Mandia's Armadin Nets 90 Zero-Days to Automate Enterprise Defense
David George, Kevin Mandia
Retaining human analysts in detection and response workflows guarantees failure against machine-speed adversaries that probe thousands of network paths simultaneously.
AI-assisted summary of Building Defense for the Agentic Era: Kevin Mandia — original source. Check the original for full context.
Source published:
Key ideas
- Kevin Mandia launched Armadin alongside Travis Lanham, David Slater, and Evan Pena to pioneer autonomous AI offensive testing, discovering over 90 zero-days in Fortune 500 production environments without source code access within months of operation. (0:00)
- The advent of machine-speed adversaries probing thousands of pathways simultaneously renders human-in-the-loop Security Operations Centers (SOCs) obsolete, forcing a shift toward automated detection, instant isolation, and compensating controls. (21:51)
- Benchmarking offensive cyber kill chains across frontier models revealed that both open-weight and closed proprietary systems successfully solved the exact same 8 out of 20 scenarios, demonstrating a significantly compressed capability gap in security tasks. (30:00)
- Because technical intellectual property advantages in AI decay within six months, enterprise security startups must rely on rapid go-to-market scaling, high-reputation Tier-1 enterprise customer halos, and continuous product iteration to build lasting moats. (42:30)
Detailed notes
## Background Published on October 6, 2026, by hosts David George and Kevin Mandia via RSS, this episode features a16z General Partner David George interviewing Armadin founder and CEO Kevin Mandia. The discussion centers on the reality of cybersecurity in the agentic era, exploring how machine-speed attackers force defenses to become autonomous, why traditional human-in-the-loop security is obsolete, and how Armadin identified more than 90 zero-days in production enterprise environments.
## TL;DR Cybersecurity veteran Kevin Mandia explains why artificial intelligence fundamentally breaks legacy defense models, transforming targeted 'sniper round' attacks into relentless, automated 'drone swarms' that operate at machine speed. To counter this threat, Mandia's startup Armadin uses autonomous AI agents to proactively attack enterprise networks, uncovering over 90 zero-day vulnerabilities in live Fortune 500 environments to prove real exploitability. Mandia argues that because machine-speed adversaries can probe thousands of vectors simultaneously, human analysts must be removed from the detection and response loop in favor of real-time autonomous controls. Looking forward, winning in this landscape requires combining offensive-trained AI models with rigorous containment architectures and an aggressive enterprise go-to-market strategy.
## Atmosphere & style The conversation carries an urgent, frontline intensity driven by Kevin Mandia's direct, no-nonsense delivery and decades of battle-tested security leadership. The tone blends wartime pragmatism with founder energy, moving fluidly between high-level football analogies and deep technical breakdowns of red-teaming, hyperattacks, and agent containment. Listening feels like sitting inside an executive digital war room where legacy paradigms are discarded in real time, leaving the audience with an exhilarating yet sober view of an unfolding AI arms race.
## Bulletin - `00:00` Kevin Mandia launched Armadin alongside Travis Lanham, David Slater, and Evan Pena to pioneer autonomous AI offensive testing, discovering over 90 zero-days in Fortune 500 production environments without source code access within months of operation. - `21:51` The advent of machine-speed adversaries probing thousands of pathways simultaneously renders human-in-the-loop Security Operations Centers (SOCs) obsolete, forcing a shift toward automated detection, instant isolation, and compensating controls. - `30:00` Benchmarking offensive cyber kill chains across frontier models revealed that both open-weight and closed proprietary systems successfully solved the exact same 8 out of 20 scenarios, demonstrating a significantly compressed capability gap in security tasks. - `42:30` Because technical intellectual property advantages in AI decay within six months, enterprise security startups must rely on rapid go-to-market scaling, high-reputation Tier-1 enterprise customer halos, and continuous product iteration to build lasting moats.
## Key takeaways - `00:00` Defenders cannot construct effective modern security without continuous testing against an elite offensive sparring partner that operates at machine speed. - `03:41` Armadin operates a deliberate two-act architecture: Armadin Red deploys AI offensively to uncover exploitable vulnerabilities, while Armadin Blue acts as an autonomous real-time tourniquet to intercept attacks without human latency. - `05:00` AI fundamentally alters attack economics by shifting from linear human penetration attempts to parallel, token-burning drone swarms that exhaust defensive resources. - `05:00` The primary gating constraint holding back large-scale criminal AI attacks today is anonymous GPU access and compute attribution rather than model capability. - `07:46` National cyber engagement doctrines are pivoting from disciplined, low-noise 'sniper rounds' toward brute-force, token-burning automated drone swarms where attribution collapses. - `10:00` Rather than continuously bombarding networks, Armadin maps an enterprise metadata twin using agent swarms and runs cheap heartbeat polling to trigger intense exploit attempts only when infrastructure changes or new threats drop. - `15:00` Legacy vulnerability scanners produce unmanageable noise by cataloging hypothetical CVEs, whereas autonomous offensive AI isolates and verifies genuine remote code execution with zero false positives. - `20:00` CISOs will be forced to accept imperfect automated 'field dressings' and patches because leaving humans in the detect-and-respond loop results in catastrophic network collapse against machine-speed intrusions. - `25:00` The industry's 'Mythos moment' established machine-driven offense as an undeniable reality, creating mutual urgency where hostile states rush to exploit weaknesses before enterprise war rooms permanently harden perimeters. - `27:30` Deploying offensive AI agents safely requires deterministic hard rules, hypervisor isolation, and passive prompt monitoring to eliminate wild goose chases and runaway compute waste without extinguishing model creativity. - `35:00` While human red teamers historically guided exploit discovery, offensive AI agents have crossed the threshold into fully autonomous zero-day discovery without human intervention. - `37:15` Threat intelligence has evolved through three distinct waves: reactive antivirus signatures, post-breach detection and incident response, and continuous proactive AI self-discovery. - `40:00` Surviving hyper-growth in enterprise AI security requires moving beyond intuition to industrialized processes, continuous weekly sales training, and shielding engineering teams from organizational chaos. - `45:00` Winning in cybersecurity demands earning the validation halo of Tier-1 institutions like money center banks and global airlines, backed by co-located engineering teams built for extreme iteration velocity.
## Detailed walkthrough ### `00:00` The 2000 Ravens Defense, 90 Zero-Days, and Getting Back on the Field
Drawing an analogy to legendary NFL units, Kevin Mandia frames the emerging reality of modern security around the principle that iron sharpens iron: “You don't have a defense unless you have a great offense to go up against.” Just as the historic 2000 Baltimore Ravens defense needed a relentless practice offense pushing them daily to reach greatness, Mandia explains that his new company, Armadin, exists to serve as that elite sparring partner—an all-star offensive unit that continuously hammers organizational perimeters so defenders can prepare for what is inevitably coming. The stakes could not be higher; since January of that year alone, Armadin’s automated platform uncovered over 90 zero-day vulnerabilities inside live production networks belonging to Fortune 500 enterprises, proving that the threat landscape has already outpaced conventional security testing.
Mandia spent three decades building cybersecurity institutions, most notably founding Mandiant and navigating its storied path through public markets and its ultimate acquisition by Google. When host David George asks why he decided to dive back into the startup arena rather than staying comfortable, Mandia admits he felt virtually compelled by the magnitude of the moment: “I don't want to sit out the AI shift change when I've done 30 years in security and the whole damn thing's about to change.” Meeting his co-founders—Travis Lanham, whom he calls a “generational talent,” David Slater, whom he describes admiringly as a “freak of nature,” and Evan Pena, an exceptional operator he had worked with previously—convinced him to return. Mandia was in his mid-50s and working in venture capital; he was not looking to start another company simply for the romantic thrill of being an entrepreneur or operational executive. Listening to their pitch, however, he realized that every enterprise on earth immediately requires what this team envisioned, and his decades of executive trust could accelerate its adoption.
The transition from human-driven security to artificial intelligence fundamentally rewrites the playbook. In Mandia’s blunt assessment, the past three decades of manual incident response, log triaging, and human penetration testing have been completely upended: “Everything I did is dead and everything else is new.” The sheer computational disparity is staggering—tasks that would take an army of 70 elite human analysts working in tandem can now be executed by AI in a single microsecond, rendering traditional defense models obsolete overnight.
- **Mandiant Pedigree**: Kevin Mandia built Mandiant into the premier breach-investigation firm before its eventual acquisition by Google. - **Founding Team**: Armadin was conceived and launched by Travis Lanham, David Slater, and Evan Pena, with Mandia joining as CEO to accelerate go-to-market and enterprise adoption. - **Zero-Day Discovery**: Armadin surfaced more than 90 previously unknown zero-days in active, live production environments of Fortune 500 corporations within its first few months of operation.
---
`03:41` Armadin's Two Acts: The Offensive Cyber Cannon and Autonomous Defense
Armadin’s core architecture is split into a deliberate two-act roadmap designed to meet the adversary on equal technological footing. Act One, known as Armadin Red, deploys frontier artificial intelligence models exclusively on offense to discover whether an organization possesses truly exploitable risk. Mandia emphasizes that the good guys cannot afford to be passive observers while adversaries operationalize frontier models. Defending modern networks requires proactively building the most sophisticated offensive tooling available and firing it directly at enterprise infrastructure to uncover structural flaws before malicious actors find them.
```mermaid flowchart LR accTitle: Armadin Two-Act Architecture accDescr: Visual representation of Armadin Red offensive cannon testing risk and feeding into Armadin Blue autonomous defense force field.
subgraph Act1["Act One: Armadin Red"] A["Frontier AI Models"] --> B["Offensive Cyber Cannon"] B --> C["Continuous Exploitable<br/>Risk Discovery"] end
subgraph Act2["Act Two: Armadin Blue"] D["Autonomous Tourniquet"] --> E["Real-Time Interception"] E --> F["Protective Force Field"] end
C -->|"Feeds telemetry & exploit data"| D ```
Mandia argues that the only viable defensive posture is maintaining a technological lead over the adversary: “The good guys have to build the offensive cyber cannon and shoot it at networks to make sure those networks can withstand these attacks because they're the ones that are coming.” If Armadin can stay even five minutes ahead of nation-states, organized cybercriminal syndicates, and opportunistic attackers, that offensive intelligence can be channeled into Act Two: Armadin Blue. Blue represents an autonomous, real-time defensive tourniquet—a machine-speed force field that intercepts attacks, contains damage instantly, and isolates compromised assets without waiting for human intervention.
- **Armadin Red (Act One)**: Focuses entirely on offense, leveraging frontier models to discover exploitable vulnerabilities across enterprise surfaces. - **Armadin Blue (Act Two)**: Translates offensive discoveries into an autonomous defense system designed to act as an instantaneous tourniquet against machine-driven intrusions. - **Competitive Margin**: The stated objective is maintaining at least a five-minute discovery advantage over external threat actors.
---
`05:00` Machine-Speed Adversaries: 25,000 Agents, Anonymous GPUs, and Structured Code
While AI-driven attacks are in their earliest phases, the capabilities under development are unprecedented. Mandia reveals that Armadin has already orchestrated systems with 25,000 autonomous agents operating in concert, performing complex reconnaissance and penetration routines without drifting off into bizarre dead ends or hallucinations. Having spent decades investigating intrusions, Mandia notes that human and synthetic attacks leave entirely distinct behavioral footprints. A human attacker moves methodically along a logical chain—breaking into system A, pivoting laterally to system B, and then targeting system C. Early machine-driven attacks, by contrast, act more like uncoordinated swarms: an agent might breach system A, hop to system B, and immediately loop back to attempt an exploit against system A again.
Despite these early tactical quirks, AI possesses decisive structural advantages over human operators: scale and velocity. Human attackers are constrained by scarce cognitive resources and must select a single high-probability path into an enterprise. Machine-speed adversaries face no such bandwidth limits; they can probe thousands of potential penetration vectors simultaneously at near-instantaneous speed. Dismissing the argument that AI models lack the creative spark needed for novel hacking, Mandia explains that identifying software vulnerabilities does not require human-style creativity or polyglot fluency: code is a structured language driven by formal deterministic processes, making it an ideal domain for large language models to master.
Mandia also pushes back forcefully against calls to artificially throttle AI development in the name of cybersecurity safety. Publicly available open-weights models have already crossed the threshold of offensive utility: “The open models are already good enough.” The primary bottleneck holding back a massive wave of criminal AI campaigns is not model sophistication, but compute attribution. Until bad actors can access top-tier GPU clusters anonymously without leaving financial or identity trails, sophisticated attacks will remain constrained. Mandia quips that cybercriminals naturally prefer anonymity over working out in the open: “If you can commit a crime anonymously, that's a lot smarter than doing it with your jersey on, with your name on it.”
- **Agent Orchestration**: Armadin runs up to 25,000 autonomous software agents simultaneously in tight coordination without operational breakdown. - **Tactical Signatures**: Human intrusions are linear (A to B to C); current AI intrusions display swarm-like, parallel, and occasionally repetitive lateral movement patterns. - **Speed Mismatch**: Operations that would require 70 human engineers can be executed by autonomous models within a microsecond. - **Code Advantage**: Because software and exploits operate within structured, deterministic syntax rather than messy conversational contexts, AI finds vulnerabilities with high efficiency. - **The Attribution Bottleneck**: The primary gating factor limiting large-scale criminal AI attacks today is the lack of anonymous GPU infrastructure.
---
`07:46` Cyber Doctrine at the Crossroads: Sniper Rounds vs. AI Drone Swarms
Drawing on his background investigating state-sponsored espionage campaigns on a daily basis, Mandia contrasts the historical doctrine of nation-state actors with the emerging capabilities of AI. Historically, elite military and intelligence agencies never utilized “spray and pray” tactics. Instead, espionage was characterized by extreme discipline and precision targeting: “Nations on offense have never, in my opinion, they've never really been, when you're hacking for espionage and for security reasons, you hack with what I would call kind of a sniper round.” State operators would quietly focus their limited resources on a narrow cluster of high-value targets—such as thirty critical defense contractors or specific military networks—and deploy tailored exploits designed to remain undetected for months or years.
The rise of generative models and autonomous agents upends this doctrine entirely, turning surgical strikes into brute-force computational assaults: “With AI, I think it becomes more like a drone swarm.” Rather than relying on a solitary operator quietly working through a perimeter, nations can now launch thousands of autonomous probes against an enterprise, burning compute tokens to exhaust defensive resources. While this swarm approach is noisier, more chaotic, and less surreptitious than a traditional sniper round, it is exponentially more comprehensive and difficult to repel.
This technological shift forces military strategists and national defense commands worldwide to rewrite their cyber engagement doctrines from scratch. Nations must now determine when the mission requires the stealth of a sniper round versus the sheer overwhelming power of a token-burning drone swarm. Defensive teams, in turn, are left facing anomalous, highly accelerated intrusions where attribution is completely obscured, making it impossible to immediately discern whether an incoming swarm is backed by a rival foreign superpower, an opportunistic cybercriminal group, or an automated script running on open models.
- **Sniper Round Doctrine**: Traditional nation-state cyber espionage focused on highly selective, low-noise targeting against narrow sectors (such as.mil domains or top defense contractors). - **Drone Swarm Doctrine**: AI-enabled offensive cyber doctrine utilizes parallel automated agents to exhaustively assault enterprise networks by burning raw compute tokens. - **Tactical Trade-offs**: Drone swarms trade stealth and elegance for speed, volume, and overwhelming exploit coverage. - **Attribution Collapse**: Defending against machine-speed swarms makes identifying the underlying perpetrator—whether a nation-state, criminal group, or rogue actor—nearly impossible in real time.
`10:00` The Democratization of Attacks and the Necessity of an Elite Offense
The advent of AI fundamentally changes the economics and distribution of offensive cyber capabilities. While a simplistic prompt like "hack abc.com" will not yield an effective, surreptitious attack without extensive training and expert human guidance, AI serves as an equalizer across the board. Lower-tier, less technical, and historically less successful threat actors will suddenly appear far more capable simply because of the sheer volume and automated scaling AI affords. Defenders will find themselves under assault by advanced models where true attribution becomes increasingly murky: is the adversary a hostile nation-state or a lone actor using an automated agent? Kevin Mandia emphasizes that “in the AI age, it does democratize far greater expertise.”
```mermaid flowchart TD accTitle: The Armadin Hyperattack and Continuous Polling Loop accDescr: Visual representation of how Armadin maps an enterprise, creates a metadata twin, polls for changes, and executes verified attacks.
subgraph Discovery ["1. Reconnaissance"] A["Drone Swarm of Agents"] -->|"Hyperattack"| B["Network Metadata Twin<br>(Services, Routes, Assets)"] end
subgraph Polling ["2. Heartbeat Polling"] B --> C{"Heartbeat Trigger?<br>(App update, route change,<br>new asset, or CVE drop)"} C -- "No Change" --> D["Cheap Background Polling"] D --> C end
subgraph Exploitation ["3. Autonomous Action"] C -- "Change Detected" --> E["AI Offensive Model Attack"] E --> F["Verified Remote Code Execution<br>(Zero False Positives)"] F --> G["Compensating Controls<br>(Armadin Blue Orchestration)"] end ```
To counter this shift, Mandia argues that an enterprise cannot build a functional defense without continuously testing against an elite offense. Drawing an analogy to the 2000 Baltimore Ravens, he notes that an all-time great defense needs a practice offense that relentlessly pushes them to their limits. In the AI era, human operators can no longer sit inside the tactical loop because machines execute too rapidly; defense must automatically "tourniquet the wounds" the moment an intrusion begins.
Armadin operationalizes this through what Mandia calls a **hyperattack**: - **Agent Drone Swarms:** Armadin deploys a coordinated swarm of agents to aggressively light up an enterprise's external perimeter, mapping every service, route, and system to construct a complete "metadata twin" of terabytes of network data from the attacker’s perspective. - **Cheap Heartbeat Polling:** Because blasting an entire network constantly with offensive models is cost-prohibitive and noisy, Armadin uses the metadata twin to poll cheaply on a regular heartbeat, probing specifically for structural alterations: an updated web application, an altered network route, a reconfigured service, or a newly spun-up machine. - **Triggered Offense:** High-intensity model testing is deployed selectively: (1) when network infrastructure changes, (2) when the external threat landscape shifts (e.g., fresh threat intelligence or a newly disclosed zero-day drops over a weekend), or (3) prior to high-stakes internal milestones like board meetings. - **Verified Exploitability:** Rather than flooding security teams with standard Common Vulnerabilities and Exposures (CVE) alerts, the system isolates whether a flaw genuinely yields remote command execution (RCE) or stable access, eliminating panic over harmless bugs.
`15:00` Moving Beyond Legacy Pen Testing to Production Zero-Days
Legacy penetration testing and vulnerability scanning—historically dominated by tools from vendors like Tenable, Rapid7, and Qualys—primarily catalog known vulnerabilities and check whether external service banners match published CVEs. Kevin Mandia contrasts this with the paradigm shift pioneered by CrowdStrike, which redefined traditional antivirus (AV) into Endpoint Detection and Response (EDR) through fundamental architecture changes. Mandia asserts that autonomous AI offense will become as ubiquitous as AV once was, because static pen testing merely produces an unmanageable list of vulnerabilities that do not matter while failing to verify real exploitability.
Traditional tools rely on brute-force checks rather than a learning system that memorizes and navigates unique enterprise topography. By contrast, Armadin trains and post-trains its models with elite human red teamers and professional exploit developers. This enables the AI agents to uncover complex logic flaws in custom-built applications rather than simple code misconfigurations, exhausting every reachable route black-box from the public internet.
The practical results of this approach reveal a critical divergence between internal source-code audits and real-world attack surfaces: - **Over 90 Production Zero-Days Found:** Since January 2026, Armadin’s external black-box agents have discovered more than 90 zero-days in production environments belonging to major software and Fortune 500 enterprises—without ever having access to source code or internal application logins. - **Actionable Findings vs. Source Noise:** Scanning tools like Mythos that parse source code generate thousands of hypothetical issues, resulting in noise. Mandia stresses that Armadin delivers confirmed exploitation: “We are black box coming from the internet over 90 zero days in major software companies.” - **Immediate Incident Response:** When Armadin discovers exploitable access, the team alerts the target company's CISO—typically within 48 hours—to demonstrate verified remote code execution in their DMZ, prompting organizations to enter active incident response mode rather than treating the alert as routine hygiene.
`18:00` Autonomous Defense: Introducing Armadin Blue
Pinpointing remote vulnerabilities is only the initial half of the problem. Mandia explains that the platform is intentionally split into two coordinated capabilities: **Armadin Red** (the offensive agent swarm) and **Armadin Blue** (the automated defensive response layer). It is insufficient to merely drop an alert on a CISO's desk and walk away; security operations require closing the exposure window in lockstep with discovery.
Kevin Mandia outlines the ultimate goal of modern security leadership: “The true north for every CISO should be effective autonomous response.” To achieve this, Armadin Blue uses real-time telemetry from exploitable risks discovered by Armadin Red and interfaces directly with the customer’s defensive enforcement plane—such as endpoint detection agents (EDR) and perimeter firewalls. By pushing automated compensating controls at machine speed, Armadin Blue neutralizes an attack path within minutes of discovery, cutting off external adversaries before their own automated models can locate and exploit the same opening.
`20:00` The Inevitability of Autonomous Defense and the “Field Dressing” Reality
Kevin Mandia argues that autonomous defense is rapidly transitioning from a theoretical ambition to an inescapable reality. Even if initial safeguards deployed over the coming months are rudimentary, the sheer operational tempo of modern adversaries will force enterprises to adopt autonomous countermeasures within the next year. Facing the harsh trade-offs of modern network security, Mandia is unequivocal about prioritizing imperfect automated interventions over an active compromise: “I'd rather have a bad patch stopping a bad guy from getting in than have an intrusion.” The paramount objective remains denying an unknown actor arbitrary access inside an enterprise environment, leading legacy defense giants—such as CrowdStrike, Palo Alto Networks, and Fortinet—to aggressively pivot toward autonomous capabilities.
Mandia draws a vivid parallel between these initial autonomous responses and emergency battlefield medicine:
> “And I likened it to, you know, kind of field dressing in war. Someone gets shot, you patch it up, but that's not the hospital, you know. That's a, hey, we kind of stopped the bleeding. But then you've got to maybe do something else with more time in humans, potentially, or even, you know, a genic approach to it down the road.”
Consequently, Chief Information Security Officers (CISOs) will find autonomous defense operationalized across their environments regardless of whether they actively seek it out, simply because the major security platforms they have already purchased are building these reflexes directly into their stacks.
`21:51` Redefining the SOC: Why Humans Cannot Remain in the Loop
Addressing David George’s question about the future of the Security Operations Center (SOC) and whether his thirty years of security experience have become irrelevant, Mandia emphasizes that a CISO’s true north must now be effective autonomous security. While retaining high-caliber talent remains critical, organizations are fundamentally evaluating which legacy workflows survive in the AI age. Mandia warns that keeping people in operational workflows where adversaries move at machine speed is an untenable liability:
> “If you have humans in the detect and respond loop, you're going to be too slow.”
Cybersecurity has historically cleaved into prevent, detect, and respond. AI is rapidly dominating prevention while taking over detection and response, compressing the response window to near zero. Mandia describes this using a stark analogy:
```mermaid flowchart TD accTitle: The Collapse of Human Response Windows accDescr: Diagram illustrating how machine-speed intrusions bypass traditional human SOC detection and response loops.
subgraph Offense["Autonomous Adversary"] A["AI Exploit Discovery"] --> B["Agentic Command & Control"] B --> C["Machine-Speed Lateral Proliferation<br/>(1,000 parallel paths)"] end
subgraph Defense["Traditional vs Autonomous Defense"] C --> D{"Defensive Posture"} D -->|"Human-in-the-Loop SOC"| E["Pop the Balloon:<br/>Instant Network Collapse"] D -->|"Autonomous Defense"| F["Automated Prevent & Lockdown Traps"] end ```
When Armadin executes internal red-team simulations using agentic command-and-control, the contrast with human operators is striking. A human analyst moves slowly, typing individual passphrases and executing single lateral movements one machine at a time. An agentic exploit, by contrast, probes and executes across a thousand targets simultaneously. Once an adversary of that nature gains a foothold, Mandia explains, “it's like the balloon popped”—the entire defensive perimeter bursts instantly. As automated detection and response compress into sub-second timelines, the boundary between prevention and response blurs entirely.
- **Obsolescence of SOC routines:** Entire workflows currently being automated inside SOCs will soon be eliminated altogether rather than merely streamlined. - **Defense in depth:** Even with proactive shields, Mandia notes that organizations must maintain layered fallback systems and automated traps, assuming that adversaries will eventually discover zero-day vulnerabilities in unassessed production applications. - **CISO workforce evaluation:** Enterprise security leaders are systematically reviewing their headcounts, organizational structures, and core processes to determine what a modern security team looks like, even though definitive answers have not yet settled across the industry.
`25:00` The Window of Exposure, Mutual Desperation, and the Mythos Moment
Discussing the exposure of Fortune 500 enterprises, Mandia explains that while vulnerabilities are shrinking rapidly, both attackers and defenders are operating under profound urgency. Hostile nation-states like Russia and Iran sense a closing window of opportunity to exploit existing structural weaknesses before automated defenses harden. Concurrently, defenders recognize that although the current transitional phase heavily advantages offensive AI, autonomous defense trained on offensive methodologies will eventually prove far more diligent and capable than human analysts manually inspecting network packets.
Mandia characterizes the present enterprise environment as an all-hands-on-deck digital war room:
> “There's no way to make the next year pretty. That's the best way to say it. You know what I mean? It's a cocktail party out there right now, a digital cocktail party. And everybody's in a race.”
Every major Tier-1 enterprise is actively scanning for perimeter exposures in real time, fostering unprecedented collaboration where CIOs, CISOs, business unit leaders, and product engineers assemble in dedicated war rooms to remediate vulnerabilities immediately. David George notes that premier tech organizations have reassigned substantial portions of their engineering and research divisions solely to fortify internal perimeters. According to Mandia, this urgency was catalyzed by the "Mythos moment." While security pioneers recognized the shift long before, Mythos acted as an inescapable proof point for the reality of machine-driven offense, compelling software vendors to perform rigorous code attestations and permanently resetting industry expectations.
`27:30` Caging the Beast: Model Vulnerabilities and Armadin’s Safety Architecture
When evaluating the incident at Hugging Face and broader vulnerabilities in AI labs, Mandia observes an enduring industry pattern: in every fundamental technological shift, organizations systematically underestimate both adversary capabilities and the autonomous potential of the models themselves. In the high-stakes race to develop cutting-edge foundation models—resembling a modern lunar landing race—frontier AI labs prioritize velocity, sometimes moving so fast that leadership appeals to government intervention because internal innovation outpaces internal controls. The core friction arises because machine learning researchers often lack deep defensive security tradecraft, while seasoned security experts do not fully understand the inner mechanics of generative models.
Mandia reveals that Armadin intentionally engineered the very offensive capabilities the security community fears, but surrounded their agents with strict, multi-layered containment:
> “Assume every layer of your security will fail, and you have to have deterministic rules that eliminate certain activities.”
```mermaid flowchart LR accTitle: Armadin Multi-Layered Agent Defense Architecture accDescr: Structural diagram of the layered controls used by Armadin to cage autonomous offensive AI agents.
subgraph Isolation["Isolation Layer"] A["Hypervisor Isolation"] B["Host-Based Lockdown"] C["Proxy Awareness & Filtering"] end
subgraph Inspection["Behavioral Governance"] D["Passive Prompt Inspection"] E["Deterministic Hard Rules"] end
subgraph Control["Agent Runtime"] F["Agent Activity"] --> D D -->|Waste or Drift| G["Immediate Process Kill"] D -->|Verified Safe| H["Target Execution"] F --> E E -->|Rule Violation| G end
Isolation --> Control ```
To govern these offensive agents, Armadin implemented a robust containment architecture: - **Host-level isolation:** Enforcing strict hypervisor boundaries, host lockdowns, and dedicated proxy configurations that constrain network communications. - **Passive prompt inspection:** Surreptitiously monitoring every prompt generated by autonomous agents in real time to detect unexpected drift or unsafe instructions. - **Cost-driven intervention:** Mandia notes that when Armadin terminates an active agent, the root cause is rarely an imminent safety breach; more frequently, the agent has diverged into an unproductive loop or a repetitive "wild goose chase" that squanders compute budget. - **Deterministic guardrails:** Operating under the assumption that heuristic or probabilistic safeguards will inevitably fail, requiring rigid, non-negotiable deterministic rules to forbid unsafe operational behaviors entirely.
`30:00` Pairing Red Teamers with AI and Benchmarking Open vs. Closed Models
Domain expertise in offensive security cannot be simulated by pure AI theory alone. Kevin Mandia explains that building effective evaluations for autonomous agents requires people who have spent years breaking into enterprise environments, which is why Armadin pairs seasoned red teamers and exploit developers directly with AI researchers. Without practical field experience, engineers run tests and inevitably miss critical edge cases that a seasoned hacker would anticipate immediately. To test model capabilities, Armadin benchmarked both open-weight and frontier closed models against historical kill chains observed across actual victim sites and real-world network penetrations.
Interestingly, both open and frontier closed models topped out at completing the exact same number of kill chains: 8 out of 20. Kevin notes that while closed models reached exploitable risk faster and with lower latency, open-weight models ultimately achieved the identical end state when permitted to run longer. On metrics of overall effectiveness and attack creativity, the performance curves hit diminishing returns at the exact same threshold, meaning the capability gap between open and closed models in cybersecurity offensive tasks is significantly narrower than in other modalities.
```mermaid flowchart LR accTitle: AI Model Offensive Evaluation Pipeline accDescr: Real-world attack scenarios run through open and closed models reaching identical 8 of 20 kill chain completion. subgraph Input["Attack Scenarios"] K["20 Real-World Kill Chains"] end subgraph Models["Model Execution"] C["Closed Frontier Models<br/>(Faster, higher initial cost)"] O["Open-Weight Models<br/>(Slower run time, catch up)"] end subgraph Outcome["Benchmark Result"] R["Diminishing Returns Plateau<br/>(Both solve 8 of 20)"] end K --> C K --> O C --> R O --> R ```
- Kevin Mandia points out the necessity of cross-disciplinary pairing: “So that's why Armadin, we combine the exploit developer types and red teamers with the AI folks because our evals most of the time are made by the red teamers.” - Assessing model performance across open versus proprietary ecosystems, Kevin observes: “So in the cyber world, the differentiation between closed and open is not as great as in other domains probably.” - David George agrees with the findings, noting that across the industry the capability gap between open-weight and closed models continues to compress.
---
`32:30` Forensics of the AI Era and "Caging the Beast"
Kevin draws a direct parallel between the early transition to cloud infrastructure and the current emergence of autonomous AI agents. During the cloud revolution, incident responders at Mandiant had to redefine what an intrusion looked like and uncover what telemetry cloud providers failed to record. Today, security teams face the same challenge with AI breaches: understanding how attackers exploit models from labs like OpenAI and Anthropic, figuring out what data those providers should log, and establishing detailed audit trails so investigators do not spend two weeks conducting post-mortem forensics. Armadin addresses this on the offensive side by recording absolute accountability for its own systems, capturing the source IP address, exact timestamp, and specific command for every single agent action so operations can be replayed frame by frame.
Navigating AI safety on the offensive side requires balancing intelligent autonomy with deterministic guardrails—an art form Kevin calls caging the beast. If defensive engineers make an offensive agent entirely deterministic and overly restricted, they strangle the model’s creativity and fail to discover novel attack paths. Conversely, leaving an agent unchecked risks unintended collateral damage. Armadin solves this by building inbound and outbound classification layers trained by human feedback to inspect inputs and outputs in real time. Whenever an agent encounters an ambiguous or unexpected payload, the system automatically pauses operations and routes the decision to a human operator.
- Kevin Mandia emphasizes the necessity of complete auditability for AI actions: “Like we log every single thing our agent does. Source IP address, time and date, and what it did.” - Reflecting on how security leaders continually misjudge the capabilities of high-end adversaries and emerging tech, Kevin warns: “My whole career, everybody underestimates the top tier of what you're up against.” - Explaining the governance balance required when deploying AI on offense, Kevin remarks: “Got to cage the beast, David.” - When an automated classifier hits an unresolvable situation, the operational doctrine is strict: “pause, escalate, judge.”
---
`35:00` High-End Operators and Crossing the Autonomous Zero-Day Threshold
The human talent guiding Armadin’s autonomous agents brings elite offensive pedigrees, typically averaging 15 years of dedicated red teaming and vulnerability research. Kevin shares that over the course of their careers, Armadin’s core team has red-teamed 99 of the Fortune 100 companies—with Kevin joking that there is only one company left on the list that has continually eluded them despite his admiration for their products. This deep institutional knowledge is used to train and supervise the agents, removing the tedious low-level labor that historically consumed a penetration tester's day.
While the majority of the 90+ zero-day vulnerabilities Armadin discovered over the past year were ultimately validated and closed out by human operators, AI was responsible for taking over 90% or more of the repetitive attack surface discovery and web application probing. However, Kevin reveals a profound recent turning point: the most recent zero-days were discovered entirely by the technology itself without human direction.
- The team possesses immense enterprise testing background: “15 years on offense, 15 years of red teaming. I think we've red teamed literally 99 of the Fortune 100 throughout our careers.” - Automated systems now carry the overwhelming majority of offensive workloads: “...we're leveraging AI to do 90 plus percent of the tedial work, which is pen testing, done, automated.” - Announcing the arrival of fully autonomous discovery, Kevin Mandia states: “The last few zero days, tech found it.” - Kevin emphasizes that the offensive landscape has fundamentally shifted: “So we've made the turn. And most people already have made the turn if you on offense leveraging AI your AI agents are finding zero days.”
---
`37:15` Company Building: Mandiant’s Origins and the Three Waves of Threat Intelligence
Reflecting on the evolution of cybersecurity company building, Kevin looks back to February 2004 when he launched Mandiant as a self-funded, profitable startup. At the time, Mandiant operated on an unconventional thesis that contradicted traditional security marketing. Their original, slightly dry website copy ran with the premise that organizations could not rely solely on preventive measures, which eventually evolved into the blunt motto: *“Security breaches are inevitable.”* The business model was straightforward: respond to every major breach in the world to gain proprietary first-mover intelligence on attacker tactics, and use that insight to build better defenses.
```mermaid flowchart TD accTitle: The Three Waves of Threat Intelligence accDescr: Evolution from reactive Antivirus signatures to breach response EDR to Armadin's continuous AI offensive self-discovery. subgraph Wave1["Wave 1: Antivirus (AV)"] W1["Signature-based prevention<br/>Relied on victims submitting malware"] end subgraph Wave2["Wave 2: Post-Breach Detection (EDR / Mandiant)"] W2["Incident response & telemetry<br/>Learn TTPs after major victim compromise"] end subgraph Wave3["Wave 3: Continuous AI Probing (Armadin)"] W3["Autonomous red teaming<br/>Find exploitable zero-days before attackers"] end Wave1 -->|"Easily evaded"| Wave2 Wave2 -->|"Too reactive / machine speed gap"| Wave3 ```
Kevin frames Armadin as the third great wave of threat intelligence. The first wave was traditional antivirus (AV), a flawed reactive model reliant on malware signatures that depended on ordinary victims discovering and submitting malware. The second wave, embodied by Mandiant and endpoint detection players like George Kurtz's CrowdStrike, added a second layer by learning attacker techniques directly from live incident investigations. However, waiting for a defense contractor or enterprise peer to be compromised before sharing threat indicators is no longer sufficient against machine-speed adversaries. Armadin represents the third wave: proactive, continuous AI-driven offensive testing that uncovers an enterprise's vulnerabilities internally before an adversary ever identifies them.
- Mandiant’s foundational business thesis rested on frontline engagement: “And the premise was that let's respond to every breach that matters so we have first mover intelligence on how to prevent it happening again.” - Kevin highlights the absurdity of outdated threat-sharing loops: “Like, why are we waiting for a victim and learn from that? That's ridiculous. You've got to find your own problems first.” - Mandiant built an elite, high-compensation culture centered on dense talent: “When I started Mandiant, it was, hey, this is what we do for a living. Let's make enough money to do it for a living. That's it. I mean, so we hired the best people and we had a philosophy of we're going to pay you more than our competition, but you're going to work harder.” - Kevin notes the enduring industry-wide footprint of that talent pool: a colleague texted him pointing out that approximately 43% of the RSA Conference main stage keynote speakers were Mandiant alumni, tracing a lineage that runs back through Foundstone in 2000 alongside George Kurtz.
`40:00` Scaling at Hyperspeed and Institutionalizing Process
Kevin Mandia outlines the immense pressures and opportunities facing Armadin, remarking that while the company enjoys an “80 mile an hour tailwind,” they must urgently build their sales force, go-to-market engine, and international presence. In today's market, surviving and beating legacy incumbents requires nailing the right technology at the right moment while already preparing subsequent acts: “And you better already have your act two ready, and your Act 3 behind that ready because you don't want to get boxed into a corner.” While consumer AI startups have seen revenue skyrocket overnight, Mandia notes that enterprise security sales operate differently, even if compression is occurring. Looking at Wiz reaching over $100 million in ARR within 18 months of their first release, Mandia states, “We're going to try to beat that.” Achieving that pace without allowing the wheels on the bus to get wobbly demands raising capital early and establishing disciplined, scalable leadership.
Reflecting on his past, Mandia contrasts Armadin’s reality with the early days of Mandiant, which was self-funded, profitable, and faced minimal competition because the broader industry did not yet believe in the premise of inevitable breaches. At extreme growth speeds, founders cannot rely purely on grit and intuition: “You can't win with grit, gut and moxie. You actually have to proceduralize, almost industrialize the Armadin way.” Compounding this challenge is the sheer velocity of AI development. In the past, companies could conduct sales training once a year at an annual January kickoff. Now, with products updating dramatically every two weeks, sales teams must be continuously re-educated. Mandia underscores that despite AI's rise, enterprise security sales still fundamentally rely on human relationships: “When I look at AI's influence on sales, the reality in enterprise security sales, people still buy from people.” Therefore, companies must build institutionalized processes to train sales reps weekly so customers are never burdened with deciphering rapid product shifts.
```mermaid flowchart TD accTitle: The Armadin Velocity and Execution Loop accDescr: A cyclical feedback and execution loop showing continuous customer feedback directly driving engineering and sales enablement.
subgraph ProductLoop ["Product & Customer Engine"] Cust["Enterprise Customers"] -->|"Direct Feedback Loop"| Eng["Engineering Team (In One Room)"] Eng -->|"Bi-weekly Product Advancements"| GoToMarket["Sales & GTM Engine"] end
subgraph ScaleOps ["Operational Foundation"] GoToMarket -->|"Continuous Weekly Training"| Cust Leadership["Scalable Leadership & Process"] -->|"Eliminate Internal Chaos"| Eng Leadership -->|"Industrialized Playbooks"| GoToMarket end ```
`42:30` Competitive Mindset, Hiding Chaos, and Transient IP
Mandia stresses that Armadin does not aspire to settle for second place in its domain: “I'm involved in, we are not ever aiming to be, let's be number two in our space. That sounds fun. It is be the best in the world at what you do.” Drawing analogies to Tom Brady and LeBron James, he explains that world-class performers work harder to stay on top, constantly testing their standing through customer feedback. For an engineering organization, establishing a tight, unfiltered feedback loop directly from the customer into the engineers is essential to maintain this standard.
Internally, high-velocity execution requires shielding the team from disorder. Mandia argues that a CEO's primary obligation is to absorb and manage organizational turbulence: “A CEO's job is to absolutely hide chaos at a company from the employees.” Employees should never feel that operations are loose or directionless; they must have clear, designated leaders and institutionalized procedures to follow. Mandia also warns that technical intellectual property is inherently ephemeral in the AI era. A company must assume that whatever differentiated feature it possesses today will be replicated within six months. Because IP advantages expire so quickly, building a recognizable brand and a relentless go-to-market execution engine becomes the true moat. Mandia synthesizes the four essential pillars required to win today into funding, speed, branding, and an accelerated go-to-market buildup.
`45:00` Winning the Enterprise Halo and the Generational Market Shift
David George points out that Wiz succeeded not only through category creation, but because it met an immediate, burning demand that struck CISOs like a ton of bricks. Mandia agrees that Wiz executed brilliantly, highlighting the necessity of capturing a respected “halo effect” within enterprise cybersecurity. That halo cannot be earned through trivial accounts; it is won by solving the hardest problems for Tier-1 institutions: “You don't get the halo if you make them happy in cybersecurity, right. But the money center banks do. The best retail does. The airlines do.” For that reason, Armadin is rigorously focused on enterprise accounts from day one.
Addressing how the current landscape differs from previous eras, Mandia observes that an influx of founders and venture capital means virtually every segment is crowded. No modern security company will enjoy an uncontested market. Consequently, the only sustainable differentiator is flawless customer satisfaction: “There is nothing else that will differentiate you other than your customer base raving about you.” Armadin complements this philosophy by keeping all of its engineers co-located in a single physical room to maximize decision-making speed and eliminate the overhead of distributed teams. Mandia and George conclude that cybersecurity is experiencing the tailwind of a lifetime, as AI will force organizations to completely tear down and revamp their entire security tech stacks over the next two years.
- **Enterprise Validation**: High-stakes customers such as global money center banks, critical retail brands, and major airlines confer the necessary security halo that smaller accounts cannot provide. - **Differentiated Execution**: In an oversaturated market, viral marketing cannot replace the foundational playbook: “Get customer, make customer happy, repeat.” - **Co-located Engineering**: Keeping technical talent in a single room prevents communication drag, allowing engineers to stand up and resolve problems across twenty people instantly. - **Tech Stack Overhaul**: The next two years will see sweeping rip-and-replace cycles across legacy cybersecurity infrastructure as autonomous and AI-driven solutions take over.
## Notable quotes > `21:51` If you have humans in the detect and respond loop, you're going to be too slow. — Kevin Mandia
> `18:00` The true north for every CISO should be effective autonomous response. — Kevin Mandia
> `00:00` You don't have a defense unless you have a great offense to go up against. — Kevin Mandia
> `20:00` I'd rather have a bad patch stopping a bad guy from getting in than have an intrusion. — Kevin Mandia
> `27:30` Assume every layer of your security will fail, and you have to have deterministic rules that eliminate certain activities. — Kevin Mandia
> `42:30` A CEO's job is to absolutely hide chaos at a company from the employees. — Kevin Mandia
> `45:00` There is nothing else that will differentiate you other than your customer base raving about you. — Kevin Mandia
> `32:30` My whole career, everybody underestimates the top tier of what you're up against. — Kevin Mandia
## Mentioned Kevin Mandia, David George, Travis Lanham, David Slater, Evan Pena, George Kurtz, Armadin, Armadin Red, Armadin Blue, Mandiant, Google, CrowdStrike, Palo Alto Networks, Fortinet, Tenable, Rapid7, Qualys, Mythos, OpenAI, Anthropic, Hugging Face, Wiz, Foundstone, Baltimore Ravens
## Video description a16z General Partner David George sits down with Armadin founder and CEO Kevin Mandia to discuss what happens to cybersecurity when attackers can operate at machine speed. After 30 years in security and building Mandiant, Kevin says AI convinced him to get back on the field. He explains how AI changes the economics of cyberattacks, allowing attackers to probe thousands of paths simultaneously, and why that means defense will ultimately need to become autonomous too. They also unpack Armadin’s approach: continuously attacking customers’ systems with AI to find exploitable vulnerabilities before adversaries do, then building toward autonomous defenses that can respond in real time. Kevin shares what Armadin has learned from finding more than 90 zero-days in production environments this year, why humans can’t remain in the detect-and-respond loop, and how the entire security stack could change over the next few years.
[Source](https://mgln.ai/e/1344/afp-848985-injected.calisto.simplecastaudio.com/3f86df7b-51c6-4101-88a2-550dba782de8/episodes/24f18a48-5a9a-44ed-905a-34359aaf1190/audio/128/default.mp3?aid=rss_feed&awCollectionId=3f86df7b-51c6-4101-88a2-550dba782de8&awEpisodeId=24f18a48-5a9a-44ed-905a-34359aaf1190&feed=JGE3yC0V)