#gcp-security-operations

Give Your AI Agent a Security Policy in Plain English with Semantic Governance

How to govern an ADK agent’s tool calls with a single sentence on Google’s Gemini Enterprise Agent Platform.

New to Google SecOps: Exploring Detections

We’ve spent plenty of time building searches in Google Security Operations (SecOps), but previously we focused on building searches for…

Architecting a Multi-Layered Security Stack: Beyond Basic IAM in Google Cloud

In the evolving landscape of cloud security, relying solely on standard “Allow” permissions is a vulnerability. Modern enterprises require…

The SIEM Delusion: Why More Data Isn’t Creating More Security

Monitoring is one of the most important pillars of cybersecurity. In many situations, it becomes the last meaningful line of defense when…

SPIFFE: Why Google’s New Agent Identity is the Future of AI Security

AI agents are everywhere. As we move deeper into 2026, the tech world is shifting from simple chatbots to autonomous agents that can browse…

Structuring a Google Cloud Armor Policy: A Rule-Ordering Playbook

Cloud Armor provides a large set of controls to protect your workloads from malicious traffic: IP allowlists and denylists, geo rules…

AI in the SOC: Hype vs What Actually Works in 2026?

The One GCP Metric to Rule Them All

In this post, I’ll show you how to build a simple alerting system around a single Google Cloud metric that can help protect your project…

New to Google SecOps: Everything Counts (in Windowed Amounts)

Back in December 2025, I wrote a blog titled This Charming Span — Bucketing Events in Time Windows. In it, I discussed how to add time…

GCP Reasoning Engine : Building Platform to Fetch Metrics

From Customer Ask to Cloud Monitoring API: Building Agent Metrics the Right Way on GCP

Google Cloud Armor’s CRS v4.22: What Changed and How to Roll It Out Safely

Google Cloud Armor now supports ModSecurity Core Rule Set v4.22 to provide more expansive coverage for OWASP Top 10 vulnerabilities. If…

Detection Engineering in Google Security Operations: YARA-L Rules, Chronicle SIEM & Cloud Threat…

Learn how to build high-signal, low-noise detection rules using YARA-L in Chronicle, reduce false positives, and design scalable…

Integrating Google Cloud Armor and Google Cloud Fraud Defense

Inserting a ReCaptcha challenge page without modifying HTML

Build vs Buy: The Truth About In-House SOCs

Why Building Your Own Security Operations Center Costs More Than You Think (And When It’s Worth It Anyway)

How Google Cloud Armor Helps Close OWASP Top 10 Risks in 2026

Most teams don’t fail OWASP because they ignore it. They fail because they can’t turn it into enforcement.

Google Security Operations Deep Dive — Chronicle Architecture and the Unified Data Model (UDM)

Cloud environments generate enormous volumes of security telemetry every second. Identity events, API calls, network flows, workload…

The Cheapest and Most Expensive Months for Google Cloud Disk Usage

Cloud Computing operates on a simple premise: the hardware is bought, connected, and managed by the cloud provider, and customers rent…

Building a Faster GCP Kill Switch: Leveraging Cloud Monitoring Instead of Billing Data

Introduction

GCP Network Reliability: Going Beyond the Basics with Cloud Armor and Private Service Connect

Standard firewall rules and basic load balancing are often the first line of defense, but for enterprise-grade workloads, they are rarely…

Google Project: Migration of Intercontinental VM (USA Region > Australia Region) using Storage…

1. Introduction

ISO 27017 and 27032: Securing Manufacturing Workloads on Google Cloud and IBM Cloud

Modern manufacturers are no longer dealing with just machines and supply chains. They’re now managing cloud-based dashboards, remote…

Service Account-Based Authentication for Legacy Applications in GCP

Migrating your workloads from On premises to Google Cloud Platform (GCP)? It’s a big move, and security is a top priority. In this blog…

Backend Access Control with Envoy Proxy and Google Cloud Service Accounts

In this blog post, we’ll explore how to configure Envoy Proxy to add an authorization header to all incoming requests and efficiently route…

Google Cloud Architecture Framework : Security, Privacy and Compliance

This is the fourth article in my seven-part series on the Google Cloud Architecture Framework.

How to Create a GCP Project?

You first need a project before you can start building anything on Google Cloud Platform. Projects allow you to organize all the resources…

GCP IAM Recommendations

In GCP we have a service called Security Recommendations which provides the security recommendation at the org, folder and project level.

Google Cloud Networking fundamentals

Introduction