Google has launched "Scan for Good", an initiative partnering with cloud security firm Wiz to deploy artificial intelligence systems for finding security vulnerabilities in critical infrastructure organisations including hospitals, public transit systems, and government agencies. The programme uses Google's Gemini 3.8 Flash Cyber model and Wiz's Red Agent, an AI pentesting tool, to autonomously identify security flaws in publicly facing systems. This represents a counterbalance to growing concerns about AI agents potentially being misused for malicious purposes, whilst demonstrating a legitimate defensive application of offensive security technology.

The AI systems autonomously identify vulnerabilities, with all findings subject to human review and validation before disclosure to affected organisations. Google's systems have already uncovered significant security issues, including a critical GitHub Actions workflow vulnerability in Snowflake's code repository and an exposed administrator key that provided access to 8.8 million files in a Middle Eastern national archive. The programme operates with human security researchers maintaining final responsibility for confirming the severity of issues and deciding on disclosure, with no set end date for the initiative. This mirrors a similar $1 billion credit programme recently announced by OpenAI called "Daybreak for Frontline Defenders", as both technology companies seek to provide resources to underfunded cybersecurity teams protecting critical systems.