Google SecOps: The Agentic SOC

Google SecOps Advances the Agentic SOC with AI-Powered Security Operations and Regional Expansion

Google has announced a series of significant updates to Google Security Operations (SecOps), reinforcing its vision of an AI-driven Security Operations Center (SOC). The latest enhancements focus on artificial intelligence, proactive threat detection, compliance, data sovereignty, and operational efficiency, helping security teams respond to threats faster and with greater confidence.

The Rise of the Agentic SOC

One of the most notable announcements is Agentic Automation, which enables organizations to integrate AI-powered agents into existing security workflows. By combining AI-driven decision support with deterministic automation, security teams can automate repetitive tasks while maintaining human oversight for critical actions.

Google has also officially launched the Triage and Investigation Agent (TINA). This AI-powered capability automatically investigates alerts and determines whether they are True Positives or False Positives within an average of 60–70 seconds. Leveraging Mandiant’s industry-leading investigation methodologies, TINA provides security analysts with detailed findings and recommendations, significantly reducing investigation time and improving SOC efficiency.

Proactive Threat Hunting with Intelligence-Driven Insights

The new Emerging Threat Center transforms how organizations approach threat hunting. Instead of waiting for threats to be discovered manually, Google SecOps now proactively identifies whether newly published threat intelligence from Google Threat Intelligence (GTI) impacts a customer’s environment.

Powered by Gemini, the platform analyzes threat reports, evaluates existing detection coverage, and recommends new detection rules when necessary. This intelligence-led approach helps organizations stay ahead of emerging threats and strengthen their security posture before attackers can exploit vulnerabilities.

Strengthening Compliance and Data Sovereignty

As regulatory requirements continue to evolve, organizations need stronger controls over sensitive data. Google SecOps now supports External Key Manager (EKM) integration, allowing customers to maintain control of their own encryption keys while benefiting from Google’s cloud-native security capabilities.

Additionally, Unified Feature RBAC streamlines access management by consolidating permissions into Google Cloud IAM. This provides organizations with centralized visibility and control over security operations, improving governance and reducing administrative complexity.

Indonesia Joins Google SecOps Global Regions

A major milestone for organizations across Southeast Asia is the launch of Google SecOps in Indonesia, alongside South Africa, South Korea, and Taiwan.

The addition of Indonesia as a supported region provides several advantages, including:

• Enhanced compliance with local data residency requirements

• Reduced latency for security operations

• Improved performance for log ingestion and analytics

• Greater flexibility for organizations with regional regulatory obligations

With these additions, Google SecOps is now available across 18 regions worldwide.

Improving Security Operations Efficiency

Google also introduced several enhancements designed to simplify and accelerate daily SOC operations:

• Unified Rule Management provides a centralized interface for managing both custom and curated detection rules.

• Auto Extraction enables structured JSON and XML logs to be used immediately without requiring pre-built parsers.

• Direct Ingestion for Model Armor Logs helps organizations monitor AI-related risks such as prompt injection attacks and sensitive data leakage.

• Playbooks & Blocks Hub delivers a library of pre-built workflows and reusable automation components, enabling faster incident response and operational consistency.

Looking Ahead

These latest innovations demonstrate Google's commitment to building the next generation of security operations the Agentic SOC. By combining AI-powered investigation, proactive threat intelligence, enhanced compliance controls, and expanded regional availability, Google SecOps continues to empower security teams to operate more effectively at enterprise scale.

For enterprises and Managed Security Service Providers (MSSPs), these updates represent a significant opportunity to improve detection, investigation, and response capabilities while reducing operational complexity and accelerating security outcomes.