Google just made vulnerability scanning cheap enough to run continuously — which means the baseline for "secure code" is about to rise fast.
The Summary
- Google launched Gemini 3.5 Flash Cyber, a cost-efficient AI security model designed to find and patch vulnerabilities faster than expensive alternatives like Anthropic's Mythos
- The model integrates with CodeMender, Google's security-focused coding agent, allowing high-speed, low-cost scanning across multiple code paths
- Available first to governments and trusted partners, signaling Google's play for infrastructure-critical security contracts
- The economics shift here: if security scanning becomes 10x cheaper, it becomes continuous instead of periodic
The Signal
The security model market has had a price floor problem. Running models like Anthropic's Mythos to scan code for vulnerabilities is expensive enough that most organizations batch their security audits. You scan before releases, after major changes, or when you have budget. You don't scan everything, all the time.
Google is attacking that floor. Gemini 3.5 Flash Cyber is built on their Flash architecture, which means it trades some capability for speed and cost. The bet: for most vulnerabilities, you don't need the most powerful model. You need one that's fast enough to run constantly and cheap enough that you don't think twice about it.
"CodeMender can call upon 3.5 Flash Cyber multiple times at high speed and low cost, allowing the AI agents to scan more code paths."
The real product here isn't the model. It's CodeMender, Google's security agent that orchestrates multiple model calls to map out code paths and find weak spots. This is the Web4 pattern: the model is a commodity, the agent is the product. CodeMender decides when to call Flash Cyber, how many times, and which paths to prioritize. The developer just gets a list of fixes.
The go-to-market tells you where Google sees the money. Governments and trusted partners first. That's infrastructure code, defense contractors, utilities, banks. The kind of organizations that need continuous security but have been priced out of it. If Google can prove Flash Cyber works at scale in critical infrastructure, enterprise follows.
Bullet context:
- Security model pricing typically scales with thoroughness — deeper scans cost more
- Flash architecture sacrifices some accuracy for 10-100x cost reduction
- Most vulnerabilities are common patterns that don't need frontier model intelligence to catch
This also pressures Anthropic's positioning. Mythos launched as the premium security model, slower and pricier but more thorough. Google is now saying: for 90% of vulnerabilities, cheap and fast beats thorough and expensive. If that's true, Mythos becomes a specialty tool for the hardest 10% of problems, not the default choice.
The Implication
If you're building anything security-critical, the question shifts from "can we afford to scan this?" to "why aren't we scanning this continuously?" The cost barrier just dropped. That means the new baseline for "acceptable security posture" rises. Code that would have passed muster six months ago won't anymore, because there's no excuse not to catch obvious vulnerabilities when scanning is nearly free.
For developers, this is both relief and pressure. Relief because agents like CodeMender catch what you miss. Pressure because "I didn't have time to audit" stops being a valid defense when the audit happens automatically in the background. Security debt compounds faster when the tools to eliminate it are sitting right there, cheap and available.