Google has launched the limited-access Fairwind Program, which will be made available to governments and trusted partners. The program aims to help cyber defenders identify and address security vulnerabilities more quickly using advanced AI.
In the initial phase, participants will gain access to Gemini 3.8 Flash Cyber models to protect critical infrastructure, public services and national security. Working with Google’s CodeMender tool, the model can find and validate vulnerabilities and create deployment-ready patches within minutes in secure cloud environments. Google says this is achieved at a much lower operating cost than traditional advanced models.
Initial access to Fairwind will be granted to government and institutional partners that are critical to societal resilience. Participants will agree to restrict access exclusively to their organizations’ cybersecurity, incident response or penetration testing teams and comply with strict operational standards such as multi-factor authentication. More than 650 partners worldwide are participating in the program.
The program will be developed according to partners’ needs, and access will be expanded over time. Google Cloud customers will be able to use CodeMender with publicly available models hosted on the Gemini Enterprise Agent Platform and AI Threat Defense solutions.
Through Google.org, the company’s global cybersecurity funding has exceeded $100 million. According to the 2026 Google.org US Cybersecurity Impact Report, $36 million has been provided to 35 cyber clinics to date; these clinics have provided free support to more than 1,250 hospitals, public school districts and municipal service organizations in the US.
Why it matters
The program presents a model that enables artificial intelligence to be used in cybersecurity not only for analysis, but also for vulnerability validation and patch development. While this has the potential to shorten response times for teams protecting critical infrastructure and public services, the fact that access is limited to governments and trusted partners shows that its use is not open to a broad user base. Multi-factor authentication and granting access only to specific security teams provide a framework aimed at reducing the risk of misuse of the technology. Google’s support for cyber clinics, meanwhile, offers a separate contribution beyond the program, focusing on the defense capacity of institutions with limited resources. The issue that remains open is according to which criteria, and to what extent, access will be expanded.