In this commentary, the speaker examines Google’s newly announced AI‑driven security add‑on for Gmail, which is priced at $10 per user per month and is marketed as an enhancement to spam, phishing, and malware filtering. The speaker questions Google’s claim that it already blocks 99% of such threats, suggesting the figure is likely optimistic. While acknowledging that AI could improve detection rates beyond the current baseline, the speaker argues that basic email protection is a fundamental service that should remain free, warning that charging for it could hurt Google’s market share as competitors like Microsoft might offer comparable protection at no cost. The commentary then outlines a suite of higher‑value AI security features that could justify an enterprise upsell—threat characterization, enterprise‑wide attack aggregation, automated remediation recommendations, user education, incident documentation, and campaign linkage. The overall stance is that Google should incorporate core AI‑enhanced protection into the standard Gmail offering and reserve paid add‑ons for advanced, value‑added capabilities.
Chapters
Google wants to charge to keep your Gmail secure. Now Google is offering a new AI security add-on to enhance the spam, phishing, and malware filtering of Gmail. And here's what you need to know. It will cost businesses an additional $10 a month per person. And here's the notification in more detail. Now, let's first overlook the fact that Gmail is, is stating that they currently block 99% of spam, phishing, and malware that, that reaches your inbox. That's probably an overzealous sales and marketing team's attempt to spin the numbers. Most email filters aren't able to be that effective and certainly can't sustain that as an average over time. We all see how spam and phishing sometimes gets through. If this number were correct, then it would mean they were blocking almost 1,000 messages for every one that you see. Now, I suspect this is a high-water mark, perhaps their success percentage on a really good day. Well, Google, if I'm wrong, please publish your credible research. That backs up your claim. Okay, overall, I think this actually is a great idea in using AI to enhance security. It is awesome, and Google definitely has the talent to pull this off. In fact, I would even expect its effectiveness, uh, their estimations here of 20%, I think that's probably a low mark. You know, I think they're going to be able to do much more better than that, especially over time. So that's really good news from a risk management perspective, especially given that social engineering is a big problem. And they are selling this add-on to enterprise customers for $10 a month per user. And I am a firm believer that cybersecurity can help be a competitive advantage and even generate new revenue for organizations. So I'm often happy when I see companies leverage innovative security as an optional benefit for their customers and shareholders. But it only makes sense when it is an over-the-top capability and not foundational or necessary to preserve the current risk mitigation levels. See, attackers are also using AI to improve their email-based attacks. They get better to customize and scale and learn from failures so that they improve the process for their desired outcomes. So if we have the current security at, again, let's say 99% effectiveness based on the attackers, and yet they're using now AI to get better, well, we would expect that the email providers would respond to that evolution and also get better over time. So it is expected that these service providers step up, that they do incrementally improve to keep pace. And in this case, AI is a response to the increased risks from the attackers. So I don't believe this is a good feature or a good candidate as a security add-on or upsell. Now, there are many AI security enhancements that would be very valuable to enterprise customers and worthy of additional costs. You could analyze phishing and malware to characterize the threat to determine, well, who's attacking you? What are they targeting? And what type of attack is really trying to be propagated? Is it credential theft, malware injection, ransomware, business email compromise fraud, whatever? That kind of information would really help security leadership better understand where they need to focus the most effort. Another opportunity is to aggregate the email attack attempts across a specific enterprise to understand if it's being specifically targeted or if specific groups within the organization are being pursued, and then anticipate the next iteration so it can be detected. Such analysis can also automatically craft a series of recommended filters with clear explanation of their purpose and also track their success metrics so security teams can be more effective and efficient. That's just a couple of examples. Because email is a focus point for social engineering attacks, AI systems in these services can do everything from generate value metrics, characterize threats, detect innovative methods of attack, enhance data security, educate users, automate security incident documentation, and recognize chained activities related to a single campaign. So there's no shortage of upsell opportunities for Gmail, and I hope they explore those and many more because they are really good upsells. But keeping spam, phishing, and malware out of the inbox is fundamental for security, privacy, and safety. Google, don't charge for this add-on. Instead, incorporate it for free for everyone and let it be a competitive advantage to increase or sustain your market share and as justification for your average selling prices. Otherwise, I foresee and would even recommend that your competitors, like Microsoft, for example, update their enterprise email services with this capability for free and leverage it to pry away some of your market share. The cybersecurity community will absolutely weigh in on vendor selections for email because again, It is a focus point of attacks, and I for one would endorse vendors who are acting responsibly to provide and maintain that fundamental level of protection over time. Google, if you're not careful, you may be harming your long-term share of market in trade for some short-term revenue bubble. So be careful. Let's do what's smart and let's give this new level of protection to everyone so that we can all keep pace with the attackers.
