Google's threat AI cuts alert triage to 60 seconds

Google made agentic threat hunting and alert triage generally available in Google Threat Intelligence for Enterprise and Enterprise+ customers, per Pulse2. The company says the system processed over 5 million alerts in the past year. What used to take an analyst 30 minutes now takes about 60 seconds, a 30x drop in a repetitive but critical part of the job.

The rollout includes a Prompt Library of predefined investigative workflows and a Malware Analysis Agent that activates automatically for sandbox inspection.

Pulse2's report doesn't say how Google measured the 30-minute baseline, or whether it holds across all 5 million alerts. It also doesn't break out how much of the time savings comes from the Prompt Library versus the Malware Analysis Agent.

Most agent product launches lean on adjectives: faster, smarter, more efficient. Google published two numbers instead, 30 minutes and 60 seconds. That's a claim a customer can test against their own queue, and a claim a competitor has to match with data, not copy.

Google's real news is the published metric, not the 60-second number. A rival vendor's agentic security claims are marketing copy until it produces the same kind of before-and-after measurement.