Mandiant is a cybersecurity incident-response firm, founded in 2004 by Kevin Mandia and now part of Google Cloud. Its core lines of work are nation-state attribution, advanced persistent threat (APT) tracking, and post-breach investigation. It has been a frequently cited vendor in announcements of nation-state compromises, and since 2026 it is one of the components Google combines into its AI-driven enterprise security products.
Overview
Mandiant was founded in 2004 by Kevin Mandia. FireEye acquired Mandiant in 2014, and Google acquired Mandiant for $5.4 billion in 2022. The company now operates within Google Cloud Security. Mandia stepped down as CEO in 2024–2025, per Axios reporting on his subsequent warning about AI-enabled cyberattacks (Source: Raw Sources/Mandia - AI Agent Cyberattacks Warning 2025.md).
Role within Google Cloud
Under Google Cloud, Mandiant's frontline involvement in nation-state and cybercrime investigations supplies Google with early warning on AI-enabled attacks (Source: Raw Sources/Mandia - AI Agent Cyberattacks Warning 2025.md), data feeding Google Cloud Security products, and positioning in AI-augmented incident response.
During 2026, Google folded Mandiant more explicitly into an agentic-AI security strategy. In March 2026, Google Cloud announced an expansion of its cybersecurity portfolio centered on agentic AI, deeper Wiz integration, and threat-intelligence upgrades (Source: siliconangle.com), and at Cloud Next 2026 it introduced AI security agents including a Threat Hunting agent and a Detection Engineering agent (Source: cybermagazine.com). In May 2026, Google released AI Threat Defense, an enterprise offering that combines Gemini, Wiz, CodeMender, and Mandiant to find and patch software vulnerabilities and respond to threats automatically (Source: helpnetsecurity.com). Mandiant's M-Trends 2026 report states that its red teams are incorporating AI-driven techniques into engagements to prepare organizations for emerging AI-enabled threats (Source: services.google.com).
In June 2026, Business Insider reported that Google had quietly laid off staff across parts of its Cloud business, including its threat-intelligence unit and Mandiant, as spending was redirected toward AI (Source: businessinsider.com; ppc.land).
Kevin Mandia and AI-era incident response
At the RSA Conference in 2025, Mandia warned about AI-agent cyberattacks (Source: Raw Sources/Mandia - AI Agent Cyberattacks Warning 2025.md). After leaving Mandiant, he founded Armadin in March 2026, an AI-native incident-response startup built around the AI-agent-attack thesis. Armadin raised $190 million for its autonomous AI agent security work (Source: https://techcrunch.com/2026/03/10/mandiant-founder-raised-190m-autonomous-ai-agent-security-startup/). Mandiant's standing as a cybersecurity vendor of the pre-AI era, combined with Mandia's departure, the AI-agent-attack warning, and the Armadin launch, has been characterized as a generational transition in incident response.
Relationships
- parent: Google (Alphabet) (Google Cloud Security)
- founded-by: Kevin Mandia
- related: Armadin, AI and Cybersecurity, (Source: Raw Sources/Mandia - AI Agent Cyberattacks Warning 2025.md)
Sources
- (Source: Raw Sources/Mandia - AI Agent Cyberattacks Warning 2025.md) — Axios + RSA Conference 2025 context.
- TechCrunch, "Mandiant's founder just raised $190M for his autonomous AI agent security startup" (2026-03-10) — includes Mandiant context (Source: https://techcrunch.com/2026/03/10/mandiant-founder-raised-190m-autonomous-ai-agent-security-startup/).
- SiliconANGLE, "Google Cloud unveils agentic AI security strategy with Wiz integration and threat intelligence upgrades" (2026-03-23) — siliconangle.com
- Help Net Security, "Google AI Threat Defense targets attackers using AI to find flaws faster" (2026-05-27) — helpnetsecurity.com
- Business Insider, "Google is quietly laying off staff in its cloud division" (2026-06) — businessinsider.com
- Mandiant/Google Cloud, M-Trends 2026 Executive Edition — services.google.com