Google Cloud urges boards to prioritise AI threat defence

Google Cloud has urged boards of directors to make AI threat defence a standard part of security governance, setting out five areas for directors to question management on as companies adopt AI more widely.

In a commentary by Chief Information Security Officer Chris Betz and Senior Director, Office of the CISO, Alicja Cade, Google Cloud said security governance now sits closer to core business strategy than to a back-office technology function. AI adoption, it argued, has changed the speed and scale of cyber risk, requiring boards to consider security in terms of business continuity, engineering productivity and oversight of automated systems.

Google Cloud said it developed AI Threat Defence, or AITD, from lessons learned protecting its own operations and customer environments. It described the product as a way to shift security work from manual, reactive firefighting to automated, continuous operations.

Betz and Cade said directors do not need to manage technical execution, but they do need to create governance frameworks that support operational change. Their argument reflects a wider shift in corporate cyber oversight, as boards face pressure to show they understand the business implications of generative AI and the risks created by faster, machine-led attacks.

Five questions

The first area is business enablement. Google Cloud said boards should ask how security modernisation spending will help the business deliver value to customers more quickly, what additional resources may be needed, and whether those investments align with broader commercial strategy.

It framed this as more than a defensive concern. According to the guidance, automated threat defence can help organisations recover engineering time, reduce delays and improve time to market for new features.

The second area is the remediation cycle. Here, Google Cloud said AI can apply business logic and internal context to reduce noise in security operations and help teams manage a more complex threat landscape. Boards should ask how management plans to balance business operations, risk and profitability while responding more quickly to AI-driven threats.

A key operational measure in this section is mean time to remediate, or MTTR. Google Cloud said boards should expect that measure to fall as organisations automate defensive work and move changes into production more quickly.

Platform shift

The third area is system consolidation. Rather than relying on a collection of point tools, Google Cloud said boards should press management on whether the company is moving towards a unified security platform.

That recommendation points to a longstanding issue in cyber security procurement: fragmented vendor estates can create blind spots and duplication. Google Cloud said an integrated workflow for scanning, risk prioritisation and code remediation would reduce visibility gaps and operational friction.

The fourth area is contextual prioritisation. Google Cloud argued that organisations already hold detailed knowledge about how applications connect, where important data sits, who has access and which workflows matter most to business operations. In its view, that context should shape how AI systems rank vulnerabilities and alerts.

That would allow engineering and security teams to focus on issues that are genuinely reachable or material to the business, rather than losing time to false positives. The guidance said boards should ask how companies are using internal context to reduce alert fatigue.

AI oversight

The fifth area is AI safety and policy. Google Cloud said every discussion about AI is also a discussion about security, and warned that companies need governance for internal AI pipelines as well as visibility over unauthorised, or so-called shadow, AI use.

Boards should ask what frameworks are in place to secure AI infrastructure, monitor use of unsanctioned tools and protect intellectual property. The operational expectations listed include runtime visibility, data egress controls and secure development standards for AI systems.

The paper ties those questions to a broader claim that passive oversight is no longer enough in highly automated digital environments. For boards, that means cyber governance is becoming more closely linked to strategic decisions about growth, product delivery and operational resilience.

Betz wrote: "Modern security governance has become a critical part of the foundation for business agility. Often treated as an operational cost center, security is increasingly recognized as a primary business enabler, a runway that empowers your organization to move fast, adopt cutting-edge generative AI, and capture new markets securely. In today's environment, every major business initiative is an AI initiative, and every AI initiative requires a secure foundation. Ensuring your company is investing in the right technologies and using the right tools will be crucial in leading through the rapid AI transformation."

Cade set out the case for changes in board-level expectations: "To operate against AI speed threats, boards of directors should encourage their CISOs and business leaders to transform their strategic approach for speed, scope, and scale. We need to emphasize risk and vulnerability management with a defensive strategy that's AI native, agentic, and open. By aligning defensive speeds with automated attack cycles, using deep internal business context, and integrating tools into unified platforms, AI-powered defense can help you confidently manage today's threats at machine speed, and simultaneously greenlight aggressive innovation."