Cloud CISO Perspectives: Introducing new $250,000 tier for Google Cloud VRP (Q&A)

Welcome to the second Cloud CISO Perspectives for October 2026. Today, Chris Betz talks with Michael Cote, our vulnerability rewards program lead, about the new tier of our Cloud VRP program and the current state of vulnerability rewards.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

Why we’ve created a new $250,000 tier for Google Cloud VRP (Q&A)

By Chris Betz, CISO, Google Cloud

Proof-of-root: Clear, cryptographic validation

To make testing safe, clear, and reproducible, without impacting production environments, we have defined technical criteria for validating root-in-cloud access.

Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility.

Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are not allowed and will result in researcher disqualification. 

The Google Cloud VRP panel will analyze the initial entry point, execution context, and attack surface to determine whether full arbitrary tenant or project takeover is achievable from that position, and award the bounty accordingly. 

This new bounty tier reflects how security research continues to evolve, and the importance of continuing to recognize the most innovative and valuable security research. As part of those efforts, Google Security held its annual Escal8 conference in Singapore last week, and I had the opportunity to discuss the changing landscape with Michael Cote, Google Cloud’s vulnerability reward program lead. 

The following transcript has been lightly edited.

Chris Betz: You are at Escal8 in Singapore announcing the new $250,000 Root-in-Cloud tier for our VRP. Why introduce this tier now, and what kind of research are you hoping to spark?

Michael Cote: This is a recognition of how the field of security research has changed over the past year. We value quality submissions from anyone, and we’ve seen that the combination of human creativity and agentic power is much richer than either on its own.

While automated scanners generate a high volume of low-impact noise, first-time researchers who pair human intuition with agentic tools are finding, on average, more interesting bugs than novices did two years ago. With the new Root-in-Cloud tier, we want to challenge the community and increasingly reward the complex, high-impact findings — like tenant-isolation bypasses and cross-service logic flaws — that require deep architectural intuition alongside agentic tools, because getting that information is essential to protecting our customers.

Chris Betz: Google Threat Intelligence Group (GTIG) recently shared research showing that monthly CVE disclosures have doubled as agentic tools mature. From your seat leading the Cloud VRP, how has automation technology impacted the reports we’ve received? 

Michael Cote: It has transformed our intake volume, though not in the way many people assume. While the number of valid vulnerability reports submitted to the Google Cloud VRP has remained stable over the last 18 months, the total number of reports has grown tremendously. 

Automation has helped democratize vulnerability discovery, and the barrier to entry has been rapidly flattening, something even our top researchers noted at Escal8. Because we’re seeing more researchers and more first-timers with interesting bugs, that creates pressure on more experienced researchers to move faster and bring more impactful findings — although their experience continues to be a key differentiator in success.

Chris Betz: I’ve been working with the research community for more than 20 years. One of the things I appreciate most is how much the community values making the world more secure. Bounty programs let us recognize this valuable work. How do you see the community changing as we move further into the agentic era? 

Michael Cote: That shared commitment to making the world more secure is still the heart of this community, which is why the pressure to move faster is something we have to watch closely. As our GTIG colleagues found, the sharpest rise in the number of exploited vulnerabilities comes from n-days, not zero-days. 

Open source accounts have suggested that threat actors are using LLMs to rapidly turn newly-public vulnerability details into working exploits. When triage teams are already working through a surge in report volume, disclosing an unmitigated vulnerability well ahead of the standard 90-day coordinated disclosure window gives attackers the exact knowledge and time window they need to target customers.

With the influx of new submissions, I worry about a growing pressure to rush to publish. Something that concerns me because we’re already seeing early indications of it. Because LLMs lower the barrier to finding bugs in source-available software, researchers worry that waiting to verify risks will allow someone else to be first to publish. Even more concerning, that same competitive pressure can tempt even established security companies to disclose unmitigated vulnerabilities without coordination, and that rush puts our users directly at risk.

Project Zero helped establish the industry’s 90-plus-30-day responsible disclosure policy, and autonomous detection and exploitation capabilities make following coordinated disclosure more important than ever. In the long run, rushing to be first works against a security company’s own self-interest. Novel discoveries may bring temporary visibility, but customers will ultimately choose not to work with organizations that put them and the broader ecosystem at risk. 

Chris Betz: When you offer a $250,000 bounty, how do you make sure researchers can validate their findings without putting customer environments or service availability at risk?

Michael Cote: High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects. Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity.

We’ve also updated our program rules to establish strict boundaries around underlying production infrastructure. If researchers think they are close to a breakthrough but are uncertain where the boundary lies, we encourage them to reach out. We are always more than happy to work with them to ensure they are recognized and rewarded for the value of their research without taking steps that would invalidate the bounty.

Chris Betz: What should enterprise CISOs take away from these trends? Especially those who run their own vulnerability management pipelines and partner with external researchers, what advice would you offer for navigating this AI inflection point?

Michael Cote: First, prepare your vulnerability triage workflows for agent-generated submissions. To keep valid reports from getting stuck in a backlog, security teams need ways to separate plausible-sounding hallucinations from real security risks.

Second, compress your remediation timelines once a vulnerability becomes public. Defensive patching and mitigations have to move faster because autonomous technology compresses the time from disclosure to working exploits.

Finally, hold your security partners and vendors to high standards of coordinated disclosure. It’s important that our industry continues to normalize agentic vulnerability research, but we must do so responsibly. Let’s continue to keep user safety at the center of everything we do.

For more information on the Google Cloud VRP, including detailed endpoint specifications, JSON payloads, and CLI examples, please check out our rules page.

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month: 

• How Google Does It: Using agents to help find, track, and fix vulnerabilities: Threat actors can now find software flaws faster than ever. To maintain an agile, responsive defense, we now use agentic systems with existing foundations. Read more.

• How to use agents to stop insider threats: As agents find their place across the enterprise, we want to be sure that they neither become an insider threat nor enable people to become one. Read more.

• Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-10961: Follow these recommendations to minimize remote code execution risks in PHP from two critical vulnerabilities in the core PHP language runtime. Read more.

• Wiz Sensor for GKE: Turnkey threat detection for Kubernetes: Introducing the Wiz Runtime Sensor add-on for Google Kubernetes Engine in preview, helping to manage deployment, lifecycle, credential security, and governance. Read more.

• Scale agents securely with IAM Helper Agent skills and MCP tools: Today we’re introducing IAM Helper, a suite of intelligent, agent-facing building blocks that can automate complex, end-to-end IAM workflows. Read more.

• Introducing new scalable perimeter options with VPC Service Controls: Today, we’re excited to announce key enhancements to VPC Service Controls that make perimeters easier to create, maintain, and scale. Read more.

• Confidential G4 GPUs are now generally available: Confidential Computing on G4 now provides hardware-based security in AI Hypercomputer to deliver dynamic performance without compromising privacy. Read more.

• Supply chain zero days: Closing the gap between publication and detection: Learn how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published. Read more.

Please visit the Google Cloud blog for more security stories published this month.

Threat Intelligence news

• Investigating ephemeral supply chain tampering: For the first time, Google Threat Intelligence Group (GTIG) and Mandiant have encountered a software supply chain compromise that was implemented with very short tampering windows that were active for only five to 10 minutes, and effectively evading traditional point-in-time triage and automated file scanning. Read more.

• ARMORY CASTLE exploits BeyondTrust: During an incident response engagement, Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor, exploited a vulnerability impacting BeyondTrust Remote Support appliances. Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public. Read more.

• Vulnerability discovery and exploitation trends in the AI era: To counter the increased risk from rapid vulnerability discovery and exploitation, organizations should transition from unprioritized mass-patching to threat intelligence-driven triage, combining targeted edge-defense with automated, agentic remediation. Read more.

• Defending against active exploitation of Citrix NetScaler ADC and Gateway appliances: Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Here’s our containment and remediation guidance. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud 

• Cloud Security Podcast: Patching browsers with AI, agents, Rust, and your tabs: Jasika Bawa and Doug Turner of Chrome Security explore how Google Chrome now uses AI agents to autonomously identify and patch security vulnerabilities at an unprecedented scale, significantly accelerating the browser’s update cadence. Listen here.

• Cloud Security Podcast: All about Project Atlas, Wiz’s AI vulnerability research: Nir Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.

• Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.