The M-Trends 2026 report, which analyzed over 500,000 hours of frontline incident response investigations conducted throughout 2025, shows that the mean time-to-exploit has reached a negative seven day window. Attackers exploit vulnerabilities seven days before a patch exists. This speed makes traditional scan-and-patch defenses ineffective. In 2025, exploits remained the leading initial infection vector, accounting for 32% of intrusions investigated by Mandiant for the sixth consecutive year. The median time between initial access and hand-off to a second threat actor fell to 22 seconds in 2025. This collapse from over eight hours in 2022 shows how industrialized access brokering has become.
Attackers now use specialized tools to accelerate these breaches. The malware family PROMPTSTEAL, attributed to the Russian state-sponsored group APT28, is the first confirmed state-sponsored tool to query large language models during execution for document theft. Another family, PROMPTFLUX, rewrites its own VBScript source code every hour by querying the Gemini API to evade signature-based detection. Global median dwell time rose to 14 days in 2025, up from 11 days in 2024. In espionage cases involving North Korean IT workers, the median reached 122 days.
Mandiant within the Google Cloud ecosystem
Google completed its Mandiant acquisition in 2022 for $5.4 billion. Mandiant now operates within Google Cloud while retaining its brand. This integration combines Mandiant’s threat intelligence with Google’s infrastructure, scale, and Gemini AI capabilities. The integration links Mandiant’s expertise with Google’s data processing and machine learning to support security operations across hybrid and multi-cloud environments.
Mandiant Advantage features four distinct modules: Threat Intelligence, Threat Defense, Security Validation, and Consulting. Gemini is embedded across all four modules to assist with various tasks. In Threat Intelligence, Gemini provides natural language queries against the Mandiant knowledge graph and summarizes long-form APT reports. In Threat Defense, Gemini assists analysts with hunt hypotheses and escalation narratives. In Security Validation, Gemini generates natural-language remediation guidance from validation findings. Google published details of the capability to access grounded private data at RSAC 2026.
Subscription levels and procurement paths
Mandiant provides different subscription tiers through Google Threat Intelligence. Users can choose from Standard, Enterprise, Enterprise+, or OEM levels. The Standard tier helps organizations with threat intelligence driven event triage and detections. The Enterprise tier is for organizations that want to be proactive and conduct efficient hunting. The Enterprise+ tier targets organizations with strong cyber threat intelligence teams. OEM subscriptions are for technology vendors.
| Product/Subscription | Description |
|---|---|
| Google Threat Intelligence – Standard | For organizations looking for threat intelligence driven event triage and detections to improve their security posture. |
| Google Threat Intelligence – Enterprise | For organizations who want to use threat intelligence to be more proactive, know more about threat actors targeting them and conduct efficient hunting exercises. |
| Google Threat Intelligence – Enterprise+ | For organizations with a strong cyber threat intelligence teams who see threat intelligence as a critical tool to understand and stay ahead of their adversaries. |
| Google Threat Intelligence – OEM | For Technology vendors looking to help their customers stay ahead of adversaries with Google Threat Intelligence. |
Mandiant does not publish list pricing. Typical enterprise contracts for the standalone Threat Intelligence module range from $40,000 to $80,000 per year. Combined module contracts covering Threat Intelligence and Threat Defense run from $80,000 to $200,000 per year. Threat Defense with an incident response retainer add-on exceeds $200,000 at most Fortune 500 deployments. Organizations already spending on Google Cloud can use the Google Cloud Marketplace to benefit from committed spend draw-down. Direct Mandiant sales remain an option for those who do not use Google Cloud.
AI applications in the security operations center
The transition of AI from experimentation to operations has changed how SOC teams function. Analysts use AI for several specific workflows. For retrospective incident analysis, SOC teams task AI to review the last 30 days of closed incident tickets to identify patterns. This helps identify subtle commonalities that indicate deeper architectural issues. AI also acts as a translation layer between human questions and complex EDR query languages like KQL or SPL. An analyst can input a natural language prompt to see how prevalent a malicious file is, and the AI generates the necessary query.
The use of AI for threat hunting and forensics provides further efficiency. Hunters use AI to quality check code or broaden the scope of investigations by asking for adjacent behavioral indicators. In forensics, AI-driven tools ingest raw streams of telemetry from SIEM and EDR platforms to construct a chronological narrative of an attack. This allows responders to focus on the implications of the timeline instead of data entry. AI also streamlines the documentation phase by transforming raw forensic artifacts into polished reports. It can generate executive summaries for the C-suite and technical documents for engineers in seconds.
The limitations of AI in vulnerability management
Mandiant divides AI-assisted vulnerability management into two tracks. Track one handles enterprise vulnerability management by normalizing findings from sources like SAST, DAST, EASM, and EDR. It scores findings based on asset sensitivity and active exploitation signals. Track two focuses on product security, involving contextual triage of SAST warnings and IDE-integrated fixes. Google’s CodeMender project represents the direction of travel for LLM-assisted remediation. Both tracks ensure the model sits on the queue rather than the codepath. Nothing reaches production without a human review gate.
AI in this workflow faces significant failures. Attention degrades over long contexts, which means a model may lose sanitization details between two different lines of code. Models also face the oracle problem. They handle bugs with a binary, observable oracle well, but they produce well-formed silence for bugs with an architectural oracle. This is the class of vulnerability attackers care about most. Indirect prompt injection through source comments and third-party dependency files also poses a risk. Model drift on managed services can quietly erode the calibration of downstream scores.
Integrating vulnerability scanning into CI/CD pipelines
The integration of CI/CD pipelines with artifact guard allows teams to detect container vulnerabilities during the build stage. This feature supports GitHub Actions, Cloud Build, and Jenkins. The scanner runs as a binary within the workflow to perform build-time policy evaluation. It evaluates container images against configured artifact guard policies before they reach a registry. If an image violates a policy, the scanner returns an exit code to the runner to block the build.
The integration performs three main tasks: policy evaluation, build blocking, and scan reporting. Results go to the Security Command Center and can be output in JSON or SARIF formats. Developers can then inspect build logs, update dependencies, and rerun the build. This process requires creating a connector and an artifact guard policy. The scanner evaluates the image against the policy, and the connector ID determines which policies apply to the image.
The competitive landscape for threat intelligence
You already know that an alert without context is just noise. Bitsight is a direct alternative for organizations that want intelligence translated into action without a dedicated analyst team. Bitsight provides a unified environment spanning identity, attack surface, and brand intelligence. It tracks 700+ APT groups, 4,000+ malware types, 95 million threat actors, and 6 million unique IOCs. Bitsight operates independently of any specific cloud ecosystem.
Recorded Future is another major player. It is owned by Mastercard and provides an Intelligence Cloud that ingests data from open, dark, and technical sources. It uses machine learning to extract entities and score indicators for relevance. For organizations using CrowdStrike Falcon, the Falcon Intelligence module is a natural complement because it couples adversary-centric intelligence with endpoint telemetry. It includes profiles on 265+ threat actors. Flashpoint specializes in deep and dark web intelligence, focusing on fraud and physical security. Anomali ThreatStream focuses on aggregating and normalizing intelligence feeds for mature SOCs.
| Vendor | Primary Focus | Best For |
|---|---|---|
| Mandiant | Nation-state attribution and IR research | Teams needing deep adversary casework |
| Bitsight | Unified cyber risk and exposure management | Organizations seeking a cloud-agnostic platform |
| Recorded Future | Large-scale data coverage and AI-driven intelligence | Large enterprises with dedicated CTI programs |
| CrowdStrike | Endpoint-integrated intelligence | Users standardized on the Falcon platform |
| Flashpoint | Dark web and fraud intelligence | Fraud and brand protection teams |
The evolution toward the agentic SOC
The shift from simple chatbots to interconnected agents enables the agentic SOC. In this model, agents reason through and execute tasks to achieve goals. They automate complex workflows so analysts can focus on strategic challenges. Within Google Threat Intelligence, agents enabled by Gemini can reverse-engineer files to identify malware. In Google Security Operations, Gemini agents perform dynamic alert triage and investigations by gathering context and rendering verdicts.
Humans remain in the loop with access to transparent audit logs detailing the reasoning and decisions of the agent. This setup allows for a more proactive defense posture. Will the shift toward autonomous agents eventually bypass the need for human analysts in the triage layer? The industry is moving toward a model where AI handles the queue and humans handle the high-level investigation.
