I spent my career on the SOC side—detection engineering, incident response, and SIEM architecture. I worked with threat intelligence teams, wired up their feeds (including integrating MISP with Chronicle SIEM), and built detection rules from their reports, even reviewing books like Intelligence-Driven Incident Response along the way. Still, I never actually sat in the CTI chair.
Recently, I started studying Google Threat Intelligence (GTI) and the services around it. Coming from the outside, the acronyms hit you fast: TAG, GTI, GTIG, DTM, ASM, UNC. You also run into the natural skepticism most security practitioners share whenever a Big Tech company with deep pockets goes on an acquisition spree: great, another tech giant buying respected security companies to dress up its portfolio, squeeze revenue, and let a good product rot—even if Google's track record with acquisitions like YouTube and Waze points in a different direction.
As I dug into how the pieces actually fit together, the 15-year strategy behind them impressed me—and the way GTI, GTIG, and Google SecOps operate today looks remarkably close to the operational blueprint described in Intelligence-Driven Incident Response. I decided to turn my study notes into a four-part series to take fellow SOC practitioners from zero to hero on how Google's intelligence ecosystem works under the hood.
Disclaimer: This series is built entirely on publicly available material. All views, war stories, and opinions here are strictly my own—not Google speaking officially.
Building the Portfolio
What looks like a massive portfolio today started as three separate pieces built years apart.
2010 — Operation Aurora and TAG
In late 2009, Google detected a coordinated intrusion targeting its corporate infrastructure—an attack publicly disclosed in January 2010 as Operation Aurora (Google's Hacking Google documentary series on YouTube covers the entire story in Episode 000). State-sponsored operators went after Google's source code and the Gmail accounts of Chinese human-rights activists.
Aurora forced Google to rethink security from the ground up. On the architecture side, while Forrester analyst John Kindervag coined the term Zero Trust in 2010, Google responded to Aurora by actually engineering and deploying the first large-scale enterprise Zero Trust network—BeyondCorp—killing the privileged corporate VPN so access depended on device and identity state rather than network location. On the intelligence side, Aurora led directly to the creation of Google's Threat Analysis Group (TAG) in 2010.
TAG wasn't created to sell threat feeds; its mission was to defend Google and its users from state-sponsored espionage, zero-day brokers, and commercial spyware vendors. TAG analysts consume planet-scale telemetry across Gmail, Chrome Safe Browsing, Android, YouTube, and Google Cloud to protect both Google's own infrastructure and billions of everyday, non-paying users. Over the last decade, their outputs directly made Google safer—powering the government-backed attack warnings in Gmail, taking down state-sponsored phishing and influence operations, and burning dozens of in-the-wild zero-day exploits alongside Project Zero (Google's offensive vulnerability research team tasked with finding zero-day bugs before attackers do).
2012 — Acquiring VirusTotal
In September 2012, Google made its first major move outside its own walls by acquiring VirusTotal. Founded in June 2004 by Spanish security company Hispasec Sistemas (led by Bernardo Quintero in Málaga), VirusTotal was an eight-year-old service that had already become the daily workbench for malware researchers and SOC analysts worldwide.
At the time of the acquisition, VirusTotal was not a traditional CTI research organization publishing threat actor attributions—it was a lean engineering team running a community platform and building hunting tools for researchers. Whenever a practitioner anywhere in the world ran into a suspicious binary, document, IP, or URL, they uploaded it to VirusTotal to scan it against 70+ antivirus engines and sandboxes. Crucially, VirusTotal's team had also created YARA (originally released by Víctor Manuel Álvarez in 2008) and launched VirusTotal Intelligence, giving the security community the ability to run YARA rules against the global malware stream.
By acquiring VirusTotal while keeping it independent and vendor-neutral, Google backed the world's largest crowdsourced malware repository with Google-scale infrastructure. Every sample uploaded in São Paulo, Ciudad de México, New York, or Frankfurt added another node to a single global threat graph.
2022 — Acquiring Mandiant
In 2022, Google made another move that shook the cybersecurity industry: it acquired Mandiant.
Founded in 2004, Mandiant had built a legendary reputation on the front lines of the world's worst breaches. They put modern adversary attribution on the map in 2013 with the landmark APT1 report, exposing a Chinese military cyber-espionage unit down to the physical building in Shanghai. Acquired by FireEye at the end of 2013, the company eventually sold off the legacy FireEye appliance business in 2021 to focus purely on what made Mandiant famous.
By the time Google acquired it in September 2022, Mandiant wasn't just a consulting shop anymore. It brought three distinct pillars into Google Cloud:
- External Frontline Services: The gold-standard Incident Response (IR) retainers, compromise assessments, red teaming, and Managed Defense (MDR).
- Internal Adversary & Malware Research: Hundreds of global threat intelligence analysts tracking nation-state and financial crime groups, backed by the elite FLARE malware reverse-engineering team.
- *An External SaaS Platform (Mandiant Advantage): A commercial intelligence portal that delivered Mandiant's actor and vulnerability research alongside two integrated modules: Digital Threat Monitoring (DTM) (monitoring the dark web, Telegram, and credential leaks) and Attack Surface Management (ASM)* (built from Mandiant's 2021 acquisition of Intrigue).
2024 — Connecting the Pieces
For a couple of years, TAG, VirusTotal, and Mandiant operated side by side while teams planned the integration behind the scenes. Starting at RSA Conference 2024, Google brought those pieces together into three clear pillars:
- GTIG (Google Threat Intelligence Group): All the human researchers—from TAG, Mandiant Intelligence, FLARE, and VirusTotal—merged into a single research organization.
- GTI (Google Threat Intelligence): The unified SaaS platform combining VirusTotal Enterprise, Mandiant Advantage (Threat Intelligence, DTM, and ASM), and Gemini.
- Mandiant Services: Human-in-the-loop expertise sold alongside the platform—including Incident Response retainers, subscription access to intel analysts via Essential Intelligence Access (EIA) or an embedded analyst via Advanced Intelligence Access (AIA), and Mandiant Managed Defense and Mandiant Threat Defense (MTD) (managed detection, threat hunting, and curated detection pipelines on top of Google SecOps).
Up Next in Part 2: We'll look under the hood at how GTIG and GTI feed each other in a continuous intelligence loop, what separates the enterprise GTI platform from free VirusTotal, and how analysts use the Diamond Model of Intrusion Analysis to cluster raw intrusions into UNC groups and named threat actors like Breeze Comet.
