Jack Henry teams with Google Cloud for AI-driven security at 7,400 community banks

Jack Henry, the core provider serving roughly 7,400 community banks and credit unions, is building a proprietary AI security platform using Google Cloud's agentic defense products, the Gemini Enterprise Agent Platform, and Mandiant incident-response consulting. The move makes Jack Henry the last of the three largest U.S. core providers to adopt a foundation-model-backed security strategy, following Fiserv with OpenAI and FIS with Anthropic. Together, these three providers served more than 70% of U.S. depository institutions in 2022, according to an OCC request for information.

What happened

Jack Henry announced an expanded collaboration with Google Cloud to develop an AI-driven security platform purpose-built for financial services. The platform combines Google Cloud's agentic defense suite with the Gemini Enterprise Agent Platform and Mandiant's cybersecurity expertise. The company described the initiative as reinforcing security across its "entire operational environment," spanning Google Cloud, other cloud providers, and on-premises equipment.

Federal banking regulators have explicitly carved out generative and agentic AI from the revised model risk management guidance issued in April. A footnote in the guidance states that "generative AI and agentic AI models are novel and rapidly evolving" and are "not within the scope of this guidance." The agencies have said they plan to issue a request for information on AI governance, but have not yet done so.

Why AI builders should care

For teams building AI products for regulated industries, this deal highlights a structural pattern: core providers become AI vendors by proxy. The bank hires Jack Henry, Jack Henry hires Google, and the bank retains full responsibility for vendor risk. The 2023 third-party risk management guidance warns that subcontracting creates risk "due to the absence of a direct relationship between the banking organization and the subcontractor." That describes the Jack Henry-Google relationship exactly.

Community banks face staffing and resource constraints that make in-house AI development impractical. The Independent Community Bankers of America noted in a January comment letter that partnering with core providers "is the most practical --- and often the only --- path forward for community banks seeking to responsibly leverage AI." This creates a concentrated vendor ecosystem where three core providers control the AI security stack for most U.S. banks.

Practical implications

Examiners can scrutinize Jack Henry's platform under the Bank Service Company Act, which gives regulators authority over services performed by core providers "to the same extent as if such services were being performed by a client bank itself on its own premises." However, the public record does not specify what examiners would measure the platform against, since no supervisory guidance specifically addresses agentic AI.

Jack Henry's average core bank client held $1.29 billion in assets, well below the $30 billion threshold where the model risk guidance is considered "most relevant." Smaller banks lack dedicated model risk departments, making them more dependent on vendor-provided governance.

The threat landscape is real. Treasury Secretary Scott Bessent and Fed Chair Jerome Powell briefed large bank CEOs in April on AI's offensive capabilities, after Anthropic's Claude Mythos Preview discovered thousands of previously unknown, high-severity software flaws, more than 99% still unpatched. Jack Henry's platform uses Gemini, not Mythos, but the speed of AI-driven vulnerability discovery outpaces what any community bank can staff against.

Caveats

Jack Henry's press release left several specifics unaddressed. It did not disclose general availability date, pricing, whether the platform can autonomously isolate machines or block traffic, whether it reaches into a bank's own network, or whether institutions can decline it or if it comes bundled with the core contract. The regulatory framework for agentic AI remains undefined, and the Fed and OCC have not yet issued the promised request for information on AI governance. Builders should watch for that RFI and any updates to the Bank Service Company Act examination procedures.