Google Threat Intelligence (Mandiant)
Mandiant's frontline research and VirusTotal, queried through Gemini
Overview
Google Threat Intelligence is Google Cloud's threat-intelligence subscription, combining Mandiant's frontline research, VirusTotal's crowdsourced malware data and Google's own signals. Gemini in Threat Intelligence answers natural-language questions and summarises reports from that corpus. Mandiant itself now operates as Google's incident-response and consulting arm.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
Use cases
What you can produce with Google Threat Intelligence (Mandiant)
- Natural-language questions and AI summaries from Gemini in Threat Intelligence, grounded in Google Threat Intelligence data
- A unified threat verdict on indicators from Mandiant, VirusTotal and Google signals
- Threat profiles of actors, campaigns, malware and vulnerabilities relevant to an organisation, with daily or weekly change alerts
- A hunting workbench with graphs, YARA hunting, rule sharing and collections
- Monitoring for exposed credentials, phishing and brand impersonation
- SIEM alert enrichment and prioritisation, including in Google Security Operations
- Access to Mandiant analysts in the console, with consulting and retainers sold separately
The value here is the data, not the chatbot. Gemini in Threat Intelligence answers questions and summarises reports, but only from Google Threat Intelligence's own reports and actor, malware and campaign records, and it stays silent when those cannot answer. Combined with Mandiant's incident-response research and VirusTotal's malware corpus, that makes it one of the better-grounded AI layers in threat intelligence.
Every edition is priced by sales on an annual subscription with API-call quotas, and Mandiant consulting is a separate engagement. It suits a funded SOC, especially one on Google Security Operations; smaller teams should start with VirusTotal.
What we found
Google no longer sells anything called Mandiant AI. Since Google bought Mandiant in September 2022, the Mandiant name has narrowed to two things: Mandiant Cybersecurity Consulting, which handles incident response, red teaming, retainers and training, and the threat analysts whose research feeds Google Threat Intelligence. Every old Mandiant threat-intelligence address now redirects to the Google Threat Intelligence page, so that is what this listing covers; it previously appeared here as Mandiant AI.
Google Threat Intelligence launched at the RSA Conference in May 2024. It combines Mandiant's frontline reporting, VirusTotal's crowdsourced malware data and signals from Google's own products into one verdict on whether an indicator matters, with a workbench for hunting, graphs, YARA rules and collections, plus monitoring of exposed credentials and brand impersonation. The AI layer is Gemini in Threat Intelligence, which succeeded a Duet AI preview from August 2023. It answers natural-language questions and writes summaries, and Google's documentation is careful about scope: summaries are generated only from Google Threat Intelligence reports and actor, malware and campaign data, and none appears when the source data cannot answer the question. That restriction is the reason to trust it more than a general chatbot.
Pricing is not published. Google lists Standard, Enterprise, Enterprise+ and an OEM edition, all marked contact sales, and says subscriptions are priced on a flat annual rate with a set number of API calls per level, with extra call packs sold separately. A dollar range shown here before had no source.
In May 2026 Google announced AI Threat Defense, pairing Wiz exposure data and the CodeMender patching agent with Gemini, with Mandiant contributing response plans. It is a programme layered on these products, not a replacement. For a funded security team already on Google Security Operations, this is serious intelligence; for anyone without an enterprise budget, VirusTotal's public service is the realistic entry point.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Google Threat Intelligence (Mandiant)'s official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Google Threat Intelligence (Mandiant) unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Google Threat Intelligence (Mandiant) directly →
Spotted something out of date? Suggest an update →
Related reading
Alternatives to Google Threat Intelligence (Mandiant)
More in Security & Safety
