Summary: During RSAC 2026 on March 24, Google Cloud promoted an agentic defense lineup combining Threat Intelligence, Security Operations, and the newly closed Wiz acquisition. Mandiant’s M-Trends 2026 report said division-of-labor attacks moved from initial compromise to hand-off in a median of 22 seconds, down from more than eight hours in 2022. Google also launched dark web intelligence and previewed SecOps triage and investigation agents.
March 24, 2026 fell in the middle of RSA Conference week, and Google Cloud used the moment to state its home-field case: COO and president of security products Francis deSouza took to the official blog to fold Google Threat Intelligence, Security Operations, and the freshly closed Wiz acquisition into a single “agentic defense” product line. That same day, the Mandiant unit inside Google published its yearly M-Trends 2026 report, assembled from more than 500,000 hours of incident investigations carried out during 2025. Read together, the two documents land on one verdict: attacks now outrun what a human SOC can track, and defense has to move into agents’ hands.
The numbers make the case without any help. Across 2025 investigations, division-of-labor attacks — one crew wins access, then passes it to a different crew to use — ran a median of just 22 seconds from initial compromise to hand-off. Cast back to 2022 and that same interval still stretched beyond eight hours. Once stolen access trades as a commodity settled in seconds, putting agents in charge of defense stops being a pitch and becomes the only tempo that answers the threat.
M-Trends 2026: The Numbers Behind 22 Seconds
Lead with the figures that matter:
- Division-of-labor attacks turned up in 9% of investigations against 4% in 2022; median compromise-to-handoff fell from more than eight hours all the way to 22 seconds
- Exploits kept the top initial infection vector slot for a sixth straight year at 32%; voice phishing rose into second at 11% while email phishing continued to fade
- Global median dwell time climbed from 11 days in 2024 to 14; ransomware featured in 13% of investigations, where prior compromise has become the leading ransomware vector at 30%
- Mean time-to-exploit has flipped negative: 63 days in 2018, -1 day in 2024, -7 days in 2025 — the exploit lands before the patch does
The tracking extends further: 714 new malware families entered the ledger during the period, lifting the total past 6,000, alongside more than 660 new threat clusters. On offense, AI’s part gets scored as incremental rather than transformative — QUIETVAULT is built to steal AI and developer tokens, while PROMPTFLUX and PROMPTSTEAL call out to LLMs mid-execution to help slip past detection. The companion AI risk report, however, strikes a sharper note: adversaries have moved beyond experimenting with AI to autonomous agents that rewrite their own code in real time.
Dark Web Intelligence: Intent Over Keywords
The marquee launch is dark web intelligence inside Google Threat Intelligence. Running on the newest Gemini models, it hit 98% accuracy in internal tests while analyzing millions of external events per day. The method shift outweighs the score: keyword matching gives way to intent-based analysis, so even when a threat actor deliberately never names a victim’s subsidiary, the system still draws the connection from the surrounding context.
LastPass’s director of threat intelligence, Michael Kosak, framed the jump in concrete terms: the dark web tooling he once depended on “averaged over 90% false positives,” while he describes the new engine as “the difference between reacting to a fire and putting it out before the match is struck.”
SecOps Agents Enter Preview, and MCP’s Double Role
Over in Security Operations, the Triage and Investigation agent has moved into preview: hand it an alert and it investigates on its own, assembles the evidence, and returns a verdict with its reasoning attached, with adaptive AI and deterministic automation lashed into one workflow. The paired remote MCP server support — the plumbing for building enterprise-grade security agents on Google’s intelligence and tooling — is set to reach general availability in early April 2026.
Within this story MCP plays two parts at once: the integration layer, and a target that itself needs guarding. Omdia principal analyst David Gruber supplies the demand-side backdrop: 89% of CISOs are pressing their organizations to speed up agentic security adoption, and more than half of cybersecurity practitioners hold that agentic AI gives defenders a larger edge than it gives the adversary.
Wiz Formally Joins, and Defending AI Itself
Also settled that week: the Wiz acquisition officially closed. Straight after closing, Wiz rolled out an AI Application Protection Platform (AI-APP) together with red, blue, and green security agents, completing the exposure-management picture for multicloud and AI workloads.
The second storyline concerns defending AI itself. In a CSA/Google survey, 72% of organizations admitted they lack confidence in executing a secure AI strategy. The product replies came on two fronts: AI Protection in Security Command Center now connects to Vertex AI Agent Engine to spot agentic threats such as unauthorized access and data exfiltration by agents, while Model Armor hooks into Google MCP servers to blunt prompt injection, data leakage, and tool poisoning.
How Developers and Security Teams Should Read It
Three takeaways. One, threat intelligence is turning into input a model can consume directly — 98% filtering accuracy plus intent-based analysis moves “reading the intel” out of the analyst’s daily routine and into a pipeline stage. Two, for security agents to compose into an ecosystem they need standard interfaces such as MCP, which makes the April GA date worth a slot on the watchlist. Three, the moment your own product runs agents, agent permission boundaries, data exfiltration, and tool poisoning become your threat model, and SCC and Model Armor already draw the map. Agents reaching production is the defining theme of 2026 — we said as much in our opening outlook for the year — and security is simply the domain where the 22-second clock bites hardest.