Google Cloud’s August 19, 2025, security announcement focused on finding and protecting AI agents and Model Context Protocol (MCP) servers, alongside new governance, identity, data-protection, network and security-operations capabilities. The rollout was mixed: some features were generally available, several were in preview, and others were planned or had no availability stated in the announcement.
The updates were announced at Google Cloud’s annual Security Summit. The status labels below reflect what Google Cloud reported on August 19, 2025; they do not establish whether a preview or planned feature has since rolled out more broadly. The announcement did not provide a complete edition or regional availability matrix.
What Google Cloud announced
| Security area | Capability | Status on August 19, 2025 | Primary users | Asset or task |
|---|---|---|---|---|
| AI security | Automated discovery and protection for AI agents and MCP servers in Security Command Center | Forthcoming preview | Security operations teams | Find agent and server risks, monitor behavior and support incident response |
| Compliance | Compliance Manager and recommended AI controls | Preview | Compliance and security teams | Define and enforce controls, monitor compliance and generate audit evidence |
| Data security | Data Security Posture Management (DSPM) | Preview | Data and security teams | Govern sensitive-data security and compliance, including through BigQuery Security Center |
| Risk prioritization | Risk Reports | Preview | Security teams | Summarize cloud issues that could expose an organization to attack |
| Identity | Agentic IAM | Planned for later in 2025 | IAM administrators | Provision agent identities and manage credentials, authorization and observability |
| Identity | Gemini-powered IAM role picker | Preview | IAM administrators | Recommend a least-permissive role for a described task |
| Identity | Sensitive-action re-authentication | Preview | Administrators and users | Require users to re-authenticate for sensitive actions |
| Data protection | Expanded Sensitive Data Protection coverage | Not stated in the announcement | Data and security teams | Inspect more AI and data assets for sensitive content |
| Encryption keys | Cloud KMS Autokey in Cloud Setup | Generally available | Cloud and key-management administrators | Help onboard customer-owned encryption keys |
| Network security | Cloud NGFW organization-scope tags with hierarchical support | Not stated in the announcement | Network and security administrators | Apply network-security controls across organizational structures |
| Network security | Cloud NGFW for RDMA networks | Preview | Network and AI infrastructure teams | Apply zero-trust networking to high-performance-computing VPCs |
| Network security | Cloud Armor Enterprise hierarchical policies and organization-scoped address groups | Generally available | Network and security administrators | Centralize policy and address-group management across projects |
| Network security | Cloud Armor WAF inspection-limit changes, JA4 rate limiting and ASN-based threat intelligence for media CDNs | Not stated in the announcement | Application and network-security teams | Adjust web-application inspection and traffic controls |
| Security operations | SecOps Labs | Availability not stated | Security operations teams | Experiment with AI-assisted parsing, detection and response |
| Security operations | Google Security Operations dashboards with native SOAR-data integration | Generally available | Security operations teams | Visualize, analyze and act on SOAR data |
How the AI security changes work
Security Command Center’s agent and MCP discovery
The most direct response to AI-agent risk is the planned Security Command Center capability for automated discovery of AI agents and MCP servers. Google said the forthcoming preview would help defenders identify vulnerabilities, misconfigurations and high-risk interactions across agent ecosystems. It was also intended to address agent-specific runtime threats, including tool poisoning and indirect prompt injection, and surface anomalous or suspicious behavior for incident response.
For organizations adopting agent frameworks, the operational value is visibility: security teams need to know which agents and connected servers exist, what they can interact with, and which behaviors warrant investigation. The announcement described intended capabilities, not independent production test results or a guarantee that every agent deployment would be discovered.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Agent identities and least-privilege role selection
Agentic IAM was described as a future way to provision identities for agents across cloud environments, support different credential types and authorization policies, and provide end-to-end observability. It was planned for later in 2025, so the announcement alone does not establish its present rollout status.
The IAM role picker addresses a separate but related problem: choosing a suitably narrow human or workload role. In preview, Gemini was to recommend the least-permissive role based on a task description. Such a recommendation can help administrators start a role assignment, but teams still need to validate the permissions against their actual workload and policy requirements.
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
Re-authentication for sensitive actions
The preview capability was intended to prompt users to re-authenticate before actions such as changing billing accounts. Google said it planned to enable the feature by default while allowing administrators to opt out. That default was a stated plan, not confirmation of current tenant behavior.
What the Security Command Center governance tools add
Compliance Manager
Compliance Manager was designed to bring policy definition, control configuration, enforcement, monitoring and audit-evidence generation together. Recommended AI controls add AI-focused baselines, controls, reporting and continuous monitoring. For compliance teams, the practical distinction is that the offering targets the lifecycle of controls and evidence, rather than simply identifying technical findings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
Data Security Posture Management
DSPM was announced in preview for governing sensitive-data security and compliance. Its native integration with BigQuery Security Center lets data teams monitor posture from within the BigQuery console. This is especially relevant where data teams and central security staff work in different operational consoles.
Risk Reports
Risk Reports, also in preview, were described as summaries of cloud-security issues that could expose an organization to attack. They draw on Security Command Center’s virtual red-team technology to help prioritize issues. The announcement did not supply independent measurements of report accuracy or how much remediation time the feature saves.
Rank #4
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
Data protection and encryption changes
Sensitive Data Protection coverage
Google expanded Sensitive Data Protection to monitor Vertex AI Agent Builder and AI-related assets in BigQuery and Cloud SQL. The announced capabilities include image inspection for sensitive elements such as barcodes and license-plate numbers, and detection of AI/ML context types including medical records, financial invoices and source code. Organizations should assess which of their actual assets and data types are covered before treating this as comprehensive discovery.
Cloud KMS Autokey in Cloud Setup
Cloud KMS Autokey in Cloud Setup became generally available. It is intended to help customers who need customer-owned encryption keys onboard more quickly while following recommended key-management practices. This addresses onboarding and key setup; the announcement does not provide a full comparison of supported configurations or pricing.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBest Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
Network controls and security operations
Cloud NGFW and Cloud Armor
Cloud NGFW added organization-scope tags with hierarchical support, extending the reach of tags used to organize network-security controls. A separate preview, Cloud NGFW for RDMA networks, brings zero-trust networking to high-performance-computing VPCs, including AI workloads.
Cloud Armor Enterprise’s generally available additions—hierarchical security policies and organization-scoped address groups—are aimed at central control and automatically protecting new projects. Google also announced updated WAF inspection limits, rate limiting by JA4 fingerprints, and ASN-based threat intelligence for media CDNs; it did not state an availability status for those specific changes.
Google Security Operations
Google Unified Security was described as an AI-powered converged solution integrating threat intelligence, security operations, cloud security and secure enterprise browsing. Its SecOps Labs environment offers AI-powered experiments for parsing, detection and response. Dashboards became generally available with native integration of SOAR data for visualization, analysis and action.
How to assess the updates for your organization
- Map the feature to a risk you actually manage. Inventory agent deployments and MCP connections for the AI capabilities; map sensitive datasets for DSPM and Sensitive Data Protection; and identify the organizations, folders, projects and VPCs affected by network-policy changes.
- Check availability in your environment. Preview, planned and generally available are materially different deployment states. Confirm the current status, supported regions, editions and prerequisites with Google Cloud before building a rollout plan; the announcement did not provide a complete matrix.
- Assign an operational owner. Security operations teams are closest to discovery, risk reports and SecOps dashboards; IAM administrators own role and re-authentication policies; data and compliance teams should validate posture controls and audit evidence; network teams should assess hierarchical policy changes.
- Validate permissions and policy effects. Test role recommendations against least-privilege requirements, and review hierarchical firewall or security policies for inheritance and project impact before broad application.
- Budget only after checking the specific service terms. Google’s announcement said pricing varies and that some capabilities are available at no additional cost, but it did not give a complete price list. Do not assume that every listed capability is included in an existing subscription.
What the announcement does not establish
The announcement and CSO Online’s August 19, 2025 report describe product direction and availability labels at that time; they are not independent production evaluations. No complete price or edition matrix, regional availability list, customer case studies or independent test results were provided. Cybersecurity and AI expert Joseph Steinberg cautioned that real-world value can differ from theoretical benefits and that security failures can have serious consequences; this is an analyst perspective, not a measured assessment of these products.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
