Google Cloud's AI Defense: Can Machine Learning Finally Turn the Tide in Cybersecurity?

Mark Johnston, Director of Google Cloud's Office of the CISO for Asia Pacific, delivered a sobering message during a 1:30 PM presentation at the company's Singapore office at Block 80, Level 3. Speaking to assembled technology journalists, he revealed a troubling reality: despite five decades of cybersecurity advancement, organisations continue to lose ground to attackers. The statistics underscore the problem's severity: In 69% of incidents in Japan and Asia Pacific, organisations were notified of their own breaches by external entities, Johnston stated, highlighting how most companies fail to detect intrusions on their own.

During an hour-long roundtable titled "Cybersecurity in the AI Era," Johnston and other security experts examined how Google Cloud's artificial intelligence capabilities might reverse decades of defensive setbacks, even as those same AI tools simultaneously strengthen attackers' arsenals.

Five decades of unresolved security problems

The cybersecurity crisis extends back further than most realise. Johnston traced the roots to a 1972 observation by cybersecurity pioneer James P. Anderson, who noted that systems that we use really don't protect themselves. Remarkably, this fundamental challenge persists unchanged. What James P Anderson said back in 1972 still applies today, Johnston remarked, underscoring how core security weaknesses have survived technological revolutions.

Basic vulnerabilities continue plaguing organisations at scale. According to Google Cloud's threat intelligence findings, over 76% of breaches start with the basics – configuration mistakes and compromised credentials that have haunted the industry for decades. Johnston cited a recent incident as illustration: Last month, a very common product that most organisations have used at some point in time, Microsoft SharePoint, also has what we call a zero-day vulnerability…and during that time, it was attacked continuously and abused.

The AI arms race: Both sides gaining power

The current security landscape resembles what Kevin Curran, IEEE senior member and cybersecurity professor at Ulster University, characterises as a high-stakes arms race where defenders and threat actors both wield AI to outmanoeuvre opponents. Curran explains that For defenders, AI is a valuable asset. Enterprises have implemented generative AI and other automation tools to analyse vast amounts of data in real time and identify anomalies.

Yet attackers benefit equally from these technologies. For threat actors, AI can streamline phishing attacks, automate malware creation and help scan networks for vulnerabilities, Curran warns. This dual-use reality creates what Johnston terms the Defender's Dilemma.

Google Cloud's AI strategy aims to shift advantage toward defenders. Johnston contends that AI affords the best opportunity to upend the Defender's Dilemma, and tilt the scales of cyberspace to give defenders a decisive advantage over attackers. The company's approach encompasses what it describes as countless use cases for generative AI in defence, including vulnerability identification, threat analysis, secure code development, and incident management.

Project Zero's Big Sleep: AI discovering hidden flaws

Google's Project Zero initiative demonstrates AI's potential through its "Big Sleep" program, which leverages large language models to uncover vulnerabilities in production code. Johnston shared striking results: Big Sleep found a vulnerability in an open source library using Generative AI tools – the first time we believe that a vulnerability was found by an AI service.

The program's capabilities have expanded rapidly. Last month, we announced we found over 20 vulnerabilities in different packages, Johnston noted. But today, when I looked at the big sleep dashboard, I found 47 vulnerabilities in August that have been found by this solution.

This progression signals a shift in security operations. Johnston describes the movement as transitioning from manual to semi-autonomous security work, where Gemini drives most tasks in the security lifecycle consistently well, delegating tasks it can't automate with sufficiently high confidence or precision.

The automation paradox: Benefits and dangers

Google Cloud envisions security operations progressing through four phases: Manual, Assisted, Semi-autonomous, and Autonomous. In the semi-autonomous stage, AI systems would manage routine operations while escalating difficult decisions to human teams. The autonomous phase would see AI drive the security lifecycle to positive outcomes on behalf of users.

Automation, however, introduces fresh risks. When questioned about over-reliance on AI systems, Johnston acknowledged the concern: There is the potential that this service could be attacked and manipulated. At the moment, when you see tools that these agents are piped into, there isn't a really good framework to authorise that that's the actual tool that hasn't been tampered with.

Curran shares this apprehension: The risk to companies is that their security teams will become over-reliant on AI, potentially sidelining human judgment and leaving systems vulnerable to attacks. There is still a need for a human 'copilot' and roles need to be clearly defined.

Managing AI's unpredictable outputs

Google Cloud addresses one of AI's most troublesome characteristics: its capacity to generate irrelevant or inappropriate responses. Johnston illustrated the problem through a practical example: If you've got a retail store, you shouldn't be having medical advice instead. Sometimes these tools can do that. Such contextual misalignment poses genuine business risks for organisations deploying customer-facing AI systems, potentially confusing users, harming brand perception, or creating legal complications.

The company's Model Armor technology serves as a protective filter layer. Having filters and using our capabilities to put health checks on those responses allows an organisation to get confidence, Johnston explained. The system screens outputs for personally identifiable information, removes contextually inappropriate content, and prevents responses that contradict the organisation's intended purpose.

Google also tackles the emerging threat of unauthorised AI tools proliferating within organisations. Companies are discovering hundreds of unsanctioned AI systems operating in their networks, creating substantial security exposures. Google's sensitive data protection systems attempt to mitigate this by scanning across multiple cloud environments and internal infrastructure.

Budget constraints amid escalating threats

Johnston identified financial limitations as the primary obstacle confronting Asia Pacific security leaders, arriving precisely when cyber threats intensify. The contradiction is striking: as assault frequencies climb, organisations lack sufficient resources to mount adequate defences.

We look at the statistics and objectively say, we're seeing more noise – may not be super sophisticated, but more noise is more overhead, and that costs more to deal with, Johnston observed. Rising attack volumes, even when individual incidents lack sophistication, drain resources that many organisations cannot replenish.

Financial strain compounds an already demanding security environment. They are looking for partners who can help accelerate that without having to hire 10 more staff or get larger budgets, Johnston explained, describing pressure on security executives to accomplish more with existing personnel and funding while threats multiply.

Unresolved questions about effectiveness

Despite Google Cloud AI's promising capabilities, significant uncertainties persist. When pressed on whether defenders are gaining ground in the arms race, Johnston acknowledged: We haven't seen novel attacks using AI to date, but noted that attackers employ AI to amplify existing assault methods and generate a wide range of opportunities in some aspects of the attack.

Claims about effectiveness warrant careful examination. Johnston cited a 50% acceleration in incident report generation speed, yet conceded that precision remains problematic: There are inaccuracies, sure. But humans make mistakes too. This admission underscores persistent limitations in current AI security deployments.

Preparing for quantum computing threats

Beyond immediate AI applications, Google Cloud anticipates future security paradigm shifts. Johnston disclosed that the company has already deployed post-quantum cryptography between our data centres by default at scale, preparing for quantum computing advances that could compromise existing encryption methods.

Balanced assessment: Opportunity and risk

Integrating AI into cybersecurity presents both remarkable potential and substantial hazards. Google Cloud's AI systems demonstrate genuine capabilities in vulnerability detection, threat evaluation, and automated response, yet these same technologies enhance attackers' capacity for reconnaissance, social manipulation, and evasion.

Curran's evaluation offers perspective: Given how quickly the technology has evolved, organisations will have to adopt a more comprehensive and proactive cybersecurity policy if they want to stay ahead of attackers. After all, cyberattacks are a matter of 'when,' not 'if,' and AI will only accelerate the number of opportunities available to threat actors.

AI-powered cybersecurity's success ultimately hinges not on technological sophistication but on implementation discipline. Organisations must deploy these tools thoughtfully while preserving human oversight and addressing foundational security practices. Johnston concluded by emphasising: We should adopt these in low-risk approaches, advocating measured deployment rather than indiscriminate automation.

The AI transformation in cybersecurity has commenced, but triumph will favour those balancing technological innovation with prudent risk management—not those pursuing the most advanced algorithms alone.