5.5 Securing the AI Stack: AI Protection, Model Armor, and Zero Trust
Key Takeaways
- Google secures every layer of the AI stack: infrastructure, data, models, platform, and agents - a compromise at any one layer undermines the others.
- Model Armor screens prompts and model responses for prompt injection, jailbreak attempts, malicious URLs, sensitive-data leakage, and unsafe content, and can either inspect only or inspect and block.
- AI Protection, delivered through Security Command Center, discovers an organization's AI inventory, assesses its risks, and manages threats against AI workloads.
- Zero trust assumes no implicit trust from network location: every request is authenticated, authorized, and encrypted, which is what Identity-Aware Proxy implements for application access.
- The updated guide names a broad security product list including Cloud VPC, Cloud VPN, Cloud Interconnect, firewalls, Cloud Armor, Cloud Logging, IAM, Sensitive Data Protection, Confidential Computing, Certificate Manager, and Identity-Aware Proxy.
Version Note
This section covers material added by the exam guide effective August 12, 2026. It builds on the security fundamentals in Sections 8.1 and 8.2, which remain in scope for both exam versions.
Why AI Needs Its Own Security Story
Every control in Section 8.2 - encryption, IAM, network defence, audit logging - still applies to an AI workload, because an AI workload is still software running on infrastructure. What is new is a set of attack surfaces that did not exist before:
- The prompt is an input channel that carries instructions, not just data, so an attacker who controls text the model reads may be able to control what the model does.
- The model is an asset with commercial value that can be stolen, and one that can memorise and leak the data it was trained on.
- An agent holds credentials and takes actions, so compromising it is closer to compromising a privileged service account than to compromising a chatbot.
The updated guide reflects this by asking you to recognise how Google secures every layer of the AI stack.
| Layer | What is at risk | What securing it looks like |
|---|---|---|
| Infrastructure | The compute, storage, and network the workload runs on | Secure-by-design data centres, custom hardware root of trust, encryption by default |
| Data | Training data and inference inputs | Access control, Sensitive Data Protection, encryption, residency controls |
| Models | Model theft, tampering, memorisation of training data | Access control on model artifacts, provenance, evaluation for leakage |
| Platform | The AI platform's own configuration and permissions | IAM, posture management, AI Protection inventory and risk assessment |
| Agents | Credentials, tool access, and actions taken autonomously | Bounded permissions, least privilege on tools, logging of every action |
The exam's point is the chain: a perfectly secured model served from a misconfigured platform, or an agent with excessive permissions, is not secure. Layers are only as strong as the weakest one.
Model Armor
Model Armor is Google Cloud's service for screening what goes into and comes out of an AI application. It inspects both user prompts and model responses before they reach their destination, across several risk categories:
| Category | What it catches |
|---|---|
| Prompt injection and jailbreak | Input crafted to override the application's instructions or bypass its safety constraints |
| Malicious URLs | Links in prompts or responses that lead to phishing or malware |
| Sensitive data leakage | Personally identifiable information, financial data, credentials, or intellectual property flowing in or out |
| Responsible AI safety | Hate speech and harassment, sexually explicit content, dangerous or violent content, and child sexual abuse material |
Two operational details worth knowing because they show up as answer options:
- It works in inspect-only mode, which logs findings without interfering, or inspect-and-block mode, which stops the request or response.
- It screens content inside documents and images too - text within PDFs, Word, Excel, and PowerPoint files, and text in images via optical character recognition - not just plain prompt text.
Prompt injection is the concept to be able to explain in one sentence, because it is the distinctively AI-shaped threat: an attacker places instructions in content the model will read - a web page, an uploaded document, an email - so that when the model processes it, it follows the attacker's instructions instead of the application's. Model Armor is the control that inspects for it; bounded permissions on what the model may then do are the control that limits the damage.
AI Protection
AI Protection, delivered through Security Command Center, applies the discover-prioritise-remediate motion from Section 9.1 specifically to AI workloads:
- Discover the AI inventory. Most enterprises cannot answer "which AI models and applications are running in our environment, using which data?" AI Protection builds that inventory, including the shadow AI nobody registered.
- Assess the risks. It evaluates the inventory against AI-specific weaknesses - exposed model endpoints, over-permissive access to training data, unsafe configurations.
- Manage threats. It surfaces and helps respond to detected threats against AI workloads, feeding into the same Security Command Center workflow the rest of the estate uses.
The distinction from Model Armor is clean and testable: Model Armor operates at run time on individual prompts and responses; AI Protection operates at the posture level across the whole AI estate. One is a filter, the other is an inventory and risk-management capability.
Gemini in Google Security Operations
Google also applies AI to security work itself. Gemini in Google Security Operations assists analysts by summarising complex investigations in natural language, translating a plain-English question into a search across security telemetry, and recommending response actions. The business value is capacity: the shortage of experienced security analysts is structural, so a tool that lets a tier-one analyst work a case that would previously have needed escalation raises the throughput of the whole team.
Zero Trust and Security by Default
Two foundational terms the updated guide names explicitly.
Zero-trust architecture discards the assumption that being inside the corporate network confers trust. Instead, every request is authenticated, authorized, and encrypted based on the identity of the user and the device, regardless of where it originates. The practical implications:
- There is no privileged "inside." A request from the office network is evaluated exactly like a request from a coffee shop.
- Access decisions consider context - who the user is, what device they are on, its security state - not just a valid credential.
- Identity-Aware Proxy (IAP) is Google Cloud's implementation for application access: it gates applications on identity and context rather than on network location or a VPN.
Security by default means the secure configuration is the one you get without asking. Encryption at rest on all Google Cloud data is the clearest example: it is not a feature to enable, it is simply how storage works. The business value is that the most common cause of breaches - a control that existed but was never turned on - is designed out.
The Wider Security Product List
The updated guide asks you to recognise the functionality, use cases, and business value of Google's other security offerings. Learn them by the job each does:
| Product | The job it does |
|---|---|
| Cloud VPC | Private, isolated network space for your resources, with subnets and routing you control |
| Firewall rules | Allow or deny traffic to and from resources based on protocol, port, and source |
| Cloud VPN | Encrypted tunnel connecting your on-premises network to your VPC over the internet |
| Cloud Interconnect | Dedicated private physical connection between your network and Google Cloud, bypassing the public internet |
| Cloud Armor | Edge defence against DDoS and Layer 7 web attacks in front of your load balancer |
| Cloud Logging | Centralised log capture, including audit logs recording who did what and when |
| IAM | Who may do what to which resource - the enforcement point for least privilege |
| Sensitive Data Protection | Discovers, classifies, and de-identifies sensitive data such as PII across your estate |
| Confidential Computing | Keeps data encrypted while it is being processed in memory, protecting data in use |
| Certificate Manager | Provisions and manages TLS certificates for your services at scale |
| Identity-Aware Proxy | Zero-trust access to applications based on identity and context rather than network position |
The pairing most often confused is Cloud VPN versus Cloud Interconnect: both connect on-premises to Google Cloud, but VPN runs an encrypted tunnel over the public internet, while Interconnect is a dedicated physical link. Choose VPN for speed of setup and lower cost, Interconnect when bandwidth, consistent latency, or avoiding the public internet is the requirement.
An attacker embeds hidden instructions in a document that a company's AI assistant will read, hoping the assistant follows them instead of its own configuration. What is this attack called, and which Google Cloud service is designed to screen for it?
What is the difference between Model Armor and AI Protection?
Which statement best describes a zero-trust architecture?
A manufacturer needs a connection from its data centre to Google Cloud with consistent low latency and high bandwidth that does not traverse the public internet. Which option fits?