Google Sec-PaLM (now Gemini in Google SecOps)
Google's 2023 security LLM; the capability now ships as Gemini in Google SecOps
Overview
Sec-PaLM was the security-tuned language model behind Google Cloud's Security AI Workbench, announced in April 2023 and upgraded to Sec-PaLM 2 that August. Google has since retired the name: the capability ships as Gemini in Google Security Operations and Gemini in Threat Intelligence, while Sec-Gemini is a separate experimental research model.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- Base SIEM and SOAR with 12 months hot retention
- 700+ parsers and 300+ SOAR integrations
- Up to 1,000 single-event and 75 multi-event rules
- Bring your own threat intelligence feeds
- Gemini in security operations
- UEBA and Google curated detections
- Up to 2,000 single-event and 125 multi-event rules
- Unlimited environments with remote agent
- Full Google Threat Intelligence (Mandiant, VirusTotal, Google)
- Up to 3,500 single-event and 200 multi-event rules
- Data pipeline routing and BigQuery UDM storage
Use cases
What you can produce with Google Sec-PaLM (now Gemini in Google SecOps)
- Natural-language search over security telemetry, with Gemini writing the underlying queries
- YARA-L detection rules generated from plain-language prompts
- AI case summaries with recommended response actions
- Response playbooks created and edited by prompt
- Alert triage by the Triage and Investigation Agent, with a structured explanation of each verdict
- Threat-actor and IOC summaries drawn from Google threat intelligence
This page records a retired name. Sec-PaLM no longer appears in Google's product pages or documentation; its job is done by Gemini in Google SecOps, which writes searches and YARA-L rules from plain language, summarises cases, drafts playbooks and runs a Triage and Investigation Agent over incoming alerts.
That assistant is included from the Enterprise package of Google Security Operations, sold by ingestion volume on sales quotes, so it suits organisations choosing Google as their SIEM and SOAR. Nobody should shop for Sec-PaLM by name; evaluate Google SecOps instead.
What we found
Sec-PaLM was the security-tuned language model Google Cloud announced at the RSA Conference on 25 April 2023, as the engine of a platform called Security AI Workbench. Google described it as fine-tuned on its own view of the threat landscape and on Mandiant's frontline intelligence about vulnerabilities, malware and threat actors. It was to power VirusTotal Code Insight, which explains what a suspicious script does and was the first piece released in preview, plus Mandiant Threat Intelligence AI, Mandiant Breach Analytics and conversational search in Chronicle. By Google Cloud Next in August 2023 the model was Sec-PaLM 2 and the assistant was called Duet AI in Security.
The name did not last. Duet AI in Security Operations became generally available on 14 December 2023, and by Next on 10 April 2024 the same features carried the Gemini name as Gemini in Security Operations. In May 2024 Google described the layer underneath as SecLM, a security-tuned API, and launched Google Threat Intelligence, combining Mandiant, VirusTotal and Google data. None of the current product pages or documentation read for this review mentions Sec-PaLM.
What can be bought today is Gemini in Google SecOps. Google's documentation lists natural-language search, YARA-L rule generation, threat-intelligence answers, playbook creation, case summaries and a Triage and Investigation Agent that judges whether alerts are true or false positives. On the pricing page it is included from the Enterprise package of Google Security Operations, which is priced by data ingestion and quoted by sales. Gemini in Threat Intelligence comes with Google Threat Intelligence subscriptions, also quoted.
Separately, Google announced Sec-Gemini v1 on 4 April 2025, an experimental model offered free to selected organisations for research, with an Apache-licensed SDK on GitHub. It is a research programme rather than the commercial assistant. Anyone arriving here looking for Sec-PaLM should evaluate Google SecOps instead.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Google Sec-PaLM (now Gemini in Google SecOps)'s official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Google Sec-PaLM (now Gemini in Google SecOps) unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Google Sec-PaLM (now Gemini in Google SecOps) directly →
Spotted something out of date? Suggest an update →
Related reading
Alternatives to Google Sec-PaLM (now Gemini in Google SecOps)
More in Security & Safety
