What was the impact of the AI solution?

The data-gathering step was reduced from about 20 minutes to one minute. Threat-detection rule authoring became six times faster. The automation helped prevent alert fatigue as log volumes grew. Analysts can spend more time on complex investigations rather than repetitive sorting.

Rank#667of 3,449

Source

GCPProductionEvidence: Medium65/100

SEP2 builds interconnected cybersecurity agents with Gemini Enterprise Agent Platform

Use case typeThreat detectionUpdated Jul 9, 2026

SEP2 uses Gemini Enterprise Agent Platform to deploy custom AI agents for faster triage and enhanced threat detection capabilities. In its UK-based security operations center, SEP2 was facing growing log volumes and a manual bottleneck because analysts spent up to 20 minutes manually checking firewalls, endpoints, and threat feeds for each event. SEP2 built an ecosystem of interconnected agents with distinct personas, including triage agents and threat intelligence agents, to gather and summarize multi-step threat context for human review. The approach integrates Google Security Operations and supports rapid iteration of new rules and external feed integrations.

Organization: SEP2
Industry: Public Sector
Location: United Kingdom
Published: July 2026

Reported outcomes

threat-detection rule authoring speedTime & speed

1 minutesdata-gathering time per event20 minutesmanual checking time per event

Strategic outcomes

Cost efficiencyReduced analyst bottlenecks and repetitive sortingEmployee experienceFreed specialists to focus on complex investigationsRisk & complianceEnabled rapid proactive defense and future self-healing SOC capabilities

Catalog median for time & speed deployments: +60% across 143 reported metrics. Compare benchmarks →

Why do we believe this?Outcome claims, sources, and evidence checks

Normalized claim

Data-gathering time per event: 1 minutes decrease

Google Cloud Customer StoriesJul 9, 2026Customer storyExplicit claimMedium evidence strength

"This entire data-gathering process takes the agents just one minute"

Normalized claim

Manual checking time per event: 20 minutes decrease

Google Cloud Customer StoriesJul 9, 2026Customer storyExplicit claimMedium evidence strength

"SEP2 security analysts spent up to 20 minutes manually checking firewalls, endpoints, and threat feeds for a single event"

Normalized claim

Threat-detection rule authoring speed: 6 x increase

Google Cloud Customer StoriesJul 9, 2026Customer storyExplicit claimMedium evidence strength

"build new threat detection rules six times faster"

Why do we believe this deployment?Customer identity, provider attribution, maturity, and source checks

Customer: SEP2
Provider: GCP
Maturity: Production
Linked source: Google Cloud Customer Stories

Google Security Operations supports the workflow, and new feeds or summary formats can be deployed within hours

Customer identity supportedSource describes one deploymentMaturity supported

Primary read

Use case focus

Showing 1 of 1

1Threat detection

Growing log volume created a manual bottleneck in the security operations center.
Analysts spent up to 20 minutes manually checking firewalls, endpoints, and threat feeds per event.
Temporary backlogs risked delays for high-priority cases and alert fatigue.

SEP2 used Gemini Enterprise Agent Platform and Gemini models to build custom AI security agents.
The agents use distinct personas such as triage agents and threat intelligence agents to pull data from firewalls, endpoints, and external threat feeds.
Google Security Operations supports the workflow, and new feeds or summary formats can be deployed within hours.

Technologies

Gemini Enterprise Agent Platform Gemini Google Security Operations

The data-gathering step was reduced from about 20 minutes to one minute.
Threat-detection rule authoring became six times faster.
The automation helped prevent alert fatigue as log volumes grew.
Analysts can spend more time on complex investigations rather than repetitive sorting.

Architecture

Custom AI agents built with Gemini Enterprise Agent Platform and Gemini models operate alongside human analysts in a security operations workflow. Separate agent personas gather data across firewalls, endpoints, and external threat feeds, summarize the findings, and hand them to human reviewers. Google Security Operations is used alongside the platform, with configuration designed for data isolation and UK data residency.

Sources & evidence1

Evidence: Medium65/100Evidence strength