Google Spent $32 Billion on Wiz. Now It Wants AI to Fight Hackers So Fast Humans Can't Keep Up

Key points

• Google completed its $32 billion purchase of cloud-security firm Wiz in 2025, the largest acquisition in the company's history.
• Google's Mandiant unit's M-Trends 2026 report found the average time for criminals to pass stolen access to a second criminal dropped from 8 hours to 22 seconds over three years.
• Google's Triage and Investigations agent has processed more than 5 million security alerts since launching, cutting typical 30-minute analyst reviews to about one minute.
• A new Dark Web Intelligence feature uses Google's Gemini AI to scan millions of criminal forum posts daily and claims a 98% accuracy rate for spotting relevant threats.
• CrowdStrike, Palo Alto Networks and Microsoft are all building similar AI-driven defence tools.

Three years ago, when criminals broke into a company's systems, they typically spent around eight hours getting settled before passing control to another criminal group. Today that handoff takes 22 seconds. No human security analyst refreshing a dashboard can respond that fast. That's the problem Google is trying to solve.

Google's answer is a platform it calls "agentic defence": AI software agents, programs that act independently without waiting for a person to click a button, watching for attacks and investigating alerts around the clock.

How did Google build this so quickly?

It bought the expertise. Earlier this year Google closed its $32 billion acquisition of Wiz, a cloud-security company founded in 2020 that had grown faster than almost any security business in history. Wiz built its reputation by drawing a graph of everything a company runs in the cloud, correlating servers, user accounts and software vulnerabilities, so a security team could see which flaws were actually dangerous rather than just theoretically bad.

Google has now wired Wiz into its existing tools. Wiz attack surface management, the process of cataloguing every digital door a criminal might try to open, now shares data directly with Google Threat Intelligence. When Wiz spots a risky exposure, it automatically enriches that finding with Google's global threat data and drops it into the SecOps queue, so analysts see context without jumping between separate screens.

The broader platform also ties in Mandiant, Google's incident-response arm, alongside Gemini, Google's AI model. A tool called CodeMender uses Gemini to write the actual code fixes when a vulnerability is found, rather than just flagging that a problem exists.

The most visible new piece for ordinary users is Dark Web Intelligence. The dark web is a hidden part of the internet where criminals sell stolen passwords and access to hacked systems. Gemini now reads millions of posts from those forums every day and surfaces only the ones relevant to a specific business, with a claimed accuracy of 98%. We first covered dark web monitoring as a security category on 3 July 2026; the automation Google is describing here is a significant step beyond what we were tracking then.

Google Security Operations also gained new agents for threat hunting (actively searching for hidden intruders) and detection engineering (writing the rules that define what counts as suspicious). The existing Triage and Investigations agent has already handled more than 5 million alerts, shrinking a 30-minute manual job to roughly one minute.

Google Cloud COO Francis deSouza said during an April media briefing: "It is very difficult, almost impossible, for a human-led defence to be effective against an AI and agentic defence; you need to use AI to fight AI."

Should you worry that rivals are already here?

The competitive picture deserves honesty. CrowdStrike, Palo Alto Networks and Microsoft are all shipping their own AI-driven security products, with deep roots inside large enterprises. Google's still the newcomer in that room, even with Wiz in tow.

There's also a failure mode worth watching: an over-confident agent that either misses a genuinely novel technique or auto-remediates something it shouldn't touch. The Russian-speaking attacker who turned Gemini CLI into a botnet co-pilot, reported here on 15 July 2026, is a useful reminder that Google's own AI tooling isn't above being weaponised.

If your security team is still triaging every alert by hand, you're already behind the pace of the attacks coming your way.