Google unveils new Gemini-powered security updates to Chronicle and Workspace

The rise of generative AI means cyber attacks are becoming more common -- and more sophisticated. Data breaches increased by 20% between 2022 and 2023, one study found. But genAI could also be the key to staying ahead of threats. 

Also: The new Google search powered by next-gen AI may be subscription-only

At Google Cloud Next '24 on Tuesday, Google announced new AI-powered innovations across its security offerings that promise to improve threat detection, deepen insights, and specify solutions. Built into Google's SecLM API, both tools use Gemini, the company's recently rebranded AI chatbot, to support security teams and increase productivity. 

Gemini in Threat Intelligence 

This expansion of Gemini uses conversational search to access Mandiant, Google's threat data compilation service, for insights about bad actor behavior. This is designed to help security teams clock what suspicious activity looks like more precisely, making it quicker to catch threats. 

The feature also makes threat research more efficient by "automating web crawling for relevant Open-Source Intelligence (OSINT) articles, ingesting information and providing concise summaries to aid analysts," according to a Google blog post. As with most current applications of AI, Gemini in Security is intended to let security analysts focus on advanced threats by making baseline defense efforts more productive. 

Also: Google is deleting millions of users' search data from Incognito mode. Here's why it matters

According to the company, Gemini allows security teams to analyze bigger samples of code for evidence of potentially malicious activity. "Gemini's larger context window allows for analysis of the interactions between modules, providing new insight into code's true intent," Google said. The feature is currently in public preview. 

Gemini in Security Operations

After making Duet AI in Security Operations generally available in December, Google is now adding Gemini in Security Operations to Chronicle, the company's security ops platform. The feature uses natural language to summarize insights, which can support security teams' ability to detect and respond to threats and make Chronicle more accessible. 

Also: Google's latest project could help protect you against cookie theft

The update comes with a new assisted investigation feature that "converts natural language to new detections, summarizes event data, recommends actions it takes, and navigates users through the platform via conversational chat," according to Google. It will be generally available at the end of April. 

Both Gemini updates are intended to help users build better security-specific data agents. 

Workspace and Gmail Improvements

The company also announced an add-on for Workspace that lets IT teams classify and protect sensitive material with AI models and data loss prevention (DLP) controls trained on their organization's data. Admins of a Workspace can automatically protect files company-wide and will be able to continuously evaluate existing and new Drive files for all employees. 

By training models on a company's unique data, the add-on further personalizes privacy efforts, and could help teams better anticipate security needs. At $10 monthly per user, it's available for most Workspace plans; Google did not clarify who that refers to, or when the feature would be generally available. 

Also: 61% of firms worry they are unprepared for security risks in quantum era

Google shared in the announcement that Gmail and Workspace were built with a zero-trust security approach in mind. In keeping with this, the company is rolling out extended DLP controls and classification labels to Gmail (in beta as of now). The company claims Gmail already stops "more than 99.9% of spam, phishing attempts, and malware from reaching your inbox," and that LLMs will now allow them to block 20% more questionable material. 

The upgrade will also help Google "evaluate 1,000 times more user-reported spam in Gmail every day," according to the company.  

Quantum computing is coming for our current encryption methods. To account for quantum computer attacks, Google also announced it's adding "experimental support for post-quantum cryptography (PQC) in client-side encryption" with its third-party partners Thales and Fortanix.