Google Cloud Enhances Cybersecurity with AI on the Dark Web

At the RSA Conference 2026 in San Francisco, Google Cloud unveiled major innovations in security, highlighting the integration of artificial intelligence to bolster enterprise defenses against cyber threats. At the heart of these announcements is an AI agent named "Triage and Investigation," integrated into Google’s "Security Operations" platform.

This agent has been specifically designed to assist corporate security teams by autonomously analyzing security alerts. It automatically incorporates additional data and context to assess whether an alert represents a genuine threat or is a false positive. This feature aims to optimize analysts' time in Security Operations Centers (SOCs), allowing them to focus on real threats.

Meanwhile, the M-Trends report from Mandiant, Google’s cybersecurity subsidiary, highlights the growing professionalism of cybercriminals. These criminals are now forming strategic partnerships and are striving to undermine their victims' ability to recover, thereby increasing extortion pressure. The time between the initial intrusion and the attack has been reduced to just 22 seconds, illustrating the heightened speed and efficiency of cyberattacks. A separate report from Mandiant reveals that attackers are now using AI tools that adapt in real-time during an attack to evade security systems.

In response to these threats, Google has also introduced a new dark web analysis tool powered by AI. This tool is capable of automatically assessing activity in the dark corners of the internet, such as forums and marketplaces where stolen data is exchanged. According to Google’s internal tests, this system can filter millions of activities per day with an impressive accuracy of 98%, only flagging threats that are genuinely relevant.