Etsy’s security team moved the majority of its SIEM to Google Security Operations in a week. That is the sort of sentence software companies love. A difficult migration, a familiar customer, a wonderfully small number. But the interesting part comes before the stopwatch starts.
The engineers had prepared. They had organized their detections as code and narrowed their attention to work they actually did. Earlier evaluations had rewarded elaborate feature lists. Experience pushed them toward search, detection writing, and APIs. The implementation happened during a hackathon; the groundwork happened beforehand.
- Google combines security data analysis, threat intelligence, and response workflows.
- SecOps pricing follows ingestion volume; features vary by package.
- Etsy’s lesson travels well: simplify the requirements before moving the machinery.
That distinction is a useful entrance to Google Cloud Security. The portfolio promises to make security work easier to connect. Its customers still have to decide which work matters.
A moonshot learns to follow through
Start with the names. Google Cloud Security covers a portfolio inside Google Cloud. Google Security Operations, or SecOps, is its platform for detecting, investigating, and responding to threats. Siemplify, the company behind the old siemplify.co address, supplies part of that platform’s ancestry.
Chronicle began as a project at Alphabet’s X in early 2016. It graduated into an Alphabet company in 2018 and joined Google Cloud in 2019. Its organizing idea was recognizably Google: apply large-scale computing and search to the security information companies already produce. An organization might possess the evidence of an intrusion without being able to find it usefully.
Search was one piece. In January 2022, Google acquired Siemplify, whose founders, Amos Stern, Alon Cohen, and Garry Fatakhov, had built a business around security operations. Its contribution was SOAR: security orchestration, automation, and response. The name is cumbersome. The job is practical: connect tools, organize cases, and make repeatable responses repeatable.
graduates from X
response workflows
takes its current name
The awkward space between tools
Consider a suspicious sign-in. A security analyst needs to establish whose account it is, what device was involved, whether the destination is malicious, and what happened afterward. Those answers may live in different systems. Every transfer between them is another small job.
SecOps combines SIEM, which collects and analyzes security events, with SOAR and threat intelligence. Logs become searchable evidence. Intelligence adds context. A case collects the investigation. A playbook coordinates the next actions. Its relevance is easy to grasp if you have ever copied the same identifier into several windows.
The broader portfolio adds different vantage points. Google Threat Intelligence brings together Google’s visibility, Mandiant expertise, and VirusTotal context. Security Command Center examines cloud risk and posture. Mandiant also provides incident response and consulting. Google completed that acquisition in September 2022. These are related jobs, with different products and commercial terms.
The assistant gets a desk
Gemini brings a conversational interface to parts of this workflow. Depending on the package, analysts can search using natural language, ask for case summaries, and draft detections or response playbooks. The distinction between asking a question and knowing the right query syntax becomes less of an obstacle.
That changes the starting point for an investigation. It also creates something to review. A plausible summary still needs evidence behind it; a generated detection still needs to match the environment. Buyers should test those steps with their own incidents. A polished demonstration can show an interface. A familiar case can expose its assumptions.
In June 2026, Google described agents for detecting coverage gaps, generating detections, investigating attacks, and retrospective hunting. Availability deserves attention: the Detection Engineering Agent documentation identifies that feature as pre-general availability. An announcement and a production entitlement are different entries on a buyer’s checklist.
The bill follows the data
SecOps has three packages: Standard, Enterprise, and Enterprise Plus. Pricing is based on ingestion volume and requires a sales or partner quote. Standard includes twelve months of hot retention, meaning retained data stays searchable, alongside core detection and response capabilities. Higher packages add intelligence, AI assistance, and additional controls.
Hot retention in the Standard package.
Searchable history; ingestion charges still apply.
Retaining evidence also changes the questions a team can ask later. A domain that looked ordinary last month may acquire significance when new intelligence arrives. Historical search lets an investigator revisit earlier activity, provided the relevant events were collected in the first place.
The practical buying question is how much useful evidence will enter the system. Migration, parser work, rule translation, training, and ongoing tuning also consume effort. A subscription quote cannot tell a team how much of that effort its own environment will require.
Google’s 2026 data benefit program excludes certain eligible sources from qualifying customers’ ingestion caps, subject to conditions. Workspace logs and Google Cloud audit logs each have a ten-gigabyte daily allowance. The program requires eligible Enterprise or Enterprise Plus subscriptions, qualifying new or renewal contracts, and a spending threshold.
A big portfolio meets a small test
The intended users include enterprise security teams, managed service providers, and government organizations. Google also markets Cybershield for national-scale defense. This is software for organizations with substantial security evidence and response responsibilities. Deployment discipline matters alongside product capabilities.
Google’s competitive argument is the connection between its infrastructure, intelligence, and operations tooling. The ecosystem includes more than 300 security vendors; April 2026 additions included Contrast Security and Gigamon integrations. That allows customers to connect existing defenses while evaluating how much consolidation they want.
Microsoft Sentinel, Splunk Enterprise Security, and Palo Alto Networks Cortex XSIAM compete for related security operations budgets. Combining detection and response is a shared ambition. Google’s particular proposition draws on its own infrastructure and research alongside acquired expertise. The useful comparison is how each option handles the customer’s data, existing tools, and response process, rather than how many categories appear on a presentation slide.
Wiz joined Google Cloud in March 2026, keeping its brand and commitment to multiple clouds. The portfolio continues to grow. Buyers can keep their evaluation deliberately small: take a known incident, supply representative logs, trace the evidence, and rehearse the response. Watch where the analyst has to stop and repair the process.
“Our new motto is just keep it simple.”
Manan Doshi · Etsy senior security engineer
The limitation is organizational as much as technical. Missing telemetry cannot answer an investigator’s question. Untranslated rules cannot preserve an old detection. Automation needs agreed permissions and a response somebody owns. The lesson to copy is the preparation: inventory the evidence, choose the essential detections, and make the workflow repeatable before asking software to accelerate it.