Cloud CISO Perspectives: Our security forecast for 2027

Welcome to the first Cloud CISO Perspectives for November 2026. Today, Chris Betz shares our security forecast for 2027, with insights from top leaders at Google, Google Cloud, and Mandiant.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

Our security forecast for 2027

By Chris Betz, CISO, Google Cloud

Security must evolve to protect the balance sheet through decision integrity. Every consequential action taken by an autonomous system requires a complete, tamper-proof decision trace, recording and tracking: 

• Inputs entered into the system.

• How the model reasoned through its decisions.

• Which tools the model called, what parameters it passed, and why policy allowed it.

Collecting this data will help ensure that your teams can reconstruct, validate, and audit every automated decision before scaling.

Making the alert queue disappear, from chasing tickets to setting doctrine

For decades, security operations centers (SOCs) have suffered from crippling alert fatigue — too many alerts compounded by legacy security tools that hand human analysts half-finished investigations. When autonomous threats can probe a network and move laterally in minutes, human defenders can’t manually stitch together logs across eight different consoles or approve individual defensive actions at microsecond speed.

That broken alert queue disappears in 2027 by flipping the operational model. The alert becomes the final output of an investigation. Autonomous defensive agents will handle the data enrichment, correlation, and triage automatically, surfacing a verified conclusion rather than a raw ticket. 

Instead of chasing alerts at a keyboard, human analysts move up the stack to set strategic doctrine, define risk appetite, and verify automated actions built for rapid explainability — where any defensive decision can be understood by a human in 60 seconds and reversed in 30.

Moving Beyond Zero: Transaction-level trust and first-class agent identities

As enterprises deploy thousands of custom agents across multicloud environments, flat trust architectures, shared human service accounts, and blanket administrator tokens are turning internal workflows into high-leverage entry points for prompt injection and lateral movement. 

Traditional Zero Trust is too rigid and broad to govern autonomous software acting on its own.

The year ahead demands an architectural shift to Beyond Zero so we can extend verification down to every individual transaction, network packet, and point-in-time authorization. Every autonomous agent should be treated as a first-class identity with its own verifiable credentials, strict least-privileged scope, and open communication standards. 

When backed by real-time autonomous reasoning, we can dynamically allow a transaction on Tuesday and block the exact same request on Wednesday if conditions look anomalous.

Closing the loop between live runtime and defect-free code

The traditional divide between writing software and securing it is breaking down, while adversaries actively target the open-source libraries and external tools that coding assistants pull into codebases. Developers can no longer file a ticket and wait weeks for a manual security review, yet deploying hasty, unvalidated automated patches in production is just as dangerous to business continuity as the vulnerability itself.

In 2027, security becomes a closed-loop, continuous system embedded directly into the software delivery pipeline. By placing agentic reasoning inside developer tools, we can perform threat modeling and catch configuration errors side-by-side as code is written. 

It’s also crucial that we link live production environments directly back to source code so that defenders can trace a real-world exposure to the exact line of code, validate whether it is genuinely exploitable, and deliver a pre-tested fix at machine speed without breaking production.

Turning internal ground truth into a decisive defender advantage

Concerns persist around attackers gaining the upper hand in cybersecurity, and many fear autonomous capabilities will only widen that gap in 2027. Adversaries are already compressing six months of reconnaissance into hours, and exploiting flaws before vendors even know they exist. Compounding the challenge for defenders, no single model can discover or patch every vulnerability across code and cloud on its own.

In the year ahead, defenders will use autonomous technology to capitalize on the one thing an outside attacker will never have: complete internal ground truth. While adversaries operate with fragmented external visibility and guesswork, defenders own the full picture of their identity privilege graphs, internal network architecture, code lineage, and live runtime activity. 

By feeding that unified context into multi-model ensembles — such as pairing lightweight models for continuous scanning with deep reasoning models that cross-validate findings and eliminate false positives — organizations can spot and remediate toxic combinations of permissions and configurations that look harmless in isolation, before an external attacker can ever piece them together.

Countering asymmetric threat speed and the new extortion playbook

Not every adversary will embrace machine speed the same way in 2027. While state-sponsored espionage actors often avoid loud, hyper-fast automated scripts that risk triggering alarms and blowing their long-term stealth, cybercriminals tend to go all-in on autonomous velocity.

As endpoint defenses get better at blocking traditional file-encrypting ransomware, criminal crews are shifting to rapid, high-volume data theft and extortion — specifically targeting proprietary model weights, custom agent skills, prompt libraries, and cloud GPU compute (“LLMJacking”).

Preparation here means eliminating security silos. It’s a critical failure point to treat models, agent permissions, software supply chains, and cloud infrastructure as separate domains. 

Instead, we want to unite them under a single, intelligence-led governance framework that allows defenders to lock down high-value autonomous assets and shut down extortion paths before data can leave the environment.

Red-teaming the agentic enterprise before adversaries attack

In the rush to capture productivity gains in the year ahead, many enterprises are deploying custom agents directly into core business workflows without testing how those systems behave under adversarial pressure. That mistake leaves guardrails vulnerable to bypasses, scanner blinding, and indirect prompt injection.

Continuous, proactive adversarial red-teaming must be a mandatory prerequisite before any autonomous workflow touches production. Systematically attempting to break into agentic systems, bypass safety controls, and manipulate model behavior prior to deployment is crucial to securing the agentic era.

Critically, model safety engineering should combine the results of those tests with frontline threat intelligence on novel attack prompts and evasion techniques. Defenders can then harden classifiers and neutralize new attack techniques before adversaries can use them against real victims.

Orchestrating specialized agent teams to prevent agent sprawl

Relying on a single generalist agent to defend an enterprise will fail in 2027 because deep technical skills do not transfer across domains. For example, an agent built to reverse-engineer malware is not the agent that should reason about an identity blast radius. 

As departments across the business rapidly spin up uncoordinated, standalone agents without centralized oversight, agent sprawl is emerging as the next iteration of shadow IT, threatening to derail enterprise agent deployments through inadequate governance.

Just as a well-coordinated human team beats a lone generalist, the year ahead belongs to orchestrated networks of specialized hunter, decoder, and responder agents, each operating with its own domain depth, memory, and dedicated tools. 

Succeeding at scale requires building the governance and orchestration layer first. The key here will be to establish graduated autonomy, shared state, clean handoffs between specialized agents, and a central coordinator that knows precisely when to act autonomously and when to escalate to a human.

To learn more about our cybersecurity guidance for the coming year, check out our Security 2027 video.

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month: 

• Helping you build and defend at machine-speed in the agentic era: At Security Summit 2026, we are sharing updates on how organizations can build securely, secure systems, and defend at machine speed in the agentic era. Read more.

• How Google Does It: Using agents to help find, track, and fix vulnerabilities: Threat actors can now find software flaws faster than ever. To maintain an agile, responsive defense, we now use agentic systems with existing foundations. Read more.

• How to use agents to stop insider threats: As agents find their place across the enterprise, we want to be sure that they neither become an insider threat nor enable people to become one. Read more.

• Empowering SOC teams with the Wiz Red and Blue agents: Red Agent gives SOC teams validated pre-breach alerts, while Blue Agent investigates active threats at machine speed, helping teams stay ahead in the AI threat era. Read more.

• The ROI of agentic remediation with Wiz Green Agent: Learn how Fireblocks, Rogo, and project44 used Green Agent to eliminate cross-team blockers and accelerate critical risk resolution. Read more.

• Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-10961: Follow these recommendations to minimize remote code execution risks in PHP from two critical vulnerabilities in the core PHP language runtime. Read more.

• Working collaboratively to fight scams in Asia Pacific: To help tackle scams in the Asia Pacific region, here’s how we combine built-in protections, local partnerships, and education. Read more.

Please visit the Google Cloud blog for more security stories published this month.

Threat Intelligence news

• The rise of LLMJacking: How threat actors monetize compromised resources: Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to large language models, a tactic known as LLMJacking that can generate large spikes in fraudulent cloud charges in a matter of hours. Read more.

• Shutting the door on the XCPE botnet: Google and industry partners dismantled the XCPE backdoor that had assembled more than 1.3 million set-top boxes into a botnet. We assessed with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology Company, an Android original equipment manufacturer and original design manufacturer. Read more.

• ARTEX and friends: Enter agentic offensive frameworks: Since September, Google Threat Intelligence Group and Mandiant have observed multiple threat actors abusing the open-source, agentic pentesting frameworks ARTEX, Hexstrike, and CAIRN to conduct a broad range of actions across multiple phases of the attack life cycle. Read more.

• Investigating ephemeral supply chain tampering: For the first time, Google Threat Intelligence Group (GTIG) and Mandiant have encountered a software supply chain compromise that was implemented with very short tampering windows that were active for only five to 10 minutes, and effectively evading traditional point-in-time triage and automated file scanning. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.