For most of this year, it has become quite clear that
AI is changing the economics of cyberattacks. Vulnerability-discovery tasks that once required substantial time and specialized, painstaking expertise can increasingly be performed by frontier AI at machine scale.
Teams equipped with the right AI models can discover hundreds or thousands of vulnerabilities in hours or even minutes — and attackers can use the same technology to accelerate exploitation.
Yet while vulnerability discovery and exploitation rocket forward, many defensive workflows are left behind, still depending on humans to manually find, prioritize and patch flaws. Closing that gap requires more than using AI as another scanning tool. It requires applying AI across the vulnerability-management lifecycle.
To aid in this process, Google has introduced AI Threat Defense, an AI-powered cybersecurity platform that automates the entire
vulnerability-management lifecycle from discovery to validation to remediation.
"By connecting real-world exposure directly to autonomously creating and prioritizing patching, AI Threat Defense helps organizations actively predict attack paths, prioritize the most significant threats, and deploy verified fixes faster than adversaries can exploit them," writes COO of Google Cloud and President of Google Security Products
Francis deSouza in a recent blog post.
Why AI-powered attacks require AI-powered defenses
Automated systems can rapidly scan networks, discover vulnerabilities, and execute multi-stage attacks with minimal human intervention, all of which would give attackers great advantages over unprepared targets.
The countermove is for defenders to be prepared by applying the same AI vulnerability-finding technology to level the playing field.
But AI agents can do much more than just generate reams of vulnerability alerts. They can examine software, verify potential vulnerabilities, and feed their validated findings into automated remediation workflows.
AI Threat Defense is an always-on platform intended to predict attack paths, prioritize significant threats and deploy verified fixes faster. And rather than relying on a single AI model, AI Threat Defense will let users plug in models of their choice for maximum efficiency.
"Some models may be stronger at
application logic, others at
cloud configuration, binary analysis, exploitability validation, or remediation guidance," points out DeSouza. "No single model finds the superset of vulnerabilities that other models find."
Google similarly applies lighter, faster models for broad scanning while reserving frontier models for higher-risk applications and findings. The objective is to replace periodic, reactive vulnerability management with a continuous cycle of preparation, scanning, prioritization, remediation, and monitoring.
Why effective vulnerability management depends on contextual risk analysis
Discovering more vulnerabilities does not necessarily make an organization safer. If AI produces thousands of additional findings without determining which ones truly matter, it will just create a larger remediation backlog.
Effective prioritization requires context. Google uses Wiz to map applications, infrastructure, APIs, identities and runtime environments and evaluate factors including reachability, exploitability and business impact.
AI Threat Defense then combines code findings with architectural and runtime context to distinguish theoretical weaknesses from vulnerabilities that create meaningful real-world risk.
Google's internal approach similarly uses a Configuration Graph to prioritize vulnerabilities according to accessibility and potential blast radius.
That changes the fundamental question from "How severe is this vulnerability?" to "How likely is this vulnerability to become part of an attack path, and what would the business impact be?"
How successful cyber defense combines AI models with exposure management, automated remediation, and human expertise
Finding and prioritizing vulnerabilities solves only part of the problem. Defenders must also remediate them quickly.
Google's CodeMender, a code-checking and code-remediation agent, shows how AI can close that loop. The agent scans software for vulnerabilities, builds and executes proof-of-concept exploits in an isolated environment to verify risk, and generates and tests patches for validated flaws. Developers retain control by reviewing and approving fixes before they are committed.
"As adversarial AI threats accelerate attacks on code, security teams must counter them with machine-speed defenses that can automate code remediation and fight AI with AI," write Google VP of Product Management at Gemini Enterprise Michael Gerstenhaber and Google Director of Product Management at Cloud AI Clemens Viernickel in
another blog post.
Google's broader strategy combines these capabilities. Gemini and other frontier models provide reasoning, Wiz contributes contextual risk prioritization, CodeMender provides code scanning and remediation, and Mandiant contributes frontline incident-response expertise.
Internally, Google pairs automated exploit validation and 24/7 patching workflows with human review and rollback capabilities, demonstrating that autonomy need not mean removing people from critical decisions.
The result is a continuous vulnerability-management lifecycle that goes far beyond just AI-driven vulnerability finding. AI discovers vulnerabilities, validates their exploitability, determines which pose genuine risk, generates fixes and monitors the environment for new threats.
"The collapse of the exploit window has made one thing clear: Human-speed vulnerability management is no longer a viable strategy for enterprise risk," writes DeSouza. "The era of machine-speed attacks demands an autonomous, continuous defense."
