EP259 Why DeepMind Built a Security LLM Sec-Gemini and How It Beats the Generalists

Security. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your host, as ever, myself, Tim Peacock, the Senior PM for, well, a bunch of stuff in Google SecOps. And of course, Anton Chuvakin, a reformed analyst and now senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, what are we talking about today? We have a returning guest.

We do. And I think that in my mind, this episode is tagged difference between general-purpose AI and security-specific AI, or maybe domain-specific AI.

So is it an agent episode?

No, no, no. It's— think about it. AI is becoming so smart that the need for expertise within AI is just not something people talk about a lot. They sort of assume that they can go ask a consumer-grade bot about how to fix the security of their environment or how to— OK, I'm going to skip this one joke because Tim is already smiling at me and virtually kicking me under the table. I'm not making this joke.

Yes, listeners, it turns out if you podcast together long enough, you can kick somebody under a table who's 45 miles away.

Correct. So this— you sort of— people start to assume that the gen AI becomes so smart that it knows all the domains. And suddenly somebody shows up and says—

And it doesn't.

It does not, yes. But it's also somewhat difficult for people to comprehend. So we have expert AI for some domains.

And sometimes those domains are moving so fast, as you'll hear, that even if you know the domain, that's still not enough because the domain moves.

Correct. So as of today, we have our guest in a few moments give an answer. But the answer is, of course, as of today, right?

As of today, which by the time you watch this, listeners, might be outdated because of how fast this industry is moving. And so let's hurry up and turn things over to today's guest before things move any faster. Today we're joined by Elie Burstein, a distinguished scientist at Google DeepMind. Elie, thank you for joining us once again on the show. We had you on ages ago. Today I want to talk about SecGemini. So I've heard of Gemini. I love Gemini. I use it all the time. It writes all my PRDs for me. But what is SecGemini? Who are we building it for, and why are we building it?

Thank you for having me on the show. I'm glad to be invited again. SecGemini is a research initiative that we launched mid-2025, which aims at trying to build the most capable AI for cybersecurity tasks. And it has evolved quite a bit. It's a research project for non-commercial use cases that we offer to partner with the community on how can we advance some of the difficult challenges of making AI useful for the cyber workforce. And those challenges are quite complex. And so we don't think you can solve them by yourself. You need everyone to put their heads together and— Figure that out. So what is the relationship between Gemini and SegGemiNi? So essentially, we went to a very winded discovery path over the last year, but honestly, we ended up on using Gemini, the latest version at whatever it will be at the time of the recording, to power a form of agent. And we can talk about the evolution of how we evolved it multiple times based on the learning of this experiment actually, and the learning of the community and other agents. But essentially we use Gemini plus an agentic framework plus a lot of really specialized tools and data. So for example, SecGemini has access to what we call near real-time data, which is sub-1 hour essentially. Every vulnerability The Mandiant data, but also some access to VirusTotal, access to also other data sources about IPs, domains, and so forth. So it has the cybersecurity knowledge, the timely data it needs to be able to help cybersecurity professionals on various tasks, such as, is my system vulnerable? Well, to know that, you kind of need to know what are the latest vulnerabilities.

Right.

How vulnerable is a temporal question. It will change hour to hour. So it's not something you can bake into the Gemini main model. We are working really closely with the foundational teams to put cybersecurity knowledge inside Gemini. So Gemini should know about all the fundamental MITRE and all the fundamental— what is a buffer overflow and all those things. So foundational knowledge should be in Gemini because it's of broad applicability. and long-term stability. But all the time people think about current attacks, right? At some point at the end of 2025, we had this Next.js remote compromise which took the world by storm. If you were to ask TechGemini within an hour after the vulnerability being in the wild, you would want to know what it is, what are the patches, and is it exploited?

Right. But that's not going to be the training data because it was trained more than an hour ago. So What the heck do you do about that?

Yeah, so that's one of the big, big important reasons of why you need Stack Gemini and why it's also a gated project is we have to give it access to a lot of temporal, high-value data, which is usually reserved to paying customers of GCP.

Surely there are other fields though where highly temporal data is relevant, like news, weather, traffic. So this doesn't feel to me yet like Sec Gemini needs to exist. It feels like Gemini in general needs to have access to temporal data. So what's the gap there?

I think I call that broad agents. I think they're going to exist for many domains, actually. I think there will be a financial agent. I don't know who's going to create it, but I could imagine an agent which has access to all financial markets and news and insider— not insider, but a lot of news chatters and everything to be able to come up with better predictions will be built by someone. I don't want to say Bloomberg Terminal 2.0, but something along those ideas of like, I think they will exist. So I think there is a set, as you said, of areas where you want this kind of broad temporal data, which is quite expensive to get and not necessarily interesting to the general public. Most people don't care about threat intelligence, to be honest. And most people, I mean, a larger swath probably care about finance, but not to the point of what a trader cares about. I think those are going to emerge. I think those are not going to be models in themselves. They will be like agents which have broad capability specialized into your market. It just happens that at SecGemini, we scoped it to cybersecurity because that's where we come from and that's our expertise. And that's where we develop the technology we think to solve some of the challenges we all face as a community towards cybersecurity. And I think that's what it is.

That makes sense.

So I'm kind of curious because in the past, of course, DeepMind specifically has a lot of hard problems to solve from like, well, protein folding, and I'm sure some stuff that we haven't even talked about. So how did we decide to actually dedicate resources to a cybersecurity problem? I mean, of course, all of us here think cybersecurity is the most important thing in the world. But also, if somebody wakes me up and says, Anton, would you rather cure cancer or cure ransomware? The answer would be kind of obvious. So how is DeepMind deciding to create something like SecGemini? What went into the thinking?

Okay. So that's where we might ship outside more of our org chart than we would like. But to explain, I'm part of originally, and I'm still part of the security team, which is inside Google, Alphabet. And I'm also reporting to DeepMind. I'm in both places. The project originated from the Google side of the house, or the security team side of the house, because we have a very large working force and we see the need of AI to defend Alphabet as a critical component to stay ahead of our attackers. Everyone is very concerned. We talk about deepfake and we talk about the model being able to accelerate nation states and also malicious actors' capabilities. That has been at the forefront of Google security team's mind for a long time. And so that's where, if you do research on security, that is just in front of your mind because we know we need those capabilities. And then where it intersects with the big bad thinking of DeepMind is, as AGI approaches, the threat raised by AI and raised by making more powerful models makes the situation worse. So fundamentally, we want So defensive capability to be ahead of the offensive capability. And so we do need better defensive capability as early as we can. And I think Stack Gemini is one of those projects. For reference, I will cite 2 others which do exist, which are also very innovative and interesting. We have BigSleep, which I think has been on the show before, which is, for those who haven't heard this episode, is about finding vulnerabilities like a Project Zero person would do. Again, started from the security team and in collaboration with DeepMind. So we have the same thing, which is like, yes, finding vulnerability faster than the attacker is very important. And then we have Mender, which started from the other side. We started from DeepMind with the help now of the security team. So everyone works together, right? And I mean, at the end of the day, it's only one big company. And where we try to fix the vulnerability, because it's not enough to To find the vulnerability, we also need at some point to be able to create a patch for them, and that takes time.

A fire department is much more effective when they can put the fire out instead of just saying, hey, look, it's on fire.

And I think that's a very interesting segue into what are the hard problems that we're facing with StackGeminis, which is neither of those 2 things.

Yeah. What are you trying to do that's not vulnerability discovery or vulnerability patching? Because to me, those are like, I don't know, kind of the 2 scariest things AI could do right now.

So what?

Yeah, exactly. Right.

So I think that's a good—

those are very important projects. And that's why I said those are important to exist. I think we do, moving forward, consider exposing those capabilities via SecGemini to the trusted program. So actually vulnerability pen testing is important. I think pen testing is a little bit more than just finding bugs in code. It might be also finding misconfiguration. It can be finding crypto not correctly configured. It can be finding different types of of things that need to be hardened. So that's one of the paths. The other thing is, and we could call it SecOps in a way, there is this problem of, well, Big Sleep found a vulnerability, Mender wrote a patch. Now you have to deploy this patch a million times. And deploying patches is not as easy as people would imagine at first glance. Or maybe people are very aware of how hard it is, but it's not only like deploying the patch is a problem. It's also, what are the consequences of deploying such a patch? So for example, there is this, it's not a well-known example, but it's an example that we heard of, this famous database who, as part of a fix, actually added this very small delay at the startup.

Mm-hmm.

And then that, by rebooting the database, took down quite a few companies because they were all expecting the database to be immediately available at reboot time. And so a lot of assumptions baked into the behavior of software have downstream consequences, which are extremely hard to evaluate. So eventually, even if you create a million patches, those million patches need to be applied. That's why we still have a lot of old vulnerabilities that are making massive damage to the world infrastructure because the backlog is so intense. So that's one of the—

I suppose the problem of patch availability on vulnerability remediation is only a problem for a short period of time, and then the problem is actually patch application. And so, yeah, I can see how DeepSleep is good at solving, oh, we need to find vulnerabilities. Mender is going to be helpful at, we need patches. But then there's everything that comes after that. And we all know how many things are getting popped by non-zero-day vulnerabilities.

Exactly. And I think there is also this need for people who are not necessarily large security teams like Google to have an integrated solution where you probably want everything to be done. In one go. And so that is also one of the ideas of having this longer horizon capability in SecGenAI, which has been the focus starting end of 2025 on making it a meta-agent who can do very, very long reasoning steps. You need to do a lot of steps, and those steps are very dependent on the organization who wants to make them. And I think if we want to help security professionals, it's more like, find me the configuration bugs for that machine and try to fix it. Then when you go grab a coffee, you come back and maybe it has a bunch of decisions for you to make, and then you approve them and then it's going to execute them. And then while doing that, you need to have multiple tasks. And I think moving to also this paradigm of workflow and multitask is something we're exploring. And so that's the part of the thing we try to build with text generation. Those are large problems which are mostly unsolved. And I think a lot of people are working on them. That's great. I think we need all the brains we can get. To kind of make those happen.

And so this makes sense. And I think that that to me is the logical kind of set of tasks that we have. But here's the thing, even regular LLMs constantly get asked security questions. And I mean, I'm sure all of us have asked Gemini, and I've asked Gemini earlier today about some tricky problem I had. So I mean, the answer quality is improving and all that. And I think the currency, the recent breaches, all that stuff comes up. But, and people who hear about SecGemini occasionally come to us and say, okay, I tried Gemini for security tasks. I pasted logs, I pasted alerts from my SIEM, I've pasted vulnerabilities. I tried to make a gem the other day that explains whether certain vulnerabilities should be prioritized. These things work. But if somebody comes to you and says, hey, Eli, give me 3 tasks where SecGemini is amazing, but regular general-purpose AI, whether ours or somebody else's, is just not good enough. What would be the 3 examples? Like, where is SecGemini better at security? What are the specifics?

Okay. So, 3. So, I think the first one is the one we talked about at Black Hat, which is digital forensic incident remediation, where if you were to pass a million lines of log into Gemini, which you can, I mean, the context can do it, it gets very, very quickly difficult for it to reason about your log and you don't necessarily get the result. To be able to do digital forensics, you need actually quite a bit of tooling and quite a bit of steering and quite a bit of other secret sauce to be able to do it in a way which is efficient. And I think the model, just raw data into the model is not working for that. I think a lot of people have tried that. If that was that obvious, digital forensics would be solved today, which it's not. So we have really good results with, say, Gemini. I think the last evaluation we ran late 2025, we had like 60% of analyst findings refound by the AI on real-world use cases we run. But that 60% is far, far better than, let's say, even the latest Gemini because of the tooling, the data, and the reasoning engine we have. So I think that's one. A second example is, and it's a little bit more niche maybe, is code analysis. For example, deobfuscation, where if you give a piece of obfuscated code to Gemini, because it doesn't have access to deobfuscating tools and it doesn't have access to knowledge about deobfuscation techniques out of the bat, It might produce some result, and with the help of a Python sandbox, it will get further, and it might rezone, and it will do, in some cases, some result. We had, thanks to one of our trusted testers, access, for example, to an 11-megabyte JavaScript obfuscated, and then Gemini did some analysis of it, but it was completely incorrect, and it couldn't figure out what were the crypto addresses used, what was the the command and control, whereas we have a lot of tooling, and we have a lot of specialized modules for deobfuscation for JavaScript. And so SEG Gemini gives you far better deobfuscated code. Again, it piggybacks on the extreme quality capability of the later generation of Gemini, but it also added the tool and the playbook and the knowledge that is needed to push it a little bit further. And that further does make a difference in deobfuscation. And we see that in many other use cases such as pen testing, adding tools for pen testing is something that everyone knows is helping a lot because the model can really benefit from tools to check the HTTP, scanning for SQL injection, looking at code, doing GraphQL and whatnot. So I think pen testing is the third one and scam might be a fourth one. For scam, it's actually interesting. Gemini is quite paranoiac. So really? Yeah, it is.

Yeah. No, I, that's, I can, yeah, I think I know what he's talking about.

Oh, this gets back to what we were discussing yesterday, Anton. Yes, it is.

Yes, correct. Correct. That's exactly. I'm like, I mean, Ellie, last time Ellie brought that dirty bomb example, so I'm not sure.

That's true.

So let's not, we're not going to plan any invasions for any kind of small states. No, no, no.

But I think we have this problem, right? So for example, for scam, we have the exact opposite problem, which is if you were to ask it, is it a scam? Gemini would have far higher false positives than we would have with Sex Gemini because Sex Gemini gives it enough context and enough tools to actually counterbalance it being overly suspicious. And so that's an example where actually there is something to be done.

Yeah.

And when you equip the model, it's able to use what's in the context and the tool and the code to drive all those executions to be able to be a little bit more balanced. So I think that's kind of this type of things. And then there is a lot of details such that because it has better data, you get better answers, or you can ask questions that you cannot get temporally, as we discussed. So I think that's all those things which make it an interesting journey to have. And I think it helps to develop capabilities which are genuinely useful and we would love to have in the hands of as many people as we can to help. So I hope that answers your question, Anton.

Yes, it actually helped quite a bit.

I'm glad it helped. I'm glad Anton is mollified. I want to ask something a little bit off book, which is, you keep talking about trusted testers. Why is this limited availability for now? Why are we not going broader with it?

I think we want to explore, and to be able to explore, we can't make any promises that what is available today is the same as tomorrow, and there is no stability, right? There's no that. And it's also, we don't have really SLO or SLA. I mean, it's running well, and I mean, we had, I don't remember, billions of tokens processed through the system over to 2025. But we want to reserve the right to iterate quickly and to iterate with the people we work with. And we want them to give us feedback. And feedback comes through the hands, in the form of the prompts they use or how well it was doing, because it's a learning experience, right? And so it's also, it's not something, if you're a company who just wants the thing to do patching for you, we're not at the stage where it is. And if you were at that stage, you could ask yourself, should it be done through SecGemini directly, or is it better to put it into maybe SecOps, or is it better to put it into different parts of Google? It's not clear. It's not clear if the capability should be accessed through that platform or should be accessed through normal commercial offering, a different type of commercial offering. There are many options for each of those capabilities, and some of them have Very, very different interests and user base. I think people who are interested in scam detection are very different from people who want to have a better deobfuscator. I think that would be a different type of— so it's not clear how those capabilities will trickle down to commercial offerings.

Hmm.

I think the goal is to make them available to as many people as we can when we have confidence that they are in the level of quality that they can be out of the lab. I think we're still cooking with our Trusted Tester. And I think that's been a very, very good journey to have people who are outside of Google and have different views and different data and different problems testing things and providing knowledge and even ideas on how we should fix it. They also find ideas on how to use it that we haven't thought of by ourselves. I think it's also driving, also, it's also a very good learning experience on Oh, we should have thought of that. For example—

Yeah. What's something in that category?

For example, threat modeling. We didn't expect to get a few organizations telling us, well, threat modeling is an interesting capability. We're using AI quite a bit to do threat modeling for our product or our system or whatnot. I think it's not something which was on our radar from the get-go. So I think that was quite an interesting one.

That's interesting. Is Gemini good at threat modeling? I mean, it's paranoid, so.

Yeah, maybe. I think we haven't explored that one. We found it very interesting. We got a nonprofit, one of our trusted testers, which is nonprofit, came to us and said, our problem is making sure that the phones actually do not have any kind of sensitive data when our personnel is traveling because we are afraid of the phone being stolen or lost or seized. Is there a way to do hardening posture to the phone? And you could argue maybe it's part of ASM, maybe it's not. That was just some of the prospective clients of— sorry, some of the prospective testers of Stage 9 would say, this is the type of problem we might be interested in. And when we have those fit calls with the trusted tester, we learn a lot about what they want to do. And sometimes it's a good fit, sometimes it's not a good fit. For that specific one, we didn't have a good answer. But that's an interesting view of what ISM truly means. It's like, yeah, I'm concerned about the security posture of the phone of my organization. That's a very valid one. I think we don't sort of have that one.

So I want to ask you kind of a weird side question about— we, of course, had a recent episode about Google using AI agents for security, but are we using SecGemini for anything internally? And is there anything you can talk about? Do we find value in that tech? in any kind of internal tasks? You can describe them even vaguely if this is even maybe too sensitive.

I think we try to experiment with internal teams the way we experiment with external trusted testers. For example, the digital forensic incident remediation, FSIR, is something which interests a lot of internal teams as well for various reasons. They're also experimenting with the idea and see how our reasoning capability on logs is helping them. So far, it has been pretty successful. How it translates into internal security, we'll have to see if it's a technological transfer, if they're going to keep using it as is. It's a good question. I think SecGemini is really like an engine for innovating and trying ideas and getting to the forefront of what we can do today. I think that's what we ask ourselves every morning is like, what can we do today we haven't done yet? How can we go one step further as fast as we can? And I think that then we learn things and we readily share. We talk to other teams about deobfuscation, and they are very interested in how we approach deobfuscation, what type of tool we're using, what type of reasoning we are enforcing on that to try to do their own use case. We have a lot of deobfuscation need inside Google, for example, where I think we have good engagement. Scam is a big problem for many of our projects. So they are also very interested in agentics to help our users being less scammed. How it's going to materialize, how we're going to release it to users is a different question. But I think it is actually part of the conversation and driving innovation, which is really the goal of it. So I think maybe that also explains a little bit more why would DeepMind want something like that. and why we get also cloud support and everyone else's support, actually, I think everyone is supportive inside Google about the project, is we need kind of a thing to keep the innovation going as fast as we can, and we learn something out of it. And it evolves in goal and scope as time passes to reflect the nature of the evolution of the threat landscape and our understanding on how to do it, right? So I can't even tell you what it will be in 6 months. I have no idea.

Well, that's the nature of research, and that's why you are, well, a distinguished scientist. That's why we're doing research. Yeah. That actually kind of makes sense. Yeah.

If we had a PM here, we could ask for what it would be in 6 months, and they would give us an answer. However, PMs like AI will confidently give an answer that might very well be wrong.

Well, I think no one knows, to be honest.

Yeah, that is the interesting thing here, is nobody knows. So in the spirit of nobody knows, I hate to do this, but I have to ask our traditional closing questions. One, do you have a tip to help teams get more value out of LLMs in their security programs? 2, do you have recommended reading? And 3, is there a way for people to reach out if they want to join the Trusted Tester program for SecGemini? Okay, well, 3 is a bonus, by the way.

3 is a bonus question. Okay, I got the bonus question. Oh, lucky me. So one, tips for security team. I think one thing we learned, I think we learned 2 things which are broadly applicable. So first one is a version of the bitter lesson, which is we started very early on to focus on custom model and doing a lot of reinforcement learning and stuff like that as an idea on how to improve some of the capability. But base models are becoming increasing, improving quite steadily and quite well. So investing into models themselves has very, very strong diminishing returns, even internally. So I would say that is not something which is a good thing to do. I think the model of today will be subsumed by the model of tomorrow, and tomorrow will be much better. Having your own, rolling out your own has diminishing returns very quickly. And so we did abandon that. I wish we would never have started. At the time, it was not that clear. Again, when we started ideating the project, it was Gemini 1.0. It was not like 3 and above. So there's a very, very long gap. But knowing that now, it would be like, that's not the thing. I think the other thing is when you design an AI for security, it's a workload. It is not an interactive chat. It should not be considered as a ChatGPT clone or something you do with a prompt. It should be something that you let the AI run and do in the background and then collect. And I think that creates a different type of infrastructure need and a different type of design, architectural design. I think a lot more people are going to discover over the next few months that long-term horizon planning, which is like being able to do 200, 300 steps, is going to be needed. And that control of context and control of what you put into it and being able to prune it and have it like this is going to be important. So I think when you design your AI for security, you need to think of this kind of like, I'm going to run this as a long-term, long-running job. And that creates a lot of different architecture decisions. Again, I wish we would've done that from the get-go, but from the get-go, it was like, well, you ask a question to Stack Gemini, you get immediately an answer. And then the answer becomes, well, we are going to investigate 6 million lines of logs, so be patient. It's going to be a 17-minute answer for you now. And past a certain point, it's like, well, everything is like this. If I investigate an alert, it's not an interactive thing. If I reverse a binary, it's not an interactive thing. Not at the beginning. There is a lot of those long processing phase followed by some review. And so I think thinking along those way when you design your system or think on how to integrate AI, make it very, very different from, oh, I'm adding a chatbot to my product, which is not going to work long-term. And I think that that's what will make a better, more successful project. I think those are 2 fundamental design principles. So that was the one question.

Reading. Reading. Recommended reading.

I post every week a weekend read on LinkedIn. If you want to follow, this is the paper that week I found the most interesting. It's usually AI or security. Sometimes it's a blog post. It's just like, if you want to read one thing this week, just read that.

Nice.

So that's my way of sharing what to read.

Okay. So you just shared actually a subscription, not just one thing to read. That's great. Very well done. And then bonus question.

It's free. It's on LinkedIn.

That's awesome. That's really great.

It's on Twitter. Oh, sorry, X. It's on X also. I'm just posting it as like, read it if you would like. I think I'm trying to, I read through a lot of things every week and I try to find one that if you have a cup of coffee on a Saturday or Sunday and want to read something interesting and stimulating, you would find it interesting. Even if you're not a research scientist, that's not the point. It's like the idea is worth knowing. So that's my, so that's the proposal. So that's basically only, it's the only thing I post on social media. So, you know, that's, but I think people find value of it. And then 3, Trusted Tester Program. Okay. Well, it depends. If you are a Google Cloud customer, then your sales reps can do that for you. And they have a form and we work very closely with all the Google Cloud organizations and we're really happy with the collaboration. It's awesome. And so they know how to— put people on the list. And as I said, we go through the list and we onboard very, very few people at a time because we want to have them on the call and we talk seriously about what is the use case, what they want to do, what we have, and try to really make it like strong, productive research partnership. So if people really want that, then they should be on the list. And then that's for Google customers. For people who are not big customers, who are university, nonprofit, And people who think they can benefit from it, I think we have from time to time a form that we send out, or you can reach out. I'm sure you can ping me on LinkedIn. Usually I add people also to the list. But again, we make no promises of how many people we can onboard because at the end of the day, we are a research team and we have some limited capacity to take more people and we'd rather do better to do scale, which is very weird for Google, I know. But this one is the reverse of the other one where it's like, well, we'd rather do it carefully. And so that's for now, that is how it is. Now in the future, maybe we might open up to a larger amount of people through other means, but then that's going to be announced in blog posts that we're going to publish on one of our blogs.

And then we'll see. Amazing. Well, Elie, thank you so much for joining us today. I really appreciate the dive into the world of using LLMs for security. And thank you for putting up with all of our unscheduled or bonus questions.

I love bonus questions. Thank you so much for having me. Really, always a pleasure.

And now we are at time. Thank you very much for listening, and of course, for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast, tweet at us, email us, argue with us, and if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.