AIAI Toolbox
Submit a tool
AI SECURITY

Google Fairwind Program: Eligibility, Controls, and Deployment

A practical guide for security leaders evaluating Google’s limited-access cyber defense program, its operating rules, and a safe adoption path.

By AI Toolbox Team··10 min read

Google’s Fairwind Program is a limited-access cyber defense program for vetted governments, critical-infrastructure operators, core technology platforms, and qualifying defensive research organizations. Approved partners receive exclusive access to Gemini 3.8 Flash Cyber, either directly or through the CodeMender security agent. Applicants should treat admission as only the first gate: safe deployment still requires named authorization, phishing-resistant MFA, user-level access tracking, isolated test environments, independent patch review, and normal secure-development controls.

Key takeaways

  • Fairwind is a vetted, limited-access program rather than a generally available Gemini plan
  • Priority groups include governments, critical infrastructure operators, and core technology platforms
  • Approved partners can use Gemini 3.8 Flash Cyber directly or through CodeMender
  • Program rules restrict access to authorized security, incident-response, and penetration-testing personnel
  • Vendor benchmark results should begin an internal evaluation, not decide production approval
  • Generated vulnerability findings and patches still require reproduction, review, testing, and controlled release

Understand what Fairwind includes—and what it does not

Google announced Fairwind on September 2, 2026 as a limited-access program that combines its advanced cyber model, Gemini 3.8 Flash Cyber, with CodeMender. The stated purpose is to help trusted defenders find, verify, and fix software vulnerabilities at agentic scale. This is not a new consumer Gemini tier, a general developer API entitlement, or blanket permission to conduct offensive activity.

The model and harness are different layers. Gemini 3.8 Flash Cyber supplies specialized reasoning for vulnerability research, code synthesis, and threat intelligence. CodeMender is the security-agent environment that can invoke a model repeatedly, investigate code paths, validate findings, and propose repairs. Google says approved partners can use the cyber model by itself or with CodeMender. Teams should evaluate both layers because orchestration, tool access, repository context, and validation rules can change the result as much as the underlying model.

The program page reports vendor-run benchmark results for vulnerability discovery, an internal multilingual codebase evaluation, CWE-Bench patching, and prompt-injection robustness. These are useful capability signals, but they are not a warranty for a particular repository. Some evidence is internal, some competitor numbers are provider-reported, and benchmark conditions may differ from the safeguards and tools used in production. Treat every figure as a hypothesis to reproduce on work you are authorized to test.

Check eligibility before designing a migration

Google says Fairwind prioritizes organizations important to societal resilience: governments and national cyber authorities, operators in sectors such as healthcare, telecommunications, energy, and finance, and technology platforms whose software affects many downstream users. Academic labs may apply when their work focuses on defensive benchmarking. Google also says it vets applicants for security history and ethical operations and will add partners over time.

That means a conventional procurement process should start with organizational fit, not a model shootout. Write down the owned systems and defensive questions the program would address, the personnel who would use it, the authority under which testing occurs, and the expected public or operational benefit. An application framed as broad access to a powerful cyber model is weaker and riskier than one tied to bounded remediation, incident response, or authorized research.

If the organization is not eligible, the documented alternative is CodeMender with publicly available Gemini models on Google’s enterprise agent platform, alongside AI Threat Defense products. Do not assume this route has identical capability, price, retention, or safeguard behavior. Test it as a separate configuration and resist building a business case around access that has not been approved.

Translate program rules into enforceable controls

Fairwind permits selected dual-use tasks such as authorized threat simulation, reverse engineering, and malware analysis for defensive or academic research, while prohibiting malicious activity. Participating organizations must confine access to appropriate internal cybersecurity, incident-response, or penetration-testing staff, use user-level authentication and phishing-resistant MFA, apply relevant access controls, track employee use, and avoid sharing or reselling access.

Convert those terms into technical and operating controls before the pilot. Use named accounts rather than shared credentials; separate model invocation from permission to merge or deploy; restrict repositories, networks, tools, secrets, and outbound connections; and record who initiated each run. Put exploit validation in an isolated environment with synthetic credentials and no uncontrolled route to unrelated systems. Legal authorization and written scope should travel with every assessment.

Google’s broader AI Control Roadmap is helpful context, though it is not presented as a Fairwind customer specification. It argues for defense in depth, treating capable agents as potential insider threats, monitoring behavior, blocking high-risk actions synchronously, and increasing permissions only after verified behavior. The practical lesson is that model safeguards cannot replace sandboxing, endpoint security, deterministic authorization, monitoring, and an emergency stop.

Evaluate findings and patches as security evidence

Build an evaluation set from historical vulnerabilities, secure coding patterns, deliberately seeded defects, and clean code that should not trigger findings. Preserve the starting commit and expected evidence. Score whether the system identifies the right weakness, provides a reproducible path, changes only necessary code, maintains behavior, and survives relevant unit, integration, regression, fuzzing, static-analysis, and performance checks.

Measure false positives and duplicate findings as seriously as headline discovery. A tool that surfaces many plausible issues can increase risk if reviewers cannot reproduce them or if triage noise hides the important few. For patches, track accepted fixes after review, human correction time, regressions, incomplete root-cause treatment, dependency changes, and time to safe release. Compare the entire workflow with the team’s current process, not one impressive example.

Never let the same generated artifact serve as claim, proof, and approval. Reproduce exploits through an independent method where safe; require a reviewer who did not generate the change; and keep protected branches, CI, separation of duties, staged rollout, and rollback intact. A model can accelerate analysis while the organization retains responsibility for every action and release.

Plan data handling, cost, and ongoing governance

Source code, crash artifacts, credentials, and incident evidence can be among an organization’s most sensitive data. The Fairwind FAQ says zero data retention is supported when Gemini 3.8 Flash Cyber is accessed directly as a managed model on Gemini Enterprise Agent Platform. That statement is route-specific. Confirm in the contract which service receives each input, what telemetry persists, where processing occurs, which administrators can inspect it, and whether CodeMender or connected tools introduce separate storage.

Public Fairwind materials do not provide a complete customer price card. Model total cost from the offered contract and observed workflow: model use, agent iterations, storage, logging, network and sandbox infrastructure, security engineering, human review, test execution, false-positive triage, and remediation. A lower model cost does not create savings if repeated runs or review effort rise.

Set recurring reviews for access, acceptable use, model and harness changes, evaluation drift, incidents, spend, and continued eligibility. Define triggers that force retesting: a model version, new tool, wider repository scope, changed network access, altered retention route, or more autonomous deployment. This article is based on Google’s public documentation and does not claim hands-on access to Fairwind or independent validation of Google’s benchmark results.

Practical checklist

  • Document the defensive use case, systems in scope, legal authority, and accountable executive
  • Confirm that the organization and intended users fit Google’s stated eligibility priorities
  • Separate research, validation, staging, and production environments with distinct identities
  • Require user-level authentication, phishing-resistant MFA, least privilege, and access logging
  • Build a representative evaluation set from authorized repositories and known historical defects
  • Measure reproducible findings, valid patches, false positives, review time, latency, and complete cost
  • Run generated changes through code review, tests, dependency checks, and deployment approvals
  • Define retention, telemetry, incident response, rollback, and access-removal procedures
  • Record the model, harness, settings, prompt, repository state, and evidence for every accepted result

Warning signs

  • A team assumes ordinary Gemini access includes Gemini 3.8 Flash Cyber
  • The use case includes systems the organization is not authorized to test
  • A generated exploit or patch can leave an isolated environment without human approval
  • Success is based on vendor benchmark percentages without repository-specific reproduction
  • Shared accounts prevent attribution of model access and actions
  • A patch is called deployment-ready before normal security, reliability, and regression checks

Frequently asked questions

Who is eligible for the Google Fairwind Program?

Google says it prioritizes governments and national cyber authorities, critical-infrastructure operators, core technology platforms, and vetted academic labs focused on defensive benchmarking. Applying does not guarantee approval.

Is Gemini 3.8 Flash Cyber generally available?

No. Google describes it as exclusive to approved Fairwind partners. Organizations outside the program can use CodeMender with generally available Gemini models and other Google AI Threat Defense products.

What is the difference between Gemini 3.8 Flash Cyber and CodeMender?

Gemini 3.8 Flash Cyber is the specialized model. CodeMender is the agentic security harness that uses models to find, validate, and propose fixes for vulnerabilities. Fairwind partners may use the model directly or with CodeMender.

Does Fairwind support zero data retention?

Google’s program FAQ says Gemini 3.8 Flash Cyber supports zero data retention when accessed directly as a managed model on Gemini Enterprise Agent Platform. Confirm the exact route and contract before sending sensitive code.

Are Fairwind-generated patches safe to deploy automatically?

The public materials do not justify unattended production deployment. Reproduce findings, inspect diffs, run relevant tests and security checks, and preserve independent approval and rollback.

Primary sources and further reading

Research before you rely.

AI products, prices, policies, and capabilities change. Verify consequential details with primary sources and test tools using representative work.