How AI intelligence and human expertise combined to identify threats 66% faster Cybersecurity is at an inflection point. The scale of data, the speed of attacks and the sophistication of threat actors mean that traditional approaches are no longer fit for purpose. In this case, a major European government organisation faced a highly advanced state-sponsored cyberattack. The attacker had gained access to the environment, creating a real risk of disrupting critical digital services and exposing highly sensitive data linked to senior individuals. “The client could no longer assure the quality of the security of their data and environment,” explains Paul Beverley-Paddock, Director at Deloitte and Security Operations Lead. “We were dealing with nation-state threat actors operating with tools that can appear indistinguishable from legitimate IT activity,” shares Caroline Honeycombe, Director at Deloitte and Cyber Incident Response Lead. The organisation needed to respond immediately, regain control, stop the threat and strengthen its ability to defend against future attacks. This required not just new technology, but a fundamentally different approach: combining AI, including Generative AI, with human expertise to detect and respond to threats at scale. Deloitte combined cyber incident response expertise with advanced AI capabilities from Google Cloud to transform how the threat was identified, understood and removed. At the core was a threat-led approach. Billions of data points were inputted into Google SecOps, creating a unified, real-time view of activity. This was enriched with integrated threat intelligence, enabling rapid attribution and a deeper understanding of the attacker’s tactics. By using Gemini, analysts could interact with this data in a fundamentally new way. Instead of manually complex queries to search through vast datasets, they could ask natural language questions, generate and evolve detection rules in real time and quickly identify patterns linked to the threat actor. Gemini enabled us to reduce