The Biggest Shift in Cybersecurity in 30 Years

Summary · 3 min read

Mandia spent 30 years in cybersecurity and founded Mandiant, which later became part of Google. He is now founder and CEO of Armadin, which is building AI-powered security testing and defense.

Mandia says AI lets attackers test many paths at once and makes less technically capable attackers more effective, though he describes AI-led attacks as still early. He says Armadin uses AI agents to map and test production networks, and reports finding more than 90 zero-days at customer sites in 2026. Mandia argues that defense must become autonomous because human detect-and-respond workflows cannot keep pace, while security teams still need layered controls and oversight for uncertain actions. He also says cybersecurity startups need funding, fast go-to-market execution, and customer results to stand out as the market changes.

Minute by minute

1. 1:03

   AI shift brought Mandia back. Mandia says meeting founders David Slater, Travis Lanham, and Evan Pena convinced him to return after 30 years in security. He says Armadin uses frontier AI models to find exploitable risk, with a later product aimed at stopping attacks.

2. 4:06

   AI multiplies attack scale and speed. Mandia says AI can explore far more attack paths than humans, and that work taking 70 people could happen in a microsecond. He argues that finding vulnerabilities is structured work suited to AI, and that open models are already capable enough for cyberattacks.

3. 7:05

   AI can make attackers more capable. Mandia contrasts nation-state attacks, which he says often target specific systems, with AI attacks that could act more like a drone swarm. He expects AI to make less technical attackers more effective and says defenders may have a harder time identifying who is behind an attack.

4. 10:07

   Continuous testing tracks network changes. Mandia says Armadin’s hyperattack sends agents to map a network’s services, routes, systems, and assets. The resulting metadata lets the company monitor changes and test affected areas when a network or the threat picture changes, rather than running a full attack constantly.

5. 24:40

   Security teams are racing to reduce exposure. Mandia says both attackers and defenders feel pressure to act quickly, and describes companies bringing together security, product, and business teams to fix exposures. He says the Mythos announcement made AI offense more visible and accelerated that response.

6. 27:02

   Agent safety needs domain expertise. Mandia says teams tend to underestimate what models can do and argues that AI researchers need to work with experienced security practitioners. He describes Armadin’s safeguards, including monitoring agent prompts and using human review or classifiers when the system encounters uncertain activity.

7. 31:16

   Logging and red-team evals matter. Mandia says companies need detailed logs of agent actions, including source IP, time, and activity, to investigate incidents. He says Armadin tested 20 real-world kill chains and that both open-weight and closed models completed eight, though closed models reached results faster.

8. 35:38

   Proactive security builds on Mandiant's model. Mandia says Mandiant responded to breaches to learn how to prevent them from recurring, while Armadin represents a more proactive step: finding problems before an attacker does. He says Mandiant was self-funded, whereas Armadin needs funding to pursue a faster growth opportunity.

9. 39:17

   Growth requires process and sales training. Mandia says Armadin needs to build its go-to-market operation and prepare future products while scaling. Because the product changes every two weeks, he says sales teams need frequent training and the company needs scalable leaders and consistent processes.

10. 44:16

    Customer outcomes stand out in crowded markets. Mandia says more startups and competitors make differentiation harder, so companies need to win customers and make them happy. He says Armadin is focusing on large enterprises and argues that strong customer results and repeat business matter more than marketing claims.

Published Oct 6, 2026.