Google is shifting from manual, batch vulnerability handling to an end-to-end, agentic find‑fix‑deploy pipeline called Project Fortify, enabling autonomous discovery, validation, remediation, and patch deployment.

The core message for 2026 defense is that autonomous systems operating at the speed of the threat — with humans supervising rather than performing manual triage — are essential.

Core tools and initiatives include Mantis as an open‑source scanner, rapid Chrome patch cadence, OpenSSF collaboration for maintainer tooling, and CodeMender integration with OSS-Fuzz.

Google emphasizes a precision‑first trust model to preserve developer trust, delivering high precision for most code while adjusting recall for critical assets to balance automation with human oversight.

Remediation latency is highlighted as a key risk driven by exponential vulnerability volume and machine‑speed exploitation, necessitating faster, automated responses.

To avoid fragmented tooling, Google built a company‑wide defense with centralized discovery, automated patching services, and integrated deployment pipelines across tens of thousands of services and open‑source dependencies.

Beyond patching, Google is investing in memory‑safety transitions (Rust adoption), secure architectural invariants, and continuous agentic assurance to verify security guarantees on every commit.

The four‑stage pipeline consists of discovery via agentic scanners (PageBreak, Mantis, Gemini), autonomous validation to separate exploitable issues, automated remediation with CodeMender, and deployment through human review and SRE oversight.