GCP – Forrester study: Customers cite 240% ROI with Google Security Operations

As part of Google Cloud’s fundamental belief that robust security can enable business resilience and innovation, we’re committed to empowering security operations teams with solutions that deliver measurable value and demonstrable return on investment (ROI).

That’s why we’re thrilled to announce a new, in-depth Forrester Consulting Total Economic Impact™ (TEI) study on Google Security Operations. Based on interviews with our global customers, Forrester’s analysis, which models a composite organization with $8 billion in annual revenue and a 25-person security operations team, found a 240% ROI over three years, with a net present value (NPV) of $4.3 million.

Forrester’s research found this value comes from:

• 70% reduction in the risk and cost of a breach by increasing event ingestion, onboarding more log sources, and implementing more detection rules.
• 50% faster mean time to respond and 65% faster in mean time to investigate for security operations teams.
• Empowering junior security analysts, shifting 35% of security operations work and reducing time to productivity by 70% with an easy-to-use platform and gen AI capabilities.
• Saving organizations $1.2 million over three years by providing a predictable cost model and enabling the decommissioning of legacy on-prem security tools.

“In simple terms, Google SecOps is a mass risk-reducer. Threats that would have impacted our business no longer do, because we have greater observability, better mean time to detect, and better mean time to respond,” said a CISO from an insurance company interviewed for the study.

Reducing risk with speed, scale and observability

In today’s threat landscape, getting ahead of threats means mastering both speed and scale. The Forrester TEI study highlights how Google Security Operations helps organizations tackle two critical needs: ingesting and analyzing massive volumes of security data to provide unfiltered visibility, and significantly reducing risk. Customers told Forrester their prior solutions simply couldn’t keep up with the evolving threat landscape or offered unsustainable cost models.

With Google Security Operations, the story changes dramatically. The study notes organizations achieved “near real-time” query results in “seconds.” This enhanced performance, combined with the platform’s ability to “scale and grow with our [customers’] business,” translated into tangible gains:

• 3x increase in event ingestion speed
• 5x more log sources onboarded
• 8x increase in detection rules implemented
• 10x increase in the number of cases managed with half the number of people

We believe the impact is clear: Google Security Operations can provide unparalleled observability, speed, and a significantly reduced risk profile, helping your team do more with less.

Using threat intelligence to shift from reactive to proactive defense

Staying one step ahead of attackers isn’t just an advantage — it’s a necessity. As threats get more sophisticated, integrating and operationalizing high-fidelity threat intelligence in your security operations platform is critical for a proactive defense.

The Forrester study highlights that Google Security Operations is one of the few platforms that truly understands the value of threat intelligence — and how to use it. Google Security Operations customers can access up-to-date, industry-specific, and frontline insights augmented with generative AI because we’ve integrated Google Threat Intelligence directly into the platform, including intelligence from active Mandiant incident response engagements, VirusTotal’s crowd-sourced threat intelligence, and threat insights by Google based on protecting billions of devices globally.

This deep, out-of-the-box integration means analysts can get the context they need without manual effort. It can also help them understand the impact of emerging threats on their environment before anyone else does, and lead to significant efficiency gains.

Customers saw a 50% reduction in mean time to investigate and a 65% reduction in mean time to respond, according to the Forrester study.

“The threat intel integration is a big deal, and having Mandiant as part of the integrated Google SecOps package is a huge differentiator,” said a director of cyber defense at a healthcare company.

The Forrester study found that these efficiencies can save organizations significant time and effort, contributing $1.5 million in value for the composite organization over three years.

Empowering analysts with AI to close the gap

The ongoing cybersecurity talent shortage demands tools that can empower existing teams and accelerate the productivity of new hires. AI and automation are crucial here, helping to alleviate tedious, manual work and reduce the risk of human error, leading to more efficient and accurate security operations teams.

Google Security Operations has been making significant strides in AI capabilities. We’ve expanded our Gemini AI features and introducing agentic AI to automate repetitive tasks and enhance analyst productivity. These innovations have led to a substantial $636,000 in value for the composite organization over three years, according to the study.

The recent Forrester Wave™: Security Analytics Platforms, Q2 2025, acknowledged Google Security Operations as a Strong Performer, and also pointed to Google’s heavy focus on AI.

We’re proud that direct customer feedback in this TEI study demonstrates our significant progress in enabling defenders with AI.

“Google has developed a very, very strong AI toolset. And from what I’ve seen, there’s an aggressive roadmap and I’m very comfortable that AI will only become more and more powerful on the Google SecOps platform,” said a security operations lead in professional services.

“[Google SecOps] empowers [our team] to investigate quickly and deeply so that no stone is unturned. Gemini obviously plays a large part in that,” said a CISO at an insurance company in Forrester’s report. “Our employees really love that Google SecOps has a context rich data set, along with Gemini which can give a really slick summary and really quickly. It’s a huge accelerator when investigating. You get everything that you need, and it can write complex queries for you. They absolutely love it.”

The tangible impact of these innovations demonstrates how Google Security Operations streamlines operations and actively cultivates a more skilled and empowered security workforce.

A partnership for success

For us, the Forrester TEI study for Google Security Operations underscores our commitment to delivering a powerful security operations platform that can drive a quantifiable competitive advantage. Investing in Google Security Operations can translate into significant financial and operational benefits, and help enable your team to focus on what matters most: securing your organization’s future.

You can get your copy of the Forrester Total Economic Impact™ of Google Security Operations study here to see how Google Security Operations can empower your organization.