Security Command Center

I speak with customers daily. A challenge many security teams face isn't just finding vulnerabilities—it is mapping those vulnerabilities to compliance frameworks in a way that satisfies both internal security teams and external auditors.The monitoring and auditing capabilities of Compliance Manager in Security Command Center can fundamentally change how you define, monitor, and enforce your cloud compliance postures. What is Compliance Manager? Compliance Manager is a native SCC capability that uses software-defined cloud controls to assess, monitor, and actively enforce compliance across your Google Cloud infrastructure. https://docs.cloud.google.com/security-command-center/docs/compliance-manager-overviewInstead of relying on disconnected compliance dashboards, Compliance Manager maps Security Health Analytics (SHA) detectors directly to specific regulatory requirements, allowing you to see exactly where your workloads stand in real time. Three Operational Modes of Cloud ControlsCom

Hello everyone,I am seeking urgent guidance regarding a GCP project suspension. My account was recently suspended, and I received an email stating that the project was engaged in abusive activity consistent with "hijacked resources."The Situation:Access Denied: My production application is currently offline. Whenever I attempt to access the IAM & Admin or APIs & Services dashboard to investigate, I am automatically redirected to the suspension warning page. Unknown Leak: I have audited my frontend/backend/app environment variables (.env) but haven't found any obvious exposures. Account Lockout: Because I cannot access the IAM dashboard or Cloud Logging, I am unable to identify which credential is being abused or delete the compromised keys. Appeal Status: I submitted an appeal over a week ago, but I have not received a response, and my production app remains affected.My Questions:Is there a way to access Cloud Logging or Security Command Center via the SDK or a restricted conso

Hello Community Managers,Our production project MeshTek-Live (Project ID: meshtek-push-notificatio-724ad) was suddenly suspended yesterday for "abusive activity consistent with hijacked resources."We filed a comprehensive appeal immediately, but our production environment is completely down, impacting our active users. Because we are entirely locked out of the Google Cloud Console, we are unable to look at the Logs Explorer or rotate keys.Why we believe this is an automated false positive: Zero Billing Impact: Our Google Cloud billing dashboard shows exactly $0 in fraudulent or unexpected charges. Timing & Certification: The suspension happened immediately after we submitted our first Google Home Action integration for certification review. We believe the heavy testing traffic from Google's automated certification bots or an embedded client-side credential scanner mistakenly triggered a false-positive "hijacking" flag. No Leaks: We have audited our systems; no code or keys are

Hi all,I'm hosting a technical session on a key challenge we're all facing: adapting our security posture for AI and cloud-native workloads without slowing down innovation.I'll be moderating a discussion with my colleague, Griselda Cuevas, called "Raising the Security Baseline: Essential Protections for AI and Cloud Workloads." We'll get straight into practical approaches.Key topics we'll cover: SCC Standard Tier: A look at the newly enhanced "out-of-the-box" foundational security. Native AI Guardrails: Our strategy for making AI protection an accessible, built-in enabler. Frictionless Visibility: Methods for gaining in-context visibility for better threat detection. SCC Premium Deep Dive: When to consider upgrading and what specific problems it solves. I'm keen to share what we're learning and hear your thoughts.Session Details: When: May 20, 2026, at 8:00 AM PDT Registration/Replay: https://www.brighttalk.com/webcast/18282/666842 What are the biggest challenges you're current

The April 22 release notes for Security Command Center detail a number of new additions to the platform related to Agent Platform and Agent Runtime. Specifically,  we have introduced new correlated rules and predefined security graph rules for Agent Runtime, a long with new Event Threat Detection (ETD) rules related to AI Agents.You can read the full release notes using the link above.

In this post, we’ll explore the idea of creating a report for the configuration of Security Command Center (SCC) so that we can convey the current ‘health’ of the SCC platform to an audience.  We’ll use tools like Gemini CLI to help us draft an initial version of this report, which will let us offload the architecture of the script and let us focus on the high-level goal we are trying to solve.What types of information should go into a health check report for SCC?  Here are some ideas of things that an SCC administrator might spot-check as part of a platform review:Are there any SCC errors? Which SCC services (SHA, ETD, etc.) are enabled? How many Mute Rules are defined? Which continuous exports are defined? Are there high-value resource sets defined? Which principals (users) have administrative access to SCC?Our development environment for this use case will revolve around using Gemini CLI.  We can use Gemini CLI to prompt for this script by providing a detailed and task-oriented prom

Title: Securing the Agentic Era: Governance and Trust in the New Gemini Enterprise Agent PlatformAuthor: Tyler DooskinDate: April 26, 2026 IntroductionFollowing the major announcements at Google Cloud Next '26 in Las Vegas this week, the shift from experimental AI to the "agentic enterprise" is officially underway. The headline news is the consolidation and evolution of Vertex AI into the Gemini Enterprise Agent Platform [1]. As organizations deploy autonomous agents capable of managing complex, multi-day workflows, the conversation immediately turns to trust. How do we secure systems that not only retrieve data but act upon it?Here is a breakdown of the new governance, security, and compliance controls introduced for the Gemini Enterprise Agent Platform and what they mean for your security posture. From Vertex AI Governance to Gemini Enterprise ControlThe evolution from Vertex AI to the Gemini Enterprise Agent Platform isn't just a rebrand; it represents a unified approach to building

How to detect cyber security criminals and stop black hat hacker 

Hello community members, We recently released the first official Adoption Guide for SCC, right here in the Google Cloud Security Community!  The guide is about configuring high-value resource sets and covers this workflow with examples and screenshots that should make implementing this part of SCC a breeze! Take a look at the guide here!

I am a Computer Science undergraduate researcher currently analyzing network traffic patterns and regional access control mechanisms. I am particularly interested in how Google/YouTube services ensure service integrity across different geographic locations.I would like to inquire about the technical feasibility and the actual utilization of specific network metadata within the Google ecosystem (including YouTube):1. Mobile Country Code (MCC) Extraction: From a security and service delivery standpoint, does the infrastructure actively monitor the MCC of a mobile user (e.g., via carrier-provided headers or app-level telemetry) to prevent regional service bypass? If so, is this data prioritized over IP-based geolocation?2. Autonomous System Number (ASN) Analysis: Does Google’s security layer utilize ASN data (derived from the user's connecting IP) to categorize traffic and identify potential anomalies or unauthorized access points (such as VPNs or data centers)?3. Data Correlation: Is the

 Navigating security and regulatory compliance in the cloud can be a significant challenge. Staying on top of diverse requirements and demonstrating adherence to auditors is a complex task.To help lighten the load, Google Cloud is rolling out the new features in SCC Compliance Manager, currently in preview (For Enterprise service Tier). Compliance Manager in Google Cloud enables organizations to meet security and regulatory requirements for their Google Cloud infrastructure, workloads, and data. Compliance Manager offers a library of frameworks, primarily consisting of frequently used cloud controls, to assist organizations in meeting their security and regulatory obligations within cloud environments. While you can customize an existing framework to align with specific needs, the option to create a completely custom framework is also available. So, what can it do for you?Define and deploy security rules: Instead of manually setting up security policies across your environment, Complia

Hello everyone,I’m currently working on improving security configurations within Google Cloud for small to mid-sized projects.I would appreciate insights on: Recommended baseline security configurations IAM best practices Monitoring and threat detection tools Common misconfigurations to avoid Looking forward to learning from the community.

In case you haven’t seen it, dark mode support has come to the SCC UI!  Here is a before and after visual for dark mode fans:Before:After:To enable dark mode, click the 3 dots in the upper right next to your profile and select Appearance.From there, you can select Light, Dark, or Same as Device, applying the theme to entire Google Console.Many thanks go out to our internal teams who worked hard to make this happen!!

Google Cloud is taking a massive leap forward in cloud security by integrating Mandiant's Attack Surface Management (ASM) capabilities into the Enterprise Tier of its Security Command Center (SCC). Let's explore what this means for anyone seeking to fortify their cloud environments. What is Mandiant Attack Surface Management? Mandiant Attack Surface Management is a cybersecurity solution that continuously discovers, analyzes, and prioritizes an organization's internet-facing vulnerabilities from the attacker's point of view, helping to reduce the risk of breaches. Think of it as your digital perimeter's vigilant watchdog: Continuous Discovery: It relentlessly scans your entire Cloud Asset Inventory. Exposure Quantification: ASM goes beyond simple identification. It analyzes and prioritizes discovered vulnerabilities based on their potential severity and ease of exploitation, giving you a data-driven roadmap for remediation. Risk-Based Prioritization: Mandiant's ASM guides you to focus

Hello Google Support Team,I am the owner and developer of the website: https://www.bawoumarket.com (and the hosting URL: [suspicious link removed]).I recently deployed this website using Firebase Hosting. It is a legitimate e-commerce project currently under development. I added a login.html page for user authentication, and immediately after deployment, Google Chrome started flagging my site as "Dangerous / Deceptive Site Ahead".This is a false positive. The site is clean, safe, and does not contain any phishing or malicious content. It is simply a new project with a login form.I have verified my ownership in Google Search Console.Please review the site and remove the red warning screen so I can continue my development.Thank you.

Why Daily Status Report is not available ?

Hello Guys, I am able to see many container image vulnerabilities in our environment. The occurrences are from artifact registry.We have fixed from 156 vulnerabilities to 22 and deleted the older digests as well.But in Risk overview -> Findings -> I am still able to see the older digests vulnerabilities that have already been fixed. When I click them it shows not found (That confirms it was deleted) but in findings tab it still retains the count.Why doesn't the count gets refreshed? We have tried manual artifact image scanning using Gcloud artifact scanner and also tried pushing the image again for refreshing still its not working. Any solution ?

Google Cloud's Security Command Center (SCC) offers a unified dashboard for consolidating security findings and assets. But what if you need to add your own business context to these findings? That's where security marks come in. To incorporate your specific business context into these findings, security marks prove invaluable. With the recent GUI upgrade, Enterprise versions now necessitate API usage, while SCC Standard and Premium versions retain GUI functionality. Security marks are custom key-value pairs you can use to annotate assets and findings in SCC. They allow you to add context like:Priority: “priority: high” Access Level: “access: confidential” Application: “app: marketing-web-prod” Incident Reference: “Incident-number: x2345”This feature is incredibly powerful for filtering, managing policies, and integrating SCC data into your security workflows. While you can add marks through the Google Cloud console, the Enterprise version of SCC often requires programmatic management

Navigating security and regulatory compliance in the cloud can be a significant challenge. Staying on top of diverse requirements and demonstrating adherence to auditors is a complex task. To help lighten the load, Google Cloud is rolling out the new feature - SCC Compliance Manager, currently in preview for Enterprise Tier.Compliance Manager offers a library of frameworks, primarily consisting of frequently used cloud controls, to assist organizations in meeting their security and regulatory obligations within cloud environments. While you can customize an existing framework to align with specific needs, the option to create a completely custom framework is also available.So, what can it do for you?Define and deploy security rules: Instead of manually setting up security policies across your environment, Compliance Manager helps you define and deploy a secure and compliant configuration from the get-go.   See your compliance in a snapshot: With easy-to-read dashboards, you can quick

I'm trying to setup up Web Security Scanner with non-Google account for authorisation. I have a simplified login form that works as expected when saving the scan details, and I can see in our server login it's requesting the page, submitting the form, receiving the cookie, and then viewing the post-login page successfully.However when I try to run the scan it is always return a Login procedure failed error. Checking the logs I can see it's still visiting the sign in page, however no POST requests are being made. This includes both the post for the submit form, and another POST request that runs on page load. Both are called when the scan settings are being saved and verified however.I can see the login form submit is definitely triggering. From reading the documentation I can see custom scans should support POST requests, on managed scans are GET only. We are using the standard tier so these scans can only be custom scans.I've testing using alternate User Agents with no success. Is the

  Security Marks are a unique concept in Security Command Center.  They allow us to annotate assets or findings in SCC with additional business context.  You can apply Security Marks to both Assets and Findings. To apply Security Marks, you'll need one or both of the following permissions depending on whether you'll be applying Security Marks to assets, to findings, or both. For Asset Security Marks: Asset Security Marks Writer, securitycenter.assetSecurityMarksWriter For Finding Security Marks: Finding Security Marks Writer, securitycenter.findingSecurityMarksWriter You can add a Security Mark to an asset by navigating to the Assets view in Security Command Center and then selecting one or more assets.  Click the Set Security Marks button. Security Marks take the form of key-value pairs.  Here is an example of configuring a Security Mark to add the key/value pair of stage/prod to an asset. To learn more about Security Marks in Security

Hello Security Engineers\\Operators\\AnalystsGoogle Cloud Learning Services has launched a new lab for Model Armor.  This lab will cover the basics of getting started with Model Armor and walks you through initial steps for working with the product. Get used to configuration and responses from within the product set while learning how you might implement it for your own applications or agents. Find our new lab at the link below. Sanitize Prompts and Responses with Model Armor  Do you want to know more details? Model Armor on Google Cloud Platform enhances AI safety by screening both user prompts and LLM responses for risks like harmful content, prompt injection, and sensitive data leaks. It allows organizations to centrally manage and enforce security policies for their AI applications, acting as a filter to ensure interactions are safe and compliant. This service integrates with Security Command Center for unified visibility and helps protect against unauthorized exposure or

Please note at the time of this post the Toxic Combinations feature is currently in Preview. A toxic combination is a group of security issues that, when they occur together in a particular pattern, create a path to one or more of your high-value resources that a determined attacker could potentially use to reach and compromise those resources. A security issue is anything that contributes to the exposure of your cloud resources, such as a particular configuration of resources, a misconfiguration, or a software vulnerability. The Risk Engine of Security Command Center Enterprise detects toxic combinations during the attack path simulations it runs. For each toxic combination that Risk Engine detects, it issues a finding. Each finding includes an attack exposure score that measures the risk of the toxic combination to the high-value resources in your cloud environment. Risk Engine also generates a visualization of the attack path that the toxic combination creates to the high-value reso

How does it work? Hash Generation: The system generates hashes for process binary data. VirusTotal (VT) Query: Hashes are used to construct VT links and query the VT database. Link Retrieval: VT link is retrieved and displayed alongside corresponding findings. Risk Assessment: Quickly assess risk based on VT reputation data (e.g., benign, suspicious, malicious). Does customers need a VirusTotal License?VirusTotal License are not required to leverage this feature. Are we leveraging VT data when rating the severity of the finding (ex positive match = high / critical, no match at all = low or something like that) We are not leveraging VT data to rate the severity of the findings.