform where teams can instantly search, preview, and validate the exact data available for restore.

This platform protects Google Workspace, NetSuite, Salesforce, Workday and many SaaS environments, providing complete visibility and enterprise-grade oversight.

Visit Vast Edge Backup & Disaster Recovery and get a free trial of their backup solutions on the GCP Marketplace for Google Workspace Backup, NetSuite Backup, Salesforce Backup, and Workday Backup.

Jul 20 - Jul 24

Claude Opus 5, Anthropic’s latest model, is now available on Agent Platform. It brings performance improvements over Opus 4.8 across coding, long-running agents, and knowledge work.The model is Zero Data Retention (ZDR) compatible. For safety, high-risk workflows — such as penetration testing or exploit generation — it will notify you and fall back to Opus 4.8.We’re excited to continue to offer enterprise customers options across frontier models to build, deploy, and scale AI securely. Try it here.
Apigee Northam Roadshow 2026 | The AI Agent Evolution: Powering Tomorrow's Enterprise
AI is evolving. As your organization deploys autonomous agents, the integration between APIs and models becomes critical. Join Google Cloud specialists for an exclusive day of deep-dive sessions and live demos. Discover how the unified power of Apigee and the Google Cloud Agent Platform allows you to build, govern, and scale high-performance AI agents with complete control. Call to Action: Register for Sunnyvale | Register for NYC | Register for Chicago
Deploy an Apigee Proxy for MCP Registry Discovery
Learn how to deploy an Apigee X proxy to format Apigee API Hub data into the Model Context Protocol (MCP) Registry format. This tutorial by Tyler Ayers guides developers through cloning the sample repository, deploying using the Apigee Feature Templater (aft), and testing the endpoint to make API data easily discoverable by coding agents.

Read the full community tutorial to get started.
Simplify AI Infrastructure: Getting Started with Apigee AI Gateway
Managing a complex AI landscape with multiple backend environments can present significant operational and governance challenges. A new tutorial walks you through how to build a unified API proxy using Apigee AI Gateway. By establishing a single, secure entry point for all model traffic, teams gain access to real-time analytics, comprehensive tracing, and financial operations auditing—completely seamlessly, and with absolutely no modifications required to client environments or user configurations.

Read the step-by-step setup guide
Your AI agents are ready. Is your data?
The biggest bottleneck to scaling AI isn't the models—it's giving them access to business context. As enterprises move to proactive systems of action, legacy infrastructure often buckles under the nonlinear speed of AI agents. Google Cloud’s new Agentic Data Cloud, built on AI-native infrastructure, solves this by unifying data, AI models, and operational databases. Discover how a borderless Lakehouse and active Knowledge Catalog can empower your AI agents with trusted, real-time context without unnecessary engineering overhead. Read more.
Secure and govern your AI at Apigee AI Horizon in London
Moving AI from basic prompts to complex agentic workflows requires trust and control. Join us on Tuesday, 1st September 2026 at Google London for our 5th edition of Apigee AI Horizon. Discover how Google Cloud product leaders and architects are using Apigee and Model Armor to secure LLM APIs, implement policy controls, and manage token consumption. Do not miss this one—register soon!

Secure your spot for AI Horizon London

Jul 13 - Jul 17

Resource-Based CUD Sharing is Now Enabled by Default
Starting June 16, 2026, the default setting for Google Cloud Resource-based Committed Use Discount (CUD) sharing will change from disabled to enabled for new billing accounts and eligible existing accounts without active CUDs. This update automatically maximizes your savings by pooling underutilized discounts across your resources.

You retain full control and can adjust your CUD sharing preferences at any time by changing your CUD scope configuration. For instructions, see Enable CUD sharing or Disable CUD sharing.
Webinar for India: Google Cloud for EdTech: Optimizing Traffic and Token Governance at Scale
API traffic surges and AI model integration are reshaping the EdTech landscape. Join Satyam Maloo for the webinar Google Cloud for EdTech: Optimizing Traffic and Token Governance at Scale on July 23, 2026. Learn to implement advanced rate limiting, gain granular token visibility, and leverage real-time analytics to govern your platform effectively. Whether you’re scaling for peak academic seasons or integrating complex AI workflows, this session provides the infrastructure blueprint you need.

Register Now
Scaling AI Agents: Treat prompts like software artifacts
As AI agents move into production, monolithic system prompts often result in configuration drift, merge conflicts, and silent runtime failures. The solution is adopting a Prompts-as-Code architecture. By breaking prompts into modular skill files and using a build-time transpiler, engineering teams can introduce dependency resolution, static validation, and CI/CD rigor to their agent's control plane. Stop manually editing massive text files and start building deterministic, reliable agent infrastructure.

Read more here.

Jul 6 - Jul 10

Webinar: Introducing Google Cloud NGFW Enterprise advanced malware protection - powered by Palo Alto Networks
Discover the new Cloud NGFW advanced malware sandbox, arriving in preview later this year. Powered by Palo Alto Networks Advanced Wildfire, it leverages data from 70,000+ customers to help defeat advanced malware. Join us on July 16 at 11 AM EDT to learn how to build a resilient, zero-trust cloud infrastructure that protects your apps and data, wherever they reside.

Register for the webinar now
Safely run AI-generated code in Cloud Run sandboxes
Cloud Run sandboxes, now in public preview, are lightweight, isolated execution boundaries that you can spawn near-instantly within your existing Cloud Run service instances.

Whether you need to let an LLM run a dynamically generated Python script to calculate business margins or spin up a headless browser to perform web research, Cloud Run sandboxes give you a secure, isolated sandbox to run these tasks without leaving your serverless environment.

Read the blog to learn more and get started today.
Australia API Horizon: Scaling Enterprise Governed AI Agents
The transition from AI chatbots to autonomous agents is the most critical integration point for your business. Join Google Cloud at our upcoming events to explore exclusive deep-dive sessions on architecting for the agentic era.

Discover how to use Apigee as an intelligent AI Gateway to govern, secure, and scale high-performance architectures. You will learn to seamlessly build AI tools from your existing APIs and maintain control over your entire ecosystem.

Join us in your preferred city:
Build highly available, multi-region services on Cloud Run
Maintaining uptime for business-critical applications just got a lot easier on Cloud Run. Service health, now Generally Available, automates cross-region failover by leveraging readiness probes for instance-level health checks with a simple, two-click setup. You can configure service health with global external Application Load Balancers for public-facing applications or cross-region internal Application Load Balancers for private networking traffic.

Learn how to configure service health for Cloud Run.
Report: 83% of organizations need infrastructure upgrades for agentic AI
The shift from conversational bots to autonomous agents is breaking legacy systems. Our new State of AI Infrastructure report details how engineering leaders are adapting to these massive new workloads. To eliminate inference bottlenecks, control hidden scaling costs, and manage agent sprawl, the industry is rapidly moving toward fluid compute, centralized governance, and unified, co-designed architectures.

Explore our key infrastructure insights
Stop tinkering, start scaling: the industrialized AI Playbook
Did you know that only 5% of custom AI investments actually return measurable business value? The problem isn’t the technology—it’s how organizations are wired to run it.

In this compelling read, Google Cloud Consulting breaks down the operational blueprint that bridges the stark gap between "cool tech experiments" and real, P&L-impacting enterprise ROI.

Read the full article on Medium
AI Agent Clinic: Slashing App Latency by 80%
Prototyping an AI agent is easy, but scaling for live traffic presents unique challenges. In the latest AI Agent Clinic, our technical experts partner with a developer to optimize PlaybackIQ, a live football analysis agent. This session demonstrates how to use OpenTelemetry to trace bottlenecks in the Gemini Enterprise Agent Platform and deploy to Cloud Run for high-concurrency scaling, achieving an 80% reduction in response time. Learn production-grade debugging strategies to optimize your own LLM applications.

Watch the 60-minute teardown

Jun 29 - Jul 3

Claude Sonnet 5, Anthropic’s latest model, is now available on Agent Platform.
This addition serves as a drop-in replacement for Sonnet 4.6, giving organizations expanded choice for task completion across enterprise workflows. It features enhanced reasoning, cleaner code generation, and computer use capabilities for desktop and browser workflows.

By continuing to rapidly bring frontier models to our platform, Google Cloud offers an uncompromised choice of the industry's best technology to build, test, and scale enterprise-grade AI.

Get started today.
Automate your AI governance with Apigee and YAML
Manual API gateway configurations can quickly slow down your AI engineering velocity. Join the Apigee community on Thursday, July 16, to discover an automated, declarative blueprint for model garden management. Learn how a simple, repeatable YAML pattern lets your AI practitioners instantly spin up secure, policy-backed enterprise configurations without friction. Bring your questions and connect during our live Q&A session.

Register for the July 16 Community TechTalk
Build next-generation AI portals for autonomous agents
Standard developer portals were designed for human developers to subscribe to static APIs. Today, autonomous agents, LLM toolkits, and dynamic runtimes demand a central nervous system for governance. Join our technical deep dive on Thursday, July 23, to explore Apigee's new AI Portals solution. You will see exactly how to deploy full-service, MCP powered hubs to safely manage enterprise self-service for models, tools, and agents.

Register for the July 23 Community TechTalk
Protect your infrastructure from advanced cyberattacks at the API layer (Presented in Portuguese)
In an era of increasingly sophisticated threats, relying solely on traditional firewalls leaves critical data gaps. Join our technical community TechTalk on Thursday, July 30—conducted in Portuguese—to learn how to proactively mitigate risks directly at the gateway layer. This session demonstrates how to configure and govern essential Apigee security policies to build a robust line of defense, ensuring maximum availability and complete integrity for your enterprise microservices.

Register for the July 30 Portuguese Community TechTalk

Jun 22 - Jun 26

Accelerate TPU model loading while saving RAM on GKE.
Large model cold starts often stall scaling and leave high-value TPUs idle. The open-source Run:ai Model Streamer now natively supports TPUs with Google Cloud Storage in TPU vLLM 0.18.0. This integration accelerates inference pipelines on GKE by streaming tensors directly into CPU memory, bypassing local disk bottlenecks and the "double-buffering" trap. In benchmarks, loading a 480B parameter model was over 2x faster while cutting peak host memory usage by half. Read the full guide and get started today.
Stop Training Blind: Scaling AI with the New OpenTelemetry-Based TPU AI Telemetry Collector Agent
Google Cloud’s new AI Telemetry Collector agent standardizes TPU monitoring using OpenTelemetry. It optimizes enterprise ML workloads by identifying silent failures and providing zero-cost operational metrics without draining host CPU cycles. The agent seamlessly routes telemetry to Google Cloud Monitoring or Prometheus and custom Grafana setups. Pre-installed on Google-optimized Ubuntu images or available via Docker, it tracks memory, network latency, and core utilization to maximize multi-node training efficiency.

You can read more of this capability by clicking this link.

Jun 15 - Jun 19

Join us for a deep dive into agentic AI control with AppyThings
Your integrations aren’t failing—they are evolving. When users interact with AI agents, they no longer arrive directly at your site, resulting in experiences stripped of your context, expertise, and intended experience. Join us on Thursday, June 25, for a community tech talk in partnership with AppyThings to learn how to solve this new gateway challenge. We will explore how MTN laid an integration foundation with the Model Context Protocol (MCP) to deliver accurate, consistent experiences. Our technical experts will demonstrate how to leverage Apigee as a centralized tools management solution to govern agent access.

Register for the session
Optimize Spot VM Deployments with Capacity Advisor for Spot, Now in Public Preview
Google Compute Engine has launched Capacity Advisor for Spot to Public Preview, now open to all customers. This tool turns Spot capacity discovery into a data-driven process by providing real-time deployment recommendations to maximize obtainability and minimize preemption risks. Query the Capacity Advisor API for obtainability and minimum estimated uptimes, or use the new Console UI featuring a global availability map, spot price lookups, and historical preemption rate trends to visually find the most cost-efficient compute capacity.

Get started today to start optimizing your Spot VM deployments!
Build a multi-tenant agentic AI system
When scaling generative AI across different business units, your teams need specialized AI agents with unique operational rules and tools. Our new reference architecture helps you build a centralized multi-tenant platform to prevent fragmented silos, eliminate data exposure risks, and maintain unified compliance. Read the guide to design and deploy a multi-tenant agentic AI system in Google Cloud.
How to Configure Gemini Enterprise to Connect to a Custom MCP Server
The Gemini Enterprise MCP Connector was a big announcement at Google Cloud Next because it introduces the ability to connect Gemini Enterprise to MCP servers. This blog post provides a step-by-step guide on how to configure your first Custom MCP Server connector using the Google Maps Ground Lite MCP server as an example. Once you understand this flow, you can configure multiple MCP servers with Gemini Enterprise to bring all the context you need.

Jun 8 - Jun 12

Simplify Multi-Cloud Planning with Cloud Location Finder, now Generally Available
Cloud Location Finder provides up-to-date data on public regions, zones, and Google Distributed Cloud Connected locations across Google Cloud, AWS, Azure, and OCI. You can now programmatically discover locations based on provider, proximity, territory, and carbon footprint to optimize your global infrastructure strategy for performance, compliance, and sustainability.

Get started for free today

Jun 1 - Jun 5

Modeling the physical world with BigQuery Graph
Managing complex supply chains requires more than just spreadsheets; it requires a digital replica of the physical world. In this post, Guru Rangavittal and Candice Chen explore how BigQuery Graph enables organizations to build a digital twin by turning physical assets into an interconnected map of nodes and edges. By moving beyond traditional relational databases, businesses gain real-time clarity into operations—from executing surgical ingredient recalls to analyzing weather-driven logistics risks. Discover how BigQuery Graph transforms reactive firefighting into proactive, precision modeling, allowing you to see critical connections in seconds and future-proof your supply chain.
Apigee for AI: Govern LLMs and MCP Servers (Presented in Spanish)
Learn how to securely transition your AI initiatives from experimental prototypes to enterprise-ready deployments. Join Luis Cuellar on June 18 for a technical deep dive (presented in Spanish) exploring Apigee’s latest AI gateway capabilities. Discover how to centralize governance over Model Context Protocol (MCP) servers, protect Large Language Models (LLMs) with robust API gateway security policies, and manage token-based quotas.

Register for the June 18 Spanish Community TechTalk

May 25 - May 29

Anthropic’s Claude Opus 4.8 is now available on Gemini Enterprise Agent Platform. As we continue to expand our platform's model offerings, this addition gives organizations more options for handling complex, multi-stage enterprise workflows. Claude Opus 4.8 brings strong capabilities in agentic coding, allowing developers to manage extensive refactors and tracking dependencies over extended sessions.
API Horizon Munich July 6, 2026: Orchestrating the Next Era of AI and APIs
Master the orchestration of next-gen AI and digital ecosystems. Join Google Cloud experts and DACH tech leaders on July 6 for an exclusive look at the Apigee roadmap, Agent Management, and Model Context Protocol (MCP). Gain real-world insights and connect with the regional integration community.

Register now
Securing AI Agents: The Extended Agent Gateway Pattern
Learn how to prevent autonomous AI agents from invoking unauthorized APIs. Join Apigee Specialist Joel Gauci on June 4 for a technical deep dive into the Extended Agent Gateway pattern. This session covers enforcing Fine-Grained Authorization (FGA), implementing secure token exchange, and establishing Model Context Protocol (MCP) governance at the API gateway layer to protect enterprise backend services.

Register for the June 4 Community TechTalk
API-to-Agent Security: Exposing REST APIs to Gemini Enterprise via MCP
Connect Gemini Enterprise agents to core data without creating security hazards. Join Google Cloud Specialist Nigel Walters on June 11 to learn how to instantly transform legacy REST APIs into secure Model Context Protocol (MCP) servers. We’ll cover how to safely register tools with Gemini while enforcing gateway-level guardrails like rate limiting and access control policies.

Register for the June 11 Community TechTalk

May 18 - May 22

Chinese Webinar | June 4: AI Command and Control
As AI agents move from experimental pilots to core enterprise functions, governance has become a critical next step. Join Google Cloud on June 4th at 10:00 AM (Beijing Time) to learn how to build a secure AI management layer architecture. We'll explore how to develop governed MCP (Model Context Protocol) endpoints, manage tool access to enterprise data, and leverage robust audit logs to operationalize AI. This session also includes a practical demonstration of these governance frameworks on Google Cloud.

Register here
GCP Announces New Features to Benchmark and Optimize LLMs for On-Device Use Cases
Deploying fine-tuned LLMs from GCP to edge devices like smartphones is complex due to fragmented hardware. Google AI Edge Portal bridges this gap, giving GCP developers the ability to test AI performance on 120+ Android devices, representing the full diversity of high, medium, and low tier smartphones on the market today. This week at I/O, we announced brand new capabilities to benchmark and debug LLM performance across these devices. Sign-up to utilize these new features in private preview today.

May 11 - May 15

Build Your AI & MCP Control Tower for Universal Governance
Master the future of agentic security with Apigee. Join our Community TechTalk on May 21 to discover how Apigee serves as a central "Control Tower" for the Model Context Protocol (MCP). We will explore how new JSON-RPC tool authorization enables fine-grained access policies across your organization, ensuring secure and scalable AI deployments. Whether managing internal tools or external users, learn to govern your agentic ecosystem with absolute precision. This session is designed for global coverage across EMEA and AMER regions.

Register for the May 21 Community TechTalk

Apr 27 - May 1

Master Your Launch: The Apigee Production Go-Live Checklist
Ensure a secure launch with the Apigee production guide. Join Nicola Cardace on May 28 to explore security guardrails, including IAM roles, mTLS configurations, and encrypted KVM migrations. Scheduled at 11 AM EDT / 5 PM CEST to support EMEA and AMER teams, this TechTalk provides the technical roadmap you need to flip the switch with absolute confidence.

Register for the May 28 Community TechTalk
Transforming APIs into Governed Agentic Tools on the Google Cloud Agentic Platform
Turn your APIs into secure, governed agentic tools on the Google Cloud Agentic Platform. Join Specialist Christophe Lalevée on May 7 for a technical deep dive into AI productization. Scheduled at 5 PM CEST / 11 AM EDT to maximize coverage for developers across EMEA and AMER, this session explores the integration and governance frameworks required to scale enterprise-ready AI with confidence.

Register for the May 7 Community TechTalk
Fractional G4 VMs are Generaly Available, providing a highly efficient and cost-effective entry point for AI and graphics workloads. These new configurations, using NVIDIA virtual GPU (vGPU) technology, allow you to leverage the power of the NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs in flexible, smaller increments, so you can right-size your infrastructure to match the specific demands of your applications. By providing more granular access to advanced hardware, fractional G4 VMs let you optimize resource allocation and reduce overhead without sacrificing performance. You can now select from additional GPU slice sizes for your specific needs:
- 1/2 GPU: Ideal for more intensive tasks such as LLM inference, robotics sensor simulation, and high-fidelity 3D rendering.
- 1/4 GPU: Optimized for mainstream workloads, including mid-range creative design, video transcoding, and real-time data visualization.
- 1/8 GPU: Great for lightweight applications such as remote desktops, productivity tools, and entry-level streaming services.
Transitioning AI from a sandbox prototype to an enterprise-grade system is a major hurdle. A monolithic script won't suffice for widespread deployment. To achieve true scale and reliability with Gemini, organizations must adopt service-oriented micro-agent architectures, establish Zero-Trust security, and implement rigorous EvalOps. Master the "Agentic Maturity Ladder" to ensure your AI & Agentic solutions are robust, secure, and ready for the real world.

Watch the deep dive and read the developer blog to learn more.
ML Development in VS Code with Google Cloud Power: Workbench Extension Now Available
Data scientists and developers can now combine the local productivity of VS Code with the scalable infrastructure of Google Cloud. The new Google Cloud Workbench Notebooks extension allows you to connect to and run notebooks on managed cloud environments directly within your local IDE. This integration streamlines the ML lifecycle by eliminating context switching and providing high-performance compute for complex workloads in a familiar interface. As part of our commitment to the developer ecosystem, the extension is fully open-sourced to support community-driven innovation.
- Install from Marketplace: GoogleCloudTools.workbench-notebooks
- Contribute on GitHub: colab-enterprise-vscode

Apr 20 - Apr 24

Announcing the 2026 Google Cloud Partners of the Year
Google Cloud is honored to celebrate the winners of the 2026 Partner of the Year awards! These awards recognize an exceptional group of partners across AI, Security, Infrastructure, and more, who have demonstrated a commitment to customer success. From global system integrators to specialized startups, these winners are leveraging the power of Google Cloud to solve complex challenges and drive digital transformation worldwide. Join us in congratulating these organizations for their innovation, collaboration, and impactful results over the past year.

See the 2026 Partner Award winners

Apr 13 - Apr 17

We're excited to announce the Public Preview of Datastream’s metadata integration with Knowledge Catalog. This is the first step in our vision to provide a centralized, "single pane of glass" for all Datastream assets. The enhancement automatically synchronizes Streams, Connection Profiles, and Private Connections, eliminating data silos. It enhances discoverability, allowing you to search for Datastream assets using the same interface as BigQuery tables. Centralized governance is also provided, making your real-time data estate more transparent and easier to manage.
Upgrading Apigee OPDK to 4.53 with OS Modernization
Modernize your infrastructure using Google’s official, sequential upgrade path. Our Technical expert, Rakesh Talanki outlines how to upgrade Apigee OPDK to v4.53 while migrating to a supported OS (RHEL 8.x/9.x). This guide covers the "build-out" methodology, including multi-data center syncing, to ensure a stable, zero-downtime transition

Read the guide
Cloud Run Worker Pools and CREMA: Powering Serverless AI at Scale
Google Cloud has announced the General Availability of Cloud Run worker pools, a new resource type designed specifically for pull-based, non-HTTP workloads. Unlike traditional Cloud Run services that scale based on request traffic, worker pools provide an "always-on" environment for background tasks like processing message queues or running large-scale AI inference. To support this, Google Cloud also open-sourced the Cloud Run External Metrics Autoscaler (CREMA). Built on KEDA, CREMA enables queue-aware autoscaling for worker pools, allowing them to dynamically scale based on external signals like Pub/Sub backlog or Kafka lag.
Apigee Model Context Protocol (MCP) now Generally Available
Expose enterprise APIs as MCP tools for agentic AI applications with the General Availability of MCP in Apigee. This update allows developers to transform APIs into AI-ready tools using OpenAPI Specifications, removing the need for local MCP servers or additional infrastructure. With managed endpoints and semantic search in API hub, you can now provide AI agents with secure, governed access to enterprise data at scale.

Explore the MCP overview

Apr 6 - Apr 10

Community TechTalk: Powering Retail Agents with ADK, UCP & Apigee X
Move beyond basic chatbots to secure, transactional AI experiences. Join our Community TechTalk on April 16 to learn how Apigee X and Gemini build a "Trust Layer" for AI shopping assistants using UCP standards. We’ll demonstrate how to block prompt injections with Model Armor and implement cost governance via token limits to secure the path from discovery to purchase.

Register for the TechTalk
Implement multimodal capabilities in your AI agents
Explore three new reference architectures for building sophisticated multi-agent AI systems that can process and analyze multimodal data. To analyze disparate multimodal data and produce a high-confidence classification, see Classify multimodal data. To create a fluid conversational AI that processes audio and video streams in real time, see Enable live bidirectional multimodal streaming. To consolidate fragmented multimodal data into a searchable knowledge graph, see Multimodal GraphRAG resource orchestration.
Automate SecOps workflows with an agentic AI system
To accelerate incident response and reduce manual toil for your security team, you need a system that can automate remediation playbooks. Our new reference architecture helps you build an AI agent that orchestrates complex triage and investigation workflows across disparate security tools, such as SIEM, CSPM, and EDR, from a single interface. See the full guide to orchestrate security operations workflows.

Mar 30 - Apr 3

ASEAN Webinar | April 30: Mastering Agentic Governance at Scale with GCP
As AI agents move from experimental pilots to core enterprise functions, governance is the critical next step. Join Google Cloud experts Shilpi Puri & Wely Lau for a webinar on April 30th at 11:00 AM SGT to learn how to architect a secure AI Management layer. We’ll explore developing governed MCP endpoints, managing tool access to enterprise data, and operationalizing AI with robust audit logs. The session includes a live demo of these frameworks in action on Google Cloud.

RSVP here.

Mar 23 - Mar 27

Turn your API sprawl into an agent-ready catalog
As organizations scale, APIs often become scattered across multiple gateways, creating "blind spots" that hinder AI adoption. To solve this, we’ve introduced two new capabilities for Apigee API hub: a new integration with API Gateway to automatically centralize API metadata into a single control plane, and a specification boost add-on (now in public preview). This add-on uses AI to enhance your API documentation with the precise examples and error codes that AI agents need to function reliably.

Read the full blog post to get started.
Webinar | April 16: AI Command & Control
As AI agents move from experimental pilots to core enterprise functions, governance is the critical next step. Join Google Cloud expert Satyam Maloo for a webinar on April 16th at 11:00 AM IST to learn how to architect a secure AI Management layer. We’ll explore developing governed MCP endpoints, managing tool access to enterprise data, and operationalizing AI with robust audit logs. The session includes a live demo of these frameworks in action on Google Cloud.

RSVP here.
Modernizing and Decoupling Event Ingestion with Apigee
In modern cloud-native architectures, decoupling producers from consumers is critical for building resilient systems. While Google Cloud Pub/Sub provides a scalable backbone, exposing it directly to external clients can introduce security and management overhead. This new guide explores how to leverage Apigee as an intelligent HTTP ingestion point. Learn how to handle security, mediation, and traffic control before messages reach your internal bus using the PublishMessage policy or Pub/Sub API.

Read the full guide.

Mar 16 - Mar 20

Gemini-powered Assistant in BigQuery Studio Gets Context-Aware Upgrades
The Gemini-powered assistant in BigQuery Studio has been transformed into a fully context-aware analytics partner, supporting your entire data lifecycle. The new capabilities include intelligent resource discovery, which uses Dataplex Universal Catalog search to find resources across projects and deep dive into metadata using natural language. You can now automate tasks, such as scheduling production-grade queries directly through the chat interface, and instantly troubleshoot long-running or failed jobs with root cause analysis and cost control auditing.

Explore the full range of what the assistant can do.

Mar 9 - Mar 13

Want to use Gemini to develop code and don't know where to start?
This article includes a couple of examples of developing code with Gemini prompts; it identified changes that were needed to be made to get the code working. The article also refers to other examples that are available on github.

Mar 2 - Mar 6

Introducing Gemini 3.1 Flash-Lite, our fastest and most cost-efficient Gemini 3 series model. Built for high-volume developer workloads at scale, 3.1 Flash-Lite delivers high quality for its price and model tier. Gemini 3.1 Flash-Lite can tackle tasks at scale, like high-volume translation and content moderation, where cost is a priority. And it can also handle more complex workloads where more in-depth reasoning is needed, like generating user interfaces and dashboards, creating simulations or following instructions.

Starting today, 3.1 Flash-Lite is rolling out in preview to enterprises via Vertex AI and developers via the Gemini API in Google AI Studio.
TechTalk: Implementing Device Authorization Grant (RFC 8628) for Apigee
Learn how to authorize "headless" devices like Smart TVs or AI agents that lack keyboards and browsers. Join our Community TechTalk on March 19 (5PM CET / 12PM EDT) to go under the hood of Apigee X/Hybrid. We’ll cover the real-world mechanics of state management, polling, and human-in-the-loop security patterns for devices and autonomous agents.

Register for the TechTalk

Feb 23 - Feb 27

Pro-level image generation gets faster and more accessible with Nano Banana 2
Nano Banana 2 is our state-of-the-art image generation and editing model. It delivers Pro-level image generation and editing at the speed you expect from Flash — making the quality, reasoning, and world knowledge you loved about Nano Banana Pro more accessible. Learn more about the model here.

The Intelligent Path to Compliance: Transforming Regulatory QC with Google Cloud
Reducing "Refuse to File" (RTF) risks and submission cycle times is critical for life sciences leaders. Google Cloud’s Regulatory Submission Semantic QC Auditor leverages Gemini and RAG architecture to transform Quality Control from a manual burden into an active, intelligent workflow.

By automating semantic cross-referencing, narrative coherence checks, and dynamic guidance-based auditing, this solution ensures rigorous accuracy and auditability. Operating within a secure GxP-ready environment, it empowers teams to detect subtle inconsistencies and generate remediation plans without sacrificing data privacy.

Learn more.
Stop typing, start interacting! The Gemini Live Agent Challenge is here. Build immersive agents that can help you see, hear, and speak using Gemini and Google Cloud. Compete for your share of $80,000+ in prizes and a trip to Google Cloud Next '26!

Submissions are open from February 16, 2026 to March 16, 2026. Learn more and register at geminiliveagentchallenge.devpost.com

Feb 9 - Feb 13

Introducing Gemini 3.1 Pro on Google Cloud.
3.1 Pro is a noticeably smarter, more capable baseline for complex problem-solving. We’re shipping 3.1 Pro at scale, building upon our goal to help you transform your business for the agentic future. Learn more about the model’s capabilities here. Gemini 3.1 Pro is available starting today in preview in Vertex AI and Gemini Enterprise. Developers can access the model in preview via the Gemini API in Google AI Studio, Android Studio, Google Antigravity, and Gemini CLI.
Automate Storage Compatibility with GKE Dynamic Default Storage Classes
Managing storage across mixed-generation VM clusters in GKE just got easier. With the new Dynamic Default Storage Class, Google Kubernetes Engine automatically selects between Persistent Disk (PD) and Hyperdisk based on a node's specific hardware compatibility. This abstraction eliminates the need for complex scheduling rules and manual pairing, ensuring your volumes "just work" regardless of the underlying infrastructure. By defining both variants in a single class, you reduce operational overhead while maintaining peak performance and cost-efficiency across your entire cluster.

Explore automated disk type selection
Community TechTalk: AI-Powered Apigee Development with strofa.io
Join the Apigee community on February 26 for a deep dive into strofa.io. Guest speaker Denis Kalitviansky will demonstrate how this new AI-powered tool automates and orchestrates Apigee development, from local emulators to large-scale hybrid environments. Discover how to scale your API management and streamline team collaboration using the latest in AI-driven automation.

Register now to reserve your spot.

Jan 26 - Jan 30

Simplify API Governance with Native OpenAPI v3 Support
Eliminate integration debt and accelerate deployment velocity with the General Availability of OpenAPI v3 (OASv3) support for API Gateway and Cloud Endpoints. You no longer need to downgrade modern specifications to OASv2. Instead, you can now define API contracts and enforce critical policies—including telemetry, quotas, and security—using native Google-specific extensions directly within your OASv3 files. This update ensures your APIs are secure by design while remaining fully compatible with the modern developer ecosystem and Google Cloud’s AI services.

Get started with OpenAPI v3 on API Gateway and Cloud Endpoints.

Accelerate API Testing with the New Open Source API Tester
Start validating your APIs with API Tester, a simple, YAML-based Test Driven Development (TDD) framework. Designed for the Apigee community, this tool allows you to write human-readable tests, run them instantly via a web client or CLI, and perform deep unit testing on Apigee proxies. With native support for JSONPath assertions and Apigee shared flows, you can verify everything from payload data to internal variables like proxy.basepath without leaving your terminal.

Explore the API Tester guide and start testing your proxies today.
Secure Sensitive Data with Kubernetes Secrets in Apigee hybrid
Enhance security in Apigee hybrid by accessing Kubernetes Secrets directly within your API proxies. This hybrid-exclusive feature keeps sensitive credentials within your cluster boundary and prevents replication to the management plane. It supports strict separation of duties: operators manage secrets via kubectl, while developers reference them as secure flow variables—ideal for high-compliance and GitOps workflows.

Implement Kubernetes Secrets in your hybrid proxies.
See the Console in a Whole New Light: Dark Mode is Now Generally Available in Google Cloud
Elevate your cloud management workflow with Dark Mode, now generally available in the Google Cloud console. We have delivered a modern, cohesive, and accessible experience reimagined for maximum comfort and productivity—especially during extended working hours and low-light environments. Dark Mode can be enabled automatically based on your operating system's preference, or manually through the Settings -> Appearance menu.

Switch to Dark Mode today to enjoy a modern, comfortable, and productive environment!
Apigee X Networking: PSC or VPC Peering?
Deciding how to connect Apigee X? Watch this video to compare Private Service Connect and VPC Peering. We break down northbound and southbound routing, IP consumption, and how to reach targets on-prem or in the cloud. Learn to simplify your architecture and avoid common networking "gotchas" for a smoother deployment.

Watch the video.

Jan 19 - Jan 23

Bridge the Gap: Excel-to-API Conversion in Apigee Portals
Give your customers more ways to connect! This new article by Tyler Ayers explores how to extend the Apigee Integrated Portal to support direct Excel file uploads. By leveraging SheetJS and custom portal scripts, you can enable users to upload spreadsheets, preview data, and submit it directly to your APIs, all without writing a single line of integration code themselves. It’s a powerful way to simplify onboarding for those who aren't yet API-ready.

Learn how to build it.
Elevate your applications with Firestore’s new advanced query engine
We have fundamentally reimagined Firestore with pipeline operations for Enterprise edition. Experience a powerful new engine featuring over a hundred new query features, index-less queries, new index types, and observability tooling to improve query performance. Seamlessly migrate using built-in tools and leverage Firestore’s existing differentiated serverless foundation, virtually unlimited scale, and industry-leading SLA. Join a community of 600K developers to craft expressive applications that maximize the benefits of rich queryability, real-time listen queries, robust offline caching, and cutting-edge AI-assistive coding integrations.

Learn more about Firestore pipeline operations.

Your agentic summer: No-cost lessons from Google experts to build and scale agents

Thu, 06 Aug 2026 16:00:00 +0000

I’ve talked to developers, IT leaders, and builders who all ask the same question: How do we actually get agents into production?

The answer isn't theoretical — it's hands-on. Whether it’s designing a system that allows your agents to interact with external data sources while maintaining strict security guardrails or creating self-optimizing supply chain workflows or whatever you can think up, we’ve got you covered.

That’s why we’ve designed a path to help you take your AI ideas from a rough sketch to fully autonomous agents running in production. This summer, you can harness the same frameworks and approaches used by Google experts to build and scale agents — entirely at no cost.

Powered by Gemini Enterprise Agent Ready (GEAR), these hands-on labs and courses give you the blueprints and tools you need to deploy agents that ship.

Find your roadmap to future-proof your skills this summer, starting here.

1. Intro to AI Agents: Build a foundational understanding of how autonomous agents can redefine productivity.

2. Agent Fundamentals: Go under the hood of autonomous intelligence. Learn decision models and execution loops to deploy adaptive agents over rigid automation.

3. Enterprise Agents and Use Cases: Discover how AI agents drive real business impact. Map agents directly to corporate KPIs, solve operational bottlenecks, and utilize no-code to high-code frameworks.

4. Create Your First Gemini Enterprise Application skill badge: Earn a skill badge that proves you can create an app with Gemini Enterprise. You will master capabilities like deep research agents, multi-agent ideation, and Gemini Notebook for focused analysis.

5. Human-Centered AI: Keep humanity at the core of automation. Learn to strategically balance machine speed with human intuition for successful orchestration.

6. Agentic Strategy: Discover, Design, and Prototype: Prototype high-impact AI projects with zero code. Leverage Google’s transformation framework, map user journeys and build functional retail prototypes.

7. Orchestrate Multi-Agent Workflows with Gemini Enterprise skill badge: Demonstrate your ability to manage multiple agents powered by Gemini Enterprise with a skill badge. This skill badge shows that you can unify data across first- and third-party sources, develop multimedia marketing materials, and fully automate complex business actions across disjointed systems.

8. Engineer AI Agents with Agent Development Kit (ADK) skill badge: Build production-grade agents using expert developer tools. Earn a skill badge that proves you can perform live search grounding, build structured JSON schemas, and manage ADK pipelines.

9. Add Currency Tools to an Agent Using MCP: Connect your LLMs to external systems in just 20 minutes. Securely bridge agents with live external databases and deploy via CLI.

10. Manage Agent Memory and State: Give your agents a memory. Move beyond single-query replies and use session states with the ADK to build highly personalized, deeply contextual agents.

11. Create Agent Skills with Google: Infuse domain expertise into custom skills. Minimize AI unpredictability and build reusable workflows that optimize agent performance.

12. AgentOps: Operationalize AI Agents on Google Cloud: Harden your prototypes and scale safely to production. Implement observability, proactive monitoring dashboards, and robust CI/CD security.

Test your skills at the summertime Hackathon

Keep moving with agents! The All Things Agentic Hackathon is officially live.

The next leap in AI won't build itself — it needs you. Step up to the challenge with Gemini 3.5 and Google Cloud and deploy autonomous agents that do the heavy lifting in the background. Build what’s next, show the world what you can do, and compete for $180,000 in prizes, cash, and credits

Submissions are open from August 3, 2026 to August 31, 2026. Register here.

Join GEAR today

Don't wait for the summer to pass you by. Get hands-on with the tools, earn real-world credentials, and build in-demand skills, with confidence.

Ready to level up your agentic skills? Check out our two newest learning paths: Build High-Performance Multi-Agent Systems and Govern and Secure Enterprise Agents.

Learn more → Join GEAR today and start building.

Digital sovereignty in the age of AI: You don’t have to choose between control and innovation

Thu, 06 Aug 2026 16:00:00 +0000

For enterprises and governments with strict compliance and sovereignty requirements, keeping sensitive data on-premises often means missing out on the latest AI. These organizations are managing three major risks:

Jurisdictional risk: Shifting local regulations, the need to protect intellectual property and the potential of foreign data access requests make local data handling essential.
Economic independence: Reliance on foreign infrastructure providers could leave critical services vulnerable.
Geopolitical risk: A need to safeguard critical local services against unpredictable global disruptions.

In a recent survey of over 1,400 senior IT leaders for our State of AI Infrastructure report, 48% of leaders stated they are prioritizing infrastructure with data residency, controls, supporting compliance, with local data security laws.

However, staying on-premises no longer means being cut off from the latest innovation. Organizations are increasingly deploying hybrid (on-premises and multicloud solutions) to bridge this gap. Our research shows that 52% of organizations now have a hybrid cloud approach to AI.

This approach allows enterprises to balance the massive raw power of the public cloud with the sovereignty and compliance benefits of local environments — allowing them to control where their data resides and who has access to it. In the past, organizations with such strict data rules couldn't easily access advanced AI. Building their own AI systems was also too slow and costly.

That is why we introduced Google Distributed Cloud (GDC). GDC brings Google Cloud to wherever you need it — in your own data center or at the edge. It is offered in two deployment models to meet your AI workload sovereignty requirements:

Air-gapped: A fully disconnected solution that does not require connectivity to Google Cloud or the public internet. It cannot be remotely shut down by Google.
Connected: An integrated, Google-managed software lifecycle that runs directly on your existing hardware.

GDC offers a complete, on-premises AI solution with infrastructure optimized for AI workloads, a choice of Gemini or open models, and cost-effective inference services. This foundation empowers you to build and run secure AI agents while maintaining total control over your data.

Meet your sovereign AI needs on-premises

You no longer have to choose between data control and AI innovation. With Google Distributed Cloud, we bring the world's leading AI directly into your environment — keeping your data entirely yours.

Explore the hybrid strategies of leading enterprises in the State of AI infrastructure report.

Advancing brain tumor research with privacy-first AI

Thu, 06 Aug 2026 16:00:00 +0000

The intersection of medicine and AI has led to remarkable innovations. However, developers now face the thorny challenge of building robust medical AI tools that have been tested and evaluated on diverse, real-world patient data while also protecting patient privacy. At Google Cloud, our approach combines strategic collaboration with Confidential Computing.

To help protect both patient privacy and AI models during validation, we’re collaborating with MLCommons through the MedPerf initiative. First announced at Google Cloud Next earlier this year, this partnership uses Confidential Computing to establish a secure clean room for benchmarking AI models in real-world settings.

The challenge: Evaluating AI without seeing the data

MLCommons, a global community with over 125 members across tech and academia, launched MedPerf in 2023 to standardize the evaluation of medical AI. MedPerf, an open-source platform for benchmarking AI models, has advanced clinical research using federated evaluation to test models.

By using Google Cloud Confidential Space, proprietary AI models can be evaluated inside hardware-isolated Trusted Execution Environments (TEEs). This special virtual machine encrypts memory in-use and hardens the operating system, so none of the parties — the hospital or research institution, other participants, or Google — can see model code or patient data while it's evaluated.

Medical AI benchmarking is compute-heavy, so the Confidential VM extends beyond the CPU to the GPU. To protect model weights and patient data even during GPU-accelerated inference, MedPerf runs on Google Cloud's A3 machine series with NVIDIA H100 GPUs, which pairs Intel TDX technology on the CPU with NVIDIA Confidential Computing on the GPU.

Before any patient data is released into the workload, the system provides cryptographic proof that only the approved code is running on genuine Confidential Computing hardware and that the environment has been properly hardened.

Learn how ML Commons MedPerf integrates with Google Cloud Confidential Compute to enable secure, real-world evaluation of medical AI models.

From theory to critical impact: Advancing brain tumor research

This technology is already driving critical research through the Federated Tumor Segmentation (FeTS) initiative. Brain tumors, such as glioblastomas, are rare, making it difficult for any single hospital to collect enough data for high-accuracy AI training.

Compounding the problem, a model that performs perfectly in one hospital can struggle in another due to differences in patient demographics, data acquisition techniques, and even in equipment.

Working with visionary researchers like Indiana University’s Dr. Spyridon Bakas, Northwestern University’s Dr. Yury Velichko, and the University of Alberta, Canada’s Dr. Amber Simpson, MedPerf on Google Cloud is validating AI models on private brain MRI data from around the world, and identifying potential performance gaps.

For example, a model might be 95% accurate at one site but only 63% accurate at another. Our collaborative approach demonstrates that when an AI tool reaches a clinician, it has been proven to work across a truly representative patient population.

Achieving clinical trust and validation

The impact of this collaboration is best summarized by those on the front lines of clinical research.

"My experience testing federated learning on Google Cloud has shown that the future of medical AI lies in secure, scalable, and collaborative cloud environments," said Dr. Yury Velichko, associate professor, Radiology, Northwestern University. "Moving beyond the controlled lab setting to test these workflows in a production-ready infrastructure provided a unique opportunity to evaluate the performance and security of federated learning in real-world clinical applications.”

"Medical AI holds enormous promise for patients around the world, but that promise can only be realized if clinicians, researchers, and regulators can trust the benchmarks we use to evaluate it,” said Alexandros Karargyris, MedPerf lead, MLCommons. By bringing MedPerf onto Google Cloud's Confidential Computing infrastructure, we have taken a major step toward a future where AI models can be rigorously tested on real patient data — without compromising privacy, intellectual property, or benchmark integrity.”

The future: Scaling secure medical breakthroughs

The collaboration between MLCommons and Google Cloud represents a fundamental shift toward privacy by design in healthcare AI. By making it easier to securely share and evaluate data and models, we are clearing the path for faster, safer, and more equitable medical breakthroughs.

Research institutions and healthcare model developers interested in using the MedPerf platform on Google Cloud should contact medical@mlcommons.org or your Google Cloud account team.

Agentic Future Ready With BigQuery: Continually Improving Price-Performance, Zero Effort

Thu, 06 Aug 2026 16:00:00 +0000

In the modern data landscape, query performance tuning and managing system price-performance is challenging, especially as the number of agentic workloads increase. Even for experienced developers and DBAs, constantly analyzing query execution plans, tweaking schemas, and adding query hints with ever exploding volume, variety, and velocity of data is a never-ending cycle that drains business velocity.

While performance tuning is a common practice, a modern data platform should do more. As data platforms evolve from systems of intelligence to systems of action, and analytics workloads shift from humans running a few queries per day to countless agents running many thousands of queries per minute, the old way of manual query tuning doesn’t work. When queries are generated by agents and applications automatically based on user actions, manual optimization becomes practically impossible.

BigQuery has evolved from a data warehouse to the primary engine for the Agentic AI era. Building on a unique, truly disaggregated storage and compute architecture, serverless processing, and fine grained compute management, BigQuery continues to push the boundaries of autonomous query processing. Our North Star is an autonomous query processor powering both humans and agents for hands-free optimum price-performance regardless of query, schema, data, or workloads. Just in 2025, we delivered up to 35% better query performance and as much as 40% reduction in query processing costs (slot usage).

Figure 1. Summary of BigQuery price-performance improvements throughout 2025 based on industry standard benchmarks.

The following are some of the major innovations contributing to these improvements in performance and total cost of ownership (TCO), including the built-in guardrails against regression.

BigQuery’s Self-Learning Engine: History-Based Optimizations (HBO)

One of the foundational capabilities of BigQuery’s autonomous query processor is history-based optimizations.

Traditional query optimizers rely on static statistics, metadata and cardinality estimates, which can be wildly inaccurate when faced with highly complex, multi-table joins and rapidly growing/changing data. Managing these is part of the critical path for administrators and automation has to be tailored to individual workloads to be effective and efficient. Even when everything is up-to-date and correct, queries can still have vastly different behavior due to natural data skew or changes in available compute resources. History-based optimizations change the paradigm: in addition to BigQuery’s already adaptive query execution that can change plans and resource allocations while a query is running, it learns from past executions and automatically applies additional optimizations for future executions.

It tracks runtime statistics of past queries to "remember" which optimizations were beneficial and continue to apply them, and learn from prior mistakes to ensure they are not repeated. When the same or similar query runs again, BigQuery automatically applies any additional optimization technique that is known to be beneficial and avoids those that can cause regressions.

No User Action Required & Built-in Safety Guardrails
History-based optimizations require no application rewrites, SQL modifications, or schema changes. Users literally do nothing, and their recurring dashboards, ELT pipelines, agentic workloads, or line of business modules run faster.

Crucially, this is a self-maintaining, self-improving closed-loop system with built-in safety guardrails. History-based optimizations only apply an optimization when there is high confidence it will improve performance. What if an optimization makes the wrong decision? This capability is inherently self-correcting. When an optimization is applied, the system measures the result. If the expected improvement is observed, the optimization is accepted. If it does not significantly improve performance—or worse, regresses or leads to failure—the optimization is immediately rejected, revoked, and never tried again for that query. This includes detecting data skew so queries that have parameter sensitive plans do not run into major performance issues when just a single parameter (aka WHERE clause) is changed.

The result? A decrease in execution times and a reduction of slots. One enterprise customer reported P90 execution times drop by up to 50%, with slot usage falling by up to 15% resulting in substantial price-performance improvements and no regressions.

Figure 2. One example of History Based Optimization performance improvement reported by an enterprise customer.

Teaching the BigQuery execution engine newer tricks: Advanced runtime

BigQuery’s autonomous capabilities extend deep into the execution layer with BigQuery advanced runtime. This engine upgrade automatically determines the best physical execution path for a query without any manual knob-turning.

1. Enhanced vectorization
While vectorized execution is not a new concept, BigQuery enhanced its implementation by taking advantage of the newer processor efficiencies in Single Instruction Multiple Data (SIMD) instructions. The engine autonomously identifies opportunities to avoid duplicate computations, processing data in dictionary and run-length encodings natively. It couples with state-of-the-art parallel algorithms and is applied at eligible query stages to increase the opportunities for acceleration. The Impact: Fully automated, safely accelerating qualifying queries by up to 10x, yielding up to a 40% overall slot time reduction.

Figure 3. Advanced runtime - Enhanced vectorization

2. Short query optimizations
For high-concurrency and low latency BI dashboards or agentic applications generating thousands of queries that require sub-second latency, distributed processing overhead can be a bottleneck. BigQuery now autonomously accelerates eligible "short" queries without impacting other queries running concurrently. By reducing the number of stages hence reducing data shuffling, BigQuery improves overall query latency and resource efficiency. BigQuery has effectively implemented an efficient symmetric multi-processing (SMP) query path transparently within a scalable massively parallel processing (MPP), distributed databases. The Impact: up to 10x lower slot usage for short queries, with P99 sub-second query latencies. Because each query uses slots for shorter periods, we observed some customer workloads having up to 3x higher throughput—all completely transparent to the end-user.

Figure 4. Advanced runtime - Short query optimizations

Same Benefits Regardless of Data Formats

We believe you shouldn't have to sacrifice autonomous performance when adopting open lakehouse architectures using open table formats like Apache Iceberg. BigQuery performance improvements work the same regardless of the underlying table or data format. That means you still get the same benefits whether you’re using BigQuery’s native capacitor storage format or Iceberg tables where the underlying data is in parquet format.

Whether it’s automatically pushing down filters, employing Column Metadata Index (CMETA) pruning, and optimizing the I/O layer with page skipping and asynchronous read or employing the same enhanced vectorization, open formats benefit from the same hands-free acceleration as native tables.

Figure 5. BigQuery on Lakehouse Iceberg tables performance and costs tested internally against a popular open source, distributed SQL query engine using a benchmark derived from TPC-DS (10TB)

Fluid Scaling: The True Only-Pay-For-What-You-Use Autoscaler

Because BigQuery’s compute models are tied directly to slot-seconds consumed rather than a slice of nodes or clusters, autonomous performance gains can translate directly to cost savings. BigQuery autoscaler enhanced with fluid scaling enables you to run any mix of highly variable workloads with a premier autoscaling model that does not require a cost-and-performance trade-off. Fluid scaling in BigQuery enables true per-second billing for compute resources (slots) consumed and lowers costs by up to 34% on average for autoscaling workloads.

Figure 6. Fluid scaling enhanced autoscaler

On the price-performance benefits of fluid scaling, Chen Shalit, the CEO and Co-Founder at RISE, a leading AdTech company that processes 1 PB+ data per day and manages 3 trillion+ monthly bids across publishers and advertisers, summed it best. “In the high-stakes world of advertising, every cent counts. BigQuery’s Fluid Scaling has reduced our infrastructure cost by 25% allowing us to scale our slot consumption and accelerate our entire workflow. By delivering faster model results and increasing our hourly data processing throughput, we’re providing our customers with the 'freshest' data possible.”

The foundation for the agentic future

These autonomous capabilities are not just about making today's business intelligence dashboards and analytics queries run faster; they are foundational to the future of modern data platforms. As organizations rapidly deploy AI and machine learning, they are shifting toward agentic workloads.

AI agents do not interact with data the way humans do. Their query latency and concurrency (QPS) requirements are orders of magnitude more demanding than what human users generate—which is the limit of what most traditional analytics platforms were designed for. When autonomous agents are firing off thousands of distinct queries per second to make real-time decisions, human-in-the-loop query tuning is simply impossible.

BigQuery's differentiated abilities in a self-tuning and self-learning system include built-in safety guardrails against regression. With this standard of autonomy, you can spend your time and effort where it truly matters: delivering the best experiences for your users with advanced agentic applications, rather than wasting critical engineering cycles on manual infrastructure management, reactive query optimization, or trying to rein in spiraling compute costs.

BigQuery’s aggregate TCO impact: Faster and more cost-effective price-performance

When you combine a self-learning history-based optimizer with an auto-scaling advanced runtime engine supported by a highly scalable metadata platform (CMETA), you can see real impact on performance and total cost of ownership (TCO).

Conclusion

Our goal is for BigQuery to automatically and safely optimize queries without user action so our users can “just come in to work and BigQuery is faster than it was the day before."

You no longer need to worry about data skew or stale statistics causing performance regressions. No more trying to figure out which plan guide works best for which queries at what time of the day or month. No more hoping you won’t run out of budget because there aren’t enough low priced spot instances. Just focus on your organization’s goals, and your BigQuery data platform can deliver optimized price-performance for both agent and human workloads autonomously; it just works.

Learn more about BigQuery’s data and AI capabilities and get started with a free trial.

UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

Thu, 06 Aug 2026 14:00:00 +0000

Written by: Tyler McLellan, Austin Larsen

Introduction

Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts including Redact, Pink, Helix, and Falcon.

UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT helpdesk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via their personal mobile devices. These calls lure victims to spoofed login portals where Adversary-in-the-Middle (AiTM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. Once session persistence is established, the actors deploy automated scripts for data exfiltration from enterprise cloud environments, including Microsoft 365 and Okta.

In this update to our May 2026 blog, we detail the infrastructure linkages connecting these extortion brands. We also examine the evolution of UNC6671's targeting including recent activity focused on financial services, private equity, and professional services, and provide hardening guidance to help organizations protect themselves from this threat.

UNC6671 Associated Extortion Brands

Across UNC6671 intrusions, the initial access and post-compromise tactics, techniques, and procedures (TTPs) have remained remarkably consistent. These operations uniformly leverage tailored IT helpdesk voice phishing (vishing), AiTM credential harvesting panels, and data theft from SaaS applications. Despite this unified technical baseline, extortion messages have used different branding and victim data stolen during these intrusions has been published across distinct data leak sites (DLS) (Figure 1). While public group communications cited an affiliate breakaway as the rationale for the initial rebranding to Redact, subsequent overlaps in phishing templates, victimology, and shared infrastructure conduits suggests that associated actors have subsequently leveraged the Pink, Helix, and Falcon extortion brands to monetize their operations.

Figure 1: UNC6671 Associated DLS Listings by Site

Figure 2: Helix and Pink DLS

Figure 3: Falcon DLS

Initial REDACT Rebranding

On June 27, 2026, the Redact operators published a blog post on their newly established Data Leak Site (DLS) addressing their alleged rebrand away from BlackFile. In the publication, the group claimed that the original BlackFile brand had been compromised and hijacked by an exiled affiliate. According to Redact, this former associate purportedly operated an unauthorized, lookalike DLS and conducted unsanctioned extortion campaigns under their name using unlinked Tox identities. The operators asserted that this rogue affiliate intentionally orchestrated the "shutdown" of the BlackFile brand in May 2026 to sow confusion among threat intelligence analysts and cyber insurance negotiators, thereby damaging the brand's reputation. To distance themselves from BlackFile, the operators stated that they rebranded as Redact, introducing a single verified Tox ID and PGP key to authenticate all future correspondence. Additionally, the post explicitly denied that pressure from the rival groups influenced their rebranding decision.

Figure 3: REDACT statement on alleged break from BlackFile

Shared Infrastructure: Connecting the Phishing Ecosystem

UNC6671 uses credential harvesting panels hosted on generic root domains masquerading as being related to passkeys, appending victim-specific subdomains to facilitate targeted voice phishing campaigns. Monitoring this consistent digital footprint revealed overlaps in specific victim targeting associated with multiple extortion brands. These overlaps support our assessment that a common group of threat actors are affiliated with the BlackFile, Redact, Pink, Helix, and Falcon extortion brands, although other scenarios such as splintered affiliates or shared Phishing-as-a-Service infrastructure may also be plausible.

Rather than maintaining isolated infrastructure for each target, UNC6671 reuses generic root domains across multiple target organizations, creating a traceable chain between extortion brands:

Falcon: The root domain passkeyhelpdesk[.]com was used to target at least one organization extorted using the Falcon brand. This same domain was simultaneously used to target an organization extorted using the Helix brand, as well as numerous other companies that we did not observe later posted on a DLS. Additionally, root domains such as portalpasskey[.]com and addssopasskey[.]com targeted organizations extorted by Falcon, while hosting intermediate targets that bridged directly into Helix infrastructure.
Pink: A subset of unlisted companies were concurrently targeted using additional root domains (such as passkeyms[.]com and mysecurepasskey[.]com), which acted as intermediate bridges to another infrastructure cluster focused on passkeydeploy[.]com. This final domain was simultaneously used to target at least one organization extorted by Pink.
Helix: The root domain passkeyhelpdesk[.]com directly overlapped targeting between Falcon and Helix. Furthermore, intermediate target organizations bridged additional infrastructure into clusters of subdomains on oskeysync[.]com and keysyncos[.]com. These clusters targeted multiple organizations later listed on the Helix DLS.
BlackFile: Root domains such as setupsso[.]com and idokta[.]com were used to target an organization extorted using the BlackFile brand. Intermediary target organizations on setupsso[.]com acted as bridges to passkeydeploy[.]com (Pink). Concurrently, passkeyuser[.]com was used to target another BlackFile victim, where intermediate target organizations bridged into passkeyportal[.]com (Helix) and mysecurepasskey[.]com.

Figure 4: Shared infrastructure across multiple brands

Phishing templates

Analysis shows that the same phishing templates were used across all these domains, with identical code and design hosted simultaneously on different websites, including addssopasskey[.]com, createssopasskey[.]com, and passkeyhelpdesk[.]com. For instance, while addssopasskey[.]com was strictly used to target organizations later extorted by Falcon, the identically configured passkeyhelpdesk[.]com domain was simultaneously used to target two entirely separate victims—one of which was claimed by Falcon, and the other by Helix. The widespread deployment of these matching templates to harvest credentials for multiple DLS brands suggests they rely on shared underlying infrastructure.

Evolution of Targeting

UNC6671’s domain registration patterns demonstrate a regular shift in target selection, seemingly towards those that are more likely to hold sensitive information. UNC6671 leverages subdomains that incorporate prospective victim names to host tailored credential harvesting panels. Their root domains mimic enterprise authentication enrollment portals pairing terms as "passkey," "mfa," or "sso" paired with verbs.

Between April and May 2026, we observed domains broadly designed to target mature, large-scale enterprises across multiple industries including the manufacturing, real estate, healthcare, and insurance sectors. During this wave of activity, the threat actors appeared to prioritize high-volume credential harvesting across these established enterprise verticals.

The observed subdomains in the following months appeared to represent a progression in UNC6671’s extortion model. In June 2026, targeting transitioned toward large technology, transportation, and hospitality organizations, seemingly focusing on entities holding valuable intellectual property, software source code, or sensitive VIP client data. By July 2026, the target profile narrowed to focus on the financial and legal sectors, with observed infrastructure directed at private equity firms, law firms, and financial rating agencies. Concentrating on organizations involved in mergers, acquisitions, capital deployment, and litigation may reflect a strategy to target high-value corporate and confidential data to maximize leverage extortion demands.

Comparing these two time periods also illustrates an increase in operational tempo. The volume of newly observed infrastructure was evenly distributed between June 1 and July 31, 2026, establishing an accelerated cadence of approximately one domain every 1.6 days, primarily across Cloudflare and DDOS-GUARD. A brief spike in provisioning also occurred between July 20 and July 22, during which seven domains were operationalized within a 72-hour window. This overall June and July tempo represents a measurable increase from earlier activity observed between April 1 and May 31, 2026, where a set of 28 root domains was provisioned at a less frequent rate of one every 2.2 days.

On the date of publication of this blog, 7 of 8 still resolving phishing domains did not use wildcard DNS indicating that targets discovered through passive DNS data were likely specifically targeted by UNC6671.

Figure 5: Root domain registrations

New Techniques

Since our last blog, the tactics across UNC6671 intrusions have been largely consistent; however, we have observed several new techniques.

IT Helpdesk and Passkey Pretexts

UNC6671 callers have continued to call targeted employees on their personal mobile numbers, circumventing corporate security controls. In at least some recent cases, the threat actor has spoofed the legitimate helpdesk phone number adding an air of legitimacy. During these phone calls, operating under the false pretext of an urgent helpdesk mandate to enable FIDO2 passkeys or update multi-factor authentication enrollment, the caller directs the employee to a lookalike credential-harvesting subdomain (e.g., [company].createssopasskey[.]com or [company].addssopasskey[.]com).

EvasionTechniques

UNC6671 increasingly relies on defense evasion to maintain account-level persistence and conceal its operations. In recent intrusions, the group used compromised email accounts to initiate unauthorized password resets for non-SSO enterprise applications. To prevent end-user detection or automated security alerts, operators systematically deleted password-reset confirmations, secondary security notifications, company-wide security alerts, and any alerts generated during modifications to account security or MFA configurations.

Ransom Negotiations and Blockchain Analysis

Between January 7, 2026, and May 12, 2026, GTIG reviewed 18 BlackFile Bitcoin wallet addresses receiving a total of 141.65 BTC, representing approximately $10.69 million USD at the time of the transactions. Notably, ransom payments to these wallets continued past the publicized Blackfile data leak site shutdown notice on May 11, 2026. Multiple significant cashout events observed in late April and early May confirm that financial operations proceeded without interruption during the rebranding phase.

Initial ransom demands typically range from $1 million to upwards of $3 million USD. However, the extortion operators shifted demands during negotiations, often agreeing to reductions between 50% and 75% of the initial ransom demand. In over 53% of tracked cases in this timeframe, final payments averaged $750,000 USD (~10.2 BTC).

Remediation and Hardening Guidance

GTIG recommends that corporate defenders implement the following controls to mitigate identity-centric vishing, AiTM phishing, and programmatic SaaS exfiltration:

Enforce Phishing-Resistant Multi-factor Authentication: Mandate phishing-resistant authenticators such as FIDO2-compliant roaming security keys, passkeys, and platform authenticators (e.g., Windows Hello for Business, Okta Fastpass) across all SSO environments and enterprise identity providers (IdPs). These authenticators implement WebAuthn standard to enforce cryptographic origin binding between the authenticator and the specific domains it can authenticate to, rendering lookalike domains and AiTM proxies ineffective.
Integrate SaaS Applications and Cloud Platforms with SSO: Maintaining authentication standards across multiple platforms increases the propensity for configuration drift. Different SaaS applications require or support different security features. Integrating business-critical applications with a standard SSO platform such as Entra ID or Okta allows consistent application of security controls across disparate platforms.
Enforce Session Controls: Reduce session lengths to enforce re-authentication at least once per work day. Enforce idle session timeouts, especially for privileged access. These timeouts can be reduced further during active phishing campaigns. Enforce step-up authentication when accessing critical or sensitive resources. Utilize token theft mitigations within authentication platforms such as IP session binding, Device-Bound Session Credentials, or Continuous Access Evaluation.
Restrict Authentication to Trusted Network Sources: Utilize defined network zones coming from known sources such as corporate networks, VPN ranges, and Secure Access Service Edge (SASE) platforms. Define and enforce these ranges within SaaS apps or cloud platforms as well as within authentication policies in Entra ID or Okta.
Require Corporate-Managed Devices for Access: Enforcing that authentication comes from a corporate-managed endpoint with MDM and EDR reduces the attack surface and likelihood that an attacker can utilize an arbitrary device for access. Device checks can be configured as part of authentication policies in Entra ID or Okta.
Deploy Endpoint and Browser Credential Guarding: Enable Google Workspace Password Alert to trigger automated administrative alerts or resets if corporate password hashes are entered into unauthorized domains. For Microsoft 365 environments, configure Microsoft Defender SmartScreen and Credential Protection to block credential submissions on unverified sites.
Monitor IdP Logs for Abandoned Challenge Patterns: Query Okta and Microsoft Entra ID audit logs for MFA registration events (system.multifactor.factor.setup) that are immediately preceded by authentication failures (user.authentication.auth_via_mfa) or abandoned push challenges.
Audit UAL Telemetry for Direct Stream Exfiltration: Configure Security Operations Center (SOC) detection pipelines to treat FileAccessed events with the same criticality as FileDownloaded when the UserAgent string identifies a scripting library (python-requests, WindowsPowerShell, Go-http-client) or when the access volume exceeds normal human browsing thresholds.
Restrict and Alert on Residential Proxy Authentication: Create conditional access policies and anomaly alerts for SSO authentication attempts originating from commercial VPN providers (Mullvad, Private Layer) or unassociated residential broadband proxy pools (AT&T, Comcast, Charter) that diverge from established employee geographic baselines.

Outlook and Implications

The activity associated with UNC6671 highlights the fluidity of threat actor brands relative to persistent tactics, techniques, and procedures. While the extortion brands associated with this activity continue to multiply, the tradecraft across these operations remains anchored in helpdesk vishing, AiTM session interception, and SaaS exfiltration.

We believe that this most likely reflects a coordinated group of threat actors operating multiple public extortion brands possibly in an effort to compartmentalize operations, hide overall breach volumes, and isolate any negotiation fallout. This assessment is supported by the tight infrastructure overlaps, shared vishing panel deployments, and overlaps in victim targeting observed across BlackFile, Redact, Pink, Helix, and Falcon. However, there are several other scenarios that could explain the broader dynamics across these brands:

Actor Splintering: Internal rifts, financial disputes, or operational security compromises routinely lead to group fragmentation. Former affiliates or splinter cells retaining access to shared initial access playbooks, panel code, and target lists can easily establish independent extortion fronts while continuing to execute identical TTPs.
Shared Ecosystem and Panel use: Separate threat groups may simply be leveraging the same commoditized phishing panels, voice-phishing callers, and shared infrastructure. As these AiTM panels and VaaS services become widely available, distinct threat actors can deploy matching infrastructure and pretexts without requiring direct organizational alignment.
Outsourced Extortion: The intrusion operators driving initial access and cloud data exfiltration could remain the same core group of actors, while the extortion and negotiation phases are outsourced to different actors.

Regardless of whether this activity reflects a fractured threat group, outsourced extortion negotiators, or a broader affiliate network, the initial infection vector leveraged and goals of these campaigns is consistent. Organizations should prioritize phishing-resistant authenticators and behavioral SaaS auditing to disrupt these identity-centric attacks.

Indicators of Compromise (IOCs)

To assist the wider community in hunting and identifying activity outlined in this blog post, we have provided indicators of compromise (IOCs) in a free GTI Collection for registered users. At the time of publication, identified phishing domains have been added to Google Safe Browsing.

While this collection provides a comprehensive list of IOCs, defenders should note that the majority of identified IP addresses are commercial VPN nodes, and actual source IPs tend to vary as the actor continuously cycles through new infrastructure. Furthermore, the domains are often stood up and used within minutes of registration; as such, they are provided primarily as examples of past naming conventions and usage patterns rather than as a primary mechanism for real-time blocking.

Domain	Creation Date	Registrar	Name Servers	Targeted Industry
`myoktasso[.]com`	2026-04-04	TUCOWS.COM, CO.	Njalla / Pipe.ma	Financial Services, Transportation
`mypasskeysso[.]com`	2026-04-04	TUCOWS.COM, CO.	Cloudflare	Healthcare
`setupssopasskey[.]com`	2026-04-07	TUCOWS.COM, CO.	Cloudflare	Financial Services, Healthcare, Media & Entertainment
`mspasskey[.]com`	2026-04-08	TUCOWS.COM, CO.	Cloudflare	Real Estate, Healthcare, Technology
`activatepasskey[.]com`	2026-04-10	TUCOWS.COM, CO.	Cloudflare	Financial Services, Hospitality, Healthcare
`enrollpasskey[.]com`	2026-04-10	TUCOWS.COM, CO.	Cloudflare	Financial Services, Energy, Healthcare
`keyokta[.]com`	2026-04-13	TUCOWS.COM, CO.	Cloudflare	Healthcare, Financial Services
`oktaenroll[.]com`	2026-04-13	TUCOWS.COM, CO.	Cloudflare	Healthcare, Construction & Engineering
`oktaportalsso[.]com`	2026-04-16	TUCOWS.COM, CO.	Cloudflare	Retail & Consumer Goods, Healthcare, Legal
`passkeyportal[.]com`	2026-04-16	TUCOWS.COM, CO.	Cloudflare	N/A
`portalpasskey[.]com`	2026-04-16	TUCOWS.COM, CO.	Cloudflare	Transportation
`passkeyportalsetup[.]com`	2026-04-20	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services, Technology
`addoktapasskey[.]com`	2026-04-21	NICENIC INTERNATIONAL GROUP CO., LIMITED	Private Layer (31.7.56.61)	Financial Services, Technology, Media & Entertainment
`deploypasskey[.]com`	2026-04-21	TUCOWS.COM, CO.	DDOS-GUARD	Retail & Consumer Goods
`passkeydeploy[.]com`	2026-04-23	Internet Domain Service BS Corp.	DDOS-GUARD	Healthcare, Technology
`activatemypasskey[.]com`	2026-04-24	TUCOWS.COM, CO.	Cloudflare	Financial Services
`registerpasskey[.]com`	2026-04-29	NICENIC INTERNATIONAL GROUP CO., LIMITED	MEVSPACE (193.34.212.132)	Manufacturing
`createpasskey[.]com`	2026-05-03	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	N/A
`passkeyadd[.]com`	2026-05-08	TUCOWS.COM, CO.	DDOS-GUARD	Business Services, Technology
`passkeyregister[.]com`	2026-05-08	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / MEVSPACE	Energy, Technology, Healthcare
`passkeycenter[.]com`	2026-05-11	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Legal, Financial Services, Healthcare
`secureauthpasskey[.]com`	2026-05-14	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Healthcare
`passkeyrollout[.]com`	2026-05-18	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / MEVSPACE	Non-Corporate, Insurance, Legal
`setpasskey[.]com`	2026-05-22	Internet Domain Service BS Corp.	DDOS-GUARD	Technology, Business Services, Construction & Engineering
`passkeyokta[.]com`	2026-05-26	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Media & Entertainment, Transportation
`passkeyset[.]com`	2026-05-27	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Transportation
`createmypasskey[.]com`	2026-05-27	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Construction & Engineering
`newpasskey[.]com`	2026-05-28	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Media & Entertainment
`passkeysupport[.]com`	2026-05-29	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Healthcare, Technology, Legal, Retail & Consumer Goods
`sqfepjvmrd[.]xyz`	2026-06-01	NICENIC INTERNATIONAL GROUP CO., LIMITED	MY-NDNS	N/A
`passkeyregistration[.]com`	2026-06-02	PDR Ltd. d/b/a PublicDomainRegistry.com	Suspended-Domain	N/A
`addmypasskey[.]com`	2026-06-03	TUCOWS.COM, CO.	Private Layer (31.7.56.52)	Financial Services, Healthcare, Transportation
`passkey-setup[.]com`	2026-06-03	Tucows Domains Inc.	Cloudflare	Legal, Financial Services
`passkey-portal[.]com`	2026-06-05	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Retail & Consumer Goods, Technology, Media & Entertainment
`startpasskeysetup[.]com`	2026-06-05	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Technology, Healthcare, Retail & Consumer Goods, Construction & Engineering, Media & Entertainment, Financial Services
`passkey-connect[.]com`	2026-06-05	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Technology
`portalsetuphub[.]com`	2026-06-10	PDR Ltd. d/b/a PublicDomainRegistry.com	Suspended-Domain	Financial Services, Healthcare, Energy, Real Estate, Technology, Construction & Engineering
`activatepasskeyportal[.]com`	2026-06-12	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Technology, Energy
`assignpasskey[.]com`	2026-06-13	Internet Domain Service BS Corp.	DDOS-GUARD	Construction & Engineering, Financial Services, Energy
`myconnectkey[.]com`	2026-06-13	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Transportation, Financial Services, Construction & Engineering, Real Estate, Business Services, Retail & Consumer Goods, Healthcare
`mynewpasskey[.]com`	2026-06-13	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Retail & Consumer Goods, Healthcare, Financial Services, Energy
`passkeycreate[.]com`	2026-06-16	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Construction & Engineering, Financial Services, Retail & Consumer Goods, Legal, Energy
`oskeyconnect[.]com`	2026-06-17	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services, Real Estate, Legal, Healthcare, Transportation, Utilities, Construction & Engineering, Retail & Consumer Goods, Hospitality
`passkeycreator[.]com`	2026-06-19	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Non-Corporate, Media & Entertainment, Legal, Healthcare, Energy, Technology
`oskeysync[.]com`	2026-06-20	NICENIC INTERNATIONAL GROUP CO., LIMITED	EZYDOMAIN	Healthcare, Financial Services, Transportation, Real Estate, Technology, Construction & Engineering, Retail & Consumer Goods, Legal, Energy, Utilities, Hospitality
`enablepasskey[.]com`	2026-06-22	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Legal
`enablepasskey2fa[.]com`	2026-06-22	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Healthcare, Media & Entertainment
`checkpasskey[.]com`	2026-06-22	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Legal, Construction & Engineering, Retail & Consumer Goods, Transportation
`passkeyuser[.]com`	2026-06-25	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Construction & Engineering, Legal, Aerospace & Defense, Financial Services, Technology
`keysyncos[.]com`	2026-06-30	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services, Real Estate, Healthcare, Technology, Construction & Engineering, Transportation, Legal, Retail & Consumer Goods, Energy, Utilities, Hospitality
`myaccountsecurity[.]com`	2026-06-30	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Construction & Engineering
`addpasskey2fa[.]com`	2026-07-01	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Financial Services, Legal
`passkeyenroll[.]com`	2026-07-07	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services
`startpasskey[.]com`	2026-07-07	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Construction & Engineering, Retail & Consumer Goods
`passkeyenable[.]com`	2026-07-08	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services, Legal
`passkeyactivation[.]com`	2026-07-09	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services
`createmfa[.]com`	2026-07-09	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Construction & Engineering, Energy, Financial Services, Healthcare, Transportation
`passkeyhelpdesk[.]com`	2026-07-10	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Financial Services, Energy, Healthcare
`makepasskey[.]com`	2026-07-13	Internet Domain Service BS Corp.	DDOS-GUARD	N/A
`add-passkey[.]com`	2026-07-13	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Healthcare, Energy
`passkey-check[.]com`	2026-07-13	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services, Media & Entertainment
`addyourpasskey[.]com`	2026-07-20	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services, Utilities
`passkey-enable[.]com`	2026-07-20	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Aerospace & Defense, Technology
`mypasskeyid[.]com`	2026-07-21	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Technology, Retail & Consumer Goods
`passkeystatus[.]com`	2026-07-21	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Energy, Technology
`secure-passkey[.]com`	2026-07-21	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Energy, Financial Services
`addssopasskey[.]com`	2026-07-22	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Financial Services
`ssopasskey[.]com`	2026-07-22	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	N/A
`createssopasskey[.]com`	2026-07-28	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare / Private Layer	Financial Services
`myssopasskey[.]com`	2026-07-31	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services
`hubpasskey[.]com`	2026-08-03	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services
`passkeymfa[.]com`	2026-08-03	NICENIC INTERNATIONAL GROUP CO., LIMITED	Cloudflare	Financial Services

Table 1: Indicators of compromise

Network Infrastructure and Exfiltration Observables

IP Address	Role	ASN
`31.7.56.61`	Panel AiTM Reverse Proxy	AS51852 Private Layer INC (Switzerland)
`31.7.56.52`	Panel AiTM Reverse Proxy	AS51852 Private Layer INC (Switzerland)
`193.34.212.132`	Phishing Kit Backend Proxy	AS201814 MEVSPACE (Poland)
`185.178.208.153`	Phishing Reverse Proxy	AS57724 DDOS-GUARD LTD (Russia)
`23.234.75.84`	Automated SaaS Data Exfiltration	AS11878 Tzulo, Inc. (United States)
`195.140.213.114`	Automated SaaS Data Exfiltration	AS25369 Hydra Communications Ltd (United Kingdom)
`195.140.213.115`	Automated SaaS Data Exfiltration	AS25369 Hydra Communications Ltd (United Kingdom)
`107.128.45.122`	M365 / Okta Residential Proxy	AS7018 AT&T Enterprises, LLC (United States)
`76.103.148.180`	M365 / Okta Residential Proxy	AS7922 Comcast Cable Communications (United States)
`38.42.59.171`	M365 / Okta Residential Proxy	AS395354 Starry, Inc. (United States)
`47.218.103.146`	M365 / Okta Residential Proxy	AS19108 Optimum / Suddenlink (United States)

Table 2: Network infrastructure and exfiltration observables

Scripting and SDK User-Agent Strings

python-requests/2.28.1
WindowsPowerShell/5.1
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.0
0811A9866E.com.okta.android.auth/8.18.0 DeviceSDK/1.0.94 Android/16
Google/Pixel_9_Pro_XL

Figure 6: Scripting and SDK user-agent strings

Google Security Operations (SecOps) Detections

Google SecOps customers have access to automated detection rules under the Okta and Microsoft 365 rule packs that identify the vishing, MFA modification, and programmatic streaming activity described in this report:

Okta Admin Console Access Failure
Okta Suspicious Actions from Anonymized IP
O365 SharePoint Bulk File Access or Download via PowerShell
O365 SharePoint High Volume File Access Events
O365 SharePoint Query for Proprietary or Privileged Information
Okta User Authentication with Suspicious Behavioral Flags

Acknowledgements

Special thanks to researcher ZachXBT for assisting with cryptocurrency analysis.

Mirendil taps AI Hypercomputer TPUs and GPUs for pre- and post-training applications

Thu, 06 Aug 2026 13:00:00 +0000

Nearly every major AI lab uses Google Cloud infrastructure, including for training of models, inference for agents, and new frontier research. Google Cloud also continues to be the platform of choice for new, high-growth AI startups who are driving much of the industry’s research and innovation.

Today, we’re announcing that Mirendil, an exciting frontier AI lab focused on accelerating AI development, will also utilize Google Cloud’s AI Hypercomputer. This includes using a mix of Google’s TPU AI accelerators and full-stack NVIDIA AI infrastructure running on Google Cloud; this purpose-built AI infrastructure will support model pre-training and post-training applications for Mirendil.

The Mirendil team is building new AI systems that can help accelerate and democratize AI research and development. This means managing complex, end-to-end training workflows from initial model pre-training through post-training, and powering reinforcement learning on a massive scale. The ability to choose a mix of both TPU and NVIDIA’s full-stack accelerated computing platform through Google Cloud meant that Mirendil could access critical compute very quickly, and continue to match its workloads to the architecture best-suited to it over time.

We closely partnered with Mirendil on end-to-end design and deployment of combined TPU and NVIDIA AI infrastructure across compute, storage, networking, and control planes. We also collaborated on a system that uses managed training clusters running in Gemini Enterprise Agent Platform, which effectively streamlines the provisioning and management of both TPU and GPU environments for Mirendil. Mirendil is already live with a cluster of TPU v5P chips, with NVIDIA AI accelerated computing systems coming online soon.

"Progress in AI has been bounded by how fast humans can run the research loop - designing experiments, evaluating results, and iterating," said Behnam Neyshabur, cofounder and CEO of Mirendil. "We're building AI systems that can accelerate and improve that loop itself. Expanding on Google Cloud gives us the scale and flexibility to push those systems further and put frontier AI research capabilities in the hands of many more scientists and engineers to run that loop faster and at a greater scale."

You can read more about our partnership on Mirendil’s blog.