The economics of Google Cloud’s $2.2 billion Recorded Future acquisition

Google Cloud’s $2.2 billion acquisition of Recorded Future follows its $32 billion cash purchase of Wiz. This purchase expands Google’s security portfolio to compete against Microsoft and AWS. Google targets the security market by moving from storage and compute to a model driven by AI agents and token consumption. Alphabet puts $180 billion of capex into 2026, and TPU pods become obsolete in about two years. Google’s strategy shifts the focus from renting compute and storage toward a model where revenue grows through the number of AI agents deployed and the total volume of tokens consumed by each enterprise customer. This strategy relies on Google’s custom silicon to drive down the cost per token. Google wants to become the only place where enterprise AI runs. Alphabet invested more than half of its 2026 ML compute investment into Google Cloud. The company is building the Gemini Enterprise Agent Platform to allow customers to deploy thousands of agents inside Google Cloud. Each agent has a unique cryptographic ID and governance policies. Once a company deploys 800 agents on the platform, they cannot easily leave.

The API pricing overhaul

The October API pricing overhaul forces a new way to buy threat intelligence. Google Threat Intelligence uses a flat annual rate with a fixed number of API calls per subscription level. Organizations add extra API call packs to scale their usage. This model contrasts with Microsoft’s approach to enterprise security because Microsoft uses per-user subscriptions for M365 and pay-as-you-go meters for Azure.

Microsoft 365 Business Premium costs $22 per user per month with Teams, while the Enterprise E5 suite requires a payment of $60 per user per month for those needing higher security. Microsoft 365 Business Standard costs $14 per month with Teams, or $10.79 without. Microsoft 365 Business Basic costs $7 per month with Teams, or $5.40 without. Azure costs fluctuate based on regions and usage meters, although users use reservations and savings plans to reduce expenses. Microsoft 365 E3 costs $39 per user per month with Teams. You should verify your specific license needs before committing to these models.

The Mandiant rivalry

Mandiant remains a core part of Google’s security stack after its integration. This integration battles the deep presence of Microsoft in identity, productivity, and Azure cloud services. Microsoft’s FY26 operating income reached $155.2 billion, which demonstrates immense financial scale. Users like Microsoft for its scalability, but they find its admin portals fragmented and its billing processes difficult to manage. Recorded Future provides deep intelligence that users find actionable. The platform indexes more than 1 million global sources and covers vulnerability management and identity exposure analysis. Recorded Future uses the Intelligence Graph to correlate signals across technical sources, the dark web, and adversary infrastructure. The Insikt Group adds expert human analysis to ensure findings are accurate. Mandiant’s M-Trends 2026 report shows the median time between initial access and hand-off to a secondary threat actor fell to 22 seconds in three years. Google Threat Intelligence pulls together inputs from Google’s threat insights, Mandiant’s frontline intelligence, and VirusTotal’s database to deliver a unified verdict. Google Threat Intelligence aims to reduce gaps by blanketing event data with threat associations. This capability targets the increasing complexity of AI-powered social engineering and information operations. One question remains: will Google keep its security tools neutral for customers using other cloud providers?