Amazon EventBridge now supports Internet Protocol version 6 (IPv6) through new dual-stack endpoints. You can now connect to EventBridge Event Bus, EventBridge Scheduler, EventBridge Pipes, and EventBridge schema registries using IPv6, IPv4, or dual-stack clients. The existing Amazon EventBridge endpoints that support only IPv4 will remain available for backwards compatibility.
Amazon EventBridge is a serverless service that uses events to connect application components together, making it easier for you to build scalable event-driven applications. Through Event Bus for many-to-many routing, Scheduler for scheduled tasks, Pipes for point-to-point integrations, and schema registries for event schema discovery and management, EventBridge provides reliable and efficient ways to ingest, filter, transform, and deliver events. With dual-stack endpoints now available for these EventBridge services, you can use IPv6 to future-proof your event-driven architectures, maintain compatibility with existing IPv4 systems, and eliminate the need for complex IP address translation infrastructure.
As of today, AWS Batch now supports scheduling for SageMaker Training jobs. With AWS Batch for SageMaker Training jobs, data scientists are able to submit training jobs to configurable queues powered by AWS Batch. This integration enables jobs to be scheduled based on priority and resource availability, eliminating manual retries and coordination. Additionally, system administrators can set up fair-share scheduling policies to optimize resource utilization across teams. The system will automatically retry failed jobs and provide visibility into queue status.
You can also procure SageMaker Flexible Training Plans (FTP) to guarantee the capacity you need during the time you need it. With a Flexible Training Plan in place, Batch’s queuing capabilities allows you to maximize your utilization for the duration of your plan. Data scientists can submit experiments with confidence directly from the SageMaker Python SDK, knowing that infrastructure complexities are handled automatically.
You can start using AWS Batch for SageMaker Training jobs immediately through the AWS Management Console, AWS Command Line Interface (CLI), or AWS SDKs. There are no additional charges for AWS Batch itself – you only pay for the AWS resources used to run your applications. AWS Batch for SageMaker Training jobs is now generally available in all commercial AWS Regions where AWS Batch and SageMaker AI are available. To get started, see the AWS Batch for SageMaker Training jobs documentation and our blog post.
AWS Database Migration Service (DMS) Schema Conversion now supports Virtual Mode for Data providers, enabling you to perform schema assessment and conversion without connecting to target database instances. This feature helps you begin conversion planning immediately while reducing infrastructure costs.
Virtual Mode enables you to evaluate database compatibility, review and convert schema code, generate assessment reports, and plan resource requirements. All of this happens before provisioning actual database infrastructure. When you are ready for migration, you can switch from virtual to real Data providers seamlessly. Virtual Mode works with all AWS DMS Schema Conversion-supported target databases, including Amazon RDS and Aurora PostgreSQL, MySQL, Amazon RDS for Db2, and Amazon Redshift.
Virtual Mode is available in all AWS Regions where AWS DMS Schema Conversion is supported, at no additional charge. To learn more visit the Virtual Data provider page.
Amazon Connect Cases now displays email content, including message body, images, and attachment details directly within the case activity feed, enabling case workers to understand email conversations more efficiently and resolve cases faster.
Amazon Connect Cases is available in the following AWS regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Africa (Cape Town) AWS regions. To learn more and get started, visit the Amazon Connect Cases webpage and documentation.
Amazon Connect Cases is now available in the Africa (Cape Town) AWS region. Amazon Connect Cases provides built-in case management capabilities that make it easy for your contact center agents to create, collaborate on, and quickly resolve customer issues that require multiple customer conversations and follow-up tasks.
With this launch, Amazon Connect Cases is available in the following AWS regions: US East (N. Virginia), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (London), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Africa (Cape Town) AWS regions. To learn more and get started, visit the Amazon Connect Cases webpage and documentation.
Google Cloud is committed to being a trusted partner for customers who are navigating AI regulations in Europe. We have long understood that this requires a proactive and collaborative approach in order to ensure Europeans can access secure, first-rate AI tools as they become available.
This week, Google announced that we intend to sign the European Union AI Act Code of Practice (the Code). Google Cloud supports the stated vision of the AI Office to offer a simple and transparent way to demonstrate compliance with the AI Act that offers a streamlined compliance process, with enforcement focused on monitoring their adherence to the Code. We believe that this approach can result in greater predictability and a reduced administrative burden.
By participating, we believe our customers will benefit by being able to compare among the best cloud services and derive their own compliance benefits.
Looking ahead, customers should become familiar with these three compliance documents as they seek to develop and deploy AI in the EU.
The EU AI Act is a legal and regulatory framework that establishes obligations for certain AI systems based on their potential risks and levels of impact.
The General-Purpose AI Code of Practice is a voluntary tool, prepared by independent experts in a multi-stakeholder process, designed to help industry comply with the AI Act’s obligations for providers of general-purpose AI models.
Separately, the GPAI guidelines focus on the scope of the obligations for providers of general-purpose AI models laid down in the AI Act, in light of their imminent entry into application on August 2, 2025.
Google Cloud’s approach to helping customers with the Act
A core pillar of our approach to trust in AI, and a critical component of AI Act compliance, is data governance and privacy. Customers control how and where their data is used. We embed privacy-by-design principles throughout our product lifecycle, including in AI development, ensuring architectures include privacy safeguards like data encryption and providing meaningful transparency and control over data use.
We have delivered on the commitment to European customers we made back in 2020 to help them transform their businesses and address their strict data security and privacy requirements. To date, we’ve invested billions of euros to expand access to secure, high-performance computing capacity with seven data centers in Europe in addition to 13 cloud regions in Poland, Finland, Germany, Italy, Spain, France, Belgium, Sweden, the Netherlands, Switzerland, and more under development.
Our Sensitive Data Protection service and VPC Service Controlsfurther assist customers in protecting sensitive data and meeting data residency requirements. We are already working to add new features to support data governance in-line with AI Act compliance requirements.
Supporting your compliance
We were among the first organizations to publish AI principles in 2018, and have published an annual transparency report since 2019. We consistently review our policies, practices, and frameworks, incorporating robust safety and security practices, privacy-by-design, and risk assessments.
We are committed to providing and regularly updating documentation about our AI tools and services. The Cloud Compliance Center remains the most up-to-date resource for all customer compliance artifacts including Google Cloud’s ISO 42001 AI Management System certification and EU AI Act related documentation. As we prepare for compliance for all new models which will be launched globally, including in the EU, we’ll update all artifacts to ensure timely integration into Google Cloud customer uses.
Our continuously updated Secure AI Framework (SAIF) provides a conceptual framework for securing AI systems across data, infrastructure, application, and model dimensions, emphasizing defense-in-depth and secure-by-design foundations. This ensures early inclusion of prevention and detection controls, adapted to specific product and user risks.
Of course, operationalizing any industry framework requires close collaboration with others — and above all a forum to make that happen. That’s why last year we worked with industry partners to launch the Coalition for Secure AI (CoSAI) to advance comprehensive security measures for addressing the unique risks that come with AI, for both issues that arise in real time and those over the horizon.
What customers can do to prepare
Customers should work closely with the EU AI Office to understand their legal and regulatory obligations when seeking to modify a foundation model or integrate one into a large system. It will be important to track new guidance and developments released by the AI Office.
We will continue to follow all legal obligations under the Act and demonstrate how we are fulfilling and supporting compliance requirements — including new forthcoming models which will be subject to the Code.
We remain committed to providing our enterprise customers with cutting-edge AI solutions that are both innovative and compliant. We have the capabilities and experience, and we will continue to partner with policymakers and customers as new regulations, frameworks, and standards are developed.
Imagine a code review process that doesn’t slow you down. Instead of a queue of pending pull requests, you have an intelligent assistant that provides a near-instant, comprehensive summary of every change. It flags potential bugs, suggests improvements based on best practices, and frees up your human reviewers to focus on the complex architectural decisions that truly require their expertise.
This isn’t a future-state prediction; it’s what’s possible today with Gemini Code Assist, integrated directly into your GitHub workflow at no charge. By embedding a powerful AI partner into every pull request, we’re transforming code reviews from a frustrating bottleneck into a fast and painless way to ensure high quality and consistent code, leading to higher code quality and happier developers.
The challenge: Why code reviews are a bottleneck
Code reviews are a non-negotiable part of building quality software, but they are often a major bottleneck in the development lifecycle. This friction slows down delivery velocity, leads to inconsistent code quality, and makes it difficult to enforce best practices. Research from DORA’s Impact of Generative AI in Software Development report advises that organizations, “Double-down on fast high-quality feedback, like code reviews and automated testing, using gen AI as appropriate.” DORA research has found that teams with shorter-code review times have 50% better software delivery performance.1 AI adoption has been shown to increase code review speed by an estimated 3.1% for every 25% increase in AI adoption, and improve reported code quality by 3.4%.2
aside_block
<ListValue: [StructValue([(‘title’, ‘$300 in free credit to try Google Cloud AI and ML’), (‘body’, <wagtail.rich_text.RichText object at 0x3eb0e2656490>), (‘btn_text’, ‘Start building for free’), (‘href’, ‘http://console.cloud.google.com/freetrial?redirectPath=/vertex-ai/’), (‘image’, None)])]>
The solution: An AI-powered partner in your PRs
Gemini Code Assist integrates into your GitHub workflow as an intelligent partner, conducting code reviews to solve these challenges. When a pull request is created, Gemini is automatically assigned as a reviewer and gets to work immediately. Here’s how it helps:
Near-instant PR Summaries: Provides a comprehensive summary of the changes to help human reviewers get up to speed almost instantly.
In-depth automated reviews: Identifies stylistic issues, deviations from best practices, and potential bugs, freeing human reviewers to focus on more critical issues.
Interactive assistance and learning: Allows anyone in the PR to have a conversation with the AI using /gemini commands to ask for alternative implementations or get a fresh review.
The power of Gemini 2.5: A leap in code review intelligence
With our recent general availability release, Gemini Code Assist has been upgraded to run on our latest model, Gemini 2.5. This isn’t just an incremental update—it’s a major leap forward in the quality, accuracy, and intelligence of AI-powered code reviews.
What does this mean for your daily pull requests?
Deeper insights: You’ll see more insightful suggestions that go beyond simple style fixes. Gemini 2.5 is better at understanding the logic and intent behind your code, helping to identify potential bugs and suggest more efficient implementations.
More actionable code suggestions: Through customer specific style guides and configurations, the AI-generated code is now more accurate and context-aware. You’ll find that suggestions are often so reliable that you can commit them with confidence after a quick review, speeding up your iteration cycles.
Improved relevancy We have significantly increased the relevancy and accuracy of suggestions. This means you can trust the feedback you receive and spend less time second-guessing the AI and more time moving your project forward.
These improvements are a direct result of our rigorous internal testing and deliver more comprehensive and actionable feedback to help developers be more productive.
Customer story: How Delivery Hero enhances code quality with Gemini Code Assist
Delivery Hero is the world’s leading local delivery platform, operating in around 70 countries. Strengthening the code review process is a key part of their commitment to delivering high-quality, reliable features for the customers, which prompted them to become an early adopter of the Gemini Code Assist GitHub app. The initial feedback from their developers was overwhelmingly positive, and the app’s recent upgrade to the Gemini 2.5 model brought an even more significant impact to the app development process, particularly on code quality. Their engineers found the AI-generated comments to be highly relevant and valuable, directly contributing to a higher standard of code. The latest developer experience survey after the adoption of the Gemini Code Assist GitHub app showed a clear rise in developer satisfaction with the quality and speed of code reviews—marking a positive turn for this important metric.
“By integrating the Gemini Code Assist GitHub app into our workflow, we are not just adopting a tool; we are fostering a more robust, efficient, and collaborative engineering culture. Our close partnership with Google as an early adopter, built on an agile and effective feedback loop, has been a key part of this success.” N. Mert Aydin, Principal Software Engineer, Delivery Hero
Get started
Try it today: Get started with Gemini Code Assist on the GitHub Marketplace.
Learn more: Dive deeper by reading the official documentation.
AI is evolving beyond single, task-specific agents into an interconnected ecosystem, where autonomous agents collaborate to solve complex problems, regardless of their underlying platform. To make this transition easier for developers, we are announcing a comprehensive suite of tools that will empower developers to build, deploy, evaluate, and sell Agent2Agent (A2A) agents with Google Cloud.
Today, we’re excited to announce the release version 0.3 of the A2A protocol, which brings a more stable interface to build against and is critical to accelerating enterprise adoption. This version introduces several key capabilities, including gRPC support, the ability to sign security cards, and extended client side support in the Python SDK, which provide more flexible use, better security and easier integration.
The A2A protocol is quickly gaining momentum, with support from a growing ecosystem of over 150 organizations that spans every major hyperscaler, leading technology providers, and multinational customers using Google Cloud. Businesses are already building powerful capabilities for their organizations. For example, Tyson Foods and Gordon Food Service are pioneering collaborative A2A systems to drive sales and reduce supply chain friction, creating a real-time channel for their agents to share product data and leads that enhance the food supply chain.
aside_block
<ListValue: [StructValue([(‘title’, ‘$300 in free credit to try Google Cloud AI and ML’), (‘body’, <wagtail.rich_text.RichText object at 0x3eb0e03e7430>), (‘btn_text’, ‘Start building for free’), (‘href’, ‘http://console.cloud.google.com/freetrial?redirectPath=/vertex-ai/’), (‘image’, None)])]>
Build: Native support for A2A in the Agent Development Kit (ADK)
We’re releasing native support for A2A in Agent Development Kit (ADK), a powerful open source agent framework released by Google. This makes it easy to build A2A agents if you are already using ADK and is built upon our previously-released A2A SDKs. For example, with a simple “Hello, World!” style code snippet, developers can now use ADK to:
Use an A2A agent with an Agent Card and use it as a sub-agent.
Expose an existing ADK agent to make it discoverable as an A2A agent.
Developers can start building collaborative agents with ADK today.
Deploy: Flexible deployment options with Agent Engine, Cloud Run, and GKE
Once agents are built, they need a robust and scalable home to exist within. We are providing three powerful deployment paths for customers to scale agents into production:
Deploy to Agent Engine: For a managed, agent-optimized environment, Agent Engine is the choice for many agent builders. We’re adding support for A2A to Agent Engine in the coming weeks so that you can easily deploy an agent written in any framework to Agent Engine and get a production ready, Google-scale, A2A agent.
Deploy to Cloud Run: For increased flexibility, you can containerize and deploy your A2A agents to Cloud Run, leveraging Google’s serverless infrastructure for massive scale and reliability. Follow the published guide.
Deploy to Google Kubernetes Engine (GKE): For maximum control, you can deploy agents to GKE, providing the full power of Kubernetes to manage A2A systems at scale.
With support for A2A arriving in the coming weeks, developers will be able to use the `agent-starter-pack` CLI tool to complete CI/CD setup in just one line: “` uvx agent-starter-pack create my-agent -a adk@gemini-fullstack “`
Integrate: Bring your A2A agents to users with Agentspace
Agents need safe and accessible environments to be useful. That’s why we built Agentspace, the destination where agents meet end users. In the coming weeks, partners will be able to make any A2A agent available in Agentspace, transforming it from a standalone tool into a valuable service that people can consume. This includes partner-built agents that are built on partner platforms, giving customers the flexibility to access these A2A agents in multiple locations.
More than just a hub, Agentspace provides the critical governance, safety, and control features needed for an enterprise-ready agent platform, ensuring that interactions are secure and reliable.
Evaluate and commercialize your A2A systems
Building and deploying agents is just the beginning. To create truly enterprise-grade systems, you need robust evaluation capabilities, which is why we’re extending the Vertex GenAI Evaluation Service to support A2A agent evaluations. See our hands-on guidance.
Discover and sell partner-built A2A agents in AI Agent Marketplace
Partners can now sell their A2A agents directly to customers in the AI Agent Marketplace. This will allow Google Cloud customers to discover and purchase agents published by ISVs, GSIs, and other technology providers. The AI Agent Marketplace provides an important path to market for partners looking to monetize their AI Agents.
We announced the A2A protocol in April to lead the industry toward interoperable agent systems, and in June, we advanced that commitment by contributing it to the Linux Foundation. The industry’s response continues to grow, reflecting a shared belief in vendor-neutral, community-driven standards. Many of Google Cloud’s partners have previously offered agents to joint customers, and they are now enabling these agents with A2A to help future-proof investments for customers.
Adobe: A leader in generative AI, Adobe is leveraging the A2A protocol to make its rapidly-growing number of distributed agents interoperable with agents in Google Cloud’s ecosystem. The A2A protocol enables Adobe agents to collaborate in the enterprise to create powerful new digital experiences, streamline workflows that optimize the content creation process, and automate multi-system processes and data integrations.
S&P Global Market Intelligence: S&P, a provider of information services and solutions to global markets, has adopted A2A as a protocol for inter-agent communication. This strategic alignment enhances interoperability, scalability, and future-readiness across the organization’s agent ecosystem.
ServiceNow: As a founding partner of A2A, ServiceNow empowers customers with its AI Agent Fabric, a multi-agent communication layer that connects ServiceNow, customer, and partner-built agents. This provides enterprises with the greater choice and flexibility needed to unlock the full potential of agentic AI, resulting in faster decisions, fewer handoffs, and more scalable solutions.
Twilio: Twilio is using A2A protocol for implementing Latency Aware Agent Selection. By extending the A2A protocol, individual agents now broadcast their latency, enabling the system to intelligently route tasks to the most responsive agent available and also adapt gracefully – for example, playing a filler prompt or adding typing sounds, if a high-latency agent is the only option.
Developers can review more about past releases in the release notes, learn about what’s coming in the future in our roadmap, and join the community to help evolve the protocol moving forward. The community has also released great tooling around A2A with the launch of A2A Inspector and Technology Compatibility Kit.
Get started
We’re excited to partner across the industry to build the future of artificial intelligence. Here’s how you can start:
We’re thrilled to announce a significant expansion of our C4 virtual machine series, with the general availability of 28 powerful new shapes. This expansion introduces C4 shapes with Google’s next-gen Titanium Local SSD, C4 bare metal instances, and new extra-large shapes, all powered by the latest Intel Xeon 6 processors, Granite Rapids. We’re excited to be the first leading hyperscaler to bring Xeon 6 to customers.
C4 VMs with Xeon 6 deliver performance gains of up to 30% for general compute and up to 60% for ML recommendation workloads, and up to 35% lower access latency on Titanium Local SSD shapes. If you already use the C4 machine series, this means an easy and powerful path to the latest hardware without needing to migrate to a new machine series. You can take advantage of your existing committed use discounts (CUDs) and enjoy capabilities like managed instance groups and Google Kubernetes Engine (GKE) custom compute classes.
aside_block
<ListValue: [StructValue([(‘title’, ‘$300 in free credit to try Google Cloud infrastructure’), (‘body’, <wagtail.rich_text.RichText object at 0x3eb0df06a490>), (‘btn_text’, ‘Start building for free’), (‘href’, ‘http://console.cloud.google.com/freetrial?redirectPath=/compute’), (‘image’, None)])]>
C4 VMs on Intel Xeon 6
Initially launched with Intel 5th generation Xeon processors (Emerald Rapids), C4 VMs provided advancements in performance and control for enterprise and mission-critical workloads, especially AI, gaming, databases, and data analytics. And now with Xeon 6 (Granite Rapids), C4 VMs power even more demanding workloads, delivering the highest frequency of any Google Compute Engine VM — up to 4.2 GHz, the most vCPU and RAM of any Intel-based comparable product, larger L3 cache size, and 1.35x higher maximum memory bandwidth. The C4 machine series offers enhanced maintenance controls with a 30-day uptime window between planned maintenance events, and scalable Hyperdisk storage with up to 500k IOPS and 10 GB/s, including features like Hyperdisk Storage Pools.
Inference workloads on C4 with Xeon 6 demonstrate up to 60%better performance per core compared to prior-generation C3. C4’s new shapes support FP16-trained models with Intel AMX-FP16, making it a great choice for accelerating machine learning inference. Also, a new larger half- and full-host C4 shape (144 and 288 vCPU) guarantees memory isolation, for highly predictable performance. The largest C4 shape enables up to30% more performance per core on the estimated SPECrate®2017_int_base benchmark versus C3.
“SAS® Viya®, our cloud-based data and AI platform, is optimized for productivity with Intel hardware. We’re eager to scale production on C4 with Granite Rapids, having measured up to20% performance improvementin areas such asdeep learning and synthetic data generation. C4 with Granite Rapids leveraging Intel AMX delivers up to 6x speed-up, achieving GPU-comparable performance for a wide range ofgenerative AI use cases involving inference with small to mid-size models. This empowers customers to use SAS Viya in Google Cloud in a more cost-effective way.” – Craig Rubendall, Vice President, Applied Architecture and Technology, SAS
“As a next-generation visual effects studio, beloFX demandspeak performance for complex renders. When testing C4 on Granite Rapids, we observed an impressive 50% speedupagainst our n2d-standard-128 and n2-standard-128 nodes. This significant boost lets us produce more groundbreaking visual effects, faster, truly supercharging our ability to innovate.” – Christoph Ammann, Global Technology Supervisor, beloFX
New C4 standard, highmem, and highcpu with 144and 288vCPU shapes are powered exclusively by Xeon 6:
Machine Type
highcpu
standard
highmem
C4-highcpu-144
C4-standard-144
C4-highmem-144
C4-highcpu-288
C4-standard-288
C4-highmem-288
Turbocharge your storage with Titanium Local SSD
We’re also excited to announce Local SSD support for C4 VMs, available with new -lssd machine types, exclusively on Xeon 6 processors. These new local SSD shapes leverage the latest Titanium SSDs, delivering impressive I/O performance for workloads like high-performance databases (e.g., Cassandra, MongoDB, SQL Server tempDB and pagefile workloads), big data processing (e.g., Spark, Hadoop), media rendering and transcoding, and caching layers.
C4-lssd offers up to 7.2M max read IOPS, more than three times higher than comparable options from other leading hyperscalers. This translates to dramatic improvements in read/write latency. Titanium SSDs on C4 enable up to 35%lower access latency compared to previous generation SSDs.
“For financial market infrastructure, every microsecond of latency matters. With C4-LSSD, we have seen an impressive70% improvement in write latency compared to previous generations. This reduction with Titanium SSDs on C4 is crucial for our demanding, high-throughput applications, ensuring the stability and responsiveness essential for our business.”– Christian Hellmann, DevOps Engineer, Deutsche Börse Group
C4 with Local SSD is available in standard and highmem configurations starting from 4 vCPUs, exclusively on Xeon 6:
Machine Type
Local SSD Capacity (GiB)
standard
highmem
C4-standard-4-lssd
C4-standard-8-lssd
C4-standard-16-lssd
C4-standard-24-lssd
C4-standard-32-lssd
C4-standard-48-lssd
C4-standard-96-lssd
C4-standard-192-lssd
C4-standard-144-lssd
C4-standard-288-lssd
C4-highmem-4-lssd
C4-highmem-8-lssd
C4-highmem-16-lssd
C4-highmem-24-lssd
C4-highmem-32-lssd
C4-highmem-48-lssd
C4-highmem-96-lssd
C4-highmem-192-lssd
C4-highmem-144-lssd
C4-highmem-288-lssd
375
375
750
1,500
1,875
3,000
6,000
9,000
12,000
18,000
Unlock direct access with C4 bare metal shapes
For workloads that demand direct access to CPU and memory resources, we’re introducing C4 bare metal shapes. These instances are ideal for commercial and custom hypervisors, applications not traditionally supported in virtual machines, and those with special performance monitoring or licensing requirements. C4 bare metal is SAP-certified, delivering an impressive 132,600 aSAPs — the highest of any comparable machine, providing peak performance and compliance for your critical SAP application servers.
Customers in financial services, SaaS/PaaS security, with dev/test environments, and private cloud platforms will find C4 bare metal types essential for meeting their stringent performance goals. Compared to the previous generation C3 bare metal instances, C4 bare metal offers up to a 35% performance improvement.
New C4 bare metal instances are available in standard-metal and highmem-metal, powered exclusively by Xeon 6:
Machine Type
standard
highmem
C4-standard-288-metal
C4-highmem-288-metal
Get started with C4 on Intel Xeon 6 today
The expanded C4 machine series with Intel Xeon 6 is available today in 19 zones, with more expansion to come. Check the latest regional availability on our regions and zones page. Experience the leading performance, predictability, and control that C4 VMs deliver today! To learn more about C4 and its new capabilities, visit the C4 documentation.
“Intel and Google Cloud are shaping the future of cloud computing with the expansion of the C4 Machine Series powered by Intel Xeon 6 processors. With enhanced performance, built-in AI acceleration, and greater deployment flexibility with new and with extra-large shapes, we’re enabling customers to innovate faster and run workloads more efficiently than ever before.” – Ronak Singhal, Intel Senior Fellow, Intel
Managing complex SAP landscapes can feel like navigating a maze. You’re juggling application performance, database health, infrastructure stability, and more, all while striving to ensure seamless business applications. Today, we’re excited to announce new observability and monitoring functionality in Workload Manager to provide SAP customers with purpose-built tools that bridge gaps in data and provide a unified view of SAP environments across all layers of their cloud environments.
Workload Manager is not intended to replace your existing SAP monitoring tools, but rather complement them by providing a broader view of your SAP systems and enabling you to more easily correlate application-level insights with infrastructure performance and events.
Expanding visibility in complex SAP environments
Traditional SAP monitoring excels at providing detailed information at the application and database level. Metrics about transaction performance, user activity, and application logs are readily available. However, understanding the relationship between this application data and the underlying infrastructure can sometimes require additional effort. For example, a slowdown in transaction processing might be due to a database issue, a network bottleneck, or even a problem with the underlying virtual machine. While existing tools provide valuable insights, correlating application performance with infrastructure health can be a time-consuming process or may require toggling between different monitoring platforms and manual efforts.
aside_block
<ListValue: [StructValue([(‘title’, ‘Try Google Cloud for free’), (‘body’, <wagtail.rich_text.RichText object at 0x3eb0e270c9d0>), (‘btn_text’, ‘Get started for free’), (‘href’, ‘https://console.cloud.google.com/freetrial?redirectPath=/welcome’), (‘image’, None)])]>
Creating a system-centric, unified view with Workload Manager
After enabling the necessary functionality in Google Cloud’s Agent for SAP, you can navigate to the main Observability dashboard to see an overview of your SAP systems and the overall health status of each system and sub-layer. The health status is calculated using a variety of metrics from SAP Netweaver instances, SAP HANA databases, pacemaker clusters, and the availability of the underlying infrastructure hosting them.
Clicking on a system will take you to the system Overview page, where you can visualize the components of the system and see the current health status for each instance included. The Health Insights table will summarize any health issues that are currently detected, and the Maintenance Events table displays any upcoming maintenance for supported machine types.
The “Applications” and “Databases” tabs behave similarly, and help you correlate key performance indicators from your SAP applications with metrics from your VMs, storage, network, and other Google Cloud services such as the following:
Availability: GCE Instance Availability, SAP NetWeaver and SAP HANA instance status, SAP NetWeaver and SAP HANA process status and Pacemaker Cluster nodes and resource status.
Performance: GCE Instance CPU and memory utilization, operating system processes by CPU and memory and information about swap I/O operations on the operating system.
Storage: SAP related file systems usage, disk space utilization and usage, disk throughput and disk IOPS.
Networking: Information about network traffic and network packages.
Netweaver: CPU and memory utilization by SAP NetWeaver process, response time by processes in the SAP NetWeaver instance, SAP NetWeaver sessions and RFC connections by type, SAP NetWeaver process utilization per work process type and information for each SAP NetWeaver process type for each respective queue in the system.
HANA: SAP HANA System Replication status, SAP HANA System Replication latency, memory usage in the SAP HANA Database by type, information about idle and running connections in the SAP HANA database and top schemas by record count in the SAP HANA database.
Backups: Information related to Backint backups including Backup/Recovery success rate, Backup/Recovery average MBps for all operations and historical data about both Backup/Recovery status and throughput.
New Event Annotations built specifically for SAP allow you to surface system events directly on monitoring dashboards to help empower you to quickly identify the root cause or see the impact of events on your system’s performance and health. These events are also now available outside of Workload Manager in Cloud Monitoring dashboards.
SAP Availability:
Pacemaker cluster:
Pacemaker cluster node status
Pacemaker cluster resource status
SAP HANA Database:
SAP HANA instance status
SAP HANA service status
SAP NetWeaver:
SAP NetWeaver instance status
SAP NetWeaver service status
SAP Operations:
SAP HANA System Replication status
SAP HANA Backup status
SAP HANA Data backups
SAP HANA Log backups
For example, in the following screenshot we can see how a SAP HANA database failover impacted the database availability and see the series of events as the Pacemaker cluster moved the database operations to the secondary node.
Other key features and benefits:
Comprehensive metrics: The solution collects a wide range of metrics from your SAP applications and Google Cloud infrastructure, but if you are looking for more, you can create your own custom queries and add the metrics to your custom dashboards inside Workload Manager Observability.
Customizable dashboards: Modify the dashboards to create alternative views to help visualize what matters most to your business and allow for faster identification of critical issues
Alerting and notifications: The dashboards are natively integrated with Cloud Monitoring and Alerting. You can set up alerts for specific metrics and receive notifications when thresholds are breached
Automated system discovery: The Agent for SAP automatically identifies and reconciles your SAP instances and resources when enabled, saving you valuable time and avoiding manual tagging or labeling
Getting started
Ready to experience the benefits of a single-pane-of-glass for SAP observability on Google Cloud? You can view detailed documentation and instructions on how to get started and the supported architectures here. The observability service in Workload Manager is available at no additional cost, but the underlying metrics and logs are subject to costs associated with Cloud Monitoring and Cloud Logging. You can view an estimated cost for the required features that must be enabled here.
If you would like assistance onboarding or would like a demo or more information, please contact your account representative or Google Cloud support and we will be in touch.
Looking ahead
We are committed to continuously improving SAP observability on Google Cloud and plan on adding new features and more correlation capabilities and insightful visualizations.
Amazon Relational Database Service (Amazon RDS) for Oracle has expanded its instance offerings in AWS GovCloud (US) Regions. The M7i and R7i instances, which support a maximum instance size of 48xlarge, are Intel-based offerings delivering 50% more vCPU and memory compared to M6i and R6i instance types. The X2idn instances are optimized for memory-intensive workloads with up to 2TiB of memory.
M7i, R7i and X2idn instances are available for Amazon RDS for Oracle in Bring Your Own License model for both Oracle Database Enterprise Edition (EE) and Oracle Database Standard Edition 2 (SE2). You can launch the new instance in the Amazon RDS Management Console or using the AWS CLI or SDK. Refer to the Amazon RDS for Oracle Pricing page to see pricing details and regional availability.
Amazon Managed Service for Prometheus now offers a higher default limit of 50M active time series per workspace, up from 10M. This increase eliminates the need for limit increase requests up to 50M series. Customers can still request limit increases for up to 1 billion active series per workspace. An Amazon Managed Service for Prometheus workspace is a logical space dedicated to the storage and querying of Prometheus metrics.
The new limit increase is already applied to your current workspace, and is available in all AWS regions where Amazon Managed Service for Prometheus is generally available.
Amazon Aurora MySQL-Compatible Edition now supports a maximum storage limit of 256 TiB, doubling the previous limit of 128 TiB. This enhancement allows customers to store and manage even larger datasets within a single Aurora database cluster simplifying data management for large-scale applications and supporting the growing data needs of modern applications. Customers only pay for the storage they use, with no need for upfront provisioning of the full 256 TiB.
To access the increased storage limit, upgrade your cluster to supported database versions. Once upgraded, Aurora storage will automatically scale up to 256 TiB capacity based on the amount of data in the cluster volume. Visit technical documentation to learn more about supported versions. This new storage volume capacity is available in all AWS regions where Aurora MySQL and Aurora PostgreSQL is available.
Amazon Aurora is designed for unparalleled high performance and availability at global scale with full MySQL and PostgreSQL compatibility. It provides built-in security, continuous backups, serverless compute, up to 15 read replicas, automated multi-Region replication, and integrations with other AWS services. To get started with Amazon Aurora, take a look at our getting started page.
Today, we’re announcing support for custom slash commandsin Gemini CLI! This highly requested feature lets you define reusable prompts for streamlining interactions with Gemini CLI and helps improve efficiency across workflows. Slash commands can be defined in local .toml files or through Model Context Protocol (MCP) prompts. Get ready to transform how you leverage Gemini CLI with the new power of slash commands!
To use slash commands, make sure that you update to the latest version of Gemini CLI.
Powerful and extensible foundation with .toml files
The foundation of custom slash commands is rooted in .toml files.
The .toml file provides a powerful and structured base on which to build extensive support for complex commands. To help support a wide range of users, we made the required keys minimal (just prompt). And we support easy-to-use args with {{args}} and shell command execution !{...} directly into the prompt.
Here is an example .toml file that is invoked using /review <issue_number> from Gemini CLI to review a GitHub PR. Notice that the file name defines the command name and it’s case sensitive. For more information about custom slash commands, see the Custom Commands section of the Gemini CLI documentation.
code_block
<ListValue: [StructValue([(‘code’, ‘description=”Reviews a pull request based on issue number.”rnprompt = “””rnPlease provide a detailed pull request review on GitHub issue: {{args}}.rnrnFollow these steps:rnrn1. Use `gh pr view {{args}}` to pull the information of the PR.rn2. Use `gh pr diff {{args}}` to view the diff of the PR.rn3. Understand the intent of the PR using the PR description.rn4. If PR description is not detailed enough to understand the intent of the PR,rn make sure to note it in your review.rn5. Make sure the PR title follows Conventional Commits, here are the last five rn commits to the repo as examples: !{git log –pretty=format:”%s” -n 5}rn6. Search the codebase if required.rn7. Write a concise review of the PR, keeping in mind to encourage strong codern quality and best practices.rn8. Use `gh pr comment {{args}} –body {{review}}` to post the review to the PR.rnrnRemember to use the GitHub CLI (`gh`) with the Shell tool for allrnGitHub-related tasks.rn”””‘), (‘language’, ”), (‘caption’, <wagtail.rich_text.RichText object at 0x3e24fa7a8ee0>)])]>
Namespacing
The name of a command is determined by its file path relative to the commands directory. Sub-directories are used to create namespaced commands, with the path separator (/ or ) being converted to a colon (:).
A file at <project>/.gemini/commands/test.toml becomes the command /test.
A file at <project>/.gemini/commands/git/commit.toml becomes the namespaced command /git:commit.
This allows grouping related commands under a single namespace.
Building a slash command
The next few sections show you how to build a slash command for Gemini CLI.
1 – Create the command file
First, create a file named plan.toml inside the ~/.gemini/commands/ directory. Doing so will let you create a /plan command to tell Gemini CLI to only plan the changes by providing a step-by-step plan and to not start on implementation. This approach will let you provide feedback and iterate on the plan before implementation.
Custom slash commands can be scoped to an individual user or project by defining the .toml files in designated directories.
User-scoped commands are available across all Gemini CLI projects for a user and are stored in ~/.gemini/commands/(note the ~).
Project-scoped commands are only available from sessions within a given project and are stored in .gemini/commands/.
Hint: To streamline project workflows, check these into Git repositories!
<ListValue: [StructValue([(‘code’, ‘# ~/.gemini/commands/plan.tomlrnrndescription=”Investigates and creates a strategic plan to accomplish a task.”rnprompt = “””rnYour primary role is that of a strategist, not an implementer.rnYour task is to stop, think deeply, and devise a comprehensive strategic plan to accomplish the following goal: {{args}}rnrnYou MUST NOT write, modify, or execute any code. Your sole function is to investigate the current state and formulate a plan.rnrnUse your available “read” and “search” tools to research and analyze the codebase. Gather all necessary context before presenting your strategy.rnrnPresent your strategic plan in markdown. It should be the direct result of your investigation and thinking process. Structure your response with the following sections:rnrn1. **Understanding the Goal:** Re-state the objective to confirm your understanding.rn2. **Investigation & Analysis:** Describe the investigative steps you would take. What files would you need to read? What would you search for? What critical questions need to be answered before any work begins?rn3. **Proposed Strategic Approach:** Outline the high-level strategy. Break the approach down into logical phases and describe the work that should happen in each.rn4. **Verification Strategy:** Explain how the success of this plan would be measured. What should be tested to ensure the goal is met without introducing regressions?rn5. **Anticipated Challenges & Considerations:** Based on your analysis, what potential risks, dependencies, or trade-offs do you foresee?rnrnYour final output should be ONLY this strategic plan.rn”””‘), (‘language’, ”), (‘caption’, <wagtail.rich_text.RichText object at 0x3e24fa7a8f10>)])]>
3 – Use the command
Now you can use this command within Gemini CLI:
code_block
<ListValue: [StructValue([(‘code’, ‘/plan How can I make the project more performant?’), (‘language’, ”), (‘caption’, <wagtail.rich_text.RichText object at 0x3e24fa7a8dc0>)])]>
Gemini will plan out the changes and output a detailed step-by-step execution plan!
Enriched integration with MCP Prompts
Gemini CLI now offers a more integrated experience with MCP by supporting MCP Prompts as slash commands! MCP provides a standardized way for servers to expose prompt templates to clients. Gemini CLI utilizes this to expose available prompts for configured MCP servers and make the prompts available as slash commands.
The name and description of the MCP prompt is used as the slash command name and description. MCP prompt arguments are also supported and leveraged in slash commands by using /mycommand --<argument_name>="<argument_value>" or positionally /mycommand <argument1> <argument2>.
The following is an example/research command that uses FastMCP Python server:
Easy to get started
So what are you waiting for? Upgrade your terminal experience with Gemini CLI today and try out custom slash commands to streamline your workflows. To learn more, check out the Custom Commands documentation for the Gemini CLI.
Six months into 2025, we’ve already published hundreds of posts here on the Google Cloud blog. We asked ourselves, why wait until the busy end of the year to review your favorites? With everything from new AI models, product launches, emerging cyber threats, company news, certifications and customer stories, here is a mid-year recap that will get you up to speed on the latest from Google Cloud and the rapidly emerging cloud and AI landscape.
25. How Google Does It: Making threat detection high-quality, scalable, and modern
Published January 7, 2025
Google and Alphabet run the largest Linux fleet in the world, with nearly every flavor of operating system available, and see a steady stream of malicious system and network activity. Learn how our threat detection and response team detects, analyzes, and responds to threats on a vast scale.
More and more organizations are turning to Cloud Run, Google Cloud’s serverless runtime, for its simplicity, flexibility, and scalability. And now, with the general availability of NVIDIA GPUs on the platform, developers can choose Cloud Run for applications that require powerful graphics processing, like machine learning models.
23. BigQuery emerges as autonomous data-to-AI platform
Published April 10, 2025
This is not your grandfather’s data warehouse. BigQuery is now an AI-native, multimodal, and agentic data-to-AI platform. The blog post provides an overview of the many new features and capabilities that went into this new designation, including new data preparation, data analysis, code generation and management and troubleshooting capabilities.
22. Announcing Gen AI Toolbox for Databases. Get started today
Published February 6, 2025
Tired of building custom plumbing to connect your AI apps to your databases? This article announces the public beta of the Gen AI Toolbox for Databases, an open-source server built with LangChain that provides a secure, scalable, and manageable way to connect your generative AI applications to your data.
21. Ghost in the router: China-nexus espionage actor UNC3886 targets Juniper Networks
Published March 11, 2025
After discovering in 2024 that threat actors deployed custom backdoors to Juniper Networks’ Junos OS routers, Mandiant worked with Juniper to investigate this activity and observed that the affected routers were running end-of-life hardware and software. Learn more about the threat and how to remediate it in your environment.
It’s a platform, it’s a system, it’s AI Hypercomputer, Google Cloud’s fully managed supercomputing system for running AI and HPC workloads. As discussed at Google Cloud Next 2025, AI Hypercomputer supports all the latest and greatest compute, networking and storage infrastructure, and its software layer helps AI practitioners and engineers move faster with open and popular ML frameworks. Finally, there’s a full suite of workload management and observability tools to help you manage the thing.
19. Ipsos research shows why cloud certification matters — get certified with Google Cloud
Published February 25, 2025
Google Cloud partnered with Ipsos, the global research firm, to study the impact of cloud certifications on career advancement and achievement. For example, 8 out of 10 survey respondents said earning a recognized certificate helped them land a job faster and 75% believe they secured a higher salary through their certification.
18. Connect globally with Cloud WAN for the AI Era
Published April 9, 2025
With 202 points of presence (PoPs), powered by over 2 million miles of fiber, 33 subsea cables, and backed by a 99.99% reliability SLA, Google’s backbone network is, how do we put it? Vast. And with Cloud WAN, enterprises can now use it for their own wide area network (WAN) architectures.
17. Expanding generative media for enterprise on Vertex AI
Published April 9, 2025
At Google Cloud Next 25, we announced powerful new creative controls for our generative media models on Vertex AI. Now you can edit video with in-painting and out-painting, use camera controls for dynamic shots, and even create custom voices for AI-powered narration with as little as 10 seconds of audio.
Threat actors continue to target edge devices globally, leveraging deep device knowledge and using both zero-day and now n-day flaws. This activity aligns with the broader strategy that the Google Threat Intelligence Group has observed among suspected China-nexus espionage groups, who invest significantly in exploits and custom malware for critical edge infrastructure.
15. Defending against UNC3944: Cybercrime hardening guidance from the frontlines
Published May 6, 2025
Who is UNC3944? A financially-motivated threat actor characterized by its persistent use of social engineering and brazen communications with victims. Mandiant provides guidance and strategies for hardening systems and defenses against the cybercrime group, offering practical steps to protect against their specific attack methods.
14. MCP Toolbox for Databases (formerly Gen AI Toolbox for Databases)
Published April 22, 2025
Ready to build AI agents that can actually use your data? This article announces that our MCP Toolbox for Databases now supports the Model Context Protocol (MCP), making it easier than ever to connect your generative AI agents to enterprise data. With new support for the Agent Development Kit (ADK) and LangGraph, you can build powerful, stateful agents with intuitive code and connect them to your databases securely.
13. Formula E’s AI equation: A new Driver Agent for the next era of racing
Published March 25, 2025
As motorsport has grown in popularity, the ability of fans from diverse backgrounds to enter the cockpit has not always kept up. Formula E sought to level the course for aspiring drivers by creating an AI-powered Driver Agent; connected to a Formula E simulator, the agent provides drivers and coaches with real-time feedback on technique and tactics, help them improve faster than a flying lap.
12. Google Agentspace enables the agent-driven enterprise
Published April 9, 2025
Do you want to search all your company’s information in a few clicks, or generate ideas with built-in agents that already know your company’s style? Google Agentspace now includes a no-code agent designer, a gallery for discovering agents, and two new expert agents for deep research and idea generation, all integrated directly into Chrome.
11. Announcing Veo 3, Imagen 4, and Lyria 2 on Vertex AI
Published May 20, 2025
The next generation of creating for enterprise is here. We expanded Vertex AI to include our most powerful generative AI media models: Imagen 4 for stunningly realistic images with crisp text, Veo 3 for breathtaking video with synchronized audio, and Lyria 2 for composing high-fidelity, original music.
In the security realm, large language models (LLMs) open a world of new possibilities, from sifting through complex telemetry to secure coding, vulnerability discovery, and streamlining operations. However, some of these same AI capabilities are also available to attackers, leading to understandable anxieties about the potential for AI to be misused for malicious purposes.
9. Ivanti Connect Secure VPN targeted in new zero-day exploitation
Published January 8, 2025
Ivanti kicked off the year by disclosing two new vulnerabilities impacting its Ivanti Connect Secure (ICS) VPN appliances. Mandiant identified UNC5221, a suspected China-nexus espionage actor that previously exploited two other Ivanti vulnerabilities as early as December 2023, as the threat actor targeting the new zero-days. Successfully exploiting one of the vulnerabilities could result in downstream compromise of a victim network.
Google Cloud shares a vision with Wiz to improve security by making it easier and faster for organizations of all types and sizes to protect themselves, end-to-end, across all major clouds, and this post announces Google’s agreement to acquire the cloud security startup.
7. Veo 3 available for everyone in preview on Vertex AI
Published June 26, 2025
You dream it, Veo creates it. This post announces Veo 3, our most powerful text-to-video model yet, is now open for everyone to try in public preview on Vertex AI. Create stunning, near-cinematic videos with synchronized sound, and join the next wave of creative storytelling, now available to Google Cloud customers and partners.
6. Vertex AI offers new ways to build and manage multi-agent systems
Published April 9, 2025
This article announces ways to build multi-agentic systems, an evolution of traditional AI agents. To get there, we launched a new suite of tools in Vertex AI to help developers build and deploy them, including an open-source Agent Development Kit (ADK) and a managed Agent Engine. We also introduce the Agent2Agent (A2A) protocol, a new open standard to allow agents built by different companies to communicate and collaborate.
Even though it’s been around for a long time, not all developers speak fluent SQL. English, on the other hand, is pretty well-known. In this technical deep dive for developers working with natural language processing and databases, get the insights and techniques you need to enhance the accuracy and performance of your text-to-SQL conversions.
4. Firebase Studio lets you build full-stack AI apps with Gemini
Published April 9, 2025
For over a decade, developers the world over have relied on Firebase’s backend cloud computing services and application development platforms to power their web applications. And with the new Firebase Studio, they can now use it to develop full-stack AI applications, integrating with the Gemini AI model.
3. Multiple Russia-aligned threat actors targeting Signal Messenger
Published February 19, 2025
As part of the ongoing Russian-Ukrainian conflict, Signal Messenger accounts are of great interest to Russia’s intelligence services for their potential to deliver sensitive government and military communications. Google Threat Intelligence Group has observed increasing efforts from several Russia state-aligned threat actors to compromise Signal Messenger accounts used by individuals of interest to Russia’s intelligence services.
2. New Google Cloud certification in generative AI
One of the top questions we hear is “how do I get ahead”? This isn’t just another certification in a sea of technical qualifications. The Generative AI Leader certification is specifically focused on generative AI, and designed for visionary professionals like you — the managers, administrators, strategic leaders and more who understand that AI’s impact stretches far beyond code.
1. 601 real-world gen AI use cases from the world’s leading organizations
Published April 9, 2025
Since Next 2024, we’ve been gathering examples of how our customers are putting generative AI to use everyday across their operations and offerings. We nearly doubled the number of entries for Next 2025, and clearly they’re still resonating, as this has been our most popular story of the year. What use cases are most exciting you? Pop over to our LinkedIn page and let us know.
Thank you for being a part of the Google Cloud blog community! We look forward to bringing you lots more blogs for you to devour in the second half of the year.
Agentspace provides an Agent Development Kit (ADK) for building specialized agents and an A2A (Agent-to-Agent) communication protocol for agent collaboration. These tools facilitate a shift from static workflows to dynamic, adaptive business systems.
Pluto7’s Planning in a Box Pi Agent is designed to complement and offer an intelligent AI layer for autonomous planning. It integrates with various enterprise systems like SAP, Oracle, and Salesforce, consolidating structured and unstructured data into a Master Ledger via Google Cloud’s Cortex Framework. This effectively creates a real-time digital twin and control tower, providing a unified view and synchronized decision-making across the supply chain.
Pi Agent functions as a real-time supply chain planning assistant, mirroring a ride-share system for inventory. It senses real-time signals, reallocates resources, and makes proactive decisions. Examples include agents for demand analysis (Ron), inventory optimization (Kassy), financial balancing (Alex), and defect flagging (Bob), all collaborating through the A2A protocol. This allows for significantly faster decision-making and a transition from reactive problem-solving to proactive planning.
aside_block
<ListValue: [StructValue([(‘title’, ‘Try Google Cloud for free’), (‘body’, <wagtail.rich_text.RichText object at 0x3e4fd047a430>), (‘btn_text’, ‘Get started for free’), (‘href’, ‘https://console.cloud.google.com/freetrial?redirectPath=/welcome’), (‘image’, None)])]>
Practical impact
A case study featuring a LatAm CPG manufacturer demonstrates the practical impact. By implementing Planning in a Box + Pi Agent (now powered by Google Agentspace), the manufacturer gained real-time inventory visibility, improved order fulfillment, and is on track to reduce excess inventory by 15% while cutting manual reporting by 70%. It also has natural language access to inventory data: “How much inventory do I have for Faucet at Location Warehouse?”
The combination of Agentspace + Planning in a Box – Pi Agent creates an agentic command center for enterprises, enabling autonomous workflows, seamless ERP (SAP,Oracle,Netsuite) integration, and deployment within the user’s Google Cloud tenant delivered in the form for a service-as-a-software. This setup offers rapid time to value, with initial use cases deployable in weeks.
Over years, Pluto7 has seen customers getting on the platform adoption journey see significant business outcomes, including a 10–20% improvement in forecast accuracy, up to a 50% reduction in inventory carrying costs, over 50% safety stock reduction, faster planning cycles, and a 10%+ increase in margin all of which is articulated in Pluto7’s 2:10 rule of revenue growth with planning error reduction.
Looking ahead
Agentic AI isn’t the future – it’s already here redefining supply chain planning and enabling Planners to become superheros. Businesses can explore how Google Cloud’s Agentspace and Pluto7’s Planning in a Box can enable intelligent orchestration and real-time responsiveness in their supply chains.
Welcome to the second Cloud CISO Perspectives for July 2025. Today, Andy Wen, director, product management, Workspace Security, discusses new efforts we’re making to defend against identity-based cyberattacks.
As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.
aside_block
<ListValue: [StructValue([(‘title’, ‘Get vital board insights with Google Cloud’), (‘body’, <wagtail.rich_text.RichText object at 0x3e4f91e34160>), (‘btn_text’, ‘Visit the hub’), (‘href’, ‘https://cloud.google.com/solutions/security/board-of-directors?utm_source=cloud_sfdc&utm_medium=email&utm_campaign=FY24-Q2-global-PROD941-physicalevent-er-CEG_Boardroom_Summit&utm_content=-&utm_term=-‘), (‘image’, <GAEImage: GCAT-replacement-logo-A>)])]>
The evolving threat landscape: Beyond traditional 2FA
By Andy Wen, director, product management, Workspace Security
Andy Wen, director, product management, Workspace Security
Threat actors relentlessly pursue identity-based attacks, understanding that compromised credentials are a direct path to their objectives. To counter those attacks, we’re constantly innovating at Google, and we have some good news involving two critical innovations developed in close partnership with the wider security community.
Stolen credentials, email phishing, brute-force, and other identity-based vectors comprised 37% of successful breaches in 2024, in large part because of the rise of infostealers, a method threat actors rely on to scale identity attacks, according to Mandiant’s most recent M-Trends report. These initial breaches can frequently escalate into costly ransomware incidents and data exfiltration.
Google has long been a leader in security, and last year we announced that we are making two-factor authentication (2FA) mandatory for Google Cloud customers. We’re now taking security a step further and introducing new capabilities to keep customers secure.
In close collaboration with the Chrome team, we are adding a powerful addition to our security arsenal, now in beta: Device Bound Session Credentials (DBSC). DBSC are designed to disrupt cookie theft by creating an authenticated session that is cryptographically bound to a specific device.
How passkeys and Device Bound Session Credentials can help
To empower users and customers against identity-based attacks, we’ve introduced two critical innovations developed in close partnership with the wider security community: passkeys and Device Bound Session Credentials (DBSC). These advancements are designed to significantly strengthen account security and prevent account takeovers.
We highly recommend that all Workspace customers, especially those with high-value users such as IT administrators and business leaders, implement these controls.
Use passkeys for a simpler, more secure sign-in
We have made passkeys generally available to all 11 million Workspace organizations and billions of Google consumer users. Passkeys represent a fundamental shift away from passwords, offering a simpler and inherently more secure sign-in experience.
Unlike traditional passwords that can be guessed, stolen, and forgotten, passkeys are unique digital credentials cryptographically tied to your device. They use the robust FIDO2 technology, the same underlying standard used in hardware security keys like our Titan Security Key, and the added convenience of using a device you already own, such as an Android phone or a Windows laptop.
While absolute security remains an elusive goal, from the perspective of account takeover and phishing attacks, passkeys and security keys virtually eliminate these password-based threats. As a founding member and steadfast supporter of the FIDO Alliance, we are encouraged by the growing industry adoption of FIDO technology.
Disrupt cookie theft with Device Bound Session Credentials
We are also addressing the use of infostealers to exfiltrate session cookies, allowing attackers to bypass password and 2FA controls and access victim accounts from their own devices.
In addition to Mandiant’s M-Trends 2025 report, IBM’s 2025 X-Force Threat Intelligence Index observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year.
In close collaboration with the Chrome team, we are adding a powerful addition to our security arsenal, now in beta: Device Bound Session Credentials (DBSC). DBSC are designed to disrupt cookie theft by creating an authenticated session that is cryptographically bound to a specific device. This innovative approach can significantly mitigate the risk of exfiltrated cookies being used to access accounts from an unauthorized device.
DBSC introduces a new API that enables servers to establish an authenticated session bound to a device. When a session is initiated, the browser generates a unique public-private key pair. The private key is securely stored using hardware-backed storage, such as a Trusted Platform Module (TPM), when available.
The browser then issues a regular session cookie. It is crucial to note that throughout the session’s lifetime, the browser periodically proves possession of the private key and refreshes the session cookie.
This mechanism allows the cookie’s lifetime to be set short enough to render stolen cookies largely useless to attackers. While DBSC currently operates with Chrome and Workspace, numerous server providers, identity providers (IdPs) like Okta, and other browsers such as Microsoft Edge, have expressed strong interest in adopting DBSC to protect their users from cookie theft.
A combined approach for enhanced security
Combined, passkeys and DBSC can empower organizations to significantly strengthen account security and prevent account takeovers. Both of these security controls are readily available to all Workspace customers, and we strongly advocate for their implementation, particularly for your most critical users such as IT administrators and business leaders.
<ListValue: [StructValue([(‘title’, ‘Join the Google Cloud CISO Community’), (‘body’, <wagtail.rich_text.RichText object at 0x3e4f91e34ca0>), (‘btn_text’, ‘Learn more’), (‘href’, ‘https://rsvp.withgoogle.com/events/ciso-community-interest?utm_source=cgc-blog&utm_medium=blog&utm_campaign=2024-cloud-ciso-newsletter-events-ref&utm_content=-&utm_term=-‘), (‘image’, <GAEImage: GCAT-replacement-logo-A>)])]>
In case you missed it
Here are the latest updates, products, services, and resources from our security teams so far this month:
Secure cloud. Insecure use. (And what you can do about it): If the cloud is secure, why are there still cloud security breaches? Too many organizations don’t use it securely. Here’s how to change that. Read more.
Tabletopping the tabletop: New perspectives from cybersecurity’s favorite role-playing game: A group of bio-cybersecurity experts did a TTX with us to practice and share ideas on how to respond to real-world challenges — without the real-world risk. Read more.
How to enable Secure Boot for your AI workloads: Secure Boot can help protect AI from the moment GPU-accelerated workloads power up. Here’s how to use it on Google Cloud. Read more.
Too many threats, too much data: new survey. Here’s how to fix that: Operationalizing threat intelligence remains a major challenge, say security and IT leaders in a new survey. Here are the survey results, and four steps security teams can take to get more out of their threat intelligence data. Read more.
Your guide to Google Cloud Security at Black Hat USA 2025: We’re excited to bring our commitment to cybersecurity innovation and simplification to Black Hat. Here’s where to find us, and what we’ll be talking about. Read more.
How SUSE and Google Cloud collaborate on Confidential Computing: Secure sensitive data on Google Cloud using SUSE Linux Enterprise Server (SLES) and Confidential VMs with AMD SEV, AMD SEV-SNP, and Intel TDX. Read more.
Innovate with Confidential Computing: Attestation, Live Migration on Google Cloud: Confidential Computing has evolved rapidly since we first made it available. See what’s new with two key pillars: robust attestation and live migration. Read more.
Introducing OSS Rebuild: Open source, rebuilt to last: OSS Rebuild is a new project to strengthen trust in open-source package ecosystems that can give security teams powerful data to avoid compromise without burden on upstream maintainers. Read more.
We’re taking legal action against the BadBox 2.0 botnet: Recently, our researchers partnered with HUMAN Security and Trend Micro to uncover BadBox 2.0, the largest known botnet of internet-connected TVs. Building on our previous actions to stop these cybercriminals, we filed a lawsuit in New York federal court against the botnet’s perpetrators. Read more.
Please visit the Google Cloud blog for more security stories published this month.
aside_block
<ListValue: [StructValue([(‘title’, ‘Tell us what you think’), (‘body’, <wagtail.rich_text.RichText object at 0x3e4f91e34880>), (‘btn_text’, ‘Vote now’), (‘href’, ‘https://www.linkedin.com/feed/update/urn:li:activity:7356020693123145729/’), (‘image’, <GAEImage: GCAT-replacement-logo-A>)])]>
Threat Intelligence news
Exposing the risks of VMware vSphere Active Directory integration: The common practice of directly integrating vSphere with Microsoft Active Directory can simplify administration tasks, but also creates an attack path frequently underestimated due to misunderstanding the inherent risks. Read more.
Defending your VMware vSphere estate from UNC3944: Take a deep dive into the anatomy of UNC3944’s vSphere-centered attacks, and study our fortified, multi-pillar defense strategy for risk mitigation. Read more.
Ongoing SonicWall SMA exploitation campaign using the OVERSTEP backdoor: Google Threat Intelligence Group (GTIG) has identified an ongoing campaign by a suspected financially-motivated threat actor we track as UNC6148, targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances. Read more.
Update on creative phishing attack on prominent academics and critics of Russia: We detailed two distinct campaigns in June observing a Russia state-sponsored cyber threat actor targeting prominent academics and critics of Russia, and impersonating the U.S. State Department. The threat actor is continuing the initial wave of their campaign with changed ASP names while also trying a new tactic: sending calendar invites in an attempt to convince targets to link an attacker-controlled device to their Microsoft Office 365 account through Microsoft’s device code authentication flow. Read more.
Please visit the Google Cloud blog for more threat intelligence stories published this month.
Now hear this: Podcasts from Google Cloud
How to accelerate your SIEM journey: Manija Poulatova, director, Security Engineering and Operations, Lloyd’s Banking Group, joins hosts Anton Chuvakin and Tim Peacock for a lively chat on all things SIEM, from migration challenges to AI integration. Listen here.
Governing AI agents, from code to courtroom: The autonomous decision-making and learning capability promise of agentic AI and AI agents presents a unique set of risks across various domains. Anna Gressel, partner at Paul, Weiss, discusses her key areas of concern with Anton and guest host Marina Kaganovich. Listen here.
Cyber-Savvy Boardroom: Harnessing innovation while mastering compliance: Grant Waterfall, partner, PwC, joins Office of the CISO’s Alicja Cade and David Homovich with a deep-dive chat on using compliance to drive innovation. Listen here.
Behind the Binary: A reverse engineer’s journey: Reverse-engineering pioneer Danny Quist talks with host Josh Stroschein about the evolving landscape of binary analysis tools, the constant battle with malware obfuscation, and building one of the first malware repositories for research. Listen here.
To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.
AWS announces a new AWS Network Firewall dashboard that enhances the integrated analytics experience between Amazon CloudWatch and Amazon OpenSearch Service. This expands the existing set of pre-built dashboards that include Amazon VPC, AWS CloudTrail, and AWS WAF logs. The dashboard delivers insights into network metrics, including traffic patterns, protocols, AWS PrivateLink endpoints, and TLS Server Name Indication (SNI) traffic.
The AWS Network Firewall dashboard helps security teams strengthen their troubleshooting capabilities by enabling them to monitor and analyze AWS Network Firewall logs alongside other AWS service logs in CloudWatch. Security administrators can quickly identify unusual network activity, monitor private network connections, and evaluate TLS policy effectiveness to optimize their network security configurations. Customers can create the AWS Network Firewall dashboard in CloudWatch Logs Insights or in the OpenSearch Service console.
Today, AWS Entity Resolution announces advanced rule-based fuzzy matching using Levenshtein Distance, Cosine Similarity, and Soundex algorithms to help organizations resolve consumer records across fragmented, inconsistent, and often incomplete datasets. This feature introduces tolerance for variations and typos, enabling potentially more accurate and flexible entity resolution without requiring the manual pre-processing of records. Advanced rule-based fuzzy matching in AWS Entity Resolution helps customers improve match rates, enhance personalization, and unify consumer views, critical for effective cross-channel targeting, retargeting, and measurement.
AWS Entity Resolution advanced rule-based fuzzy matching bridges the gap between traditional rule-based and machine learning-based matching techniques. Customers can use fuzzy algorithms to set similarity, distance, and phonetic thresholds on string fields to match records, offering the configurability of deterministic matching with the flexibility of probabilistic matching. This feature can be applied across multiple industries including advertising and marketing, retail and consumer goods, or financial services, where resolving consumer records are critical for verifying customers, fraud detection, or marketing purposes.
AWS Entity Resolution helps organizations match, link, and enhance related customer, product, business, or healthcare records stored across multiple applications, channels, and data stores. You can get started in minutes using matching workflows that are flexible, scalable, and can seamlessly connect to your existing applications, without requiring any expertise in entity resolution or ML. AWS Entity Resolution is generally available in these AWS Regions. To learn more, visit AWS Entity Resolution.
Starting today, Amazon Aurora MySQL – Compatible Edition 3 (with MySQL 8.0 compatibility) will support MySQL 8.0.42 through Aurora MySQL v3.10. In addition to several security enhancements and bug fixes, MySQL 8.0.42 contains performance improvements for parallel replication using writeset dependency tracking, as well as enhanced debugging capabilities within the InnoDB storage engine.
Aurora MySQL 3.10 includes an increase in maximum storage capacity from 128 TiB to 256 TiB, allowing customers to manage larger database workloads within a single database cluster. Aurora MySQL 3.10 also introduces in-memory relay log optimization that improves binary log replication performance by caching relay log content in memory, reducing commit latency and minimizing storage I/O operations on binlog replicas. For more details, refer to the Aurora MySQL 3.10 and MySQL 8.0.42 release notes.
To upgrade to Aurora MySQL 3.10, you can initiate a minor version upgrade manually by modifying your DB cluster, or you can enable the “Auto minor version upgrade” option when creating or modifying a DB cluster. This release is available in all AWS regions where Aurora MySQL is available.
Amazon Aurora is designed for unparalleled high performance and availability at global scale with full MySQL and PostgreSQL compatibility. It provides built-in security, continuous backups, serverless compute, up to 15 read replicas, automated multi-Region replication, and integrations with other Amazon Web Services services. To get started with Amazon Aurora, take a look at our getting started page.