Cloud Blog

Key findings from the 2026 Public Sector M-Trends report and beyond

Mon, 13 Jul 2026 16:00:00 +0000

In 2026, the public sector is no longer defending a traditional perimeter. Instead, they are defending a complex web of interconnected trust relationships against adversaries that now operate at machine speed. We recently published the 2026 Public Sector Threat Landscape: M-Trends and Beyond report, which distills more than 500,000 hours of frontline incident investigations conducted by Mandiant in 2025, specifically tailored to the mission-critical needs of public sector leaders.

Key findings from the report and what they mean for the public sector

The most alarming trend in this year’s M-Trends data is the 22-second hand-off: the median time between an initial access broker establishing a foothold and the hand-off to a ransomware operator. This extreme compression of the attack cycle renders traditional, human-speed triage obsolete. When an infection on a municipal workstation can move to an encrypted network before a human analyst can even open a ticket, the strategic mandate for resilience must pivot toward machine-speed defense.

Additionally, the report uncovered several emerging "boundaries of trust" that adversaries are systematically exploiting:

The persistence paradox: State-sponsored espionage actors are pursuing multi-year persistence, with some remaining undetected for over five years. This "persistence paradox" directly challenges standard 90-day telemetry retention policies, often leaving agencies unable to quantify the full impact of a breach.
The virtualization stack: Attackers are moving "down the stack" to target the virtualization management plane. Techniques like "snapshot mounting" allow attackers to bypass guest-level security tools, creating snapshots of domain controllers to steal databases offline.
The SaaS domino effect: At the state and local levels, the reliance on third-party cloud tools has turned integrations into threat vectors. Exploiting non-human identities (NHIs) like service accounts and OAuth tokens allows a single compromise to trigger a chain reaction across an entire agency network.
The vishing surge: Voice phishing (vishing) has surged to 11% of global infections. These highly effective social engineering attacks target government help desks to reset passwords or enroll unauthorized devices. This proves that the ‘human element’—the administrative trust placed in help desk staff and IT administrators—is now a primary vector for establishing initial access.

A mandate for continuous verification

Looking ahead, resilience in the public sector will require more than a compliance checklist; it demands a cultural pivot to continuous verification—a security doctrine where trust is never assumed and must be constantly re-validated. Success is no longer just defined by the absence of a breach, but also by an agency’s ability to remain operational while under active attack. At Google, we provide the technical architecture to make continuous verification a reality through three core capabilities.

Identity as the new perimeter: Through Chrome Enterprise Premium, we replace traditional VPNs with context-aware access. We verify the user’s identity and the security posture of their device for every single application request, ensuring that access is only granted under the right conditions.

Agentic defense: We enable agencies to ingest and analyze massive telemetry datasets in real-time using Google Security Operations, which includes threat-centric case management, interactive, context-rich alert graphing, and automatic stitching together of entities. This allows for the "Machine-Speed" detection required to spot an adversary within the 22-second hand-off window, turning manual triage into automated, continuous monitoring. To stay ahead of these rapid shifts, this operational stack is directly infused with Google Threat Intelligence, exposing global actor infrastructure and matching internal telemetry with Mandiant’s frontline incident insights in real time.

At Google Cloud Next ‘26, we announced three new AI-powered autonomous agents within Google Security Operations: a Threat Hunting agent to proactively unearth hidden attack patterns, a Detection Engineering agent to automatically close telemetry coverage gaps, and a Third-Party Context agent to seamlessly enrich analyst workflows.

Hardened infrastructure: By moving "down the stack" with Security Command Center and leveraging our strategic partnership with Wiz, we offer deep visibility into the virtualization and cloud layers. This allows agencies to continuously verify the integrity of their hypervisors and cloud configurations, automatically detecting unauthorized "Snapshot Mounting" or configuration drifts that adversaries exploit for persistence. By hardening the administrative fabric—including identity and virtualization—and modernizing log retention to close the visibility gap, government leaders can move from a state of reactive triage to a future of context-aware resilience.

Google security in action

Google’s security technology comes to life across the public sector, where agencies are successfully shifting from manual triage to agentic defense, and accelerating their security transformation. The Pasco Sheriff’s Office transformed its security and operations, unifying siloed tools with Google Security Operations to boost efficiency, improve community safety, and champion secure AI for law enforcement. Meanwhile, the State of Connecticut moved from a fragmented operating model to a unified, proactive security posture using Google Security Operations to reduce forensic investigation times from months to mere hours and create a secure-by-design digital infrastructure for the future of public service.

Secure your future

Download the 2026 Public Sector Threat Landscape: M-Trends and Beyond report to explore the data and strategic recommendations for the latest insights and trends and what they mean for the public sector. Catch the replay of our Gemini for Government webinar to dive deeper into securing and governing an agent.

Securing the AI supply chain on GKE: Introducing k8s-aibom for automated AI BOMs

Mon, 13 Jul 2026 16:00:00 +0000

How should your security team manage shadow AI? Workloads deployed by developers without formal registration can often evade traditional security scanners, because organizations are reluctant to slow down development and compromise stability by demanding privileged Daemonsets, kernel-level access, and manual pod-spec edits.

To break this deadlock, today we are open-sourcing k8s-aibom. This lightweight, unprivileged Kubernetes controller continuously monitors the cluster API and container environments to automatically detect running AI runtimes (like vLLM and Triton) and generate standard CycloneDX Machine Learning Bill of Materials (ML-BOMs).

By providing automated, audit-grade visibility directly from runtime execution — regardless of whether the workload was formally registered — k8s-aibom can help teams safely move AI projects from pilot to production without developer integration friction.

The architecture of zero friction

k8s-aibom is designed from the ground up to respect both the CISO mandate for total visibility and the SRE mandate for cluster stability. It deploys as a single, unprivileged Deployment in the k8s-aibom-system namespace. It involves zero developer friction — no sidecars, no eBPF kernel modules, no privileged DaemonSets, and no modifications to existing developer pod specifications.

k8s-aibom watches for AI workloads and produces BOMs.

The discovery pipeline executes through four clear stages:

Scrape cluster workloads: The controller continuously monitors KServe resources, Deployments, StatefulSets, DaemonSets, and Jobs across the cluster.
Identify AI stacks: Advanced pattern matching inspects container images, environment variables, and command-line arguments to detect serving runtimes (vLLM, Triton Inference Server, TGI, Ollama), autonomous agent frameworks (LangChain, AutoGen, CrewAI), vector databases and RAG stores (Milvus, Qdrant, pgvector), as well as distributed training jobs and evaluation harnesses.
Generate standard manifests: The controller compiles the discovered artifacts into formal OWASP CycloneDX 1.6 Machine Learning Bill of Materials (ML-BOM) documents.
Export to sinks: The controller attaches the resulting ML-BOM directly to the custom resource status (status.bomDocument) of an in-cluster AIBOM Custom Resource (CR) and routes it to optional external sinks, including Google Cloud Storage buckets and external webhook endpoints.

Application teams do not need to modify their pod specifications, inject sidecar containers, or alter their continuous integration and continuous delivery (CI/CD) pipelines. Furthermore, k8s-aibom treats the Kubernetes cluster state as a pure functional input: Identical cluster inputs produce byte-identical ML-BOM documents. This deterministic property makes k8s-aibom an ideal fit for GitOps workflows, enabling site-reliability engineers (SREs) to perform exact diffs and trigger precise change-detection alerts when AI dependencies drift.

Where existing AIBOM tooling falls short

Many AI BOM solutions offer build-time scanners producing BOMs from artifacts at rest. These tools help you track the code that was intended to be deployed.

Commercial AI security platforms extend the picture with cloud-native posture management, but typically through external scanning shaped around vendor-specific data models. Few, if any, of these tools help compliance reviewers, security operations (SecOps) teams, and platform engineers understand what is running right now, what is it connected to, and how can we verify those assertions.

We purpose-built k8s-aibom to bridge that gap. It produces BOMs from live cluster observation rather than artifact scanning, emits standards-conformant CycloneDX 1.6 ML-BOMs that integrate with the broader OWASP and Open Source Security Foundation (OpenSSF) supply-chain ecosystem rather than vendor-proprietary formats, and runs as an unprivileged controller on any conformant Kubernetes cluster — making it complementary to existing build-time and posture-management tooling rather than a replacement for either.

The Confidence Model: Separating intent from inference

For compliance auditors and SecOps engineers, raw telemetry is often noise. Standard monitoring tools indicate that a container is running, but can’t prove whether an AI model was explicitly configured by a platform engineer or dynamically pulled by an autonomous script at runtime. k8s-aibom solves this ambiguity through its deterministic Confidence Model, categorizing discovered assets into distinct tiers:

Declared: Explicitly defined by the customer or developer in the workload configuration (For example, explicitly passed container arguments such as --model meta-llama/Llama-2-7b.) A “declared” confidence detection represents clear human intent.
Inferred: Derived autonomously by the controller's pattern-matching engine through deep inspection of container images, environment variables, and execution profiles. (For example, identifying ^vllm/.* container signatures.)
Unresolved: Applied to workloads where an active AI presence is detected, but exact model parameters, weights, and versions can’t be deterministically established. An “unresolved” confidence detection immediately flags the workload for targeted security review.

This structured taxonomy allows compliance reviewers to instantly separate explicit engineering intent from machine inference, establishing an unassailable chain of trust during audits.

Immutability and least privilege: Building an audit-grade security model

Auditors remain deeply skeptical of standard observability telemetry because logs and metrics can be modified, dropped, and tampered with by compromised nodes or elevated administrators. k8s-aibom establishes an audit-grade evidence trail built on strict least-privilege isolation and data immutability.

The controller operates under a dedicated Kubernetes service account bound to a minimal Identity and Access Management (IAM) Workload Identity. It acts as the sole identity authorized to write BOM records to external storage sinks, requiring only roles/storage.objectCreator permissions.

To satisfy the most stringent audit and evidentiary standards, the Google Cloud Storage external sink implementation enforces DoesNotExist preconditions on object creation. Once an ML-BOM is written to the Cloud Storage bucket, the object becomes cryptographically immutable.

It can’t be silently overwritten, modified, or retroactively tampered with by compromised cluster actors or rogue workloads. SecOps teams gain absolute assurance that the historical audit log presented to regulators represents an unalterable record of cluster execution.

Accelerating governance readiness: Mapping to global regulatory frameworks

By automating the generation of standardized CycloneDX 1.6 ML-BOMs, k8s-aibom directly bridges the gap between low-level Kubernetes runtime state and high-level governance frameworks. It unblocks stalled GKE AI deployments by providing the foundational empirical data essential to major global standards:

EU AI Act: Designed to help organizations align with Article 12 (automated logging and record-keeping for continuous traceability) and Article 50 (transparency obligations for AI systems). By automatically cataloging serving runtimes and agent stacks, the tool helps simplify the gathering of technical evidence that may be needed during compliance audits.
NIST AI Risk Management Framework (AI RMF): Provides continuous, empirical asset visibility that can help support the Govern, Map, Measure, and Manage functions, helping shift compliance workflows from purely manual checks toward more automated asset inventory tracking.
ISO/IEC 42001:Supports compliance efforts for AI management system asset discovery and tracking, reducing the reliance on manual spreadsheets or periodic snapshot audits for inventory validation.

Getting started

It’s rare that a technical solution like k8s-aibom can help mitigate the multi-faceted problem of shadow AI, impacting CISOs, governance, risk, and compliance teams, SecOps teams, platform engineers, and developers.

To learn more by inspecting the controller, review the CRD definitions, and contribute to the open-source k8s-aibom project, please visit the k8s-aibom GitHub Repository.

Building the AI-defined vehicle with Android, Google Cloud, and Nexus SDV

Mon, 13 Jul 2026 16:00:00 +0000

The automotive industry is moving from building hardware-centric platforms toward building their own sophisticated Software-Defined Vehicle (SDV) architectures. For OEMs, a vehicle is no longer just a way to go from point A to point B, but an intelligent, connected node within an AI-native ecosystem!

With its partners, Google’s Android and Google Cloud are at the forefront of this transition. Android’s open source Automotive OS (AAOS) SDV implements the AI-defined vehicle while Google Cloud provides scalable infrastructure including a full suite of AI integration tools, leveraging services like Bigtable for automotive and manufacturing telematics at scale. Valtech, a Google Cloud partner, uses Google technologies as part of its Nexus SDV platform, establishing a full end-to-end connected vehicle system that enables truly agentic mobility, offering automotive OEMs a ready-to-use, end-to-end foundation for the next generation of connected vehicles. Let’s take a look at how this all comes together.

The vehicle side: AAOS SDV

As the foundational in-vehicle platform, Google’s open source AAOS SDV platform abstracts core functions into reusable services independent of physical hardware, establishing a modular Service-Oriented Architecture (SOA). By decoupling non-safety domains like climate control, lighting, and diagnostics from Electronic Control Units (ECUs), the AAOS SDV platform introduces dynamic runtime service discovery. With this, the SDV can easily discover what services are running (e.g., the odometer, HVAC, sunroof, motorized seats, electric windows, etc.) and their status.

To accelerate development, engineering teams leverage the Android Cuttlefish emulator to build digital twins in the cloud, simulating high-frequency sensor streams to validate these decoupled services bit-for-bit before physical silicon is ready. Valtech Nexus SDV utilizes this AAOS SDV middleware layer to discover, map, and manage vehicle resources, structuring and streaming high-frequency telemetry data straight into Bigtable. Compare this to the prior state of affairs, where OEMs outsourced system software to a variety of suppliers, each with their own pipelines, protocols, and data stored in separate silos.

Crucially, this model decouples services from the heavy main infotainment stack, so they can run independently, even when the vehicle is off and parked. This allows functions like remote vehicle monitoring to remain active even when the primary infotainment system is powered down, ensuring continuous telemetry access without draining the vehicle’s 12V battery or main EV battery pack.

This tight integration between the AAOS SDV platform and Nexus SDV enables a number of agentic AI and innovative first-party solutions. Unlike traditional sandboxed infotainment tools, multimodal AI agents can utilize the service discovery layer to safely interact with the physical car and process complex, intent-based requests. For example, an AI agent could automatically adjust climate zones, window actuators, or interior lighting based on a conversation with the driver, or in response to climate sensors, as in this clip:

By linking this on-vehicle service layer managed by Nexus SDV with historical fleet telemetry stored in Bigtable, you deliver deeply integrated experiences that unlock new mobility solutions. Now let’s take a quick look at the Cloud side.

The Google Cloud side: AI-native mobility

Beyond SDV, we are rapidly moving toward AI-defined vehicles, or AIDV, where AI is core to a vehicle's operational logic. To be AI-native means being autonomous by design, with AI embedded at every architectural level. With this level of AI, the system can perceive environments, reason through complex scenarios using engines like Google Gemini, and proactively execute actions. For example, a Gemini-powered vehicle doesn't just warn you that you’re low on power; it analyzes your schedule, traffic, and charger availability to suggest an optimized charging stop that pre-conditions the battery for maximum efficiency. This is the level of contextual understanding and proactive automation that characterizes AIDV.

Compare this to legacy architectures, which weren’t designed to capture the volume and variety of data coming from different systems across the vehicle. This can lead to data silos of isolated maintenance and safety information telematics. Moreover, because this data is fragmented, it can be very difficult to get cohesive value from the data across systems. An AI-native approach can help collapse these silos, providing a unified contextual understanding. This solves a primary OEM pain point: the massive complexity of managing high-bandwidth telemetry from multiple sources like SDV telematics.

Bigtable: The data backbone for Automotive Telemetry

Bigtable was purpose-built for the massive ingestion rates and sub-millisecond latency requirements, and serves as the data backbone for petabyte-scale automotive and manufacturing telemetry datasets. In fact, Bigtable is already being used to support business critical automotive telemetry solutions. Its flexible, sparse-row schema allows OEMs to evolve their data models without downtime, accommodating diverse sensor arrays — from high-frequency engine metrics to LiDAR point clouds — within a single, unified table structure. Then, by versioning time-series events in a way that is natively optimized for both massive writes and complex, multi-dimensional analytical lookups, Bigtable helps avoid the data overload typical of legacy systems.

Meanwhile, features like Continuous Materialized Views (CMV) allow for pre-calculating key metrics, such as average battery temperature or fleet-wide torque distributions, directly within the storage layer, minimizing computational overhead. Bigtable’s integration with Agent Development Kit (ADK) further bridges the gap between data and action by giving AI agents access to data. This kit combined with Bigtable’s integrations with frameworks like Apache Spark help monitor the "firehose" of live telemetry data and trigger automated workflows in real time, e.g., logging mission-critical alerts, initiating proactive over-the-air (OTA) software adjustments, or pre-ordering replacement parts, the moment specific degradation patterns are detected.

Bring it all together: Nexus-SDV platform

The Nexus SDV platform is built on Google Cloud and integrated with AAOS SDV, supporting the future of connected vehicles. By providing a standardized data foundation, Nexus empowers automotive OEMs to go beyond building infrastructure from scratch and start focusing on unique brand experiences.

Nexus SDV uses Google components like Gemini Enterprise Agent Platform, Bigtable, and BigQuery. Setting up Nexus SDV is quick, automated and transparent. OEMs can create brand-specific customer experiences in the vehicle, as well as in other customer touch points such as the UI screen, mobile app, or service centers. The connection to the vehicle is accomplished by leveraging the open source Synadia NATS interface. This integration with the vehicle is facilitated through simple Cloud and vehicle SDKs, for service discovery on both sides. Nexus SDV is optimized for AAOS SDV, but can integrate with any vehicle framework.

Security is woven into the Nexus architecture via a "Defense-in-Depth" model. Mutual TLS (mTLS) and Google Cloud Certificate Authority Service (CAS) provide vehicles with a cryptographically secure identity. Network isolation is maintained through Private GKE clusters, while the Secure AI Framework (SAIF) helps ensure data privacy throughout the machine learning lifecycle, protecting sensitive user data and OEM intellectual property.

Together, the quick setup and integration time coupled with a standardized data foundation and built-in state-of-the-art security leads to an immediate and measurable business impact for the car manufacturer.

Let’s put it all together and look at a use case in more detail…

Predictive maintenance

By moving from reactive to predictive maintenance, OEMs can reduce warranty costs, improve customer loyalty, and ensure higher vehicle uptime.

The challenge: Traditional scheduled maintenance is often inefficient, leading to unnecessary service visits or unexpected vehicle breakdowns that incur significant costs for both OEMs and owners. By moving to a proactive, AI-driven approach, Nexus SDV, Bigtable, and ADK transform this experience. The process begins by taking the firehose of vehicle telemetry data —monitoring engine RPM, vibration, fluid levels, brake pressure, and more — ingesting it and storing it directly into Bigtable.

To enable real-time anomaly detection, agentic AI can monitor telemetry streams as they arrive. Bigtable CMVs pre-calculate rolling aggregations such as average engine vibration or sudden fluctuations in battery temperature profiles. AI models consuming these live aggregates can then detect subtle deviations from normal parameters, identifying early signs of engine wear or accelerated battery degradation long before a warning light appears on the dashboard.

Once an anomaly is detected by specialized AI models, the system shifts into the agentic reasoning and action phase. A Gemini-powered engine assesses the severity and context of the data, considering factors like mileage, model, make, service history, and upcoming trips. Based on this intelligent assessment, the system can proactively notify the driver via the AAOS infotainment system, suggests an optimized service appointment at a nearby dealership, or can even trigger an automated parts order to ensure everything is ready upon arrival. The AI model works against false negatives to protect customer sentiment or erosion of confidence, while the solution as a whole ensures higher vehicle uptime, transforming maintenance from a reactive burden into a brand-defining service experience.

Get started

The AI-native Nexus SDV platform with AAOS SDV is available today, providing a sophisticated, end-to-end connected vehicle ecosystem designed to meet the extreme scale and analytical rigors of modern mobility. By adopting this unified, open-source architecture, OEMs can transcend the limitations of legacy infrastructure and redirect their resources toward the development of high-impact, brand-defining features.

Nexus SDV takes the connected vehicle service into the agentic era, where vehicles are no longer merely connected, but serve as intelligent, proactive partners in the driving experience. Give it a try today.

Learn more

If you’d like to learn more about Nexus SDV platform, AAOS SDV and Bigtable contact us today at nexus-sdv@google.com.

AAOS SDV is available in the Android Automotive 26Q2 release. Nexus SDV documentation can be found here.

Go here to learn more about Bigtable as the time-series database for automotive telemetry.

Thinking about your connected vehicle security, check this out, Shift into high gear with agents: Securing the software-defined vehicle.

Contributing to U.K. financial sector resilience as a critical third party

Fri, 10 Jul 2026 17:00:00 +0000

At Google Cloud, we take our role in the financial ecosystem very seriously. We firmly believe that operational resilience is essential to driving and sustaining responsible innovation.

Today, we mark a milestone in our ongoing commitment to the financial sector that’s directly relevant to our customers in the U.K. On July 10, the U.K. Treasury designated Google Cloud EMEA as a critical third party (CTP) to the U.K. financial sector under the CTP regime.

This designation takes account of the number and type of U.K. firms using our services and the materiality of their use cases. We acknowledge HMT’s decision on the systemic impact of our services and are committed to playing our part in safeguarding the stability of, and confidence in, the U.K. financial system.

Building sector-wide resilience

As a CTP, Google Cloud EMEA will be directly overseen by the Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA). These authorities are known collectively as the U.K. financial regulators.

In their oversight of CTPs, the U.K. financial regulators will aim to build sector-wide operational resilience. Google Cloud wholeheartedly supports this objective.

We will continue to engage constructively with the U.K. financial regulators as we enter this new phase of deeper collaboration. We are confident that this ongoing dialogue will deliver tangible benefits for the U.K. financial sector.

Enabling customer success

Alongside our commitment to effective oversight, Google Cloud remains dedicated to supporting our customers with the requirements for U.K. firms relating to operational resilience, outsourcing and third party risk management.

We provide insight into how Google Cloud can help customers meet their operational resilience obligations under PRA Supervisory Statement 1/21 in our SS1/21 whitepaper.
We explain how Google Cloud’s contracts for UK firms address the outsourcing and third party risk management requirements under PRA Supervisory Statement 2/21 our SS2/21 mapping.

While the CTP regime does not replace these requirements, it is designed to complement them. We are confident that it will.

Looking ahead

We look forward to collaborating with the U.K. financial regulators under the CTP regime. We will do so with the same commitment to ongoing transparency and assurance that we offer our customers and their regulators today.

As this new era begins, our core objective remains unchanged: to ensure Google Cloud is the most secure, scalable, and resilient platform for digital transformation.

What’s new with Google Cloud

Fri, 10 Jul 2026 16:00:00 +0000

Want to know the latest from Google Cloud? Find it here in one handy location. Check back regularly for our newest updates, announcements, resources, events, learning opportunities, and more.

Tip: Not sure where to find what you’re looking for on the Google Cloud blog? Start here: Google Cloud blog 101: Full list of topics, links, and resources.

aside_block: <ListValue: []>

Jul 6 - Jul 10

Webinar: Introducing Google Cloud NGFW Enterprise advanced malware protection - powered by Palo Alto Networks
Discover the new Cloud NGFW advanced malware sandbox, arriving in preview later this year. Powered by Palo Alto Networks Advanced Wildfire, it leverages data from 70,000+ customers to help defeat advanced malware. Join us on July 16 at 11 AM EDT to learn how to build a resilient, zero-trust cloud infrastructure that protects your apps and data, wherever they reside.

Register for the webinar now
Safely run AI-generated code in Cloud Run sandboxes
Cloud Run sandboxes, now in public preview, are lightweight, isolated execution boundaries that you can spawn near-instantly within your existing Cloud Run service instances.

Whether you need to let an LLM run a dynamically generated Python script to calculate business margins or spin up a headless browser to perform web research, Cloud Run sandboxes give you a secure, isolated sandbox to run these tasks without leaving your serverless environment.

Read the blog to learn more and get started today.
Australia API Horizon: Scaling Enterprise Governed AI Agents
The transition from AI chatbots to autonomous agents is the most critical integration point for your business. Join Google Cloud at our upcoming events to explore exclusive deep-dive sessions on architecting for the agentic era.

Discover how to use Apigee as an intelligent AI Gateway to govern, secure, and scale high-performance architectures. You will learn to seamlessly build AI tools from your existing APIs and maintain control over your entire ecosystem.

Join us in your preferred city:
Build highly available, multi-region services on Cloud Run
Maintaining uptime for business-critical applications just got a lot easier on Cloud Run. Service health, now Generally Available, automates cross-region failover by leveraging readiness probes for instance-level health checks with a simple, two-click setup. You can configure service health with global external Application Load Balancers for public-facing applications or cross-region internal Application Load Balancers for private networking traffic.

Learn how to configure service health for Cloud Run.
Report: 83% of organizations need infrastructure upgrades for agentic AI
The shift from conversational bots to autonomous agents is breaking legacy systems. Our new State of AI Infrastructure report details how engineering leaders are adapting to these massive new workloads. To eliminate inference bottlenecks, control hidden scaling costs, and manage agent sprawl, the industry is rapidly moving toward fluid compute, centralized governance, and unified, co-designed architectures.

Explore our key infrastructure insights
Stop tinkering, start scaling: the industrialized AI Playbook
Did you know that only 5% of custom AI investments actually return measurable business value? The problem isn’t the technology—it’s how organizations are wired to run it.

In this compelling read, Google Cloud Consulting breaks down the operational blueprint that bridges the stark gap between "cool tech experiments" and real, P&L-impacting enterprise ROI.

Read the full article on Medium
AI Agent Clinic: Slashing App Latency by 80%
Prototyping an AI agent is easy, but scaling for live traffic presents unique challenges. In the latest AI Agent Clinic, our technical experts partner with a developer to optimize PlaybackIQ, a live football analysis agent. This session demonstrates how to use OpenTelemetry to trace bottlenecks in the Gemini Enterprise Agent Platform and deploy to Cloud Run for high-concurrency scaling, achieving an 80% reduction in response time. Learn production-grade debugging strategies to optimize your own LLM applications.

Watch the 60-minute teardown

Jun 29 - Jul 3

Claude Sonnet 5, Anthropic’s latest model, is now available on Agent Platform.
This addition serves as a drop-in replacement for Sonnet 4.6, giving organizations expanded choice for task completion across enterprise workflows. It features enhanced reasoning, cleaner code generation, and computer use capabilities for desktop and browser workflows.

By continuing to rapidly bring frontier models to our platform, Google Cloud offers an uncompromised choice of the industry's best technology to build, test, and scale enterprise-grade AI.

Get started today.
Automate your AI governance with Apigee and YAML
Manual API gateway configurations can quickly slow down your AI engineering velocity. Join the Apigee community on Thursday, July 16, to discover an automated, declarative blueprint for model garden management. Learn how a simple, repeatable YAML pattern lets your AI practitioners instantly spin up secure, policy-backed enterprise configurations without friction. Bring your questions and connect during our live Q&A session.

Register for the July 16 Community TechTalk
Build next-generation AI portals for autonomous agents
Standard developer portals were designed for human developers to subscribe to static APIs. Today, autonomous agents, LLM toolkits, and dynamic runtimes demand a central nervous system for governance. Join our technical deep dive on Thursday, July 23, to explore Apigee's new AI Portals solution. You will see exactly how to deploy full-service, MCP powered hubs to safely manage enterprise self-service for models, tools, and agents.

Register for the July 23 Community TechTalk
Protect your infrastructure from advanced cyberattacks at the API layer (Presented in Portuguese)
In an era of increasingly sophisticated threats, relying solely on traditional firewalls leaves critical data gaps. Join our technical community TechTalk on Thursday, July 30—conducted in Portuguese—to learn how to proactively mitigate risks directly at the gateway layer. This session demonstrates how to configure and govern essential Apigee security policies to build a robust line of defense, ensuring maximum availability and complete integrity for your enterprise microservices.

Register for the July 30 Portuguese Community TechTalk

Jun 22 - Jun 26

Accelerate TPU model loading while saving RAM on GKE.
Large model cold starts often stall scaling and leave high-value TPUs idle. The open-source Run:ai Model Streamer now natively supports TPUs with Google Cloud Storage in TPU vLLM 0.18.0. This integration accelerates inference pipelines on GKE by streaming tensors directly into CPU memory, bypassing local disk bottlenecks and the "double-buffering" trap. In benchmarks, loading a 480B parameter model was over 2x faster while cutting peak host memory usage by half. Read the full guide and get started today.
Stop Training Blind: Scaling AI with the New OpenTelemetry-Based TPU AI Telemetry Collector Agent
Google Cloud’s new AI Telemetry Collector agent standardizes TPU monitoring using OpenTelemetry. It optimizes enterprise ML workloads by identifying silent failures and providing zero-cost operational metrics without draining host CPU cycles. The agent seamlessly routes telemetry to Google Cloud Monitoring or Prometheus and custom Grafana setups. Pre-installed on Google-optimized Ubuntu images or available via Docker, it tracks memory, network latency, and core utilization to maximize multi-node training efficiency.

You can read more of this capability by clicking this link.

Jun 15 - Jun 19

Join us for a deep dive into agentic AI control with AppyThings
Your integrations aren’t failing—they are evolving. When users interact with AI agents, they no longer arrive directly at your site, resulting in experiences stripped of your context, expertise, and intended experience. Join us on Thursday, June 25, for a community tech talk in partnership with AppyThings to learn how to solve this new gateway challenge. We will explore how MTN laid an integration foundation with the Model Context Protocol (MCP) to deliver accurate, consistent experiences. Our technical experts will demonstrate how to leverage Apigee as a centralized tools management solution to govern agent access.

Register for the session
Optimize Spot VM Deployments with Capacity Advisor for Spot, Now in Public Preview
Google Compute Engine has launched Capacity Advisor for Spot to Public Preview, now open to all customers. This tool turns Spot capacity discovery into a data-driven process by providing real-time deployment recommendations to maximize obtainability and minimize preemption risks. Query the Capacity Advisor API for obtainability and minimum estimated uptimes, or use the new Console UI featuring a global availability map, spot price lookups, and historical preemption rate trends to visually find the most cost-efficient compute capacity.

Get started today to start optimizing your Spot VM deployments!
Build a multi-tenant agentic AI system
When scaling generative AI across different business units, your teams need specialized AI agents with unique operational rules and tools. Our new reference architecture helps you build a centralized multi-tenant platform to prevent fragmented silos, eliminate data exposure risks, and maintain unified compliance. Read the guide to design and deploy a multi-tenant agentic AI system in Google Cloud.
How to Configure Gemini Enterprise to Connect to a Custom MCP Server
The Gemini Enterprise MCP Connector was a big announcement at Google Cloud Next because it introduces the ability to connect Gemini Enterprise to MCP servers. This blog post provides a step-by-step guide on how to configure your first Custom MCP Server connector using the Google Maps Ground Lite MCP server as an example. Once you understand this flow, you can configure multiple MCP servers with Gemini Enterprise to bring all the context you need.

Jun 8 - Jun 12

Simplify Multi-Cloud Planning with Cloud Location Finder, now Generally Available
Cloud Location Finder provides up-to-date data on public regions, zones, and Google Distributed Cloud Connected locations across Google Cloud, AWS, Azure, and OCI. You can now programmatically discover locations based on provider, proximity, territory, and carbon footprint to optimize your global infrastructure strategy for performance, compliance, and sustainability.

Get started for free today

Jun 1 - Jun 5

Modeling the physical world with BigQuery Graph
Managing complex supply chains requires more than just spreadsheets; it requires a digital replica of the physical world. In this post, Guru Rangavittal and Candice Chen explore how BigQuery Graph enables organizations to build a digital twin by turning physical assets into an interconnected map of nodes and edges. By moving beyond traditional relational databases, businesses gain real-time clarity into operations—from executing surgical ingredient recalls to analyzing weather-driven logistics risks. Discover how BigQuery Graph transforms reactive firefighting into proactive, precision modeling, allowing you to see critical connections in seconds and future-proof your supply chain.
Apigee for AI: Govern LLMs and MCP Servers (Presented in Spanish)
Learn how to securely transition your AI initiatives from experimental prototypes to enterprise-ready deployments. Join Luis Cuellar on June 18 for a technical deep dive (presented in Spanish) exploring Apigee’s latest AI gateway capabilities. Discover how to centralize governance over Model Context Protocol (MCP) servers, protect Large Language Models (LLMs) with robust API gateway security policies, and manage token-based quotas.

Register for the June 18 Spanish Community TechTalk

May 25 - May 29

Anthropic’s Claude Opus 4.8 is now available on Gemini Enterprise Agent Platform. As we continue to expand our platform's model offerings, this addition gives organizations more options for handling complex, multi-stage enterprise workflows. Claude Opus 4.8 brings strong capabilities in agentic coding, allowing developers to manage extensive refactors and tracking dependencies over extended sessions.
API Horizon Munich July 6, 2026: Orchestrating the Next Era of AI and APIs
Master the orchestration of next-gen AI and digital ecosystems. Join Google Cloud experts and DACH tech leaders on July 6 for an exclusive look at the Apigee roadmap, Agent Management, and Model Context Protocol (MCP). Gain real-world insights and connect with the regional integration community.

Register now
Securing AI Agents: The Extended Agent Gateway Pattern
Learn how to prevent autonomous AI agents from invoking unauthorized APIs. Join Apigee Specialist Joel Gauci on June 4 for a technical deep dive into the Extended Agent Gateway pattern. This session covers enforcing Fine-Grained Authorization (FGA), implementing secure token exchange, and establishing Model Context Protocol (MCP) governance at the API gateway layer to protect enterprise backend services.

Register for the June 4 Community TechTalk
API-to-Agent Security: Exposing REST APIs to Gemini Enterprise via MCP
Connect Gemini Enterprise agents to core data without creating security hazards. Join Google Cloud Specialist Nigel Walters on June 11 to learn how to instantly transform legacy REST APIs into secure Model Context Protocol (MCP) servers. We’ll cover how to safely register tools with Gemini while enforcing gateway-level guardrails like rate limiting and access control policies.

Register for the June 11 Community TechTalk

May 18 - May 22

Chinese Webinar | June 4: AI Command and Control
As AI agents move from experimental pilots to core enterprise functions, governance has become a critical next step. Join Google Cloud on June 4th at 10:00 AM (Beijing Time) to learn how to build a secure AI management layer architecture. We'll explore how to develop governed MCP (Model Context Protocol) endpoints, manage tool access to enterprise data, and leverage robust audit logs to operationalize AI. This session also includes a practical demonstration of these governance frameworks on Google Cloud.

Register here
GCP Announces New Features to Benchmark and Optimize LLMs for On-Device Use Cases
Deploying fine-tuned LLMs from GCP to edge devices like smartphones is complex due to fragmented hardware. Google AI Edge Portal bridges this gap, giving GCP developers the ability to test AI performance on 120+ Android devices, representing the full diversity of high, medium, and low tier smartphones on the market today. This week at I/O, we announced brand new capabilities to benchmark and debug LLM performance across these devices. Sign-up to utilize these new features in private preview today.

May 11 - May 15

Build Your AI & MCP Control Tower for Universal Governance
Master the future of agentic security with Apigee. Join our Community TechTalk on May 21 to discover how Apigee serves as a central "Control Tower" for the Model Context Protocol (MCP). We will explore how new JSON-RPC tool authorization enables fine-grained access policies across your organization, ensuring secure and scalable AI deployments. Whether managing internal tools or external users, learn to govern your agentic ecosystem with absolute precision. This session is designed for global coverage across EMEA and AMER regions.

Register for the May 21 Community TechTalk

Apr 27 - May 1

Master Your Launch: The Apigee Production Go-Live Checklist
Ensure a secure launch with the Apigee production guide. Join Nicola Cardace on May 28 to explore security guardrails, including IAM roles, mTLS configurations, and encrypted KVM migrations. Scheduled at 11 AM EDT / 5 PM CEST to support EMEA and AMER teams, this TechTalk provides the technical roadmap you need to flip the switch with absolute confidence.

Register for the May 28 Community TechTalk
Transforming APIs into Governed Agentic Tools on the Google Cloud Agentic Platform
Turn your APIs into secure, governed agentic tools on the Google Cloud Agentic Platform. Join Specialist Christophe Lalevée on May 7 for a technical deep dive into AI productization. Scheduled at 5 PM CEST / 11 AM EDT to maximize coverage for developers across EMEA and AMER, this session explores the integration and governance frameworks required to scale enterprise-ready AI with confidence.

Register for the May 7 Community TechTalk
Fractional G4 VMs are Generaly Available, providing a highly efficient and cost-effective entry point for AI and graphics workloads. These new configurations, using NVIDIA virtual GPU (vGPU) technology, allow you to leverage the power of the NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs in flexible, smaller increments, so you can right-size your infrastructure to match the specific demands of your applications. By providing more granular access to advanced hardware, fractional G4 VMs let you optimize resource allocation and reduce overhead without sacrificing performance. You can now select from additional GPU slice sizes for your specific needs:
- 1/2 GPU: Ideal for more intensive tasks such as LLM inference, robotics sensor simulation, and high-fidelity 3D rendering.
- 1/4 GPU: Optimized for mainstream workloads, including mid-range creative design, video transcoding, and real-time data visualization.
- 1/8 GPU: Great for lightweight applications such as remote desktops, productivity tools, and entry-level streaming services.
Transitioning AI from a sandbox prototype to an enterprise-grade system is a major hurdle. A monolithic script won't suffice for widespread deployment. To achieve true scale and reliability with Gemini, organizations must adopt service-oriented micro-agent architectures, establish Zero-Trust security, and implement rigorous EvalOps. Master the "Agentic Maturity Ladder" to ensure your AI & Agentic solutions are robust, secure, and ready for the real world.

Watch the deep dive and read the developer blog to learn more.
ML Development in VS Code with Google Cloud Power: Workbench Extension Now Available
Data scientists and developers can now combine the local productivity of VS Code with the scalable infrastructure of Google Cloud. The new Google Cloud Workbench Notebooks extension allows you to connect to and run notebooks on managed cloud environments directly within your local IDE. This integration streamlines the ML lifecycle by eliminating context switching and providing high-performance compute for complex workloads in a familiar interface. As part of our commitment to the developer ecosystem, the extension is fully open-sourced to support community-driven innovation.
- Install from Marketplace: GoogleCloudTools.workbench-notebooks
- Contribute on GitHub: colab-enterprise-vscode

Apr 20 - Apr 24

Announcing the 2026 Google Cloud Partners of the Year
Google Cloud is honored to celebrate the winners of the 2026 Partner of the Year awards! These awards recognize an exceptional group of partners across AI, Security, Infrastructure, and more, who have demonstrated a commitment to customer success. From global system integrators to specialized startups, these winners are leveraging the power of Google Cloud to solve complex challenges and drive digital transformation worldwide. Join us in congratulating these organizations for their innovation, collaboration, and impactful results over the past year.

See the 2026 Partner Award winners

Apr 13 - Apr 17

We're excited to announce the Public Preview of Datastream’s metadata integration with Knowledge Catalog. This is the first step in our vision to provide a centralized, "single pane of glass" for all Datastream assets. The enhancement automatically synchronizes Streams, Connection Profiles, and Private Connections, eliminating data silos. It enhances discoverability, allowing you to search for Datastream assets using the same interface as BigQuery tables. Centralized governance is also provided, making your real-time data estate more transparent and easier to manage.
Upgrading Apigee OPDK to 4.53 with OS Modernization
Modernize your infrastructure using Google’s official, sequential upgrade path. Our Technical expert, Rakesh Talanki outlines how to upgrade Apigee OPDK to v4.53 while migrating to a supported OS (RHEL 8.x/9.x). This guide covers the "build-out" methodology, including multi-data center syncing, to ensure a stable, zero-downtime transition

Read the guide
Cloud Run Worker Pools and CREMA: Powering Serverless AI at Scale
Google Cloud has announced the General Availability of Cloud Run worker pools, a new resource type designed specifically for pull-based, non-HTTP workloads. Unlike traditional Cloud Run services that scale based on request traffic, worker pools provide an "always-on" environment for background tasks like processing message queues or running large-scale AI inference. To support this, Google Cloud also open-sourced the Cloud Run External Metrics Autoscaler (CREMA). Built on KEDA, CREMA enables queue-aware autoscaling for worker pools, allowing them to dynamically scale based on external signals like Pub/Sub backlog or Kafka lag.
Apigee Model Context Protocol (MCP) now Generally Available
Expose enterprise APIs as MCP tools for agentic AI applications with the General Availability of MCP in Apigee. This update allows developers to transform APIs into AI-ready tools using OpenAPI Specifications, removing the need for local MCP servers or additional infrastructure. With managed endpoints and semantic search in API hub, you can now provide AI agents with secure, governed access to enterprise data at scale.

Explore the MCP overview

Apr 6 - Apr 10

Community TechTalk: Powering Retail Agents with ADK, UCP & Apigee X
Move beyond basic chatbots to secure, transactional AI experiences. Join our Community TechTalk on April 16 to learn how Apigee X and Gemini build a "Trust Layer" for AI shopping assistants using UCP standards. We’ll demonstrate how to block prompt injections with Model Armor and implement cost governance via token limits to secure the path from discovery to purchase.

Register for the TechTalk
Implement multimodal capabilities in your AI agents
Explore three new reference architectures for building sophisticated multi-agent AI systems that can process and analyze multimodal data. To analyze disparate multimodal data and produce a high-confidence classification, see Classify multimodal data. To create a fluid conversational AI that processes audio and video streams in real time, see Enable live bidirectional multimodal streaming. To consolidate fragmented multimodal data into a searchable knowledge graph, see Multimodal GraphRAG resource orchestration.
Automate SecOps workflows with an agentic AI system
To accelerate incident response and reduce manual toil for your security team, you need a system that can automate remediation playbooks. Our new reference architecture helps you build an AI agent that orchestrates complex triage and investigation workflows across disparate security tools, such as SIEM, CSPM, and EDR, from a single interface. See the full guide to orchestrate security operations workflows.

Mar 30 - Apr 3

ASEAN Webinar | April 30: Mastering Agentic Governance at Scale with GCP
As AI agents move from experimental pilots to core enterprise functions, governance is the critical next step. Join Google Cloud experts Shilpi Puri & Wely Lau for a webinar on April 30th at 11:00 AM SGT to learn how to architect a secure AI Management layer. We’ll explore developing governed MCP endpoints, managing tool access to enterprise data, and operationalizing AI with robust audit logs. The session includes a live demo of these frameworks in action on Google Cloud.

RSVP here.

Mar 23 - Mar 27

Turn your API sprawl into an agent-ready catalog
As organizations scale, APIs often become scattered across multiple gateways, creating "blind spots" that hinder AI adoption. To solve this, we’ve introduced two new capabilities for Apigee API hub: a new integration with API Gateway to automatically centralize API metadata into a single control plane, and a specification boost add-on (now in public preview). This add-on uses AI to enhance your API documentation with the precise examples and error codes that AI agents need to function reliably.

Read the full blog post to get started.
Webinar | April 16: AI Command & Control
As AI agents move from experimental pilots to core enterprise functions, governance is the critical next step. Join Google Cloud expert Satyam Maloo for a webinar on April 16th at 11:00 AM IST to learn how to architect a secure AI Management layer. We’ll explore developing governed MCP endpoints, managing tool access to enterprise data, and operationalizing AI with robust audit logs. The session includes a live demo of these frameworks in action on Google Cloud.

RSVP here.
Modernizing and Decoupling Event Ingestion with Apigee
In modern cloud-native architectures, decoupling producers from consumers is critical for building resilient systems. While Google Cloud Pub/Sub provides a scalable backbone, exposing it directly to external clients can introduce security and management overhead. This new guide explores how to leverage Apigee as an intelligent HTTP ingestion point. Learn how to handle security, mediation, and traffic control before messages reach your internal bus using the PublishMessage policy or Pub/Sub API.

Read the full guide.

Mar 16 - Mar 20

Gemini-powered Assistant in BigQuery Studio Gets Context-Aware Upgrades
The Gemini-powered assistant in BigQuery Studio has been transformed into a fully context-aware analytics partner, supporting your entire data lifecycle. The new capabilities include intelligent resource discovery, which uses Dataplex Universal Catalog search to find resources across projects and deep dive into metadata using natural language. You can now automate tasks, such as scheduling production-grade queries directly through the chat interface, and instantly troubleshoot long-running or failed jobs with root cause analysis and cost control auditing.

Explore the full range of what the assistant can do.

Mar 9 - Mar 13

Want to use Gemini to develop code and don't know where to start?
This article includes a couple of examples of developing code with Gemini prompts; it identified changes that were needed to be made to get the code working. The article also refers to other examples that are available on github.

Mar 2 - Mar 6

Introducing Gemini 3.1 Flash-Lite, our fastest and most cost-efficient Gemini 3 series model. Built for high-volume developer workloads at scale, 3.1 Flash-Lite delivers high quality for its price and model tier. Gemini 3.1 Flash-Lite can tackle tasks at scale, like high-volume translation and content moderation, where cost is a priority. And it can also handle more complex workloads where more in-depth reasoning is needed, like generating user interfaces and dashboards, creating simulations or following instructions.

Starting today, 3.1 Flash-Lite is rolling out in preview to enterprises via Vertex AI and developers via the Gemini API in Google AI Studio.
TechTalk: Implementing Device Authorization Grant (RFC 8628) for Apigee
Learn how to authorize "headless" devices like Smart TVs or AI agents that lack keyboards and browsers. Join our Community TechTalk on March 19 (5PM CET / 12PM EDT) to go under the hood of Apigee X/Hybrid. We’ll cover the real-world mechanics of state management, polling, and human-in-the-loop security patterns for devices and autonomous agents.

Register for the TechTalk

Feb 23 - Feb 27

Pro-level image generation gets faster and more accessible with Nano Banana 2
Nano Banana 2 is our state-of-the-art image generation and editing model. It delivers Pro-level image generation and editing at the speed you expect from Flash — making the quality, reasoning, and world knowledge you loved about Nano Banana Pro more accessible. Learn more about the model here.

The Intelligent Path to Compliance: Transforming Regulatory QC with Google Cloud
Reducing "Refuse to File" (RTF) risks and submission cycle times is critical for life sciences leaders. Google Cloud’s Regulatory Submission Semantic QC Auditor leverages Gemini and RAG architecture to transform Quality Control from a manual burden into an active, intelligent workflow.

By automating semantic cross-referencing, narrative coherence checks, and dynamic guidance-based auditing, this solution ensures rigorous accuracy and auditability. Operating within a secure GxP-ready environment, it empowers teams to detect subtle inconsistencies and generate remediation plans without sacrificing data privacy.

Learn more.
Stop typing, start interacting! The Gemini Live Agent Challenge is here. Build immersive agents that can help you see, hear, and speak using Gemini and Google Cloud. Compete for your share of $80,000+ in prizes and a trip to Google Cloud Next '26!

Submissions are open from February 16, 2026 to March 16, 2026. Learn more and register at geminiliveagentchallenge.devpost.com

Feb 9 - Feb 13

Introducing Gemini 3.1 Pro on Google Cloud.
3.1 Pro is a noticeably smarter, more capable baseline for complex problem-solving. We’re shipping 3.1 Pro at scale, building upon our goal to help you transform your business for the agentic future. Learn more about the model’s capabilities here. Gemini 3.1 Pro is available starting today in preview in Vertex AI and Gemini Enterprise. Developers can access the model in preview via the Gemini API in Google AI Studio, Android Studio, Google Antigravity, and Gemini CLI.
Automate Storage Compatibility with GKE Dynamic Default Storage Classes
Managing storage across mixed-generation VM clusters in GKE just got easier. With the new Dynamic Default Storage Class, Google Kubernetes Engine automatically selects between Persistent Disk (PD) and Hyperdisk based on a node's specific hardware compatibility. This abstraction eliminates the need for complex scheduling rules and manual pairing, ensuring your volumes "just work" regardless of the underlying infrastructure. By defining both variants in a single class, you reduce operational overhead while maintaining peak performance and cost-efficiency across your entire cluster.

Explore automated disk type selection
Community TechTalk: AI-Powered Apigee Development with strofa.io
Join the Apigee community on February 26 for a deep dive into strofa.io. Guest speaker Denis Kalitviansky will demonstrate how this new AI-powered tool automates and orchestrates Apigee development, from local emulators to large-scale hybrid environments. Discover how to scale your API management and streamline team collaboration using the latest in AI-driven automation.

Register now to reserve your spot.

Jan 26 - Jan 30

Simplify API Governance with Native OpenAPI v3 Support
Eliminate integration debt and accelerate deployment velocity with the General Availability of OpenAPI v3 (OASv3) support for API Gateway and Cloud Endpoints. You no longer need to downgrade modern specifications to OASv2. Instead, you can now define API contracts and enforce critical policies—including telemetry, quotas, and security—using native Google-specific extensions directly within your OASv3 files. This update ensures your APIs are secure by design while remaining fully compatible with the modern developer ecosystem and Google Cloud’s AI services.

Get started with OpenAPI v3 on API Gateway and Cloud Endpoints.

Accelerate API Testing with the New Open Source API Tester
Start validating your APIs with API Tester, a simple, YAML-based Test Driven Development (TDD) framework. Designed for the Apigee community, this tool allows you to write human-readable tests, run them instantly via a web client or CLI, and perform deep unit testing on Apigee proxies. With native support for JSONPath assertions and Apigee shared flows, you can verify everything from payload data to internal variables like proxy.basepath without leaving your terminal.

Explore the API Tester guide and start testing your proxies today.
Secure Sensitive Data with Kubernetes Secrets in Apigee hybrid
Enhance security in Apigee hybrid by accessing Kubernetes Secrets directly within your API proxies. This hybrid-exclusive feature keeps sensitive credentials within your cluster boundary and prevents replication to the management plane. It supports strict separation of duties: operators manage secrets via kubectl, while developers reference them as secure flow variables—ideal for high-compliance and GitOps workflows.

Implement Kubernetes Secrets in your hybrid proxies.
See the Console in a Whole New Light: Dark Mode is Now Generally Available in Google Cloud
Elevate your cloud management workflow with Dark Mode, now generally available in the Google Cloud console. We have delivered a modern, cohesive, and accessible experience reimagined for maximum comfort and productivity—especially during extended working hours and low-light environments. Dark Mode can be enabled automatically based on your operating system's preference, or manually through the Settings -> Appearance menu.

Switch to Dark Mode today to enjoy a modern, comfortable, and productive environment!
Apigee X Networking: PSC or VPC Peering?
Deciding how to connect Apigee X? Watch this video to compare Private Service Connect and VPC Peering. We break down northbound and southbound routing, IP consumption, and how to reach targets on-prem or in the cloud. Learn to simplify your architecture and avoid common networking "gotchas" for a smoother deployment.

Watch the video.

Jan 19 - Jan 23

Bridge the Gap: Excel-to-API Conversion in Apigee Portals
Give your customers more ways to connect! This new article by Tyler Ayers explores how to extend the Apigee Integrated Portal to support direct Excel file uploads. By leveraging SheetJS and custom portal scripts, you can enable users to upload spreadsheets, preview data, and submit it directly to your APIs, all without writing a single line of integration code themselves. It’s a powerful way to simplify onboarding for those who aren't yet API-ready.

Learn how to build it.
Elevate your applications with Firestore’s new advanced query engine
We have fundamentally reimagined Firestore with pipeline operations for Enterprise edition. Experience a powerful new engine featuring over a hundred new query features, index-less queries, new index types, and observability tooling to improve query performance. Seamlessly migrate using built-in tools and leverage Firestore’s existing differentiated serverless foundation, virtually unlimited scale, and industry-leading SLA. Join a community of 600K developers to craft expressive applications that maximize the benefits of rich queryability, real-time listen queries, robust offline caching, and cutting-edge AI-assistive coding integrations.

Learn more about Firestore pipeline operations.

Frontier and Center: Who evaluates the evaluations?

Fri, 10 Jul 2026 16:00:00 +0000

Editor’s note: Some of the most interesting questions in AI are being asked by information theoreticians, around how to provide context to an emerging class of AI agents. A few weeks ago, we waded into those waters with a blog about the Open Knowledge Format, a specification that formalizes the LLM-wiki pattern into a portable, interoperable format to represent the metadata, context, and curated knowledge that modern AI systems need to operate. That blog generated a ton of interest, so we’ve decided to bring you more of the same, as part of our new “Frontier and Center” series. Today, we hear from two members of Google Data Cloud’s frontier AI team on the recurring challenge of how to systematically evaluate whether or not an agent is able to answer questions effectively based on its context. Read on for more, and watch this space for more blogs from this team.

A passing grade is the least interesting thing an exam can tell you. It says the student cleared the bar; leaving you entirely in the dark about how narrow their failures were, how effortless their passes were, or what to teach next. Yet this is exactly how we evaluate AI agents. We run a fixed benchmark, calculate a score, and declare progress. In doing so, we are handing our agents a pass/fail exam when what we actually need is a map of the agent’s capabilities: a picture of the terrain that shows exactly where capability falls off, and by how much.

For data agents, this map matters a lot for data discovery in search and retrieval — the unglamorous first step where an agent, handed a vague human question and a warehouse or data lake of thousands of tables and files, has to find the right datasets before it can reason over anything. Discovery is a "needle in a haystack" problem. Real users phrase their questions imperfectly, and inferring what datasets to retrieve presents a real challenge to agents. So the interesting question in evaluations is never "can the agent pass?" It is "how vague can the question get before the agent breaks?" An exam cannot easily answer that, but a map can.

Today, we share an approach rooted in information theory that we’ve been leveraging to add detail and nuance, i.e., fidelity, to benchmarks, so we can better understand agents’ performance as a part of their evaluations. Along the way, the added fidelity exposed some deeper issues with the quality of emergent evaluation cases themselves.

Difficulty, measured

When it comes to retrieval, evaluation cases are often stratified into tiers of difficulty. This can happen organically, e.g., pervasive and enduring failure scenarios are deemed difficult. Or it can be from labels applied by humans or machines categorizing some questions as "easy" or "hard" for an agent to answer correctly, e.g., based on the context provided in the query. While this kind of sentiment-based labeling is not the only way to label test cases, it’s frequently used despite its imperfections, such as being challenging to reproduce.

Despite being an industry staple, the approach of assessing every evaluation case by hand is unrealistic at scale. What we need is a rigorous approach that can modulate the difficulty of evaluation cases. We’re iterating on a meta-benchmark we call Discovery Bench: a framework that modulates an evaluation case by generating “easy” and “hard” variations of every case. This allows us to audit how close or how far an agent is from succeeding in those cases.

The lever for modulating the difficulty of an input query comes via a tried-and-trusted concept that’s present across information theory and machine learning: surprisal, or the likelihood of an output given a set of inputs. In our case, a query’s surprisal represents the uncertainty that remains about the correct dataset given the query.

The thinking behind our approach is simple: A term or a phrase in an evaluation query has high informative power when it sharply distinguishes the target from everything else in the corpus. Therefore, we can adjust the difficulty of evaluation cases by adding or removing terms with varying levels of informative power.

Let’s work through a real example from KramaBench, a publicly available benchmark. One of KramaBench’s datasets has information about orbiting satellites, and the example query from the suite includes the following text: "…the total count of satellite major altitude changes for satellite 48445 during 2024 using TLE history."

The token "TLE" is sharply distinguishing; it points almost uniquely at the TLE_____48445 table from the dataset. Strip it, and the query degrades to "the count of satellite altitudes for satellite 48445," whose vague phrasing now matches density tables, precise-orbit files, and decay logs alike. Surprisal makes this quantitative: rare, pointed terms carry more bits than common ones.

The remaining surprisal of a query is how much uncertainty is left about its answer. As surprisal approaches zero, the query has become specific enough to pinpoint exactly one dataset.

The heart of the idea behind Discovery Bench is this refinement loop, which we call iterative surprisal-based query refinement, or iSQR, which generates cases with higher or lower informative power to test where an agent can start successfully answering the query:

Figure 2: The iSQR refinement loop.

The crux is being able to control the challenge embedded into the evaluation case by making adjustments: Instead of one fixed phrasing per question, we generate the same question at three levels of calibrated ambiguity [high, medium, low], with each grounded in bits (not subjective opinion). We can even justify, term by term, why a word was added or removed. Difficulty stops being a property that is attributed by sentiment or classification, and becomes one we engineer.

The cliff you couldn't see

Here is what Discovery Bench’s difficulty dial reveals — and what a single-phrasing benchmark structurally cannot.

We have an F1 agent that's built for recall (on Gemini 3.1 Pro). Running it against KramaBench and across the full sweep of ambiguity levels traces a curve: 0.34 at high ambiguity, 0.76 at neutral, 0.81 at medium, 0.78 at low.

Figure 3: F1 swept across ambiguity — the dot versus the curve.

Two findings fall out immediately (and neither were visible to a conventional eval).

First, the cliffs. This query scores a perfect F1 = 1.00 at neutral phrasing — and 0.00 at high ambiguity. It is the satellite-48445 case from above: drop the distinguishing token "TLE" and the agent loses the table entirely. Same query, same agent, same ground truth; one notch vaguer and it falls off a cliff. A static benchmark tests the neutral phrasing, stamps "solved," and reports flat ground where there is a precipice. Pass/fail was particularly misleading in that it did not just miss the cliff, but it told us the terrain was level.

Second, the sweet spot. For Discovery Agent, medium ambiguity beat neutral, and low ambiguity sometimes underperformed it. More specificity is not monotonically better for the system being evaluated; there is an optimal amount of steering. That is a graded, actionable signal. This is the "how close, how hard" texture we were missing from a scalar. It tells you where to hill-climb, or improve, the agent: in our case, straight at concrete failure modes like time-sharded tables (precision collapsing to ~8% as the agent over-retrieves 21 near-identical shards for a two-table answer) and context blow-up (F1 dropping from 0.75 to 0.32 once a query triggers long search chains). The map did not just say that the agent failed, but it said where, and why. Note that our hypothesis that less ambiguity and more context (via steering terms) should improve retrieval generally holds true, but for the specific Discovery Agent being exercised, the idiosyncratic “sweet spot” meaningfully highlighted trade-offs in its implementation.

We're not alone

The field is converging on meta-benchmarking and exerting greater control of how we challenge and evaluate our agents. A growing body of work uses item response theory, the latent-ability model behind standardized testing, to treat difficulty as a measured quantity rather than a label: tinyBenchmarks and metabench show that a handful of informative items reproduce a model's full score, and PSN-IRT turns the same lens on benchmark quality itself. Others audit the ground truth directly: MMLU-Redux found that 6.49% of Massive Multitask Language Understanding (MMLU) questions are mislabeled, and Platinum Benchmarks re-cleaned ten datasets to minimize both label errors and ambiguity — the same two axes we sweep for. And ambiguity is increasingly treated as intrinsic rather than noise: AmbigQA showed that a large fraction of real questions admit multiple readings, and later work finds that apparent hallucinations often stem from query ambiguity rather than model failure. What we have not seen elsewhere is the combination: information-theoretic ambiguity sweeping applied as a meta-benchmark over live enterprise data.

A benchmark we trusted turned out to be broken

We built our first evaluation on kramabench-astronomy, a benchmark established in the field, and one which other teams had already leaned on for their own evals. Teams derived benchmarks from this dataset, and we hypothesized subtle issues may have been introduced over time. When we actually read the benchmarks used by teams, with Gemini's help, we found it was wrong in meaningful ways: ground-truth tables that did not answer their query, a question whose 124 sharded tables exceeded what some teams’ retrieval APIs could even return, months specified where exact dates were required. Quietly broken ground truth means quietly wrong conclusions not just for us, but for every prior analysis built on it.

This is the generalized crux of the matter: an evaluation is itself an artifact that can be defective, and almost nobody evaluates it. We instrument the agent and trust the ruler, but where do we validate that the measuring stick makes sense?

When two maps disagree

Now the recursive turn: If difficulty is something we generate, then we need to evaluate the generator itself; we should not trust it blindly either.

So we built the same ambiguity sweep two ways: steering terms from a pure-LLM guess, versus terms grounded in TF-IDF surprisal. The two disagreed violently. At high ambiguity, the LLM-built sweep scored the agent at F1 ≈ 0.34; the grounded sweep, ≈ 0.85. One of these maps is badly distorted. The grounded one, predictably, is the more robust: surprisal gives it a footing the free-running LLM lacks.

This is "evaluate your evals," made concrete. The information-theoretic lens does not only grade the agent along a continuous axis; it grades the benchmark's own construction, and adjudicates between the two.

Evaluate your evals

We have spent years optimizing agents against rulers we never measured. The bitter irony is that better models make this worse: as agents clear coarse benchmarks, the score saturates near the top and the exam loses its ability to highlight where the agent can be improved.

So the call to action is uncomfortable and overdue: evaluate your evals. Read your ground truth. Treat difficulty as a measured quantity, not a label: sweep it, plot it, find the bit-width where your system breaks. Ask not just "did it pass?" but "how close was the miss, how hard was the pass, and would a slightly vaguer question have sent it off a cliff?" Build evaluations that produce signals; not just verdicts.

There is a genuine tension to sit with here. Difficulty-as-entropy is only as reliable as the model that estimates the entropy. There's a risk that if we push too hard on a measurable proxy, we optimize the ruler instead of the agent. That is not a reason to retreat to pass/fail; it is a reason to keep the evaluator under the same scrutiny as what it is evaluating. The moment we stop asking who evaluates the evaluators is the moment our maps stop being useful again.

^{1. Maia Polo, F. et al. tinyBenchmarks: Evaluating LLMs with Fewer Examples. ICML 2024. arxiv.org/abs/2402.14992}^{2. Kipnis, A. et al. metabench: A Sparse Benchmark of Reasoning and Knowledge in Large Language Models. ICLR 2025. arxiv.org/abs/2407.12844}^{3. Lost in Benchmarks? Rethinking Large Language Model Benchmarking with Item Response Theory (PSN-IRT). AAAI 2026. arxiv.org/abs/2505.15055}^{4. Gema, A. P. et al. Are We Done with MMLU? (MMLU-Redux). 2024. arxiv.org/abs/2406.04127}^{5. Vendrow, J. et al. Do Large Language Model Benchmarks Test Reliability? (Platinum Benchmarks). 2025. arxiv.org/abs/2502.03461}^{6. White, C., Dooley, S. et al. LiveBench: A Challenging, Contamination-Limited LLM Benchmark. 2024. arxiv.org/abs/2406.19314}^{7. Min, S. et al. AmbigQA: Answering Ambiguous Open-domain Questions. EMNLP 2020. aclanthology.org/2020.emnlp-main.466}^{8. Lai, E., Vitagliano, G. et al. KramaBench: A Benchmark for AI Systems on Data-to-Insight Pipelines over Data Lakes. 2025. arxiv.org/abs/2506.06541}

Safely run AI-generated code in Cloud Run sandboxes

Thu, 09 Jul 2026 16:30:00 +0000

Here’s a question we hear often at Google Cloud: How do you safely run AI-generated code or untrusted binaries without putting your host application, data, and cloud credentials at risk? In other words, how do you give AI-written programs a safe space to run — one that keeps them completely separate from your trusted programs with higher privileges?

Until now, developers had to build complex sandboxing infrastructure using container clusters or pay for specialized third-party microVM runtimes.

Today, at WeAreDevelopers World Congress, we are announcing Google Cloud Run sandboxes in public preview. Cloud Run sandboxes are a native, secure, and ultra-fast runtime environment built specifically for executing untrusted code and agent workloads, starting in milliseconds.

In the following example, we send requests to safely execute untrusted Python code on a Cloud Run service that starts, executes, and stops 1,000 sandboxes with an average of 500ms latency:

In this post, we’ll share more about the feature and core use cases.

What is a Cloud Run sandbox?

Cloud Run sandboxes are lightweight, isolated execution boundaries that you can spawn near-instantly within your existing Cloud Run service instances.

Whether you need to let an LLM run a dynamically generated Python script to calculate business margins or spin up a headless browser to perform web research, Cloud Run sandboxes give you a secure, isolated sandbox to run these tasks without leaving your serverless environment.

Core use cases

LLM code interpreters: Build advanced data analysis features into your AI products. Let your models write and execute Python, R, or SQL code to analyze datasets, generate charts, and perform complex math securely.
Headless browsers: Give your agents a secure environment to run browsers. Safely scrape web pages, take screenshots, and automate web workflows without risking your host machine.
User-submitted code execution: Beyond AI, platforms hosted on Cloud Run can use sandboxes to safely run custom scripts, plugins, or webhooks uploaded by their own end-users.

How it works: The developer experience

Enabling sandboxes on your Cloud Run service is as simple as adding a single flag to your deployment.

Step 1: Enable the sandbox launcher

When deploying your Cloud Run service, enable the sandbox launcher via gcloud or your YAML configuration:

code_block: <ListValue: [StructValue([('code', 'gcloud beta run deploy my-agent-service \\\r\n --image=gcr.io/my-project/agent-image \\\r\n --sandbox-launcher'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a14d85e0>)])]>

Step 2: Spawn a sandbox natively in your code

Once enabled, a lightweight sandbox CLI binary is automatically mounted into your execution environment. Your agent application can spawn sandboxes programmatically using standard subprocess calls.

Here is how easily you can run an untrusted Python script generated by an LLM:

code_block: <ListValue: [StructValue([('code', 'import subprocess\r\n\r\ndef run_untrusted_code(llm_code: str):\r\n # 1. Write the untrusted LLM code to a local file\r\n with open("/tmp/generated_script.py", "w") as f:\r\n f.write(llm_code)\r\n \r\n # 2. Run it inside the secure sandbox\r\n # The sandbox shares your container\'s filesystem tools but runs in a secure silo\r\n result = subprocess.run(\r\n ["sandbox", "do", "--", "python3", "/tmp/generated_script.py"],\r\n capture_output=True,\r\n text=True,\r\n timeout=10\r\n )\r\n \r\n return result.stdout if result.returncode == 0 else result.stderr'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a14d84c0>)])]>

Security by design: Zero-trust by default

Cloud Run sandboxes are engineered to protect your host application and cloud resources from malicious or erroneous code execution. The runtime enforces three critical security boundaries:

1. Credential and environment isolation: These sandboxes do not have access to the Cloud Run service’s environment variables nor do they have the ability to call the Google Cloud metadata server.

2. Locked-down network egress (deny-by-default): By default, sandboxes have zero outbound network access. If your agent is tricked into running a script that attempts to exfiltrate data to a malicious server, the network request is blocked at the system layer. Egress can be enabled only when explicitly requested:

code_block: <ListValue: [StructValue([('code', 'sandbox do --allow-egress -- curl https://api.github.com'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a0e6cfa0>)])]>

3. Safe filesystem overlay: The sandbox runs with a read-only view of your container's filesystem (allowing it to use your installed packages, Python runtimes, and binaries) but writes all changes to an isolated, temporary memory overlay. Once the sandbox execution ends, all generated files are discarded. Though you can still import and export files as needed for re-use across sandboxes:

code_block: <ListValue: [StructValue([('code', '# Write data from the sandbox to an archive file that can be persisted\r\nsandbox do --write --export-tar=/tmp/work.tar \\\r\n -- /bin/bash -c "mkdir -p /tmp/work && echo \'task-complete\' > /tmp/work/status.txt"\r\n\r\n# Import the archive file in a new sandbox\r\nsandbox do --write --import-tar=/tmp/work.tar \\\r\n -- /bin/bash -c "cat /tmp/work/status.txt"'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a099aeb0>)])]>

ADK and ComputeSDK built-in support

Cloud Run sandboxes will be supported in the next version of Agent Development Kit with a new CloudRunSandboxCodeExecutor. This integration gives your ADK agents running on Cloud Run the ability to execute code in one single line:

code_block: <ListValue: [StructValue([('code', 'from google.adk.agents import Agent\r\nfrom google.adk.integrations.cloud_run import CloudRunSandboxCodeExecutor\r\n\r\nanalyst_agent = Agent(\r\n name="cloud_run_data_analyst",\r\n model="gemini-3.1-pro-preview",\r\n system_instruction=(\r\n "You are an expert data analyst. Write and execute Python code to answer "\r\n "user questions and process data safely."\r\n ),\r\n code_executor=CloudRunSandboxCodeExecutor(),\r\n)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a10b5b20>)])]>

Cloud Run sandboxes were also added to ComputeSDK, a vendor agnostic SDK for running sandboxes. This SDK allows you to either invoke sandboxes remotely from outside the Cloud Run service or use them directly as a local tool on the service. You can learn how to use this SDK for Cloud Run sandboxes here.

Get started today

Unlike dedicated sandbox hosting platforms that charge high premiums for on-demand virtual machines, Cloud Run sandboxes run directly on your existing allocated CPU and memory. Because the sandboxes share the resources of your running instances, there is no additional cost or premium to use this feature. You can check out our documentation here.

Solve harder problems with AlphaEvolve, now available to everyone on Google Cloud

Thu, 09 Jul 2026 16:00:00 +0000

Many of the most challenging and valuable problems in the world are related to optimization. Now, AI is now making these problems tractable. If you've ever tried to design a microchip, plan a delivery network, or optimize a training architecture for a large AI model, you know how hard it is to find the most optimized code. Traditional coding methods often cannot explore all the possible algorithms and implementations because the search space is simply too vast. To help, we introduced AlphaEvolve last year in private preview — an agent to help you design better algorithms on Google Cloud.

What’s new: Today, AlphaEvolve is generally available (GA) on Gemini Enterprise Agent Platform. AlphaEvolve is a code optimization and discovery agent built on top of Gemini that helps solve the hardest algorithmic problems and achieve breakthroughs for your business and research. It has been tested in diverse domains like logistics, semiconductors, genomics, high performance computing, and financial services during our early access program. It systematically explores the search space to find solutions optimized for your problem.

Deploying AlphaEvolve within your environment follows a structured four-step process designed to move from initial problem definition to fully optimized production code:

Define: Provide a baseline seed algorithm and problem definition, together with background knowledge that provides context about the problem you want to solve.
Measure: Establish a scoring function to objectively score candidate programs on one or more metrics important for your problems such as correctness, performance, and operational constraints.
Optimize: Use AlphaEvolve’s agentic harness to generate optimized code, explicitly optimized against the metrics in the scoring function established in the measure step.
Apply: Deploy the resulting, highly optimized algorithm directly into your production workloads and infrastructure.

In this post, we’ll share how organizations are already seeing impact with AlphaEvolve and how you can get started.

How organizations are using AlphaEvolve

AlphaEvolve has grown from a research project into a key tool we use at Google. Now, some of the world’s most innovative organizations are using it to solve their algorithmic problems, too.

BASF: Building a digital twin to optimize global supply chains
"We had several attempts to build a digital twin for our complex supply network using deterministic models, and all of them failed. By using AlphaEvolve, we can now not only map the complex network based on system data, but at the same time understand and copy the human decisions that drive our daily operations. This gives us a highly accurate and easy to maintain data driven digital twin of the entire network." — Dr. Goetz Krabbe, Vice President for Global Supply Chain, BASF.

Visit the blog to read more how BASF used AlphaEvolve to improve their existing planning and forecasting models by over 80%.

Coolblue: Optimizing e-commerce demand forecasting
“Coolblue data scientists used AlphaEvolve to directly optimize their 28-day demand forecasting pipeline, focusing on automated feature engineering, target preprocessing, and model selection. In just a few (200) iterations, AlphaEvolve improved our production forecast (by reducing WMAPE over the existing solution) by over 5%. These gains were achieved through improved feature engineering, an ensemble of different regression models, and better target preprocessing proposed and validated by AlphaEvolve. To ensure sufficient stock availability, it is crucial that the demand forecast is accurate for both the short term (the first 7 days) and the longer horizon (the full 28 days). AlphaEvolve achieved this by using an evaluation metric that combines both periods, along with a strict penalty for under forecasting. AlphaEvolve has proven its ability to significantly improve bulk purchasing decisions and help us maintain optimal stock levels for the weeks ahead.” — Cas Ruger, Data Scientist at Coolblue.

FM Logistic: Optimizing warehouse routing
"Through our partnership with Google Cloud and the implementation of AlphaEvolve and Gemini, we further optimized our routing approach for fast-moving operations. The 10.4% improvement was achieved on top of an already highly optimized baseline, where further gains are typically hard to come by. This translates directly to faster fulfillment, improved working conditions for our teams, and reduced wear on our fleet." — Rodolphe Bey, Group CIO at FM Logistic.

Visit the blog and website to read more about how FM Logistic used AlphaEvolve to improve warehouse routing by 10.4%, saving over 15,000 km in staff travel.

Infineon: Optimizing chip design
"Our initial experiments with AlphaEvolve have been very positive, demonstrating its potential to transform the chip design lifecycle. We see a clear potential for it to contribute to multiple stages of development, including areas like Surrogate modelling." — Michael Kollig, CIO, Infineon.

JetBrains: Accelerating IDE performance
"AlphaEvolve can change how we approach complex performance work. It turns optimizations that were once too time-consuming to explore into candidates we can test routinely. Engineers still own the benchmark, review, and release decision. The search space is what gets smaller." — Dmitrii Batkovich, Director of Engineering, JetBrains.

Visit the blog to read more about how Jetbrains used AlphaEvolve to improve their IDE performance by over 15-20%.

Kinaxis: Improving optimization and forecasting systems
"Kinaxis researchers have used AlphaEvolve to materially improve both the speed and quality of highly mature forecasting and optimization algorithms. In early testing, we achieved improvements of more than 22% in key forecasting accuracy metrics while reducing runtime by over 90% on benchmark datasets. As supply chains become increasingly complex and unpredictable, AlphaEvolve has the potential to help the world's largest organizations make faster, more informed decisions and adapt with greater confidence." — Gelu Ticala, Chief Technology Officer, Kinaxis

Visit the blog to read more about how Kinaxis used AlphaEvolve to achieve significant gains across their forecasting and runtime metrics.

Klarna: Doubling throughput while improving model quality
"Klarna applied AlphaEvolve to one of their largest ML training pipelines and doubled throughput while improving model quality, all under the strict reproducibility constraints of regulated financial services. Over three weeks, the system explored nearly 6,000 candidate programs, discovering deep architectural rewrites no engineer would have tried." — Klarna engineering team.

Visit the blog to read more about how Klarna used AlphaEvolve to double Training Speed and improve performance for their foundational models.

Kuro Games: Server-side Optimization
"At Kuro Games, our guiding principle is that AI should not just make our work faster — it should make our work better. AlphaEvolve is a real-world validation of that principle. We applied it to a complex backend optimization challenge and saw substantial performance gains in specific server-side workloads. AlphaEvolve handles the kind of optimization work machines do best, so our engineers can focus on what only people can do: crafting great games." — Lin Chenchen Chief Technology Officer, Kuro Games

Oak Ridge National Laboratory: GPU kernel generation for exascale computing
Under Google DeepMind’s Genesis Mission partnership with the Department of Energy to provide early-access to our AI for science tools.

“Oak Ridge National Laboratory (ORNL) recently partnered with Google to deploy AlphaEvolve on Frontier, the world’s first exascale supercomputer. The research team built a closed-loop evaluation architecture that bridges cloud-based large language model code generation with Frontier’s execution environment. The designed system optimizes mixed-precision GPU kernels—which requires complex, coupled decisions about memory, data layout, and hardware synchronization — by iteratively generating, compiling, running, and validating candidate programs, directly on the supercomputer's AMD GPUs. This executable search framework evaluates each proposed structural optimization against numerical accuracy rules.

“Our collaboration with Google's AlphaEvolve team gave us an early look at how evolutionary programming can be combined with leadership-class supercomputing. By running AlphaEvolve on Frontier, we explored a large number of optimization candidates in parallel, including novel implementation variants that helped us explore parts of the design space we might not have reached through manual optimization alone. This is an encouraging first step toward applying AI-assisted optimization to increasingly complex scientific software." — Oscar Hernandez Mendoza, PhD, Senior Computer Scientist, ORNL

Old Dominion University: Modeling biological aging mortality rates
"The Qin Lab at Old Dominion University used AlphaEvolve to search the space of Python programs that model biological aging mortality rates, a problem in computational biogerontology where the governing equations span multiple empirical laws. Utilizing an HPC cluster in Google Cloud as a part of the ODU MonarchSphere initiative, AlphaEvolve – across approximately 500 evaluations – independently rediscovered the Kannisto logistic mortality model (a published result from the 1990s biogerontology literature) with no prior knowledge of that literature, improved the Emergent Aging Model composite fitness score by 19% through heterogeneous decay rate distributions, and demonstrated near-perfect Strehler-Mildvan correlation (0.949) via scale-free network topology with Laplacian spectral aging across approximately 500 evaluations. The central finding is that structurally diverse models all converge on the same empirical aging laws, providing evidence that Gompertz, Strehler-Mildvan, and Kannisto regularities are robust attractors of biological systems. The team plans to extend this work to multi-species datasets and to connect the evolved program structures to testable biological mechanisms.” — Dr. Hong Qin,Department of Computer Science, Old Dominion University

PacBio: Scaling accuracy and lowering costs in genomics
"The solution the Google team discovered using AlphaEvolve unlocks meaningfully higher accuracy rates for our sequencing instruments. For researchers, this higher-quality data might enable the discovery of previously hidden disease-causing mutations." — Aaron Wenger Senior Director, PacBio.

Visit the blog to read more about how Pacbio used AlphaEvolve to improve DeepConsensus — a model developed by Google Research for correcting DNA sequencing errors — achieving a 30% reduction in variant detection errors.

Pebble: Optimizing serving performance on GPUs
"Optimizing inference serving is an incredibly challenging problem because it is a multi-dimensional system design challenge that shifts dynamically between memory, compute, and hardware orchestration constraints. NVIDIA's AI Configurator latency model was severely bottlenecked by a single, static 0.8 empirical correction factor that applied uniformly to all workloads, and did not model FP8-vs-BF16 efficiency divergence, causing recommended configurations to drift away from the optimum. AlphaEvolve solved this by autonomously discovering GPU performance modeling formulations directly from our training prior. This Gemini-powered evolutionary approach drastically cut our model errors by more than delivering a 56% relative error reduction. We are excited to integrate this smoother, learned efficiency function and leverage AlphaEvolve to continuously map emerging hardware specifications without manual tuning." — Keval Shah Head of AI, Pebble

Qbraid: Advancing quantum computing
"AlphaEvolve delivered a result on top of an encoding family we had already spent years refining. It searched a design space far too large to comb through by hand and handed back something we could read, verify, and understand. Systems like AlphaEvolve will meaningfully accelerate progress toward useful quantum computing." — Kenny Heitritter, Vice President of Research and Development at qBraid.

Visit the blog and paper to read more about how Qbraid used AlphaEvolve to find significantly more error efficient error-correcting codes for quantum chemistry.

Schrödinger: Shortening cycles for molecular simulations for drug discovery
"AlphaEvolve allows us to explore larger chemical spaces faster and more efficiently than ever before. Faster MLFF inference carries real business impact, shortening R&D cycles in drug discovery, catalyst design, and materials development, and enabling companies to screen molecular candidates in days rather than months." — Gabriel Marques, ML Tech Lead, Schrödinger.

Visit the blog to read more about how Schröedinger used AlphaEvolve to quadruple the speed of molecular discovery.

Substrate: Accelerating runtime speed for semiconductor simulation
“AlphaEvolve transformed the speed and efficiency of our computational lithography frameworks and, more impressively, demonstrated the potential of these models to design their future selves, all the way down to the atoms.” — James Proud, CEO, Substrate.

Visit the blog to read more about how Substrate applied AlphaEvolve to its computational lithography framework, achieving a multi-fold increase in runtime speed, enabling them to run significantly larger simulations of advanced semiconductors.

WPP: Cracking the code of campaign success
"WPP faced a ceiling in predicting creative campaign performance, as their manual model optimizations yielded only marginal 1% accuracy gains despite significant time and effort. To overcome this challenge, WPP’s Research team utilized AlphaEvolve to autonomously propose, evaluate, and refine candidate model architectures rather than relying on slow manual experimentation. This agentic framework effectively bypassed their trial-and-error limits, successfully navigating complex, high-dimensional campaign data and class imbalances. As a result, WPP achieved a highly significant 5–10% (across different use cases) increase in both prediction accuracy and downstream recommendation scores, outperforming all previous baseline models including neural and fine-tuned Gemma models." — Anastasios Tsourtis, Lead Data Scientist, WPP.

Visit the blog to read more about how WPP used AlphaEvolve to optimize machine learning models for digital marketing campaigns, delivering a 10% lift in prediction accuracy and up to a 7% boost in downstream recommendation scores.

Hardening our own infrastructure and scientific research

Beyond external deployments, Google has integrated AlphaEvolve as a core engine to scale its own state-of-the-art infrastructure. As detailed by Google DeepMind, AlphaEvolve has successfully optimized the silicon design of next-generation Tensor Processing Units (TPUs) with a highly efficient, counterintuitive circuit layout, refined Google Spanner’s Log-Structured Merge-tree compaction heuristics to reduce write amplification by 20%, and reduced software storage footprints by nearly 9% through new compiler optimization strategies. Additionally, the agent has made critical contributions to scientific research, boosting predictive accuracy across 20 natural disaster risk categories by 5%, and discovering quantum circuits with 10x lower error rates for running complex molecular simulations on Google's Willow quantum processor.

According to Pushmeet Kohli, Chief Scientist, Google Cloud & Vice President, Science at Google DeepMind, “AI is moving beyond acting as a productivity assistant that accelerates how we work to a discovery engine that expands what we can achieve. By autonomously navigating complex computational search spaces, tools like AlphaEvolve are helping researchers and engineers uncover breakthrough algorithms that augment traditional human intuition”.

Start evolving your codebase today

Getting started with AlphaEvolve requires only two core inputs on your end:

Seed program: The initial algorithm written as code. You designate which segments of code are open to optimization and provide them to AlphaEvolve
An evaluator: A deterministic client-side evaluation script that compiles, tests, and scores the mutated candidates, returning one or more scalar metrics for AlphaEvolve to maximize.

Your client-side runner queries the AlphaEvolve API to acquire mutated candidate solutions, runs them through your client-side evaluator (which can be running anywhere), and submits the scores back to AlphaEvolve which you sample from.

To use AlphaEvolve we recommend getting going through the documentation. After quickly setting up the AlphaEvolve API using the onboarding guide, we recommend starting going through the repository with the basic colab examples to understand how the AlphaEvolve heuristic works. For agentic workflows, you can easily get started using the AlphaEvolve Skill in your IDE of choice, such as Antigravity or Claude Code. For more complex experimentation, our best practices guide and advanced examples provide additional resources to run through detailed AlphaEvolve experiment workflows.

Autopilot Clusters with GKE managed DRANET: GPUs and TPUs

Thu, 09 Jul 2026 07:00:00 +0000

Google Kubernetes Engine (GKE) managed DRANET supports both GPUs and TPUs. There are several configurations to use this implementation, including standard cluster (where you have full control) and autopilot cluster (where Google does the heavy configs for you). I've been exploring the capabilities and in this blog we will explore setting up for autopilot clusters.

Autopilot and managed DRANET

GKE autopilot is a managed version of GKE that handles nodes, scaling, security, and other preconfigured settings. GKE managed DRANET lets you request and allocate networking resources for your Pods, including network interfaces that support TPUs and Remote Direct Memory Access (RDMA).

Setup flow

To deploy your GKE autopilot cluster and enable managed DRANET, you need to create a Virtual Private Cloud (VPC). Let's walk through the setup:

Deploy an Autopilot cluster.
Create a custom ComputeClass which supports the accelerator type (TPU or GPU)
Create a ResourceClaimTemplate for GPUs (RDMA) or non-GPU (TPU)
Deploy workload and reference the ComputeClass and ResourceClaimTemplate to get the correct networking set up.

Now let's explore the configs for both TPU and GPU.

Configure variables:

code_block: <ListValue: [StructValue([('code', 'export PROJECT_ID=$(gcloud config get project) #automatically sets your Project_ID\r\nexport REGION="REGION"\r\nexport CLUSTER_NAME="CLUSTER_NAME"\r\nexport NETWORK="NETWORK"\r\nexport SUBNETWORK="SUBNETWORK"\r\nexport RESERVATION_URL="RESERVATION_URL"\r\nexport HF_TOKEN="HUGGING_FACE_TOKEN"'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a0f5bbe0>)])]>

Replace the following:

REGION: The region where you want to create your cluster, such as us-east1. You can only create the cluster in the region where your reservation or resources exists.
CLUSTER_NAME: A name for your cluster, such as dranet-cluster.
NETWORK: The name of the VPC network.
SUBNETWORK: The name of the subnet in the VPC.
RESERVATION_URL: The URL of the reservation that you want to use to create your resources.
HUGGING_FACE_TOKEN: The Hugging Face access token to download your model.

1. Deploy an Autopilot cluster

Deploy an Autopilot cluster.

code_block: <ListValue: [StructValue([('code', 'gcloud container clusters create-auto $CLUSTER_NAME \\\r\n --project=$PROJECT_ID \\\r\n --region=$REGION \\\r\n --release-channel=rapid \\\r\n --network=$NETWORK \\\r\n --subnetwork=$SUBNETWORK'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a0f5bf40>)])]>

2. Create a custom ComputeClass

Example: GPU B200 custom ComputeClass with managed DRANET support and a reservation.

code_block: <ListValue: [StructValue([('code', 'apiVersion: cloud.google.com/v1\r\nkind: ComputeClass\r\nmetadata:\r\n name: dranet-a4-computeclass\r\nspec:\r\n nodePoolAutoCreation:\r\n enabled: true\r\n nodePoolConfig:\r\n dra:\r\n networking:\r\n enabled: true\r\n priorities:\r\n - machineType: a4-highgpu-8g\r\n gpu:\r\n count: 8\r\n type: nvidia-b200\r\n acceleratorNetworkProfile: auto\r\n reservations:\r\n affinity: Specific\r\n specific:\r\n - name: ${RESERVATION_URL}\r\n project: ${PROJECT_ID}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a125c940>)])]>

Replace the following:

${RESERVATION} : With the URL of the reservation that you want to use to create your resources.
${PROJECT_ID}: With the ID of the project you are using.

Alternatively you can set the variables in your terminal and use the following command to pass the variables at creation envsubst < filename.yaml | kubectl apply -f -

Example: TPU v6e custom ComputeClass using on-demand example.

code_block: <ListValue: [StructValue([('code', 'apiVersion: cloud.google.com/v1\r\nkind: ComputeClass\r\nmetadata:\r\n name: dra-gke-auto\r\nspec:\r\n nodePoolAutoCreation:\r\n enabled: true\r\n nodePoolConfig:\r\n dra:\r\n networking:\r\n enabled: true\r\n priorities:\r\n - tpu:\r\n type: tpu-v6e-slice\r\n count: 8\r\n topology: "2x4" \r\n acceleratorNetworkProfile: auto\r\n location:\r\n zones: \r\n - us-east5-b'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a125cc10>)])]>

3. Create a ResourceClaimTemplate

RDMA support deviceClassName: mrdma.google.com ResourceClaimTemplate example for GPUs:

code_block: <ListValue: [StructValue([('code', 'apiVersion: resource.k8s.io/v1\r\nkind: ResourceClaimTemplate\r\nmetadata:\r\n name: all-mrdma\r\nspec:\r\n spec:\r\n devices:\r\n requests:\r\n - name: req-mrdma\r\n exactly:\r\n deviceClassName: mrdma.google.com\r\n allocationMode: All'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a1cc9970>)])]>

Non-RDMA deviceClassName: netdev.google.com ResourceClaimTemplate example for TPUs.

code_block: <ListValue: [StructValue([('code', 'apiVersion: resource.k8s.io/v1\r\nkind: ResourceClaimTemplate\r\nmetadata:\r\n name: all-netdev\r\nspec:\r\n spec:\r\n devices:\r\n requests:\r\n - name: req-netdev\r\n exactly:\r\n deviceClassName: netdev.google.com\r\n allocationMode: All'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a1cc94f0>)])]>

4. Deploy workload and reference ComputeClass and ResourceClaim

Create a secret in your cluster

code_block: <ListValue: [StructValue([('code', 'kubectl create secret generic hf-secret \\\r\n --from-literal=hf_token=${HF_TOKEN}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a0d57f40>)])]>

Example deploying GPUs

code_block: <ListValue: [StructValue([('code', 'apiVersion: apps/v1\r\nkind: Deployment\r\nmetadata:\r\n name: gemma-4-31-deploy\r\nspec:\r\n replicas: 2\r\n selector:\r\n matchLabels:\r\n app: gemma4\r\n template:\r\n metadata:\r\n labels:\r\n app: gemma4\r\n ai.gke.io/model: gemma-4-31b\r\n ai.gke.io/inference-server: vllm\r\n spec:\r\n resourceClaims:\r\n - name: rdma-claim \r\n resourceClaimTemplateName: all-mrdma\r\n containers:\r\n - name: vllm-inference\r\n image: us-docker.pkg.dev/vertex-ai/vertex-vision-model-garden-dockers/pytorch-vllm-serve:gemma4\r\n resources:\r\n requests:\r\n cpu: "10"\r\n memory: "1000Gi"\r\n ephemeral-storage: "1Ti"\r\n nvidia.com/gpu: "8"\r\n limits:\r\n cpu: "10"\r\n memory: "1000Gi"\r\n ephemeral-storage: "1Ti"\r\n nvidia.com/gpu: "8"\r\n claims:\r\n - name: rdma-claim\r\n command: ["python3", "-m", "vllm.entrypoints.openai.api_server"]\r\n args:\r\n - --model=$(MODEL_ID)\r\n - --tensor-parallel-size=8\r\n - --host=0.0.0.0\r\n - --port=8000\r\n - --max-model-len=131072\r\n - --max-num-seqs=16\r\n - --enable-chunked-prefill\r\n - --gpu-memory-utilization=0.90\r\n env:\r\n - name: MODEL_ID\r\n value: google/gemma-4-31B\r\n - name: HUGGING_FACE_HUB_TOKEN\r\n valueFrom:\r\n secretKeyRef:\r\n name: hf-secret\r\n key: hf_token\r\n volumeMounts:\r\n - mountPath: /dev/shm\r\n name: dshm\r\n startupProbe:\r\n httpGet:\r\n path: /health\r\n port: 8000\r\n failureThreshold: 240\r\n periodSeconds: 10\r\n livenessProbe:\r\n httpGet:\r\n path: /health\r\n port: 8000\r\n periodSeconds: 10\r\n readinessProbe:\r\n httpGet:\r\n path: /health\r\n port: 8000\r\n periodSeconds: 5\r\n volumes:\r\n - name: dshm\r\n emptyDir:\r\n medium: Memory\r\n nodeSelector:\r\n cloud.google.com/compute-class: dranet-a4-computeclass'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a0d57610>)])]>

Notice how the deployment references the ResourceClaimTemplate and ComputeClass. When this kicks off, it triggers a scale-up operation. GKE Autopilot reads the ComputeClass to provision the specific node type and to configure managed DRANET networking. Meanwhile, the resource claim acts as the bridge, binding your Pods directly to the accelerators on those nodes. This process works exactly the same for TPUs.

Next Steps

Take a deeper dive into GKE managed DRANET and autopilot with these resources:

Hands-on Lab: GKE Autopilot clusters with TPUs, GKE managed DRANET and Gemma 4
Document set: DRANET
Documentation: AI Hypercomputer

Want to ask a question, find out more, or share a thought? Please connect with me on Linkedin.

C4N, now GA: Delivering cloud’s highest per vCPU network and block storage I/O for x86 workloads

Wed, 08 Jul 2026 20:00:00 +0000

As organizations scale modern workloads — from high-throughput databases and network/security appliances to real-time analytics and AI/ML inference — network and block storage performance can quickly become a bottleneck. Standard virtual machines often struggle to balance compute efficiency with the high-volume data-transfer demands of these applications.

At Google Cloud Next ‘26, we announced C4N in preview, our first network- and block-storage-optimized Google Compute Engine instance that’s purpose-built to eliminate I/O bottlenecks for demanding enterprise applications, and today, it is generally available. Built on Google's custom-designed Titanium offload architecture, C4N instances offload network and storage tasks to dedicated hardware to unlock incredible performance and compute efficiency. C4N offers up to 400 Gbps of network bandwidth and a market-leading 95 million packets per second (MPPS) — nearly 33% higher network bandwidth per vCPU and 224% faster packet processing performance than comparable Intel-based offerings at other hyperscalers. This performance makes C4N a great fit for network-intensive applications such as virtual appliances (e.g., next-gen firewalls, virtual routers, load balancers, DDoS mitigation), large-scale data analytics, telco applications (5G UPF), distributed compute and CPU-based AI/ML workloads.

Paired with Hyperdisk Extreme, our high-performance block storage, C4N also delivers Compute Engine’s highest block storage performance, scaling up to 25 GiB/s of storage bandwidth and 1M IOPS — nearly 33% higher storage bandwidth and 39% more IOPS per vCPU versus comparable Intel-based offerings, making them a strong choice for large-scale databases, high-performance file systems, in-memory databases, and other workloads that benefit from high block storage performance.

Engineered specifically to deliver predictable, high-throughput I/O performance for networking, packets-per-second-bound and storage-optimized applications, C4N allows customers to scale network, storage, and compute resources more precisely to meet specific workload requirements, delivering significant TCO benefits by eliminating the need to over-provision resources just to meet I/O demands.

C4N is powered by 5th Gen Intel® Xeon® Scalable processors (code-named Emerald Rapids).

“Google Cloud’s introduction of C4N highlights how infrastructure innovation and a strong silicon foundation can help customers address increasingly data-intensive workloads. With Intel Xeon and Custom Infrastructure Processing Unit (IPU), C4N delivers the performance and efficiency needed for demanding network optimized environments.” – Srini Krishna, Intel Fellow, Data Center products, Intel

What’s new: Scaling massive data layers with C4N

Our network-optimized C4N instances are designed to deliver predictable, high-performance I/O at scale. By providing consistent bandwidth, packet-processing performance (PPS), and IOPS scaling across all VM shapes and sizes, C4N helps ensure your most demanding data workloads run reliably. To achieve this, we have built deep resiliency into every layer of our infrastructure — from the host and fabric layers to redundant top-of-rack (ToR) switches — delivering continuous performance for your applications.

Compared to general-purpose C4 VMs, the network-optimized C4N delivers significant performance gains across both network and block storage vectors.

Next-generation network performance

Superior VM-to-VM network bandwidth: Achieves up to 400 Gbps of VM-to-VM network bandwidth (an almost 4x increase in BW-per-vCPU over standard C4) and supports up to 50 Gbps single-flow bandwidth between C4N instances routed within the same VPC network. This provides non-blocking data delivery for high-throughput single-stream and multi-stream applications.
Enhanced VM-to-internet performance: Benefits from an 8x increase in internet egress network bandwidth, reaching up to 200 Gbps. It also features a nearly 32x increase in internet egress packet processing performance, scaling up to 48 MPPS.
Optimized I/O for smaller shapes: Keeps your cloud bill lean by delivering up to 25–50 Gbps of network bandwidth specifically for 2–16 vCPU shapes, great for accelerating I/O-bound tasks without needing to over-provision compute. Furthermore, these smaller shapes introduce predictable, steady-state baseline bandwidth limits to provide consistent performance at a lower cost.
Enhanced out-of-the-box networking: gVNIC interfaces on C4N now start with more Tx/Rx queues by default, scaling with vCPUs up to a maximum of 64 (in comparison to 16 queues on C4/C4D).
Shorter Google Cloud Storage transfer times: C4N VMs now offer up to a 2x increase in bandwidth to retrieve and store large volumes of data from Cloud Storage, boosting performance for analytics, AI/ML, and backup workloads.

Better yet, this performance is available out of the box, with no add-ons. Designed for high performance from the get-go, C4N offers maximum performance without needing to purchase or configure premium add-ons like Tier_1 networking.

Dynamic storage performance with Hyperdisk

The C4N instance family, when combined with Hyperdisk, can help dynamically tune storage performance, latency, and throughput independently of your compute instance sizing to deliver high block storage performance for your applications. C4N supports the complete Hyperdisk portfolio, including Hyperdisk Balanced, Balanced High Availability, Extreme, Throughput, and ML block storage options.

Hyperdisk Extreme: C4N with Hyperdisk Extreme provides low-latency, high-speed data access for modern databases and enterprise AI applications, with up to 25 GiB/s of block storage throughput and nearly 1M IOPS, a 2x increase in storage performance over C4. Also, exclusive to network optimized machine series such as C4N, we now offer Hyperdisk Extreme across all machine sizes — even down to the smallest 2 vCPU sizes.
Hyperdisk Balanced: Delivering the highest throughput and IOPS for general-purpose block storage in the Compute Engine portfolio, Hyperdisk Balanced on C4N scales up to 20 GiB/s of block storage throughput and nearly 640K IOPS. This makes it a highly cost-effective option for running storage-intensive applications at scale.

Together, C4N’s network and storage optimizations combine for tremendous impact in real-world applications:

Web serving: Up to 1.5x additional Nginx requests per second compared to C4 for typical web request sizes (100–300Kb), significantly boosting capacity for network-bound web applications
Databases: Up to 45% better queries per second (QPS) for MySQL when data resides primarily on disk than equivalent C4 VMs

What customers are saying

Industry leaders are already proving that workload-optimized infrastructure is the engine for transformation. Here is how our customers are leveraging the network-optimized power of C4N:

“5G Core workloads are inherently network-heavy, demanding high-throughput packet processing and deterministic latency that standard public cloud instances often struggle to maintain at scale. By leveraging the Google Cloud C4N compute family, we’ve found the ideal engine for Ericsson On-Demand. The C4N’s architectural focus on network-optimized compute allows our 5G Core-as-a-Service to reach unprecedented throughput levels — like our recent 1 Tbps milestone — while maintaining the carrier-grade reliability our customers expect. It’s no longer just about cloud-native; with C4N, we are delivering network-native performance in a public cloud environment.” - Eric Parsons, VP, Head of Ericsson On-Demand, Ericsson

“Teradata's Autonomous Knowledge Platform unifies production-grade AI, analytics, and data into a single integrated system — providing the context, governance, and performance backbone autonomous AI demands at scale. Customers rely on Teradata to run mission-critical, highly I/O-intensive workloads where performance and cost control directly determine value.

Google Cloud C4N instances are well suited for these demanding workloads, delivering strong price-performance and supporting more efficient, optimized deployments. By leveraging C4N on Google Cloud, Teradata Cloud can help customers accelerate from insight to action — scaling enterprise intelligence with confidence and driving greater impact from their data and AI investments” - Kevin Dougherty, Senior Director of Product Management, Core Platform, Teradata

“With the next-generation network and storage bandwidth of C4N VMs, Google Cloud NetApp Volumes will unlock new levels of performance to support our customers’ most demanding AI workloads. By collaborating to extend Google Cloud NetApp Volumes support for the C4N VM family, Google and NetApp are deepening our partnership to address real customer challenges. Together, we’re delivering data-in-place AI and analytics solutions that simplify architectures, maximize performance, and turn data into impact.” - Pravjit Tiwana, Senior Vice President and General Manager of Cloud Storage and Services, NetApp

"Most Compute Engine instances ship with a single high-speed network interface. The new C4N doubles the bandwidth potential with two 200 GbE interfaces. That architectural shift is significant. It means we can dedicate both networks entirely to storage traffic, doubling the available bandwidth for data-intensive workloads, and achieving 2x storage performance over the previous generation. The C4N was announced just weeks ago and is already active in Sycomp's test environment, ensuring our customers can evaluate the latest GCP capabilities without delay. Google Cloud’s published maximum hyperdisk balanced performance for the C4N is 20 GiB/s. In our tests, with three storage servers Sycomp achieved 58.5 GiB/s on read and 58.6 GiB/s on write, with ten C4N storage servers we achieved 195 GiB/s read and write — 97% of the theoretical ceiling with zero platform-specific tuning. That's a strong starting point, and there's measurable room to close the remaining gap through configuration work we can finetune. The C4N isn't just faster — it changes the price-performance equation for storage workloads on Google Cloud." - Scott Fadden, Senior HPC Solutions Architect, Sycomp

“At ClipperDB Technologies, our mission is to drive down the cost and drive up the performance of large-scale Spark analytics. Google Cloud’s C4N instances are the perfect compute engine for our fully native architecture. C4N’s substantial increase in network bandwidth per vCPU combined with large memory configurations and 5th Generation Intel Xeon processors align with ClipperDB’s precise parallel cloud-store prefetching and caching, concurrent dataflow native batch pipelines, streaming no-copy exchange, and cloud store checkpoint fault tolerance to radically accelerate and cost reduce Spark workloads with disaggregated Cloud Storage datalakes.

The results speak for themselves: across industry-standard TPC-DS benchmarks, ClipperDB+C4N delivered over 3x lower cost per query and up to 11x faster analytics, all while maintaining 100% Spark compatibility. We can’t wait to see customers dramatically improve their Spark workload price-performance with C4N coupled with Clipper DB Accelerator." - John Busch, CEO, ClipperDB Technologies

A deeper look at C4N shapes and specs

C4N instances are available in nine different sizes ranging from 2-192 vCPUs and up to 1.5 TB of DDR5 memory, offering predefined shapes in high-cpu, standard, and high-mem configurations.

For applications that benefit from caching and high-speed, low-latency local storage, C4N VM instances are equipped with up to 12 TiB of latest Titanium SSDs (coming soon, Sign-up here to request C4N Local-SSD preview access). For workloads that require direct access to the machine's resources (e.g., hypervisors, container platforms), where nested virtualization does not meet the workload’s performance requirements, or have special performance monitoring or licensing needs, we are introducing C4N bare metal shapes. Coming soon, these native bare metal shapes will offer the same network and storage I/O performance as their virtual machine counterparts. Google Cloud customers can use C4N instances with Compute Engine and Google Kubernetes Engine (GKE), with support for other services coming soon.

Name	vCPUs	Memory (GB)	Local Storage (GiB)	Network Bandwidth		Hyperdisk Extreme Bandwidth (MiB/s)	Hyperdisk Extreme IOPS
Name	vCPUs	Memory (GB)	Local Storage (GiB)	VM-VM (Gbps)	VM-Internet (Gbps)	Hyperdisk Extreme Bandwidth (MiB/s)	Hyperdisk Extreme IOPS
C4n-highcpu	2 - 192	4 - 384	N/A	25 - 400	7 - 200	1.000 - 25,000	80,000 - 1M
C4n-standard	2 - 192	7 - 720	N/A	25 - 400	7 - 200	1.000 - 25,000	80,000 - 1M
C4n-standard-lssd	4 - 192	15 - 720	375 - 12,000	30 - 400	7 - 200	1.000 - 25,000	100,000 - 1M
C4n-highmem	2 - 192	15 - 1,488	N/A	25 - 400	7 - 200	1.000 - 25,000	80,000 - 1M
C4n-highmem-lssd	4 - 192	31 - 1,488	375 - 12,000	30 - 400	7 - 200	1.000 - 25,000	100,000 - 1M

C4N machine series performance and specifications

How to get started

Whether you’re hosting heavy-duty distributed databases, running network virtualization appliances, or orchestrating large-scale data pipelines for AI, C4N is engineered to provide the throughput, scale, and efficiency your business demands. C4N instances are now generally available via on-demand, as Spot VMs, and via reservations. You can also take advantage of further cost savings by purchasing Committed Use Discounts (CUDs) or FlexCUDs in one- and three-year terms in the us-central1 (Iowa), us-east1 (South Carolina), us-east5 (Ohio), us-west1 (Oregon) and europe-west2 (London). For more information visit Network Optimized Machine Type.

Ready to establish a high-performance launchpad for innovation? Head straight to the Google Cloud console to spin up a C4N VM under the “Network Optimized” machine family. Stay up-to-date on regional availability by visiting our regions and zones page or contact your Google Cloud sales representative for more information.

Google Cloud named Leader in the 2026 Gartner® Magic Quadrant™ for AI Infrastructure

Wed, 08 Jul 2026 16:00:00 +0000

In the agentic era, AI is evolving from answering questions to reasoning and taking action. Companies who want to lead in this next phase of AI need computing infrastructure that’s designed and optimized for these new requirements, helping them innovate faster, deliver compelling user and customer experiences, and optimize for cost and energy efficiency — all at massive scale.

Today, we are pleased to announce that Google has been named a Leader in the inaugural Gartner^Ⓡ Magic Quadrant™ for AI Infrastructure, positioned highest for ‘Ability to Execute’ and furthest for ‘Completeness of Vision’. We believe their findings validate our dedication to solving these challenges internally and for our customers.

Read the full report: 2026 Gartner Magic Quadrant™ for AI Infrastructure

Building on the infrastructure foundation powering Gemini

Today’s model and serving architectures require a fundamental rethinking of how silicon and software interact. We realized early on that the platform we envisioned couldn’t be bought off the shelf — we had to invent it. For over a decade, our infrastructure engineers and Google DeepMind researchers have worked shoulder to shoulder to co-design the entire stack for Gemini, YouTube, and Search. We make those innovations, together with popular third party and open source software, available to our customers through Google Cloud. Today our integrated stack serves 9 out of 10 frontier AI labs; capital markets firms like Citadel Securities; and enterprises like Mercedes Benz.

At the hardware layer, Gartner recognized our commitment to custom silicon as a core strength. Earlier this year we shared two new advancements in custom silicon, our 8th generation TPUs, engineered to solve enterprise scaling and memory bottlenecks at a systems level:

TPU 8t, the training powerhouse: Purpose-built to optimize training timelines, TPU 8t packs 9,600 chips into a single superpod, delivering the high-density compute required for frontier models with nearly 3x the compute performance per pod over the previous generation.
TPU 8i, the inference engine: Engineered to handle the collaborative, iterative work of specialized agents, TPU 8i breaks the memory wall for real-time agentic workflows, with 288 GB of high-bandwidth memory and 384 MB of on-chip SRAM — 3x more than the previous generation — keeping a model's active working set entirely on-chip.

While our TPU platforms push the boundaries of what is possible, we know that one size doesn't fit all. Different customers have different workloads, different requirements, and different use cases. So, we also partner deeply with NVIDIA to deliver the latest accelerated computing platforms as highly performant, reliable and scalable services in Google Cloud. We will be among the first to deliver A5X instances based on the next-generation Vera Rubin platform when it becomes available later this year, enabling customer choice. We also work closely with NVIDIA to integrate GPUs into many Google Cloud software services to give our customers easier access to accelerated computing.

To enable even more flexibility, we continue to contribute to open-source projects across the orchestration, inference engines, and framework layers through llm-d and vLLM. We also recently announced TorchTPU, which gives PyTorch developers portability without complex code rewrites while maximizing the performance of their deployment.

Get more performance per dollar on AI Hypercomputer

As your infrastructure investment grows, you need to balance raw performance and cost to make AI applications economically viable. Taking a ‘buy now, integrate later’ approach to AI is becoming unsustainable. By combining pre-integrated hardware and open software frameworks that feature flexible consumption models, we deliver a unified system engineered for better performance per dollar across training, reinforcement learning, and inference.

Gartner recognized our integrated AI Hypercomputer as a core strength. This AI-optimized infrastructure is engineered to drastically improve your performance per dollar:

A massive compute cluster is only as effective as the storage system feeding it data. Google Cloud Managed Lustre, powered by our new C4NX instances and Hyperdisk Exapools, now delivers 10 TB/s of bandwidth — up to 20x faster than other hyperscalers — while Rapid Buckets transforms object storage with up to 20 million operations per second, helping ensuring large-scale training checkpoints and recoveries happen near-instantly.
Our Virgo Network provides a high-bandwidth scale-out fabric capable of connecting more than one million TPUs across multiple data center sites into a training cluster, or up to 960,000 GPUs across multiple sites without performance degradation — transforming globally distributed infrastructure into a unified supercomputer.
GKE Inference Gateway enables scaling models in production with near-zero latency by combining LLM-aware routing, caching, and the disaggregated serving capabilities of llm-d, increasing throughput by up to 40% while reducing serving costs up to 30%.

Run AI on a fluid infrastructure at virtually any scale

In the agentic era, infrastructure cannot be a rigid, static constraint. It must be an intelligent resource that adapts to the shifting priorities of your business, scaling up with demand and down to zero when agents are idle, with consistent, reliable performance. On AI Hypercomputer, you can:

Train smarter and faster, using Cluster Director and Google Kubernetes Engine to scale up to 130,000 nodes. At the same time, squeeze up to 97% productivity (Goodput) out of every accelerator using TPU 8t together with software co-designed with Google DeepMind and integrated open-source frameworks — from JAX to Pathways and Pallas.
Enable secure, low latency agent execution with GKE Agent Sandbox. Because agents need to scale, GKE Agent Sandbox can sense agent bursts and respond rapidly — provisioning up to 300 sandboxes per second per cluster, then instantly scale back when agents sit idle, optimizing compute costs.
Run distributed enterprise and AI workloads consistently across multicloud, edge, and on premises environments with Cross-Cloud Network and Cloud WAN. This approach delivers low-latency, policy-driven connectivity across Google’s private global backbone spanning over 10+ million kilometers of fiber and over 200 countries and territories, with up to 40% higher performance than public internet routing.

Take the next steps on your journey with AI Hypercomputer

From frontier models, to billion user applications, AI Hypercomputer gives you the purpose-built hardware, open software, and flexible consumption models you need to improve AI performance, cost, and developer productivity. We are honored to see decades of experience building scalable, affordable and reliable AI systems rewarded with a leadership position in Gartner’s research.

You can download a complimentary copy of the 2026 Gartner Magic Quadrant™ for AI Infrastructure on our website.

New ways to keep Google Cloud certifications current and boost your career

Wed, 08 Jul 2026 16:00:00 +0000

If you’re reading this, you’ve likely already done the hard work to prove your qualifications with a Google Cloud certification. And good for you — research shows that’ll help you get ahead. Certified individuals report more responses from recruiters, faster promotions, and higher salaries. In fact, 81% of organizations say certifications from Google Cloud increase their confidence in a job candidate's knowledge or ability.

But the pace of change in cloud technology today means getting certified once isn’t enough. The average half-life of a skill used to be about 6 years; today, it’s about 2.5, according to Harvard Business Review research.

That’s why recertification matters more than ever.

And thanks to some new technological approaches, we’re making it easier than ever to keep those certifications up to date. Tools like skill badges and work-based training are just some of the ways we’re recognizing the progress you’ve already made.

Moving beyond the exam

We know that the traditional recertification model — studying for a multi-hour, proctored exam every two years — is a significant commitment of time and resources. And let’s face it: Exams are stressful. You need your skills to stay current. But you need a better, more flexible way to prove it.

That’s why we’re transforming the recertification process. You can now use Google Skills to take up-to-date courses and skill badges to renew your Google Cloud credential.

Get recertified today

Google Skills now lets you select the most vital courses and skill badges behind each certification so that you can prioritize specific products and competencies most aligned to your role.

Deepen your knowledge with select courses: If you want to brush up on new topics, you can take the latest courses and labs to learn what’s changed.
Fast track with skill badges: If you’re already using new cloud technologies in your daily job, you can jump straight to skill badges. Earning a skill badge entails interactive, hands-on labs that validate your ability to apply your knowledge to a real-world problem. The practical approach of skills badges helps you recertify faster than taking courses.

This streamlined recertification opportunity is now available to individuals holding the following certifications: Cloud Digital Leader, Associate Cloud Engineer, Professional Cloud Architect, and Professional Data Engineer.

Once you’ve completed the required activities while your certifications are active, your certification will automatically be extended by one year. You can learn whatever helps your career the most, whenever you have the time.

Your living credential

In a fast-moving job market, an active certification is a living credential. It tells employers not just what you knew once, maybe even years ago — but that you’re ready for any challenge you’ll face today.

Keep your career growing and get recertified through this new program today on Google Skills.

Gemini Enterprise for Education named a Commander in Tambellini StarChart™: 2026 AI Agents for Administrative Efficiency—Agent Platforms

Wed, 08 Jul 2026 15:14:00 +0000

The agentic AI era is here, transforming how higher education institutions innovate, operate, and fundamentally empower learners, faculty, and researchers. AI agents can deliver unprecedented efficiency, academic innovation, and mission effectiveness as institutions seek to diversify pedagogy, accelerate research, and automate campus operations.

That’s why we are proud to share that The Tambellini Group has named Gemini Enterprise for Education a Commander, the report’s highest category, in the Tambellini StarChart™: 2026 AI Agents for Administrative Efficiency—Agent Platforms, ranking first in innovation and usability. We believe this recognition underscores Google’s AI leadership position in the market, performant Gemini models, and agentic platform that is already being used to strengthen student support and drive new efficiencies across higher education.

The Tambellini StarChart states: "Gemini Enterprise for Education is differentiated by how much it brings together in one place. It combines Gemini models, agent-building tools, enterprise search, governance controls, and Google Cloud infrastructure in a single environment. For institutions that do not want to manage a mix of disparate tools, this creates a clearer path to building and managing AI services at scale."

Source: “StarChart™: 2026 AI Agents for Administrative Efficiency—Agent Platforms,” By Alpha Hamadou Ibrahim, PhD, April 2026

Drive impact with Gemini Enterprise for Education

Gemini Enterprise for Education brings together the best of Google’s AI-optimized cloud services, industry-leading Gemini models, and agentic solutions. It is a seamlessly integrated solution designed from the ground up for AI, built upon three core strengths:

A flexible, unifying foundation built on the Google Cloud stack: Gemini Enterprise for Education stands out because of the unmatched breadth of the surrounding Google Cloud stack. While many campuses are currently limited by siloed, single-task AI applications, Google’s platform enables institutions to establish a custom, unified architecture. In our view, this aligns with the report’s finding that Gemini Enterprise for Education "is best understood as part of a broader cloud AI environment rather than as a single packaged higher education application." By providing this holistic environment, the report notes that the platform offers "a familiar foundation for building conversational and agent-based services that can work across different interfaces, data types, and connected systems." We think this foundation gives institutions complete control to shape how agents are designed, integrated, and deployed across their campus.
Automating complex campus operations to shift focus to strategic oversight: Leveraging this flexible architecture, Gemini Enterprise for Education empowers institutions to handle complex administrative workflows and unify campus intelligence. By taking on multi-step tasks, AI agents allow institutions to shift their focus from manual administrative work to strategic oversight. We believe this is supported by the report’s analysis that the platform "can support administrative use cases such as advising, student support, and service operations" to "administrative efficiency across business, academic, and research operations." Tambellini also states that "simpler agents can be created through no-code tools, while more advanced use cases can be built through the Agent Development Kit and Agent Runtime," which we believe highlights the technical versatility of the platform, allowing campuses to easily design tailored solutions.
Empowering the entire campus with secure, governed AI agents: Beyond administrative efficiency, Gemini Enterprise for Education serves as the new front door to agentic AI for every student, faculty member, and researcher. Users are empowered to trade manual busywork for breakthroughs by deploying custom agents that provide 24/7 adaptive support for the academic journey. In our view, this is validated by Tambellini's focus on the platform’s connection to institutional data, stating that "agents can be grounded in sources such as productivity tools, content repositories, databases, and data platforms like BigQuery" and that features like "enterprise search and Deep Research extend this further by helping users find and synthesize information across connected internal sources." Crucially, as this technology scales, institutions are able to maintain trust. As the report highlights, "administrative controls, permission inheritance, role-based access, logging, and Model Armor help institutions manage access, oversight, and data protection within the same environment."

We believe our Commander placement in the Tambellini StarChart validates a decade plus of investments in AI, security and cloud to drive innovation and impact across teaching, learning and research.

Transforming campus operations

We are driving real-world impact across academia, helping them achieve enhanced operations and strategic progress. From automating complex campus workflows to advancing AI-enabled learning, our customers are seeing measurable benefits:

UC Riverside: UC Riverside implemented Gemini Enterprise for Education to provide a unified portal for agent experiences across its entire campus community of 25,000 students, faculty, and staff. For the personnel driving the university's mission, the focus is on augmentation. By using Google AI as a force multiplier, the ITS team is transforming how the university operates.
Purdue University: Purdue's broad AI strategy is centered on five core areas: learning with, learning about, researching, using, and partnering in AI. Google Cloud provides the flexible, AI-optimized tech stack needed to support this entire spectrum. Additionally, the platform, coupled with the creation of the new Google AI Hub space, is helping Purdue foster hands-on collaboration, automate campus operations, and advance AI-enabled education.

Build the agentic future with us

As higher education continues to evolve, agentic AI offers a path toward more resilient, efficient, and student-centered institutions. To explore how these capabilities are being evaluated across the sector and learn more about Google’s position as a Commander in the administrative efficiency category, download the report excerpt from The Tambellini Group.

Join us at the Higher Education Leader Series

We invite you to join fellow leaders and trailblazers at Google for Education’s Higher Education Leader Series to explore how technology and human-centric design come together to transform the university experience. We are hosting this event in Sunnyvale, CA, on July 16, and New York, NY, on July 30. Register here to secure your spot.

Meet the 33 cybersecurity startups joining the Gemini Startup Forum

Wed, 08 Jul 2026 13:30:00 +0000

Startups are at the forefront of tackling some of the world’s most complex challenges, especially in cybersecurity, where new ideas and adaptability are always needed. These companies are embracing AI as a powerful tool, enabling them to scale their impact.

Google believes that enabling the next generation of AI-native cybersecurity startups will have a positive impact across the globe. Today, we are thrilled to announce that our flagship Google for Startups program, Gemini Startup Forum: Cybersecurity, has selected its first 33 trailblazing startups. This exclusive forum is designed to address critical domains and foster deep dialogue on AI integration in cybersecurity.

Every startup will be able to work on their roadmap alongside AI and cybersecurity specialists from Google DeepMind, Google Cloud, and Wiz. This year’s cohort is organized into six specialized focus areas, from autonomous agent protection to post-quantum cryptography.

AI agent security and governance

Capsule Security (Israel): Delivers runtime protection and behavioral monitoring for autonomous AI agents. The platform tracks agent activities, API calls, and tool usage in real-time to prevent unauthorized actions and data exfiltration across software-as-a-service (SaaS) and endpoint agents.
Evoke Security (United States): Functions as an endpoint detection and response (EDR) platform designed for AI agents. It deploys an endpoint sensor to scan for risky agent configurations, monitor runtime behavior, and block unauthorized skill executions.
Manifold Security (United States): Provides agentless detection and response for AI agents using graph analysis and runtime monitoring. By tapping into open telemetry and API hooks, the platform maps agent behavior and connections to identify anomalies without installing software on local machines.
Mirror Security (Ireland): Specializes in data-in-use protection for AI workloads using fully homomorphic encryption. The platform enables enterprises to perform model inference, database searches, and agent communications directly on encrypted data without decrypting it.
Onyx Security (Israel): Offers an AI control plane to discover, govern, and monitor autonomous AI agents across enterprise environments. The platform analyzes agent posture, tracks session token streams, and uses a model mesh to enforce context-aware compliance policies.
Refractal (United Kingdom): Builds runtime security and governance, risk, and compliance (GRC) infrastructure to monitor and govern enterprise AI agents. It intercepts agent actions, evaluates them against organizational policies and European regulations, and generates cryptographic audit logs.
Unbound Security (United States): Acts as an agent access security broker (AASB) that provides visibility and governance for developer-focused coding agents. It deploys endpoint hooks to monitor terminal commands and restricts agent actions based on user identity and group permissions.
XOR (United States): Produces reinforcement learning training data and environments to help AI models autonomously find and fix their own security flaws. The company provides verified task trajectories and benchmarks that developers use to train secure coding agents.

Application security and vulnerability management

Aisy (United Kingdom): Models enterprise environments from an attacker's perspective to prioritize vulnerability remediation. The platform maps external attack surfaces, groups related assets into business-centered threat models, and identifies critical exploit chains.
Alt Security (Israel): Develops an agentic penetration testing platform that uses autonomous AI agents to perform security testing. The system automates reconnaissance, chains vulnerability findings to identify critical business risks, and validates exploits in sandboxed environments.
Arcjet (United States): Provides application security that executes natively inside developer codebases via an SDK. The platform handles bot detection, rate limiting, and prompt injection directly in the codebase, maintaining a low-latency decision loop.
Pixee (United States): Automates vulnerability triage and code remediation by converting scanner results into verified pull requests. The platform uses a context graph and a deterministic harness to generate codebase-compatible fixes that pass developer continuous integration (CI) pipelines.

Cloud, network, and infrastructure security

CloudFence (United States): Monitors a company's cloud network like an invisible overhead drone. It studies the normal patterns of how systems talk to each other and immediately alerts managers if a system starts talking to an unfamiliar location.
CyberSeQ (United Kingdom): Scans software code and digital pipelines to check if their encryption is outdated. It helps organizations plan their transition to modern, quantum-proof security keys.
Huskeys (Israel): Works as a smart tuner for a company's digital firewall. It automatically optimizes and adapts traffic filters in real-time, reducing false alarms so legitimate customers can visit websites without being blocked.
Native (Israel): Serves as a multicloud security control plane that manages built-in native provider controls across Google Cloud, AWS, Azure, and Oracle. The platform uses a simulation engine to preview the operational impact of security policy changes before deployment.
Prowler (United States): Automates cloud security posture management and compliance checks across multicloud environments. The open-source platform uses a database of community-driven security controls to identify and remediate misconfigurations.
QIZ Security (Israel): Manages enterprise cryptographic assets and compliance posture through a centralized dashboard. The platform maps certificates, databases, and source code into a knowledge graph to help organizations transition to post-quantum cryptography.
Tracebit (United Kingdom): Uses cloud-native decoys, or canaries, to detect infrastructure intrusions and unauthorized access. The platform deploys these decoy resources at scale via infrastructure-as-code to trigger alerts the moment an attacker moves.

Endpoint security and data protection

Bold Security (United States): Provides a user-space endpoint security agent that protects enterprise devices from data exfiltration and insider threats. The agent runs local classification models on-device, allowing for policy enforcement and data loss prevention without cloud latency.
Glow (Israel): Unifies endpoint, software, and AI agent monitoring into a single workspace protection layer. By using a team of collaborative AI agents, the platform maps organization-wide software footprints and blocks unauthorized browser extensions and plugins.
Jazz (United States): Modernizes data loss prevention (DLP) by analyzing user intent and business context rather than relying on static pattern rules. It uses a lightweight endpoint agent and an intelligent investigator to automatically triage and resolve data-flow alerts.
ORION Security (United States): Deploys an indicator-driven data loss prevention platform that tracks data lineage across endpoints, browsers, and SaaS tools. By mapping file movements in a graph database, the platform identifies exfiltration risks without requiring manual policies.
MokN (France): Combats credential theft through a proactive identity recovery platform. Its proprietary technology turns the tables on attackers by using ultra-realistic decoy access points to trick them into revealing the credentials they have stolen. This can help neutralize threats before the compromised credentials can be exploited.

SOC automation and offensive security

COGNNA (Saudi Arabia): Operates an agentic security operations center (SOC) platform that analyzes security alerts and automates threat response workflows. The platform ingests telemetry from existing endpoint and security information and event management (SIEM) tools, using AI agents to investigate incidents and reduce alert noise.
Latent Defense (United States): Builds foundational world models for cybersecurity to represent complex system architectures as dense, multi-dimensional graphs. The platform uses these graph representations to identify exploitable attack paths and test them with automated red-teaming agents.
Mate Security (Israel): Investigates security alerts at scale using an AI-native security operations platform. It integrates with existing SIEM and security orchestration, automation, and response (SOAR) tools to map asset relationships, automatically triage incoming alerts, and minimize false-positive rates.
Nrdsnipe (Sweden): Builds an AI-driven security testing platform, Hedgehog, that automates internal network penetration testing. Deployed directly in customer networks, it uses planner and terminal agents to map assets and construct exposure-based knowledge graphs.
RIFFSEC (Poland): Delivers an early-warning threat intelligence and attack surface management platform tailored for the central European market. It monitors the dark web, Telegram channels, and code repositories to identify leaks, exposed credentials, and phishing campaigns.
TandemTrace (Spain): Augments security operations teams with autonomous AI agents that analyze raw telemetry to investigate alerts and hunt threats. The platform connects directly to existing data lakes and SIEM APIs to build human-readable context around security incidents.

Security infrastructure and specialized services

Netsec (France): Manages the entire IT and cybersecurity lifecycle for mid-sized organizations through an all-in-one platform delivered directly inside collaboration channels. It automates user onboarding, device management, and SaaS posture remediation from a single control plane.
Revelum (United States): Detects and dismantles deepfake-driven fraud and impersonation campaigns at scale. The platform uses vision models and classification engines to analyze social media advertisements, verify biometric identities, and automate domain takedowns.
Synqly (United States): Provides a unified connectivity platform and API management control plane that simplifies integrations between IT and cybersecurity tools. It normalizes data schemas and acts as a deterministic middleware layer to facilitate bidirectional data sharing.

By collaborating with global specialists, these startups are well-positioned to build a safer, more resilient digital infrastructure. The Gemini Startup Forum is a benefit of the Google for Startups Gemini Kit, packed with APIs, tools, training and technical resources to help startups scale with AI. You can learn more about the kit here.

The threat landscape is always evolving. To meet this challenge, we will continue our commitment to Google for Startups. Over the past four years, we’ve supported more than 50 cybersecurity founders, including Authologic, BforeAI, Build38, Cerby, Crowdsec, and Risk Ledger.

This year's cohort reflects the industry's transition from perimeter defense to autonomous AI agent security — emphasizing enterprise governance and the safe deployment of self-governing AI. Looking ahead, the integration of these technologies will help define the next generation of proactive digital defense.

A developer's guide to publishing agents in Gemini Enterprise and Google Cloud Marketplace

Tue, 07 Jul 2026 16:00:00 +0000

Software-as-a-service (SaaS) is evolving into Agents-as-a-service (AaaS).

Instead of isolated applications, developers are creating AI agents that interoperate using standardized open protocols such as the Agent2Agent (A2A) protocol and can be orchestrated through centralized agent platforms like Gemini Enterprise Agent Platform.

When building for your specific use case, we believe the goal should always be to engineer high-quality agents that combine autonomy with the ability to reliably execute complex, multi-step workflows that deliver clear business value. For agent builders and developers looking to publish and commercialize these high-impact, third-party agents through Google Cloud Marketplace and to deploy them to the Gemini Enterprise app, this guide provides a step-by-step path to a fully integrated, marketplace-ready solution.

Step 1: Design your agent architecture for integration with Marketplace

The end-state architecture bridges Google Cloud Marketplace billing, identity provider (IdP) security, and Gemini Enterprise Agent Platform.

Here’s an overview of these architectural elements:

Customer project: Where users discover agents via the dedicated Agent Marketplace category within Google Cloud Marketplace and interact with these agents through the Gemini Enterprise app.
Partner project: Hosts your agent as well as the marketplace handler, which handles the logic for procurement, and Dynamic Client Registration (DCR) for authorization.
Partner Marketplace project: Manages the Partner Procurement API and Pub/Sub topics for Marketplace events like account creation or entitlement approvals.

Step 2: Review the organizational requirements to sell on Marketplace

Join the Google Cloud Partner Network: If you're new to offering your solutions on Marketplace, join the Google Cloud Partner Network.
Review Agent-as-a-Service listing requirements. Verify that your organization meets the requirements to list your solutions on Marketplace.
Marketplace Vendor Agreement: Review and accept the Marketplace Vendor Agreement (MVA).
Nominate your agent for Google Cloud Marketplace by contacting your Google Cloud representative.

All agents listed on Marketplace must comply with the above standard requirements plus several agent-specific mandates:

Define your agent use case: We recommend defining specific, agentic use cases targeting high-value enterprise functions designed to solve tangible pain points and scale across multiple enterprise customers.
A2A protocol adherence: Agents must comply with the A2A protocol specifications for interoperability. This can include the A2UI protocol which enables your agents to generate rich, interactive user interfaces.
A2A Agent Card: Create an Agent Card, a JSON file declaring capabilities (skills), authentication methods, and service endpoints.
Authentication: Agents must support public access or OAuth 2.0 Authorization Code Grant Flow.
Marketplace integration: Mandatory integration with Procurement APIs and Pub/Sub for entitlement lifecycle management.

Step 3: Review the technical requirements for your agent to be compatible with Marketplace and the Gemini Enterprise app

A2A protocol

When designing and implementing your agent, ensure you follow the A2A protocol documentation. This will guide you on choices for interaction patterns (e.g., streaming or asynchronous tasks) that your agent can provide and can include incorporating an interactive UI experience using the A2UI protocol. Using A2UI allows you to leverage the latest and greatest UX controls available—such as advanced, dynamic charts and modern interaction models. By utilizing these native user controls, you ensure your agent doesn't just function reliably, but looks, feels, and operates with a premium sense of "pride in craft" inside the Gemini Enterprise app.

A2A agent card

To list your Agent-as-a-Service product on the Marketplace, you must provide an A2A Agent Card for your agent. The Agent Card is a JSON file declaring the agent's capabilities (skills), supported authentication & authorization methods, and service endpoints.

The Gemini Enterprise app relies on your Agent Card to:

Display your agent name, description, and other necessary metadata.
Locate endpoints for Dynamic Client Registration (if supported).
Discover agent entry points for sending messages or getting task execution status updates.
Determine the required authentication/authorization methods.

Here is an example Agent Card with definition below.

code_block: <ListValue: [StructValue([('code', '{\r\n "name": "AI Agent Example",\r\n "protocolVersion": "1.0",\r\n "description": "Marketplace agent example.",\r\n "url": $AGENT_APP_URL,\r\n "preferredTransport": "JSONRPC",\r\n "provider": {\r\n "organization": $AGENT_PROVIDER_ORGANIZATION,\r\n "url": $AGENT_PROVIDER_URL\r\n },\r\n "version": "1.0.0",\r\n "capabilities": {\r\n "streaming": false,\r\n "pushNotifications": false,\r\n "extensions": [\r\n {\r\n "uri": "https://cloud.google.com/marketplace/docs/partners/ai-agents/setup-dcr",\r\n "params": {\r\n "target_url": $AGENT_DCR_URL\r\n }\r\n }\r\n ]\r\n },\r\n "defaultInputModes": [\r\n "application/json"\r\n ],\r\n "defaultOutputModes": [\r\n "application/json"\r\n ],\r\n "skills": [\r\n {\r\n "id": "current_time_generation",\r\n "name": "Current time generation",\r\n "description": "Generates a current time.",\r\n "tags": [\r\n "time"\r\n ],\r\n "examples": [\r\n "What time is it?"\r\n ]\r\n }\r\n ],\r\n "supportsAuthenticatedExtendedCard": false,\r\n "iconUrl": $AGENT_ICON_URL,\r\n "security": [\r\n {\r\n "oauth2": [\r\n $AUTH_SCOPE\r\n ]\r\n }\r\n ],\r\n "securitySchemes": {\r\n "oauth2": {\r\n "type": "oauth2",\r\n "flows": {\r\n "authorizationCode": {\r\n "authorizationUrl": $AUTHZ_URL,\r\n "tokenUrl": $TOKEN_URL,\r\n "refreshUrl": $REFRESH_URL,\r\n "scopes": {\r\n $AUTH_SCOPE: $AUTH_SCOPE_DESCRIPTION \r\n }\r\n }\r\n }\r\n }\r\n }\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a08d5b20>)])]>

$AGENT_APP_URL - A required field representing the base URL endpoint where the A2A agent can be reached. All API calls to the agent will use this as the base path.
$AGENT_PROVIDER_ORGANIZATION - A required field representing the agent provider's organization.
$AGENT_PROVIDER_URL - A required field representing the agent provider's website or relevant documentation.
$AGENT_DCR_URL - A required field if the agent implements Dynamic Client Registration (DCR).
$AGENT_ICON_URL - An optional field providing a URL to an image file to be used as an icon for the agent. If provided, it will be displayed in the Gemini Enterprise app.
$AUTH_SCOPE - An array of strings listing the scope names required for the client to access the agent's operations.
$AUTH_SCOPE_DESCRIPTION - Scope description. Example: "Permission to retrieve email address of the user.”
$AUTHZ_URL - A required part of the OAuth2 security scheme definition for the Authorization Code flow. It specifies the URL of the authorization server's endpoint used to obtain an authorization code from the resource owner. This follows the OpenAPI Specification.
$TOKEN_URL, $REFRESH_URL - URLs for the client to exchange the authorization code for an access token and a refresh token (can be the same).

Authentication and authorization

Implement authentication and authorization for your agent according to the A2A protocol. To allow the Gemini Enterprise app to call your agent, you must establish one of these two methods for your agents:

Public Access: No authentication required. Suitable only for agents that do not access any user data or sensitive resources.
OAuth 2.0 Authorization Code Grant Flow: This is the standard flow for delegated user authorization. Users will be prompted to authorize your agent to access their data or act on their behalf.

Dynamic Client Registration (DCR)

Traditionally, connecting a third-party app to an enterprise system required manual copying of Client IDs and secrets. DCR eliminates this by allowing Gemini Enterprise to programmatically register itself as an OAuth client with your agent's authorization server.

How the DCR Flow Works:

Discovery: The Gemini Enterprise app reads your Agent Card to find the DCR endpoint.
Request: Google sends an HTTP POST to your endpoint containing a software_statement which is a cryptographically signed JSON Web Token (JWT).
Validation: Your backend verifies the JWT signature using Google's public keys to ensure the request is authentic.
Provisioning: Upon success, your server creates a new OpenID Connect (OIDC) application in your identity provider (e.g., Okta) and returns the client_id and client_secret to Gemini Enterprise.

code_block: <ListValue: [StructValue([('code', 'DCR Request\r\n{\r\n "software_statement": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImY1OTIwZDJmMjIyYjNjMTE3Y2MyZmQzZmQxYWJjNzM..."\r\n}\r\n\r\nJWT Decoded\r\nHere is the decoded value of software_statement parameter:\r\n\r\nHeader:\r\n{\r\n "alg": "RS256",\r\n "kid": "f5920d2f222b3c117cc2fd3fd1abc7367fd00402",\r\n "typ": "JWT"\r\n}\r\nPayload:\r\n{\r\n "aud": "https://your-provider.com",\r\n "auth_app_redirect_uris": [\r\n "https://vertexaisearch.cloud.google.com/oauth-redirect"\r\n ],\r\n "exp": 1766773074,\r\n "google": {\r\n "order": "xxxxxxxx-c3bc3976a8e0"\r\n },\r\n "iat": 1766772774,\r\n "iss": "https://www.googleapis.com/service_accounts/v1/metadata/x509/cloud-agentspace@system.gserviceaccount.com",\r\n "sub": "xxxxxxxx-xxxx-xxxx-xxxx-4656e5b81fe8"\r\n}\r\nDCR Response\r\n{\r\n "client_id": $CLIENT_ID,\r\n "client_secret": $CLIENT_SECRET,\r\n "client_secret_expires_at": 0\r\n}'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7fc6a08d5a00>)])]>

Note: Validating the JWT ensures the request is from Google, but you must cross-reference the google.order ID against your database to ensure the user has actually paid.

Step 4: Publish your agent listing on Marketplace

Once you’ve built your agents, you will need to publish and offer them on Google Cloud Marketplace. This is where you describe your agent and define availability and pricing models. The seller journey begins in the Producer Portal accessible through Google Cloud Console:

Select Solution Type: Choose "AI Agent as a Service" as the product type in the Producer portal.
Upload Agent Card: Provide the Agent Card JSON file via a Google Cloud Storage (GCS) bucket.
Availability: Decide whether the AI agent listing can be purchased through publicly available pricing (self-service) or available via private offer only.
Pricing: Create your pricing plan and choose the pricing model you want to use to monetize the agent through Marketplace.
Technical Integration: Configure the backend procurement. No frontend integration is required for this solution type.
Validation and End-to-End testing: Google Cloud reviews the agent's functionality, security, and pricing model before it is published to the catalog.
Publish: Agent is now successfully published and available in Google Cloud Marketplace.

Step 5: Managing transactions and registrations in Marketplace and the Gemini Enterprise App

There are distinct phases to the procurement and registration lifecycle of agents on Google Cloud Marketplace and the Gemini Enterprise app, which is critical for establishing strict enterprise governance, preventing shadow IT, and ensuring seamless compliance across the organization. A secured chain of custody is managed across three key personas: the Billing Administrator, who maintains financial oversight by controlling procurement and spending on Google Cloud Marketplace; the Discovery Engine Administrator, who acts as the technical gatekeeper by securely registering verified agents and determining organizational access in Gemini Enterprise; and the Discovery Engine User, who can safely leverage the agent's full capabilities within their Gemini Enterprise app only after completing proper identity authorization.

1. Procurement Flow - Async (Google Cloud Marketplace)

Once listed, the backend procurement sequence follows these steps:

Trigger: A customer with Billing Administrator privileges clicks "Subscribe" (for self-serve listings) or accepts a "Private Offer" (for tailored private offer only listings).
Notification: Google sends a Pub/Sub notification to your environment.
Approval and storage: Your integrated marketplace handler approves the account and the entitlement via the Partner Procurement API.
Activation: The handler records the transaction by storing the unique Order ID in a database like Firestore, instantly activating the subscription or offer for the customer.

As shown above, the Billing Administrator executes a one-click subscription to activate the Lovable Agent free plan alongside their already active SaaS subscription procured through Cloud Marketplace.

2. Registration flow - sync (Gemini Enterprise)

After successful procurement, the customer's administrator links the purchase to their actual Gemini Enterprise app environment:

Redirect to Gemini Enterprise: The Discovery Engine Administrator will see a "Go to Gemini Enterprise" option directly on the procured Marketplace listing.
Project Verification: Clicking this prompts the administrator to log into the Google Cloud project where their Gemini Enterprise licenses are allocated. Note that the customer must ensure this destination Google Cloud project is actively linked to the specific billing account used during procurement.
DCR Handshake: The Discovery Engine Administrator configures the agent within the Gemini Enterprise app. At this point, your Dynamic Client Registration (DCR) logic validates the incoming JWT's Order ID against your Firestore records. If the IDs match, the secure registration completes successfully.
Agent successfully Registered: Agent is now successfully registered in Gemini Enterprise. Discovery Engine Administrator can now decide whom to give access to the agent.

Following procurement, the Discovery Engine Administrator registers the Lovable Agent into the Gemini Enterprise app to make it available to authorized users across an organization.

3. End-User Activation Flow (Gemini Enterprise)

Once the agent is securely registered, it becomes discoverable to your target enterprise users:

Gemini Enterprise in-app agent discovery and requests: End users have the ability to browse and directly request access to any available partner-built agent from Cloud Marketplace within the Agent Gallery in the Gemini Enterprise app. When a request is submitted, the Discovery Engine Administrator can review the request and coordinate directly with the organization’s Billing Administrator to procure the agent through Google Cloud Marketplace, and, if already procured and registered, can give access to the end user.
Access: Once access is given to the agent, any end user with an active Gemini Enterprise app account and Discovery Engine User role and license will be able to invoke the agent within their Gemini Enterprise app.
Authorization: Upon the first interaction, the user will be prompted to complete an OAuth authorization by inputting their partner-system username and password. Once authenticated, they can seamlessly leverage the agent's full capabilities from the Gemini Enterprise app chat interface.

An end user seamlessly invokes the Lovable Agent inside the Gemini Enterprise app, completes the one-time partner authorization prompt, and initiates a live conversational task workflow.

An end user requests access to Atlassian Rovo, another agent available from Marketplace, directly from the Agent Gallery in the Gemini Enterprise app. In this demo scenario, the agent has already been procured from Marketplace, allowing the Discovery Engine Administrator to verify, integrate, and instantly grant access.

Get started

Building agents for Gemini Enterprise and Google Cloud Marketplace as an AI Agent-as-a-Service solution provides a path to extend your reach and to get your agent into the daily workflow of millions of enterprise users.

We encourage you to start building today using tools like the Agent Development Kit (ADK) and to learn more about how you can accelerate your growth in the era of the agentic enterprise with Google Cloud Marketplace.

For any assistance, you can contact Google Cloud Marketplace support team.

Report: 83% of organizations need to upgrade their infrastructure to support agentic AI

Tue, 07 Jul 2026 16:00:00 +0000

For years, enterprise AI has been synonymous with conversational AI — the customer service bots and digital assistants we interact with every day. But today, the market has shifted. We’ve officially moved from moving from AI that answers through simple chats, to AI that takes action, automated workflows, and executes complex tasks on its own. While this unlocks entirely new use cases, there’s a catch: it places significant stress on the underlying infrastructure we’ve relied on in the past.

We recently surveyed more than 1,400 senior IT leaders for our State of AI Infrastructure report, and a resounding pattern emerged: the gap between AI ambition and infrastructure reality is widening. In fact, 83% of organizations say they require infrastructure upgrades to support production-grade agentic AI.

Why? Because yesterday’s infrastructure simply wasn't built for agents that act autonomously.

In this blog, we lay out the core insights from our research on how leading organizations are rethinking their infrastructure to build resilient, fluid foundations. For more details and depth, we encourage you to download and read the full report.

Escape the “inference tax” with fluid compute

Agentic workloads introduce a new level of scale, where a single prompt can trigger hundreds of downstream actions, requiring massive context windows to be held in memory. Trying to run these continuous reasoning loops on legacy architecture is financially unsustainable. In fact, 62% of leaders are seeing a significant inference tax driven by data egress fees, storage bloat, and idle specialized hardware. Furthermore, 81% cite operational complexity as a hidden cost of scaling AI.

To fix this, organizations need fluid compute — the ability to dynamically match the right silicon to the right task while minimizing operational overheads.

For heavy training: Compute accelerators like our new TPU 8t deliver tremendous scale to train the world's most sophisticated models.
For low-latency inference: The TPU 8i, meanwhile, was purpose-built to maximize on-chip memory, so agents can think and react in real-time.
For orchestration: General-purpose compute powered by CPUs is emerging as a critical component for driving AI control plane operations. Using highly efficient, Arm-based processors like Google Axion, organizations can cost-effectively run reinforcement learning simulations and orchestrate agents.

Managing agent sprawl with centralized governance

Agents are designed to act autonomously — reading emails, querying databases, and executing workflows across your business. But as agentic AI scales, organizations are facing a new challenge: agent sprawl. How do you manage thousands of autonomous agents scattered across diverse platforms, without losing visibility and control?

It’s no surprise that 79% of tech leaders cite security, governance, and MLOps as their top challenge to scaling inference. In the agentic era, you need a mature governance strategy before you can innovate. This entails creating a centralized control plane that provides a single system of record for agent permissions, identity, and workflows.

Instead of patching together disparate tools, leading enterprises are relying on solutions like Agent Gateway to enforce enterprise-grade governance. Agent Gateway gives you the visibility you need to see exactly how agents are sharing data. It lets you define precise read/write scopes and maintain full audit trails of every interaction, and it provides human-in-the-loop oversight for when an agent needs approval before taking a critical action. This drive for unified, straightforward governance explains why 78% of organizations now source their gen AI solutions directly from their primary cloud partner — a 30 point increase from 2025.

A unified data layer

Agents perform reasoning, meaning they constantly run heavy queries across your organization. If your data is fragmented across silos, your AI is effectively flying blind.

To move from managing disconnected data to gathering unique and actionable business context, leaders are adopting a unified data layer. Using tools like Smart Storage — which automatically annotates unstructured data to make it searchable — and the Cross-Cloud Lakehouse, agents can natively read and understand data no matter where it lives, without needing custom pipelines or duplicated data.

Hybrid multicloud and digital sovereignty

The debate between public cloud and local computing is settled: hybrid is the destination. In fact, 52% of organizations now use a hybrid multicloud architecture.

For technology leaders, this shift is largely driven by digital sovereignty and data gravity. Indeed, 48% of leaders are prioritizing infrastructure with strict data residency controls. You need the flexibility to run AI where it complies with shifting local laws. Whether that’s leveraging the public cloud for broad compute, or bringing foundational models entirely on-premises via Google Distributed Cloud for air-gapped isolation, modern infrastructure must adapt to geopolitical realities, not the other way around.

AI at the edge

For technology leaders and infrastructure architects, relying on a strictly centralized cloud topology to process every agentic interaction is not a viable strategy. A staggering 90% of organizations now rank edge deployment as important for AI initiatives, with 72% describing it as extremely or very important.

Moving AI to the edge solves three issues:

The latency bottleneck: Real-time agents — especially those that rely on voice, video, or financial trading algorithms — can't afford the microsecond gap of a round-trip to a distant data center.
Operational resilience: If an internet connection drops, business can't stop. Edge deployment ensures that agents running in manufacturing plants, retail stores, or hospitals can continue functioning autonomously.
Sustaining cost-efficiency: Running always-on, continuous reasoning in the cloud is expensive. By utilizing highly optimized models on edge devices (like smartphones, IoT devices, or local warehouse servers), organizations shift the compute burden locally, drastically cutting variable per-token costs.

Breaking through the energy wall

Energy consumption used to be a sustainability metric reserved for annual reports. Today, it plays a crucial operational role. 91% of leaders now factor power consumption into their hardware selection, with 61% rating it as a primary or significant factor.

For technology leaders, power consumption presents a three-fold barrier to growth:

Grid scarcity: You simply cannot buy more power in certain regions, heavily limiting how much compute infrastructure can be provisioned.
Regulatory compliance: Energy efficiency is now a strict legal prerequisite to operate. For example, in Germany, new data centers must achieve a Power Usage Effectiveness (PUE) of 1.2 or lower. And Ireland now mandates that large data centers provide 100% on-site dispatchable generation to match their grid draw.
Infrastructure economics: Inefficient power envelopes drastically inflate the Total Cost of Ownership (TCO) of AI deployments. Accommodating high-power hardware requires massive capital expenditure (CapEx) for advanced cooling architectures, specialized rack designs, and facility upgrades.

To address the energy wall, technology leaders must treat energy as a strategic asset. One of the focus areas for optimization must shift to performance-per-watt. This is why co-designed silicon is becoming so important. For example, our new TPU 8t delivers nearly three times the performance of the prior generation while being up to twice as energy-efficient.

Unified, AI-optimized infrastructure

Ultimately, you cannot solve the challenges of tomorrow’s agentic systems with yesterday’s architecture. When engineering teams are forced to manually integrate heterogeneous compute, storage, and networking layers, organizations incur high operational overhead just to ensure basic interoperability.

To innovate quickly and cost-effectively, technology leaders are therefore moving toward holistic, unified systems.

This is the philosophy behind Google Cloud’s AI Hypercomputer. It’s an architecture where every layer is co-designed and co-engineered to work together. The custom silicon (TPUs, GPUs, CPUs) isn't designed in a silo; it's engineered alongside the ultra-high-bandwidth networking (Virgo Network), the storage (Managed Lustre, Hyperdisk), and the software orchestration layer (GKE).

Bridging the digital and physical worlds

When you embrace this co-designed, holistic approach, the results go far. With this level of scalable, fluid intelligence operating at the edge, we're entering the era of physical AI. A new generation of autonomous robots can sense, simulate, and navigate the physical world, practicing tasks millions of times in digital twin simulations on Google Cloud before they ever set foot in the real world. From performing complex industrial inspections to capturing cinematic videography, AI is now solving tangible problems in the real world.

Your blueprint for agentic AI

Adapting your infrastructure to meet the demands that agentic applications place on your systems will help you move from pilot to production. The organizations set to thrive in 2026 are embracing a unified foundation that is cost-efficient, resilient at the edge, optimized for autonomous action — and governed by default.

Ready to start? Download the State of AI Infrastructure report to explore the data behind our findings, and discover how your peers are already building for success.

20 questions for the Agentic Enterprise (and how Agent Platform can help)

Tue, 07 Jul 2026 16:00:00 +0000

If you’re an IT leader, you might be getting a lot of questions about how to build and deploy agents.

The pressure to move fast is intense, but the engineering reality is incredibly complex. Where do your teams even begin? How do you untangle a fragmented mess of disconnected tools? And as things grow, how do you ensure your agents don’t accidentally leak sensitive data, or burn through your token budget in an afternoon? It’s a lot to balance, and trying to establish a secure foundation for an entire organization can quickly feel overwhelming.

That’s why we built Gemini Enterprise Agent Platform. It gives your technical teams a unified destination to build, scale, govern, and optimize both customer-facing agents and the ones managing your internal operations. Agent Platform handles the underlying complexity so your teams can focus on driving actual business value.

To help you navigate these conversations, we gathered 20 essential questions to ask your engineering teams, along with some practical advice and code examples to get you going. Let’s dive in.

The build phase — establishing the foundation

#0 Who is building the application?
Before choosing a tool, look at who on your team is actually doing the work. Is it your engineer? Your legal team? Building with AI is no longer exclusive to high-code engineers. Anyone can vibe code now. This incredible accessibility has turned millions of non-coders into creators who can build and launch applications in seconds. So it means your work could be coming from anywhere. This may sound like an obvious step, but it’s an important one in the AI era.

The ecosystem now spans a spectrum of personas: no-code business experts defining logic via visual interfaces (think: your business teams, sales, and marketing), low-code developers assembling modular parts, and high-code engineers creating bespoke, custom reasoning loops. Successful adoption means choosing a platform that empowers all three personas without siloing your data or security.

#1 Where should my developers start?
When setting up an agentic strategy, it's easy to focus exclusively on the end product, like the agents that will handle customer support or financial analysis. But to build those sophisticated agents, you have to start by empowering the builders who write their underlying logic. Your developers need their own specialized AI tools, like coding agents, to accelerate code generation, scaffolding, and integration.

However, most coding agents are isolated. They can only analyze the immediate file they are working on, with no connection to your live databases, internal documentation, tech stack, or business systems.

To keep your devs moving quickly without sacrificing governance, we recommend using Google Antigravity as your primary engineering harness, and then integrating specific extensions based on what that team is building. Here’s a helpful breakdown:

For core application engineers: Use the upgraded Agent Development Kit (ADK) as your baseline framework, paired with Agents CLI to handle the entire agent lifecycle from the terminal.
For data engineers: Plug in the Google Cloud Data Agent Kit, which provides dedicated skills and Model Context Protocol (MCP) tools tailored for data pipelines.
For Google Cloud ecosystems: Deploy Agent Skills to give your coding environment native capabilities across Google products.
For integrated IDE experiences: Connect the Developer Knowledge Base via MCP to stream official documentation directly into your teams' workflows.

#2 Who are we building for? Humans, or other agents?
Like #1, this might sound like a straightforward question, but you'll want to decide early on if you're building an AI agent for your employees to talk to directly, or if it's meant to coordinate with other agents behind the scenes. Your design requirements will look completely different depending on who — or what — is interacting with the system, so keeping everything under your team's control starts with knowing exactly who you're building for.

If your answer is humans (building for employees or customers), focus on user experience. You can host and share these tools in a single place like the Gemini Enterprise app, or use the Agent-to-User Interface (A2UI) framework to drop interactive components directly into your custom apps.

If your answer is agents (and you’re building agents meant to talk to other agents), focus on interoperability. By adopting the open Agent2Agent (A2A) protocol, an open standard for seamless communication and collaboration between AI agents, your agents can use standardized metadata to discover each other, pass context, and securely delegate background work across completely different enterprise frameworks.

See question #14 for more on user and agent identity.

#3 Which agent development tool should I use?
With so many frameworks available, it’s easy for engineering teams to default to fragmented, homegrown setups. To simplify this, we look at agent development as a four-rung ladder, which allows teams to slide between out-of-the-box configuration and code-first control:

Rung 1: Agent Studio (low-code): A visual workspace inside Agent Platform for rapid prototyping and business teams. Build an agent with Agent Studio here.
Rung 2: Managed Agents API (Agent-as-a-Service): For technical teams who want to define agent behavior via API and let Google handle the infrastructure inside a secure sandbox. Build a custom agent with Managed Agents API here.
Rung 3: Antigravity 2.0: A dedicated workspace for developers leveraging AI for advanced coding tasks and engineering pipelines. Build with Antigravity here.
Rung 4: Agent Development Kit (ADK 2.0): An engineering-first, code-first framework for software engineers building highly custom, multi-agent networks from scratch. Build a sample agent with ADK here.

#4 Should I start with one agent or many, and how do I specialize them?
Always advocate for your teams to start with a single, highly specialized agent for initial prototyping. If an agent tries to do everything, a few things might happen: accuracy drops, latency spikes, and debugging becomes a nightmare. To avoid this, write tight instructions and limit the tools it can access.

As your workflows grow more complex – or if you hit model context limits – have your engineers graduate to a multi-agent system. At its core, a multi-agent system is a collection of individual, autonomous agents that collaborate to achieve a goal. Using a framework like ADK, they can organize agents into a network of sub-agents where a coordinator delegates specific tasks to specialized team members, maintaining clear organizational logic.

Example: Build a sample multi-agent solution with ADK here.

The scale phase - connectivity and interoperability

#5 How do we connect enterprise data and maintain the right business context?
Your agents need access to the right data to be truly useful. This is where “enterprise truth” comes in – it's what we call your enterprise’s specific data, tools, constraints, policies, and processes that the agent needs to be successful.

While there are several ways to accomplish this, the emerging practice is using open standards like Model Context Protocol (MCP) to connect your agents directly to live databases and business apps. However, simply establishing connectivity isn’t enough. To help your agents work accurately and avoid hallucinations, you must also organize this data with clear business context, metadata, and logic. This structured approach ensures your agents don’t just pull raw information, but actually interpret it correctly to and make better decisions across your organization

Example: Build a sample multi-agent solution with ADK and MCP Toolbox (Managed Server).

#6 How do we connect agents built on completely different frameworks?
In a large organization, different teams will naturally build agents using the tools that best fit their specific needs, whether that's LangGraph, a homegrown framework, or something else entirely. However, if these systems can’t communicate, you end up with isolated data and workflow silos.

Establishing a universal communication standard allows agents developed on completely different platforms or frameworks to exchange intents, state, and results without specialized integration work.

For cross-framework connectivity (e.g., connecting a LangGraph-based HR agent to an ADK-based CRM agent ), you can implement the A2A protocol. This allows a microservices-style communication pattern across multiple distinct agents, ensuring they can securely talk to each other.

Example: Build a sample multi-agent solution with ADK and A2A.

#7 How do we help agents find the specific tools they need?
Stuffing an agent's context window with multiple tools and APIs degrades performance, increases latency, and drives up token costs. Just as we use RAG to dynamically fetch data on demand, we must apply the same dynamic retrieval strategy to agent tooling.

By utilizing focused agentic Skills, agents load capabilities only when a task requires them. Instead of parsing a massive library of generic instructions, the agent pulls from a single, task-specific index card—ensuring precise, tightly controlled execution.

Example: Build a multi-agent orchestration pattern with ADK and Skills

#8 How do we deploy our agents so they can easily scale?
This is the million-dollar question — or, perhaps more accurately, the "tokens-per-minute" question. The key isn't just about choosing the cheapest option, but about finding the right recipe of tools and services that aligns with your workload patterns.

To scale your agents without racking up massive infrastructure overhead, your teams should deploy agents within a fully managed, serverless execution environment. Agent Runtime is a set of services that enables developers to deploy, manage, and scale AI agents in production. Agent Runtime handles the infrastructure to scale agents in production so you can focus on creating applications.

A production-ready runtime must offer elastic auto-scaling to handle sudden usage spikes, containerized flexibility to bundle custom software dependencies, and native support for bidirectional streaming to ensure low-latency, real-time interactions. The architecture must also integrate built-in private networking interfaces to securely connect to internal enterprise data without public internet exposure.

Example: Build a multi-agent orchestration pattern with Agent Runtime

#9 What if our agents lose track of context during long-running tasks?
To help your AI agents work more effectively, you can give them both short-term and long-term memory. This means using real-time session state to keep immediate conversations going, and a long-term storage layer to remember user preferences and past interactions — all while keeping your agents safely under your team's control.

Agent Platform handles this across two layers. In ADK, a sessionService handles the immediate steps of a multi-stage task, while Agent Memory Bank acts as a persistent, long-term storage layer to recall past user preferences and project outcomes over time.

Example: Build a multi-agent orchestration pattern with Agent Memory Bank and ADK memory

The optimize phase — trust and efficiency

#10 How do we limit the blast radius for an agent running scripts or using a browser?
If your agents need to run Python, execute scripts, or browse the web to gather data, they shouldn’t do it directly on your network. Running these tasks in a temporary, isolated sandbox environment makes it easy to isolate any untrusted code or runtime logic errors, keeping them completely separate from your core enterprise systems.

Plus, using our agent runtime with a built-in sandbox helps protect your primary infrastructure and lets your agents safely execute tool calls under your team's full control.

Example: Build a multi-agent orchestration pattern with Agent Sandbox

#11 How do I ensure my agent stays on-brand?
An agent represents your corporate identity. While defining system prompts with clear constraints is a starting point, relying on prompts alone is insufficient (and risky) for production security. You need a mandatory safety layer that enforces core corporate rules and tone constraints, making sure the agent remains bounded regardless of the model's inherent probabilistic nature.

Guardrails turn an unpredictable LLM into a safe enterprise system by allowing the agent to have the flexibility to make autonomous decisions, while keeping it incapable of violating core safety rules. Because these boundaries are implemented as deterministic constraints outside of the agent’s reasoning, they cannot be bypassed.

Complementing this safety layer, structured workflows drive even greater predictability by breaking complex tasks into deterministic, step-by-step pipelines that use code-level routing, conditional logic, and state management to guide the agent through repeatable paths.

Example: Build a multi-agent orchestration pattern with Guardrails agent. See also ADK Workflows

#12 How do we trust the result?
Trust is earned through evidence gathered from rigorous testing and ongoing evaluations across the agent’s entire lifecycle. It’s not an automatic given, but rather a result of your method.

At scale, evaluation is automated using a mix of metrics, human-in-the-loop oversight, and LLM-as-a-judge patterns. By using a more capable model or a specialized self-evaluation agent to audit the primary agent’s output before it reaches the end-user, you can systematically catch inaccuracies and protect the user experience.

Example: Build a multi-agent orchestration pattern with LLM-as-a Judge and Self Evaluation agent built in

#13 How do I control costs that are going overboard?
High-performance reasoning is powerful, but it isn’t cheap. To optimize your spend, try using a tiered approach: employ fast, lightweight models (like Gemini Flash) for high-speed, low-complexity tasks, leverage open source models (like Gemma), and reserve your largest, most expensive reasoning models for final decision-making.

For high-volume production, switch to Provisioned Throughput (PT). Think of it like booking dedicated capacity for your steady, predictable everyday traffic, while unexpected spikes safely overflow into standard pay-as-you-go billing.

You can further protect your budget by trimming context windows with precision RAG, utilizing context caching, setting hard stops on agent iterations, and transitioning predictable parts of the agent workflow into deterministic code where feasible.

Example: Build with cost control in mind and KPIs that matter

The govern phase — security and oversight

#14 How do I align an agent’s data access to match that of its human user?
Aligning an agent’s data access starts with establishing a secure agent identity, which supports three models: operating directly under a user's identity, using the agent's own independent identity, or acting via delegated authority.

For many employee-facing workflows, leveraging delegated authority is the most secure approach. The agent automatically inherits and respects the existing permissions of the employee interacting with it. This guarantees that the agent cannot access data it isn't explicitly authorized to see, eliminating the need to rebuild complex permission structures from scratch while maintaining a clean audit trail.

Example: Build with Agent Identity

#15 How do I manage shadow AI and agent sprawl?
Unmonitored agents create severe data fragmentation and compliance risks. To prevent sprawl, you can use a central agent registry — a single, discoverable directory that automatically inventories every active agent, its business owner, its target dataset, and its permitted tools. Moving away from manual tracking spreadsheets gives your teams visibility into internal AI projects, ensuring that redundant agents are consolidated and orphaned endpoints are safely decommissioned.

Example: Build with Agent Registry

#16 How do I define how users, agents, data, and tools are allowed to interact?
Scaling enterprise automation safely requires a dual-layered policy architecture. First, apply IAM policies to set clear boundaries so agents only access authorized tools and specific data buckets. Second, implement semantic policies that analyze the natural language intent of a user prompt in real time, validating that the agent's planned response aligns with core business rules and compliance mandates before execution.

Example: Build with Policies

#17 How do I enforce those policies and gain visibility into agent activity?
Policies are meaningless without runtime enforcement and a clear audit trail. To achieve this, you need to route all agent traffic through an agent gateway — the network entry and exit point for all agentic interactions. This gateway should automatically intercept calls between users, agents, and tools to instantly block policy violations, sanitize content, and prevent prompt injections. For total visibility, this gateway must generate network-layer telemetry for every single interaction, feeding real-time behavioral metrics and execution traces directly into your observability dashboards.

Example: Build with Agent Gateway

#18 How do I protect prompts and responses against data leakage, prompt injections, and offensive content?
When integrated with Agent Platform, Model Armor intercepts prompts before they reach Gemini models, and intercepts responses before your application receives them.

Based on your configuration, Agent Platform calls the Model Armor service, which inspects or blocks traffic that violates your defined policies — enforcing security measures like prompt injection and jailbreak detection, responsible AI filters, and sensitive data protection. You can configure this integration either by using floor settings for project-level protection or by using templates for per-request protection.

Example: Build with Model Armor

#19 How do I know if something has gone wrong with one of my agents?
To protect your systems, you need to look for behavioral anomalies by auditing your agent's decision-making loop in real time. Running this continuous behavioral audit alongside threat detection ensures you instantly catch whenever a compromised agent attempts a high-risk, uncharacteristic action.

This is where Agent Platform Threat Detection (part of Security Command Center) comes in. If an agent attempts unauthorized database commands or connects to unverified external network addresses, the system flags the event in near-real time for rapid isolation — keeping your automated workforce safely under control.

Example: Build with Threat Detection and Agent Anomaly Detection

#20 How can I manage the complete agent lifecycle in one place?
Nobody wants to click through five different cloud consoles just to push an update or run a test. With Agent Platform, you can simply give your coding agents the specific skills and commands needed to build, scale, govern, and optimize production-ready agents.

We recommend using the Agents CLI in Agent Platform as the central command tool for your development teams. It acts as a direct bridge between local terminal work and live production management, making it much easier for developers to transition from testing to a live launch.

It also allows your teams to version-control agent configurations, run automated evaluations, and seamlessly push updates through your existing CI/CD pipelines. Because the underlying tools and skills are built and rigorously tested by Google's experts, your team can deploy with confidence without having to reinvent the wheel or break their day-to-day coding workflows.

Example: Build with Agents CLI here

Get started today

By tackling these 20 questions early, you can build agents that actually do real work for your business — without keeping your security and operations teams up at night.

Get started with Gemini Enterprise Agent Platform here.

BGP route policies: Top 3 use cases by customer demand

Tue, 07 Jul 2026 16:00:00 +0000

When we first made BGP route policies for Cloud Router generally available over a year ago, our goal was to give network administrators deep, programmable control over how network paths are evaluated and propagated. Since then, we’ve been watching closely how our customers have adopted this feature. We've seen network engineering teams build incredibly sophisticated, resilient routing architectures that were previously difficult to achieve without third-party virtual appliances.

This year, we launched policy named sets for Cloud Router. As routing environments grow more complex, managing individual prefixes or communities within these policies can become cumbersome.

Policy named sets solve this by allowing you to group lists of IPv4/IPv6 prefixes or BGP communities into a single, reusable entity. This significantly simplifies your configurations, making it easier to scale, manage, and update your routing rules across multiple Cloud Routers.

Powered by the Common Expression Language (CEL), BGP route policies allow you to define fine-grained, ordered rules to filter BGP routes and modify route attributes directly within Cloud Router.

To celebrate the launch of policy named sets, we want to highlight three of the most impactful ways we've seen customers use BGP route policies over the past year, along with resources on how you can build them yourself.

1. The foundation: Route filtering and network protection

Before manipulating traffic paths, network stability requires strict control over which routes are allowed into and out of your network. We've seen customers extensively use BGP route policies to filter out unwanted learned routes from peers or prevent specific subnet prefixes from being advertised out of their Virtual Private Cloud (VPC).

Operating on a "fail open" model by default, many security-conscious organizations have adapted BGP route policies to create a "fail closed" environment — appending a "drop all" policy as the final term in their evaluation list. This helps enable absolute certainty over accepted network routes, preventing routing loops and ensuring traffic isn't BGP hijacked or inadvertently blackholed.

Dive deeper: For a foundational look at how to set up CEL expressions for route filtering, check out our deep-dive guide: Introduction to BGP policies.

2. Influencing traffic paths for active/standby architectures

Achieving optimal traffic distribution often requires forcing traffic down a specific path, whether for cost optimization or managing active/standby interconnects. Customers have used BGP route policies to influence the preferred BGP route without touching their on-premises hardware.

By dynamically modifying the BGP multi-exit discriminator (MED) attribute, network teams can make a specific peer preferred for incoming traffic. Conversely, if they want to steer traffic away from a congested or backup link, they are using AS-PATH prepending — adding one or more values to the route's AS-PATH to deprioritize it across the broader network.

Dive deeper: To see the configuration steps for managing MED and AS-Path prepending, read: Using BGP policies to influence traffic paths.

3. Solving asymmetric routing with BGP communities

One of the most advanced and highly requested use cases we’ve seen over the last year is achieving traffic symmetry. When enterprises use stateful firewalls or specific network appliances on-premises, return traffic must flow back through the exact same appliance it originated from. If it doesn't, the traffic is dropped.

Customers are successfully solving this by using BGP route policies to match against specific standard BGP communities. By tagging routes with specific communities on-premises, Cloud Router can read those tags via inbound policies and adjust the route preference by manipulating the MED accordingly. This helps ensure that Google Cloud inherently understands the stateful topology of the on-premises network and routes the return traffic symmetrically.

Dive deeper: To learn how to architect stateful traffic symmetry using BGP community tags, explore: Using BGP communities to create traffic symmetry.

Get started today

Taking control of your dynamic routing is now easier and more robust than ever. Using BGP route policies, it's a great time to optimize and secure your hybrid cloud connectivity.

We recommend testing your BGP route policies in a staging environment to verify your CEL expressions and routing logic before rolling them out to production. To explore the technical documentation, check out the BGP route policies overview.

Drive proactive security, prioritize risks with Google Threat Intelligence and Wiz ASM

Tue, 07 Jul 2026 16:00:00 +0000

Being more proactive continues to be a leading goal for security organizations. As AI accelerates the pace of vulnerability discovery and exploitation, organizations will rely on the personalization of their security investments to help prioritize their defenses.

To help you be more proactive by matching your real-world exposures with real-time adversary activity, we’ve begun integration efforts between Google Threat Intelligence and Wiz Attack Surface Management (ASM).

By connecting exposure and validated exploitable risks directly to real-time threat intelligence, we can help you detect and prioritize external-facing exploitable issues and uncover logic-driven vulnerabilities with AI scanning at the speed needed for today’s defenses. This allows you to shift to a strategy that prioritizes actions based on the real-world threats that pose the greatest risks to your organization.

Combining these two perspectives on threats can help you move from reactive maintenance to a proactive security strategy. In addition to detecting your exploitable exposures, you gain insight into which of those exposures are being actively targeted by adversaries.

We will continue to build towards native integration that will feed exposure data directly into the Google Threat Intelligence correlation engine. This automated connection will help you focus on the exposures adversaries are targeting in the wild, and use our real-time threat intelligence to prioritize remediation efforts and threat hunting activities.

Building a proactive security strategy

Google Threat Intelligence provides global visibility into how adversaries operate, tracking their infrastructure and campaign activity in real time.

Wiz ASM maps your external attack surface across cloud, AI, software-as-a-service (SaaS), and on-premises environments to reveal exposed assets like domains, IPs, and APIs. It scans for exploitable vulnerabilities, misconfigurations, and default credentials to validate exploitability. It also scans for and validates exposed secrets and sensitive data.

At the same time, the Wiz Red Agent scans exposures with AI to uncover complex, logic-driven vulnerabilities by reasoning about applications behavior.

The power of this combination lies in the ability to prioritize and hunt with confidence:

Prioritize based on real-world activity: With the incoming integration, exposure data feeds into the Google Threat Intelligence engine. This helps you spot the exposures that adversaries are currently exploiting, allowing your team to focus remediation efforts where they are needed most.
Understand attacker behavior: When a critical risk is flagged, we plan to provide behavior-based guidance alongside the alert. This details how an attacker typically acts after exploiting a vulnerability, using specific host commands or malware, giving your defenders the context they need to hunt for active footprints inside your network.
Discover complex vulnerabilities: The Wiz Red Agent uses AI to scan for logic-driven vulnerabilities, such as authentication bypasses, business logic flaws, and multi-step attack chains, helping you uncover risks that traditional scanners often miss.

Get started with proactive defense

This combined approach is designed to help you streamline your security posture by reducing the noise and focusing on the signals that represent real danger to your organization. To get started with Google Threat Intelligence and Wiz ASM today, contact your Google sales representative.

The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI

Tue, 07 Jul 2026 14:00:00 +0000

Written by: Shebin Mathew

Introduction

The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant researchers in 2021, remains one of the most effective methods for threat actors to forge identity assertions in the Microsoft ecosystem. By obtaining the private key of an ADFS token-signing certificate, an attacker can authenticate as any user to any SAML-federated application, bypassing multifactor authentication (MFA), conditional access, and all identity-based controls.

However, during a recent red team engagement, Mandiant discovered that when ADFS certificates are manually rotated, configuration drift can silently leave active signing keys exposed in Machine DPAPI. Specifically, Mandiant discovered that in environments where AutoCertificateRollover is disabled and certificates are manually rotated, the database often becomes a 'ghost'—a record that still exists, still decrypts successfully, but references a certificate no longer used for token signing by the ADFS service. This attack vector warrants attention because the underlying configuration is commonly deployed in enterprise environments. The technique avoids direct interaction with components such as LSASS and the live ADFS service process, which are often subject to enhanced monitoring in enterprise environments, and may therefore result in lower visibility depending on the organization’s telemetry coverage. This post details how adversaries may exploit this TTP to forge high-privilege SAML tokens and provides the blueprint to defend against it.

Technical Insight: Encountering the ‘Ghost Certificate’

Analysts followed the standard DKM extraction path, retrieving the encrypted blob from the WID database and decrypting it using the DKM material stored in Active Directory. The extraction succeeded, but the recovered certificate was no longer valid for token signing, and Entra ID rejected the resulting tokens with AADSTS500172 due to invalid signing material. Although structurally correct, the artifact is not usable for authentication, as the active signing key resides in the system’s machine-scoped cryptographic store, protected by Windows Machine DPAPI and managed through the operating system’s cryptographic subsystem. Successfully obtaining this active key allows an attacker to forge valid SAML assertions for any user, bypassing the need for user credentials and multi-factor authentication, and granting unauthorized access to any SAML-federated application including Microsoft 365 and Entra ID within the organization's environment.

Analysis revealed that AutoCertificateRollover had been disabled and a manual rotation had been performed. Confirmation was obtained directly via Get-AdfsProperties, which returned AutoCertificateRollover: False, indicating that certificate lifecycle management had been delegated to manual administrative processes. While the ADFS service used a new valid key for signing, the WID configuration database was never updated to reflect the new certificate—leaving an expired "ghost" entry as the only record. This drift condition surfaces via Microsoft Event ID 385, which indicates certificate validity warnings in the ADFS service. Notably, this event self-resolves when AutoCertificateRollover is re-enabled and a subsequent certificate rollover is performed; in environments where it is disabled and manual rotation is performed without a corresponding database update, it is the observable symptom of this drift condition.

Figure 1: ADFS certificate enumeration output showing configuration drift between the WID database and the active host certificate

ADFS maintains private keys in two protection contexts. In Location 1 (User DPAPI), encrypted key blobs may exist on disk, but the DPAPI protection is tied to the service account's SID and associated DPAPI masterkey material. In the assessed environment, the domain DPAPI backup key approach successfully decrypted masterkey material for interactive user profiles, but returned no decryptable material associated with the ADFS service account profile. All subsequent offline decryption attempts similarly failed, consistent with the masterkey not being recoverable through the evaluated on-disk recovery approach in this environment—though this observation is bounded to the assessed environment and does not represent a universal architectural property of all ADFS deployments.

Location 2 (Machine RSA) does not rely on a user-specific logon session. Instead, the key material is protected using Machine DPAPI, leveraging the DPAPI_SYSTEM LSA secret together with machine masterkeys available to sufficiently privileged SYSTEM-level contexts.

Why the WID Path Misses This Key

In ADFS environments experiencing configuration drift—commonly arising during manual certificate rotations where AutoCertificateRollover is disabled—the ADFS service host can successfully bind to a newly provisioned signing certificate at the operating-system level, ensuring continued service operation. However, the WID configuration database may not reflect the current signing certificate, resulting in stale certificate metadata.

This divergence between configuration and runtime state is the condition that ADFS Event ID 385 is designed to flag. As a consequence, extraction techniques that rely solely on the WID database and DKM material may return certificates that are no longer used for active signing, leading to rejected assertions in downstream federation scenarios.

Understanding How the Machine DPAPI Store Becomes Populated

Understanding how the Machine DPAPI store becomes populated requires examining how ADFS persists its token-signing key material. During initial deployment, automatic certificate rollover, or manual certificate rotation, ADFS persists its RSA private key material in the machine-scoped CAPI key store at C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\, protected using machine DPAPI context rather than a user-bound DPAPI context. SharpDPAPI /machine enumeration in the assessed environment confirmed that the active machine key material resided under this path, while the CNG Crypto\Keys store was not observed in use in the assessed environment.

The protection chain relies on the DPAPI_SYSTEM LSA secret together with machine masterkeys associated with the S-1-5-18 security context, stored in C:\Windows\System32\Microsoft\Protect\S-1-5-18\ as DPAPI-protected key material—both components ultimately resolvable only within highly privileged SYSTEM-level contexts on the host. The corresponding certificate is enrolled into the LocalMachine\My certificate store, from which ADFS retrieves the associated private key during token-signing operations.

The architectural rationale for machine-scoped key storage is operational resilience. A machine-scoped key remains usable across service account password changes, gMSA rotations, system reboots, and service restarts without requiring key reprovisioning or dependency on a specific interactive logon session. This design ensures that the ADFS service can consistently access the signing key regardless of changes to the underlying service account credentials.

However, this same design choice has important security implications. Because the private key is protected using Machine DPAPI rather than a user-bound DPAPI context, a sufficiently privileged local process capable of accessing the machine key store and associated DPAPI artifacts may be able to recover the key material independently of the original service logon session. As a result, under certain conditions, recovery of the active ADFS token-signing private key may be achievable without direct interaction with LSASS memory or the live ADFS service process itself, potentially reducing visibility to defenses primarily focused on credential dumping or process-memory access behaviors.

KEY DESIGN IMPLICATION

ADFS persists its token-signing private key material in the machine-scoped key store, protected using Machine DPAPI semantics. This is a documented behavior enabling machine-scoped key persistence that survives service account changes, credential rotations, and service restarts.

However, this design introduces an operational security implication that is not commonly emphasized in standard ADFS hardening guidance: private keys stored within the machine key store are protected using this protection model and may be recoverable by a sufficiently privileged SYSTEM-level context through access to the DPAPI_SYSTEM LSA secret and machine masterkeys available locally on the host.

As a result, recovery of the active ADFS token-signing private key may be achievable without direct interaction with LSASS memory or the live ADFS service process itself, potentially reducing visibility to security controls primarily focused on credential dumping or process-memory access behaviors.

Attack Flow: Machine DPAPI Key Recovery to SAML Forgery

Figure 2: Machine DPAPI extraction flow—five-step process from SYSTEM execution to SAML assertion

Figure 3: ‘SharpDPAPI /machine’ output confirming successful recovery of the active ADFS token-signing private key from the machine DPAPI store

The recovered key was used to forge a SAML assertion impersonating a Global Administrator identity, which Entra ID accepted as a valid authentication assertion, resulting in authenticated access at Global Administrator privilege level within the federated Microsoft 365 tenant.

Detection and Hunting

Defenders should prioritize visibility into operating system-level cryptographic operations and identity issuance behavior, rather than relying solely on application-layer configuration stores.

SACL-Based Object Access Monitoring: Configure object access auditing via SACLs on C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ and C:\Windows\System32\Microsoft\Protect\S-1-5-18\. When configured correctly, this generates Security Event ID 4663 for file access attempts. Coverage depends on SACL configuration and access paths; treat this as supporting evidence in correlation-based detection rather than a stand-alone signal.
ADFS Token Issuance Consistency: Monitor for inconsistencies between primary authentication events and token issuance events in ADFS audit logs. Relevant events include token issuance and claims processing records (Event IDs 299, 1200-series, depending on ADFS version and audit configuration). The objective is to identify token issuance that cannot be clearly correlated to a preceding authentication context. This is most effective when normal authentication patterns per relying party trust are baselined.
Federated Identity Monitoring in Entra ID: Entra ID sign-in logs will record an accepted forged assertion as a standard federated sign-in event. Detection requires cross-correlating Entra ID sign-in records against ADFS-side issuance logs—neither source in isolation is sufficient. For privileged accounts, focus on unexpected Internet Protocol (IP) ranges, claim set deviations,and user-agent inconsistencies.

Mitigation and Remediation

ADFS infrastructure should be treated as Tier 0 identity infrastructure, equivalent in criticality to Domain Controllers. If SYSTEM access is achieved on an ADFS host, the signing key must be considered compromised.

Hardware-Backed Key Protection: Migrate token-signing certificates to a Hardware Security Module (HSM). HSM-backed keys ensure private key material does not exist in software-accessible storage on the host, eliminating the Machine DPAPI extraction path entirely.
gMSA Service Identity: Run ADFS services using Group Managed Service Accounts to automate credential rotation and reduce operational drift in service identity management. While this does not directly address machine-scoped key protection, it eliminates manual credential management as a contributing factor to configuration drift.
Tier 0 Administrative Controls: Govern ADFS servers with strict Tier 0 controls: restricted administrative access pathways, dedicated Privileged Access Workstations (PAWs), separation from general server administration domains, and enhanced privileged access monitoring.
Certificate Rotation and Configuration Validation: If compromise is suspected, rotate the token-signing certificate and validate consistency across ADFS configuration, the LocalMachine\My store, and federation metadata. Do not rely on a single source of truth. For environments with AutoCertificateRollover disabled, manual rotation must include updating ADFS via Set-AdfsCertificate—installing the certificate alone is insufficient. Validate using Get-AdfsCertificate after rotation. If Event ID 385 appears afterward, investigate for configuration inconsistency.
Multicloud Scope Awareness: A compromised ADFS token-signing key affects all SAML relying party trusts, not just Microsoft services. Organizations using ADFS for identity federation across other software-as-a-service (SaaS) platforms should treat ADFS as Tier 0 infrastructure and audit all relying party trusts. Migrating away from ADFS-based federation (e.g., to native OIDC federation) removes this specific attack path.