Google launched its Fairwind Program on September 2, giving governments, critical infrastructure operators and other trusted organizations access to some of its most advanced AI-powered cybersecurity capabilities.

Rather than being another general-purpose AI program, Fairwind is specifically focused on helping defenders find and fix software vulnerabilities faster. The limited-access program combines Google’s new Gemini 3.8 Flash Cyber model with CodeMender, its specialized code-security agent, to automate parts of the vulnerability discovery and remediation process.

That distinction matters. Fairwind isn’t simply about using AI to identify that something is wrong. Google wants the system to help security teams go from finding a vulnerability to producing and validating a fix, potentially cutting down a process that can take weeks to something much closer to minutes.

What is Google’s Fairwind Program?

Google describes Fairwind as a limited-access program for governments, Google Cloud customers and trusted cybersecurity partners. Its goal is to give organizations responsible for important systems an early advantage against increasingly capable cyber threats.

The program launched alongside Gemini 3.8 Flash Cyber, which Google describes as its most capable cybersecurity model. Unlike the standard Gemini 3.8 Flash, the Cyber version is specifically designed for security work, including vulnerability discovery and automated patching.

The program is deliberately restricted because the same capabilities that can help defenders understand complex vulnerabilities could also have dual-use implications. Google therefore isn’t simply putting Gemini 3.8 Flash Cyber on general public access.

Instead, participating organizations have to meet Google’s requirements for responsible use and security.

What does Fairwind actually give organizations?

The centerpiece of Fairwind is the combination of Gemini 3.8 Flash Cyber and CodeMender.

CodeMender acts as the security harness around the model, allowing defenders to use AI to investigate vulnerabilities, develop fixes and validate those fixes. Google says the system can generate verified, deployment-ready patches within an organization’s secure cloud environment.

That could change an important part of the security workflow.

Traditionally, finding a vulnerability is only the beginning. A security team still has to understand the problem, determine how it can be fixed without breaking something else, write the patch, test it, review it and eventually deploy it. In large organizations with enormous codebases, that process can become a significant bottleneck.

Fairwind is designed to automate more of that work.

The benefit isn’t necessarily that humans disappear from the process. Instead, security teams can potentially spend less time on repetitive vulnerability remediation and more time reviewing fixes, investigating serious threats and dealing with problems that require human judgment.

Google says Gemini 3.8 Flash Cyber can operate at a substantially lower cost than larger frontier models while still providing the specialized reasoning needed for cybersecurity tasks. That matters for organizations that need to run security analysis repeatedly rather than occasionally.

Why governments are one of the main targets

For governments, the appeal goes beyond protecting ordinary enterprise software.

Government networks can contain systems responsible for public services, citizen information and national security. A vulnerability in one of those environments can have consequences far beyond a single company.

Google says the first group of Fairwind users includes government agencies and national cyber authorities looking to harden public-sector networks and citizen services against targeted intrusions.

The program also targets critical infrastructure operators in areas including healthcare, telecommunications, energy and financial services.

These organizations have a particularly difficult security problem: they cannot simply wait for vulnerabilities to become widely exploited before responding. Many of their systems need to remain operational around the clock, while their software environments can be enormous and complicated.

A tool that can identify a vulnerability and help produce a tested fix more quickly could therefore be valuable even when the organization already has a large cybersecurity team.

Critical infrastructure could be one of the biggest beneficiaries

Fairwind’s focus on critical infrastructure is perhaps the most important part of Google’s announcement.

Healthcare systems, telecommunications networks, energy providers and financial institutions are increasingly dependent on software. A successful cyberattack against one of these organizations can cause operational disruption rather than simply exposing corporate data.

Google is effectively positioning Fairwind as a way to shorten the window between vulnerability discovery and remediation.

That window is becoming more important as AI gives attackers new ways to automate parts of their own work. If attackers can analyze software and develop attack strategies faster, defenders need to be able to investigate and patch vulnerabilities at a comparable pace.

Google calls this an “adaptation window” — giving trusted defenders access to the technology before malicious actors can take advantage of similar capabilities.

Fairwind isn’t open to everyone

This is one of the most important things to understand about the program.

Fairwind is not a new subscription tier that any business can simply purchase. Google is controlling access to Gemini 3.8 Flash Cyber and conducting due diligence on organizations that apply.

Participating companies must restrict access to appropriate internal teams, such as cybersecurity, incident response and penetration-testing groups. Google also requires security measures including user-level authentication and phishing-resistant multi-factor authentication, along with applicable access controls and tracking of employee access and usage.

Google also says participating organizations cannot share, redistribute or sell access to the frontier model.

The restrictions make Fairwind as much a governance program as it is a technology program.

That’s important because highly capable cybersecurity AI creates an unusual problem: giving defenders better tools is useful, but giving unrestricted access to the same capabilities could make offensive cyber activity easier too.

Google’s approach is to put the more capable model behind a controlled-access system and limit its use to defensive and approved research activities.

Google says more than 650 partners are already involved

The program isn’t starting from scratch.

Google says it currently has more than 650 participating partners globally, spanning the broader ecosystem of organizations involved in cybersecurity and critical digital infrastructure.

Those partners include companies such as CrowdStrike, Palo Alto Networks, Snowflake and Wiz, which Google identifies as organizations already putting Gemini 3.8 Flash Cyber through its paces.

Google’s own testing also suggests why it believes the model is useful for this particular job.

On the CyberGym benchmark for autonomous vulnerability discovery, Google reports that Gemini 3.8 Flash Cyber achieved a leading result among the models it tested. It also reported a success rate above 70% on an internal benchmark covering vulnerabilities across complex codebases written in 20 programming languages.

For automated patching, Google reports a 47.2% pass@1 result on CWE-Bench, close to a larger frontier model’s 47.8% result while requiring substantially less cost per rollout. These are Google’s reported benchmark results, rather than a guarantee of how the system will perform in every production environment.

What if a company isn’t part of Fairwind?

There is an important distinction here: Fairwind isn’t the only way organizations can use Google’s cybersecurity tooling.

Google says any Google Cloud customer can use CodeMender with publicly available models hosted on the Gemini Enterprise Agent Platform, alongside Google’s AI Threat Defense offerings.

What Fairwind provides is preferential access to Gemini 3.8 Flash Cyber itself.

That means Google is effectively creating two paths. Organizations that meet the requirements for the Fairwind Program get access to the more specialized cyber model, while other Google Cloud customers can still use CodeMender and Google’s broader security tools with publicly available models.

For businesses, that distinction could be important when deciding whether applying for Fairwind is worth the additional governance requirements.

The bigger change is the move from detection to remediation

The most interesting part of Fairwind isn’t necessarily the model name or the benchmark numbers. It’s the direction Google is taking cybersecurity AI.

For years, AI-powered security products have largely focused on finding suspicious activity, identifying vulnerabilities or helping analysts make sense of enormous quantities of security data.

Fairwind pushes further into what happens next.

If an AI system can reliably identify a vulnerability, understand the relevant code, create a patch and validate that patch, the technology starts becoming part of the remediation pipeline rather than simply another detection tool.

That could have a meaningful effect on how large organizations handle software security.

The challenge, of course, is trust. An automatically generated security patch can be extremely useful, but organizations still need confidence that the fix actually solves the vulnerability without introducing a new problem somewhere else.

That’s why Google’s emphasis on verification, secure environments, access controls and human cybersecurity teams is significant. The company isn’t presenting Fairwind as a button that organizations can press and blindly deploy whatever the AI produces.

Instead, it is building a controlled system around increasingly autonomous security capabilities.

Fairwind could become more important as AI-powered attacks accelerate

Google says the Fairwind Program will evolve over time, with plans to adapt its offerings and expand access while working with governments, industry and the open-weight community.

That suggests the September 2 launch is less of a finished product announcement and more of the beginning of a controlled ecosystem for advanced defensive AI.

For governments and enterprises, the practical takeaway is relatively straightforward: Google wants to give trusted defenders a head start in using AI to secure the software they depend on.

For everyone else, Fairwind is an early look at where cybersecurity may be heading.

The future of enterprise security may not simply involve AI watching for attackers. Increasingly, it could involve AI continuously inspecting software, identifying weaknesses and helping security teams repair them before those weaknesses become incidents.

That is ultimately what Google’s Fairwind Program is about: reducing the time between discovering a vulnerability and actually fixing it — because in cybersecurity, that gap can be the difference between a flaw that gets patched and one that gets exploited.