Cloud CISOの視点：AIが「守る側の優位性」として深いコンテキストを活用する方法Cloud CISO Perspectives: How AI leverages deep context as the defender’s advantage

Google's Cloud CISO team has published a perspective arguing that artificial intelligence is beginning to shift a long-standing imbalance in cybersecurity toward defenders, primarily by allowing security teams to analyze deep context at a scale that was previously impractical. The topic matters because the so-called "defender's dilemma" — the idea that defenders must secure every possible entry point while an attacker needs to succeed only once — has shaped security strategy for decades. If AI can meaningfully ease that asymmetry, it could change how security operations centers are staffed, structured, and measured.

The central argument is that context, not raw data volume, is where defenders have historically struggled. A modern enterprise generates enormous quantities of telemetry from identity systems, endpoints, network traffic, cloud configurations, and application logs. Human analysts and traditional rule-based tooling can inspect individual signals, but stitching them together into a coherent narrative across many systems is slow and labor-intensive. According to the Google team, large language models such as Gemini are well suited to this correlation work because they can ingest and reason over large, heterogeneous inputs, summarizing what happened, why it might be suspicious, and what an analyst should examine next.

In practical terms, the post frames several security operations tasks where this capability appears most useful. Alert triage is a common example: rather than presenting an analyst with a raw detection, an AI system can gather the surrounding context, describe the likely attack path in natural language, and recommend next steps. Investigation and threat hunting are described similarly, with AI generating queries, interpreting results, and drafting incident summaries. The team also points to the value of translating between technical artifacts and human-readable explanations, which can reduce the specialized knowledge required to begin an investigation and help shorten response times.

This messaging aligns with Google's broader product direction. The company has integrated generative AI across its security portfolio, including Google Security Operations, formerly built on Chronicle, and its Security Command Center for cloud posture management. Gemini features have been added to assist with detection engineering, case investigation, and summarization. Google also owns Mandiant, a well-known incident response and threat intelligence provider, and the company has emphasized combining frontline threat intelligence with AI reasoning so that defensive tools reflect current attacker behavior rather than static rules alone.

The perspective fits within a wider industry trend. Vendors including Microsoft, with its Security Copilot, and CrowdStrike, Palo Alto Networks, and others have introduced AI assistants aimed at security analysts, and the sector is increasingly discussing agentic workflows in which AI systems carry out multi-step tasks with some autonomy. For readers less familiar with the underlying tooling, it is worth noting the ecosystem these assistants sit within: SIEM platforms aggregate and search logs, SOAR tools automate response playbooks, and endpoint detection and response systems monitor devices. AI is generally being positioned as a layer that connects these systems and reduces the manual effort of moving between them.

Google's framing is notably measured about where the advantage comes from. The claimed benefit is not that AI detects entirely new categories of threats, but that it compresses the time and expertise needed to understand context, which is often the bottleneck during an active incident. That distinction matters because attackers are also adopting AI, using it to write phishing content, generate code, and scale reconnaissance. The company's position appears to be that defenders hold an inherent data advantage, since they control and can observe their own environments in depth, and that AI helps them finally use that data effectively.

Several caveats accompany this optimism. Generative models can produce inaccurate or fabricated output, so human review of AI-generated conclusions remains important, particularly for consequential response actions. Feeding sensitive security data into AI systems also raises governance, privacy, and data-residency questions that organizations must address. As with most vendor commentary, the post reflects Google's own products and strategic interests, and independent evaluation of real-world effectiveness is still limited. Even so, the underlying premise — that scalable contextual analysis is a genuine and increasingly practical benefit for defenders — is consistent with how much of the security industry is currently deploying AI, and it is likely to influence how security teams plan their tooling and workflows going forward.