Google Security Operations Agentic SOC

Spec sheet

Purpose

Google Security Operations provides agentic defense for workflows including alert triage, threat hunting, and detection engineering.Read 14 Nov 2026 · cloud.google.com

Integrations

Google SecOps SOAR playbooks can orchestrate over 300 tools, including EDR, identity management, and network security tools.Read 14 Nov 2026 · cloud.google.com

Headquarters

Mountain View, California, United StatesRead 19 Oct 2026 · cloud.google.com

Founded

1998Read 19 Oct 2026 · cloud.google.com

Alert triage

The Triage and Investigation agent investigates alerts, enriches them with threat intelligence, and provides verdicts with explanations.Read 14 Nov 2026 · cloud.google.com

Analyst oversight

Agentic automation combines AI agents with deterministic playbooks and retains analyst control over critical actions.Read 14 Nov 2026 · cloud.google.com

Detection engineering

The Detection Engineering agent creates and validates detection rules to address emerging coverage gaps.Read 14 Nov 2026 · cloud.google.com

Platform capabilities

Google SecOps includes threat-centric case management, alert graphing, entity stitching, and AI-generated case summaries and recommendations.Read 14 Nov 2026 · cloud.google.com

Threat hunting

The Threat Hunting agent searches for novel attack patterns and stealthy behaviors using intelligence from Mandiant, VirusTotal, and Google.Read 14 Nov 2026 · cloud.google.com

Token entitlements

Enterprise Plus and Google Unified Security customers receive daily included token allotments tied to the annual contract value of their underlying eligible package.Read 14 Nov 2026 · docs.cloud.google.com

Token limits

Paid token consumption must be activated per tenant, and administrators can set daily consumption limits through the web interface or Chronicle API.Read 14 Nov 2026 · docs.cloud.google.com

Token metering

Generally available autonomous agents consume Security Tokens; standard chat panels, automated summaries, and preview agents do not.Read 14 Nov 2026 · docs.cloud.google.com

Trial status

The official trial period for Security Tokens has ended; interested customers are directed to their account representative.Read 14 Nov 2026 · docs.cloud.google.com

Who it is for

The platform is intended for security teams seeking to detect, investigate, and respond to cybersecurity threats.Read 14 Nov 2026 · cloud.google.com

Plans and prices

Every Google Security Operations Agentic SOC plan and price →

Where Specifiction places it

• AI SOC Agents#7 of 226.0
• AI Cybersecurity Software#8 of 136.0