Google SecOps Triage & Investigation Agent Enters Public Preview: 60-Second Autonomous Alert Analysis

Google Cloud Blog·medium signal

Google's Triage and Investigation Agent (TIN) is now in public preview for all Google SecOps Enterprise, Enterprise Plus, and Unified Security customers through June 30, 2026. TIN autonomously investigates alerts using Mandiant principles, evaluates incoming alerts, executes investigation plans, and provides structured true/false positive verdicts with reasoning — averaging 60 seconds per investigation with a 20-minute maximum. This represents Google's agentic SOC vision materializing as a production feature, directly competing with CrowdStrike's Charlotte AI and Arctic Wolf's Aurora.