Uploaded June 2026 | Updated September 2026, 3 weeks ago
*Featured in this video:* Caroline Honeycombe, Director of Cyber Incident Response at Deloitte, and Paul Beverley-Paddock, Director, Security Operations Lead at Deloitte
*Executive summary:* Deloitte, one of the biggest and oldest global consulting firms, tackles a huge range of challenges for clients — from boardroom strategy to technical implementation. One recent win was hugely impactful: the firm helped stop a state-sponsored cyberattack before it could affect public and digital services across Europe. Stopping that attack and reclaiming highly sensitive compromised data depended on a solution built using both the Google Security Operations and Google Threat Intelligence platforms along with Gemini. The Deloitte team ingested billions of log data points into Google SecOps, then used Gemini to ask questions of the data to decide how to tackle particular threats. That new visibility and searchability turned data points into prioritized actions the team could take immediately to counter and remove the threat. Deloitte’s AI-powered Illuminator also visualizes data so teams can identify and neutralize potential threats. The new solution has brought huge gains for level 1 and 2 analysts, who can identify threats 66% more efficiently by analyzing alerts and identifying whether they’re a true positive or false positive and what, if any, action should be taken.
*Challenge:* The complexity and scale of data, and sophistication of bad actors, have grown concurrently to offer new challenges for security teams. The foiled cyberattack at Deloitte’s client came from sophisticated threat actors, though they used typical IT organization tools that made it easier to hide the threat. For Deloitte, the key ingredients in building a system to counter these new, fast-moving threats were speed and the ability to parse tremendous amounts of data immediately.
*Solution:* The integration of SecOps and Threat Intelligence meant that Deloitte’s team could quickly identify who the threat actor was, and take action. Along with these Google Cloud Security tools, the natural language search capabilities of Gemini in SecOps allow the Deloitte team to ask questions in real time, such as whether and what type of detection rule should be written. Those answers brought both speedy insights and prioritized actions so the team could remove the threat and re-secure the environment. Along with those short-term reactions, the Deloitte team can now build improved client capabilities so they’re more protected in the long term and better able to react to threats going forward.
*Results:* Gemini AI’s capabilities applied to massive amounts of data now let Deloitte’s cybersecurity clients’ teams quickly identify and remove threats before they can attack and cause any number of disruptions. This combination of AI and security technology has helped Deloitte reimagine their entire approach to the challenges of modern threat detection. The team is able to act faster than ever before with previously unimaginable depth and hugely increased efficiency in identifying threats.
*Key takeaways and highlights from our interview with Caroline Honeycombe, Director of Cyber Incident Response at Deloitte, and Paul Beverley-Paddock, Director, Security Operations Lead at Deloitte:*
→ “It essentially gave us speed, scale, depth. We can act faster than we could before with a depth we couldn’t have dreamed of. We’re able to help clients ‘shift left’ and put threat intelligence at the heart of everything we do.” —Paul Beverley-Paddock
→ “Bringing in Google allowed us get insights into what we were facing and very quickly reduce billions of data points into very short, prioritized actions that we were able to take to remove the threat actor from the environment, re-secure the environment, and build the client’s capability so they’re more protected and in a better position to react going forward.” —Paul Beverley-Paddock
→ “Being able to use Google SecOps to actually search what we’re after has been super powerful. And we’ve now got a really nice picture of forensics data, log data, and threat intelligence in one place.” —Caroline Honeycombe
→ “Taking AI as an example, Google is one step ahead of where technology is going and what is happening in the market. Google Cloud is helping Deloitte find a new way to hunt threats faster.” —Caroline Honeycombe
*Google Cloud products used:* Google Security Operations, Google Threat Intelligence, Gemini
*Learn more:*
→ Entering the era of generative AI-enabled security https://cloud.google.com/security/res...
→ Make Google part of your security team cloud.google.com/security
*Featured in this video:* Caroline Honeycombe, Director of Cyber Incident Response at Deloitte, and Paul Beverley-Paddock, Director, Security Operations Lead at Deloitte
*Executive summary:* Deloitte, one of the biggest and oldest global consulting firms, tackles a huge range of challenges for clients — from boardroom strategy to technical implementation. One recent win was hugely impactful: the firm helped stop a state-sponsored cyberattack before it could affect public and digital services across Europe. Stopping that attack and reclaiming highly sensitive compromised data depended on a solution built using both the Google Security Operations and Google Threat Intelligence platforms along with Gemini. The Deloitte team ingested billions of log data points into Google SecOps, then used Gemini to ask questions of the data to decide how to tackle particular threats. That new visibility and searchability turned data points into prioritized actions the team could take immediately to counter and remove the threat. Deloitte’s AI-powered Illuminator also visualizes data so teams can identify and neutralize potential threats. The new solution has brought huge gains for level 1 and 2 analysts, who can identify threats 66% more efficiently by analyzing alerts and identifying whether they’re a true positive or false positive and what, if any, action should be taken.
*Challenge:* The complexity and scale of data, and sophistication of bad actors, have grown concurrently to offer new challenges for security teams. The foiled cyberattack at Deloitte’s client came from sophisticated threat actors, though they used typical IT organization tools that made it easier to hide the threat. For Deloitte, the key ingredients in building a system to counter these new, fast-moving threats were speed and the ability to parse tremendous amounts of data immediately.
*Solution:* The integration of SecOps and Threat Intelligence meant that Deloitte’s team could quickly identify who the threat actor was, and take action. Along with these Google Cloud Security tools, the natural language search capabilities of Gemini in SecOps allow the Deloitte team to ask questions in real time, such as whether and what type of detection rule should be written. Those answers brought both speedy insights and prioritized actions so the team could remove the threat and re-secure the environment. Along with those short-term reactions, the Deloitte team can now build improved client capabilities so they’re more protected in the long term and better able to react to threats going forward.
*Results:* Gemini AI’s capabilities applied to massive amounts of data now let Deloitte’s cybersecurity clients’ teams quickly identify and remove threats before they can attack and cause any number of disruptions. This combination of AI and security technology has helped Deloitte reimagine their entire approach to the challenges of modern threat detection. The team is able to act faster than ever before with previously unimaginable depth and hugely increased efficiency in identifying threats.
*Key takeaways and highlights from our interview with Caroline Honeycombe, Director of Cyber Incident Response at Deloitte, and Paul Beverley-Paddock, Director, Security Operations Lead at Deloitte:*
→ “It essentially gave us speed, scale, depth. We can act faster than we could before with a depth we couldn’t have dreamed of. We’re able to help clients ‘shift left’ and put threat intelligence at the heart of everything we do.” —Paul Beverley-Paddock
→ “Bringing in Google allowed us get insights into what we were facing and very quickly reduce billions of data points into very short, prioritized actions that we were able to take to remove the threat actor from the environment, re-secure the environment, and build the client’s capability so they’re more protected and in a better position to react going forward.” —Paul Beverley-Paddock
→ “Being able to use Google SecOps to actually search what we’re after has been super powerful. And we’ve now got a really nice picture of forensics data, log data, and threat intelligence in one place.” —Caroline Honeycombe
→ “Taking AI as an example, Google is one step ahead of where technology is going and what is happening in the market. Google Cloud is helping Deloitte find a new way to hunt threats faster.” —Caroline Honeycombe
*Google Cloud products used:* Google Security Operations, Google Threat Intelligence, Gemini
*Learn more:*
→ Entering the era of generative AI-enabled security https://cloud.google.com/security/res...
→ Make Google part of your security team cloud.google.com/security
