Kevin Mandia is a cybersecurity executive who founded the incident-response firm Mandiant in 2004 and, in 2026, founded and serves as CEO of Armadin. He has become a frequent public commentator on the prospect of AI-agent-enabled cyberattacks.
Background and roles
Mandia founded Mandiant in 2004. Google acquired Mandiant in 2022 for $5.4 billion, and Mandia stepped down as CEO over 2024–2025. His public profile draws on three decades of incident-response experience and exposure to both nation-state and cybercriminal tactics.
In February/March 2026 Mandia founded Armadin, where he is CEO. The company raised $189.9 million across a seed and Series A round led by Accel, with participation from In-Q-Tel. The In-Q-Tel investment ties Armadin to the US intelligence community's interest in AI defensive capability and positions Mandia as a public interlocutor on AI cybersecurity for that community.
Positions on AI-enabled cyberattacks
At the RSA Conference on May 13, 2025, Mandia forecast that an AI-agent-enabled cyberattack would occur within a year, likely originating from criminal groups using less-controlled models, according to Axios reporting (Source: Raw Sources/Mandia - AI Agent Cyberattacks Warning 2025.md).
At RSA 2026, Mandia appeared on a panel with Alex Stamos and Morgan Adamski that characterized the coming two years as "insane" for AI-powered threats (Source: CyberScoop). Mandia's incident-response background and view into nation-state and cybercriminal activity are cited as the basis for his commentary on the subject.
Relationships
- founded: Mandiant, Armadin
- authored: (Source: Raw Sources/Mandia - AI Agent Cyberattacks Warning 2025.md) (Axios as author of Mandia's quoted positions)
- related: Goldilock — AI-Powered Malware 2025 Threat Forecast, (Source: nytimes.com), planned AI and Cybersecurity.