Security and Compliance
SEP2 needed to eliminate the alert-analysis bottleneck in its security operations center, where analysts were spending up to 20 minutes gathering context for a single event and risking backlogs during threat spikes.
Reported impact
SEP2 now writes threat-detection rules six times faster, triages new security alerts 20 times faster, avoids analyst burnout during high-volume periods, and is building toward proactive continuous threat hunting and automated containment.
SEP2 built an ecosystem of custom security agents on Gemini platform and Google Security Operations to automate the repetitive parts of threat triage while keeping human analysts focused on higher-value investigations. The company defines specialized agent personas such as triage agents and threat-intelligence agents that pull data from firewalls, endpoints, and external feeds, then use Gemini reasoning to summarize findings and support faster remediation. These workflows also help engineers create new threat-detection rules far faster by turning natural-language inputs into programmatic logic. SEP2 designed the environment with customer-data isolation and UK residency requirements in mind, using Google Cloud controls so client data is kept separate and never used to train public models. The roadmap extends toward continuous threat-hunting agents and a self-healing SOC where verified threats can trigger automated containment in seconds.
When a new alert fires, SEP2's triage and threat-intelligence agents gather evidence from firewalls, endpoints, and external feeds, reason over the combined context with Gemini, and present a standardized summary to human analysts who can approve remediation or continue deeper investigation.
20x faster to triage new security alerts
6x faster to write threat detection rules with Gemini
Because the company services enterprise clients with strict security needs, they use Google Cloud configuration parameters to ensure that all customer data remains isolated.
The long-term goal is a self-healing security operations center where verified threats trigger automated containment actions
This entire data-gathering process takes the agents just one minute
Review how this reference was scored and trace each normalized claim back to its documented source.
Scoring methodology
Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.
Traceability
Field coverage shows which facts each source supports. Dates are shown only when documented by the source.
LinkedIn's Organization JSON-LD lists addressLocality "Leeds", addressCountry "GB", and numberOfEmployees value 102.
Related
Google Cloud Sample Archived · Oct 2, 2026 PT Astra Graphia IT AGIT needed to scale a managed security operations center that could meet Indonesian data-residency requirements, reduce noisy alert handling, and standardize detection engineering for enterprise customers. AGIT scales its enterprise Managed SOC in Indonesia using Google SecOps, Gemini, and Mandiant to drive 15%… Cloud Run · Compute Engine · Gemini Google Cloud Sample Modified · Sep 4, 2026 Quantiphi Quantiphi needed to consolidate security data spread across multiple clouds because analysts were stuck triaging alerts in isolated dashboards and dealing with severe alert fatigue instead of proactively addressing… Gemini in SecOps · Google Security Operations (SecOps) · Google Security Operations SOAR Google Cloud Sample Modified · Aug 14, 2026 MTP MTP needed to speed up security research, compliance analysis, and software validation for regulated clients without exposing confidential customer data or overwhelming engineers with repetitive manual work. 35% faster to create software documentation with Gemini 3.1 Pro Deep Research · Gemini 3.1 Pro · Gemini Code Assist 