Gemini 3.8 Flash Cyber has a deliberately different front door from public Gemini models. You cannot confirm access by finding a model name in AI Studio or by changing a version string. Google makes the cyber model available to approved organizations through the Fairwind Program.
That design changes the buying question. Before comparing tokens or writing an integration, a security leader needs to establish three things: the organization protects systems with broad public or ecosystem impact, the proposed work is authorized and defensive, and the team can enforce tightly managed access.
A five-minute Fairwind fit screen
An application is worth considering when the organization belongs to, or closely resembles, one of Google's stated priority groups:
- a government body or national cyber authority defending public networks and services;
- an operator of essential healthcare, telecommunications, energy, or financial infrastructure;
- a core technology platform or software maintainer whose security affects many downstream users;
- an academic lab conducting defensive benchmarking.
These categories indicate priority, not entitlement. Google says it conducts due diligence on applicants' security history and record of ethical operations. It does not publish a guaranteed acceptance threshold or a fixed review time.
The case is weak if the applicant is an individual, cannot identify the systems it is authorized to test, wants broad offensive capability without a defensive mandate, or has no way to restrict access to a designated internal security team. A weak fit is not improved by looking for an invitation code or a reseller.
What Cyber access changes
Google's launch announcement describes Gemini 3.8 Flash and the Cyber variant as sharing foundational intelligence. The deployment boundary is different: public 3.8 Flash is a general coding and reasoning model, while Cyber has more permissive cybersecurity mitigations for vulnerability discovery and automated patching.
That distinction has immediate operational consequences:
| Question | Public Gemini 3.8 Flash | Gemini 3.8 Flash Cyber |
|---|---|---|
| How do you get it? | Standard Gemini product or developer access | Fairwind approval |
| Is there a documented public ID? | gemini-3.8-flash | No general public ID on the checked pages |
| Is there a public rate card? | Yes | No general Cyber price published |
| Who may use it? | Eligible product users and developers | Authorized staff at an approved partner |
| What is it for? | General coding, reasoning, and agentic work | Defensive vulnerability discovery and remediation |
Do not use an inferred string such as gemini-3.8-flash-cyber in architecture documents. An approved organization may receive an identifier and route under its agreement, but that does not make the same details public. Similarly, the public model's $0.75 input and $3.75 output introductory rates cannot be assigned to Cyber.
For the public model's actual ID, pricing, and migration considerations, use the separate Gemini 3.8 Flash deployment guide.
Build the control case before the product case
Fairwind is not merely a waitlist. Its public rules describe how access must be governed after approval. A credible internal readiness review should cover the following areas.
Named users and prompt revocation
Access may be granted only to internal cybersecurity, incident-response, or penetration-testing teams. Google calls for user-level authentication, phishing-resistant MFA, applicable access controls, and tracking of employee access and use.
Translate those requirements into answers, not slogans:
- Which identity provider establishes each user's identity?
- Which phishing-resistant factor is enforced?
- Who approves access, and who can revoke it immediately?
- How are contractors, subsidiaries, and emergency responders separated?
- What event closes access when a person changes role or leaves?
A shared credential is incompatible with meaningful user-level accountability.
Authorized targets and allowed work
The program allows authorized threat simulation, reverse engineering, and malware analysis for defensive or academic research. Malicious activity, including creating malware, is not permitted.
For each proposed workflow, record the target owner, written authorization, allowed techniques, test environment, stop condition, human approver, and path for reporting a finding. “Security research” is not a sufficient boundary when a model can inspect and modify code at agentic speed.
Logs that support an investigation
Access tracking should be able to answer who used the model, against which asset, under what authorization, what actions or tools ran, whether a patch was accepted, and how an exception was handled. Token totals alone cannot reconstruct a risky session.
Decide log retention, review ownership, tamper protection, and access restrictions before a pilot. These choices also affect privacy and data-residency analysis, so they should not be left to the team that writes the first prompt.
Data handling by route
The Fairwind FAQ says Gemini 3.8 Flash Cyber supports zero data retention when accessed directly as a managed model on Gemini Enterprise Agent Platform. That statement is valuable but route-specific. It does not automatically cover CodeMender, connected repositories, monitoring, support channels, exported findings, or logs your organization stores.
Ask Google to map retention, region, telemetry, subprocessors, support access, backups, and deletion to the exact architecture in the agreement.
Read the benchmark claims as a pilot hypothesis
Google reports 86.2% Pass@1 on CyberGym, more than 70% success on an internal vulnerability-discovery evaluation spanning 20 programming languages, and 47.2% on the external CWE-Bench patching benchmark. The numbers support the claim that Google evaluated both finding and fixing vulnerabilities.
They do not establish performance on your repositories. The 20-language test is internal, and public benchmarks cannot reproduce your build system, dependency graph, test quality, authorization rules, or patch-review standard.
If access is approved, evaluate with representative, authorized code and measure:
- reproducible true findings rather than raw issue count;
- patches that pass builds, tests, and security review;
- false-positive and missed-issue cost;
- analyst time saved or added;
- latency and total cost per accepted remediation;
- safe interruption and rollback when an agent goes off course.
No patch should bypass the existing code owner or release control simply because the model generated it.
Questions the public pages do not answer
Google publishes an interest form whose first visible step asks for an email and says eligible partners will receive a response. Later registration fields are not exposed before that step, so it would be misleading to present a guessed document list as an official application requirement.
Internally, however, prepare questions that the public pages leave open:
- delivery product, endpoint, region, and project structure;
- Cyber model identifier and lifecycle terms under the agreement;
- price, minimum commitment, quotas, concurrency, and failed-call billing;
- whether CodeMender is optional, bundled, or separately contracted;
- exact zero-retention coverage and required logging;
- support, incident notification, evaluation, suspension, and offboarding;
- permitted integrations with repositories, scanners, ticketing, and CI/CD.
Submit interest only through the official Fairwind route. Google explicitly prohibits partners from sharing, redistributing, or selling access, so a third party offering a “Fairwind API key” conflicts with the published rules.
The documented path when Fairwind is not available
Google says in its Fairwind security announcement that any Google Cloud customer can use CodeMender with publicly available models and combine it with AI Threat Defense products. Availability, region, and price still need account-specific verification. This path is not equivalent to Cyber, but it provides a legitimate way to build a find–verify–fix workflow without pretending restricted access exists.
Teams comparing restricted cyber programs can also review the distinct GPT-5.4-Cyber access model. A shared “Cyber” label does not make the vendors' eligibility, controls, capabilities, or commercial terms interchangeable.
The go/no-go rule is straightforward: apply when your mission matches high-priority defense, your target authorization is explicit, and your identity, access, logging, and incident controls are ready. Otherwise, improve the defensive workflow with public tools first. Fairwind's gate is part of the security design, not an obstacle to route around.
