Securing the agentic enterprise on Google Cloud

The top concerns cited by enterprises are sensitive data exposure at 52% and regulatory compliance at 50% (Source: Cloud Security Alliance, Dec 2025). However, the enterprise transition to autonomous agentic AI introduces critical new vectors:

• The mean time to exploit vulnerabilities has plummeted to minus seven days, meaning zero-days are routinely exploited before software patches are published (Source: Mandiant M-Trends Report).
• Non-human workload identities now outnumber human identities by 82x in modern cloud environments (Source: Google Cloud NEXT 2026).
• 42% of active enterprise AI agents currently hold sensitive, over-permissive privileges (Source: Google Cloud NEXT 2026).
• Defending against these machine-speed attacks requires securing the full AI stack—infrastructure, data, models, and autonomous agents—simultaneously.

Shadow AI occurs when developers or business units deploy unsanctioned models, external APIs, or third-party agent skills without IT review:

• Over 15% of agent skills available in public marketplaces are known to be malicious (Source: Google Cloud NEXT 2026).
• 68% of organizations run self-hosted models bundled deep inside third-party software, often without realizing it (Source: Wiz, State of AI in the Cloud 2026).
• To detect shadow AI, organizations use the Wiz AI-APP, which connects via API in 15 minutes to generate a dynamic AI-Bill of Materials (AI-BOM), paired with Gemini, which provides a centralized Agent Registry to catalog and govern all active agents, custom MCP servers, and external tools.

No. While skill shortages are a recognized challenge, organizations with formal AI governance are 3x more likely to train staff on AI security tools(Source: Cloud Security Alliance, Dec 2025), and security teams now lead AI protection in 53% of organizations (Source: Cloud Security Alliance, Dec 2025). Google Cloud shifts security directly into the platform fabric: foundational configurations are automated via the Enterprise Foundations Blueprint, runtime interactions are governed natively by Model Armor, and autonomous find-and-fix agents like CodeMender and Wiz Green Agent test and generate idiomatic code patches directly in developer workflows.

Securing autonomous agents requires moving past static service accounts. Because non-human identities outnumber humans by 82x and 42% of active agents possess over-permissive privileges (Source: Google Cloud NEXT 2026), Google Cloud establishes an Identity-First Security Stack:

• Agent Identity: A dedicated, first-class principal type distinct from human users, provisioning cryptographic, strongly attested, lifecycle-bound runtime credentials.
• Least-privilege controls: Capabilities are restricted using Privileged Access Manager (PAM) for just-in-time (JIT) access, eliminating standing privileges.
• Principal Access Boundary (PAB): Imposes protective, hard resource boundaries to constrain the maximum blast radius of running agent identities.

The Secure AI Framework (SAIF) is Google’s conceptual architecture for secure, responsible AI deployment. It translates Zero Trust security principles into AI systems by mandating SLSA Level 3 build provenance validated through Binary Authorization, automated policy-as-code checks in Cloud Build, and continuous threat detection. In agentic environments, SAIF operationalizes through the 4-stage lifecycle: Architect, Inventory, Intercept, and Defend(Source: Secure AI Innovation eBook, Chapter 6).

The Model Context Protocol (MCP) is an open standard that allows autonomous AI agents to connect to external data sources, enterprise tools, and business APIs. However, unmanaged custom MCP integrations introduce risky, unvetted endpoints into production. Google Cloud secures agentic tooling via Google Cloud Managed MCP Servers (such as the MCP Server for BigQuery). This standardizes how agents interact with corporate databases, enforcing strictly scoped, auditable IAM permissions and replacing custom API wrappers with hardened, enterprise-managed connections (Source: Google Cloud NEXT 2026, Session BRK1-089).

Session bleeding occurs in multi-tenant or multi-agent environments when private conversation context, user tokens, or sensitive enterprise data from one user's session unintentionally leaks into another's. Google Cloud eliminates session bleeding through the Agent Development Kit (ADK) (Source: Secure AI Innovation eBook, Chapter 2):

• Tenant isolation: The ADK enforces strict user boundaries and execution isolation using native session_id and user_id primitives.
• Credential segregation: Downstream authentication tokens are isolated so that an agent cannot carry over credentials or conversational state across distinct user sessions.

Yes. Organizations pursue multi-model strategies running an average of 2.6 different models(Source: Cloud Security Alliance, Dec 2025). Google Cloud supports multi-model governance by using Gemini as a centralized execution control plane. Unified runtime guardrails—including Model Armor for prompt sanitization and Semantic Governance Policies—apply consistently across first-party Gemini models, open-source models, and third-party models. For multi-cloud estates (including AWS Bedrock, Databricks, and unmanaged open source), the Wiz Security Graph maps vulnerabilities and attack paths across all cloud providers (Source: Google Cloud NEXT 2026, Session BRK1-098).

No. CodeMender is engineered with a privacy-first local execution architecture (Source: Secure AI Innovation eBook, Chapter 4):

• Local CLI processing: The CodeMender scanning engine operates through a local command-line interface directly within the developer's secure environment.
• Isolated sandboxing: Application builds and active exploit verifications execute inside an isolated sandbox on your own infrastructure.
• Zero model training: Your proprietary source code and intellectual property remain strictly protected and are never used to train Google foundation models. Developers retain complete oversight through standard IDE/CLI workflows and Human-in-the-Loop (HITL) approval gates before any code patch is merged.

To execute high-risk business logic without exposing core infrastructure, enterprises use the Bring Your Own Container (BYOC) reference architecture:

• Container sandboxing: High-risk autonomous agents (such as inventory or logistics liaisons) are deployed in isolated containers on Cloud Run.
• Strict permission separation: Deploy-time infrastructure permissions are strictly separated from runtime execution permissions.
• Human-in-the-loop (HITL) gates: The Agent Development Kit (ADK) introduces programmed pause points where high-risk actions (such as initiating fulfillment APIs or financial disbursements) require explicit human sign-off before execution.

Google Cloud enforces a double-guardrail runtime solution to sanitize payloads without adding latency:

1. Controlling access (IAM boundaries): Enforced natively at the Agent Gateway using Identity-Aware Proxy (IAP) to cryptographically verify caller digital IDs before routing connections.
2. Controlling intent (semantic boundaries): Model Armor operates as an inline proxy screening user, agent, and model interactions in real time to neutralize prompt injections, prevent jailbreaks, and redact sensitive PII. At the application layer, the Agent Development Kit (ADK) enforces input validation (such as BeforeToolCallback) to stop indirect SQL injections against BigQuery tables.

Preventing data leakage requires defense-in-depth across the network, application, and model layers:

• Private topologies: AI workloads run on centrally managed Shared VPCs isolated by VPC Service Controls (VPC-SC), creating a macro-perimeter around the entire agent ecosystem.
• Inline sanitization: Model Armor automatically scrubs and redacts sensitive customer data and PII from prompt inputs and model outputs.
• Tokenless auth: Agent Identity Auth Manager handles complex downstream OAuth handshakes on behalf of users, passing tokens securely without exposing raw credentials to the agent.
• Confidential computing: Protects data in-use by encrypting memory during active model processing.