He Sold Mandiant to Google for $5.4 Billion. Now Kevin Mandia Is Back — With $190M and an AI Army of Cyber Defenders

Four years ago, Kevin Mandia sold Mandiant to Google for $5.4 billion — capping a two-decade career building the most trusted incident response firm in the cybersecurity industry into a company that governments and Fortune 500 corporations called when everything went wrong. He could have retired. He did not. On Tuesday March 10, Mandia's new startup Armadin announced it has raised $190 million in combined seed and Series A funding — one of the largest early-stage raises in cybersecurity history — to build what Mandia describes as fleets of autonomous AI agents that defend digital infrastructure the way the Spanish Armada defended the seas. The round was led by Accel, with participation from Google Ventures, Kleiner Perkins, Menlo Ventures, and Ballistic Ventures — the security-focused firm Mandia himself co-founded. Armadin launched quietly in September 2025 and has already recruited more than 60 employees. Several Fortune 100 companies have begun working with the startup as early customers. The man who built cybersecurity's most trusted institution is building its most ambitious successor — and he has $190 million to do it with. Why Mandia Came Back: The AI Shift That Changed Everything The reason Mandia returned to the arena after four years — rather than retiring on the proceeds of a $5.4 billion acquisition — is the same reason the cybersecurity industry is moving faster right now than at any point in its history. Artificial intelligence, and specifically autonomous agentic AI, is fundamentally rewriting both sides of the cybersecurity equation simultaneously. Attackers are using large language models to craft more sophisticated phishing campaigns, probe for vulnerabilities at machine speed, and automate the kind of patient, persistent reconnaissance that previously required large teams of skilled human operators. Defenders, meanwhile, are drowning in alerts — security operations centre teams that were already stretched thin before the AI era are now facing attack volumes and attack sophistication that no human-scale response can match. Mandia's thesis is simple, direct, and backed by thirty years of frontline experience: in a world of machine-speed attacks, defence must become autonomous. "You cannot have a human in the loop for every defence decision and expect to win," Mandia said in Armadin's launch announcement. "The AI shift is changing cybersecurity more rapidly than any transition in history." The statement carries weight because of who is saying it. Mandia led investigations into the SolarWinds supply chain attack that compromised multiple US federal agencies, the Sony Pictures hack, and the Target breach — some of the most consequential cyber incidents in history. When he says the current shift is moving faster than any previous transition, the industry listens. What Armadin Actually Does: An Agentic Attacker Swarm Armadin's core product is built around a concept that inverts the traditional approach to cybersecurity. Rather than building defensive tools that react to known threats, Armadin deploys specialised AI agents — described by the company as an agentic attacker swarm — that continuously reason, plan, and adapt like the most advanced human threat actors. These agents use AI-powered red teaming to find and exploit weaknesses in exactly the way that real attackers would attack them — probing an organisation's infrastructure relentlessly, identifying exploitable vulnerabilities before malicious actors do, and delivering what Armadin describes as decision-grade proof of what can actually be exploited to CEOs and boards. Chief Offensive Security Officer Evan Peña described the philosophy with striking directness: "The most honest measure of security has always been the offensive lens. At Armadin, we are taking decades of human-led red teaming expertise and reinforcing it into AI models. These models are learning our tactics and techniques and are outpacing our human operators at every turn." Chief Technology Officer Travis Lanham added the operational context: "Security expertise is a constrained resource that organisations never have enough of in the moments when it matters most." Armadin's autonomous agents are designed to be that resource — available 24 hours a day, operating at machine speed, never fatigued, never distracted, and continuously learning from every engagement. The Name: An Eighth-Grade History Lesson The origin of Armadin's name is one of the most genuinely charming details in any recent startup launch story. Mandia has said the name struck him late at night as he recalled an eighth-grade history lesson about the Spanish Armada — the famous fleet of warships assembled by Spain in the 16th century to dominate the seas. The historical reference reflects the company's core concept: fleets of automated AI defenders working together in coordinated formation to protect digital infrastructure — just as the Armada's ships worked in formation to project Spanish naval power across the Atlantic. The name is not merely whimsical. It is strategically precise. A single autonomous AI agent, however capable, is a tool. A fleet of coordinated autonomous agents — each specialising in a different dimension of the attack surface, sharing intelligence in real time, adapting collectively to new threat information — is a genuinely transformational defensive capability. That fleet architecture is what Armadin is building with its $190 million. The Investors: Why Accel, Google Ventures & Kleiner Perkins Moved Fast Armadin's investor lineup tells its own story about how seriously the venture capital community is taking both the threat and the opportunity. Accel — one of Silicon Valley's most successful early-stage investors, with a portfolio that includes Facebook, Slack, Dropbox, and dozens of enterprise software category leaders — led the round. Accel Partner Ping Li described Armadin as the first company he had seen that truly weaponises the attacker's perspective to build a more resilient defence — and as delivering the autonomous, comprehensive system of record for an enterprise's security posture that boards and CISOs have been demanding for years. Google Ventures' participation is particularly notable given that Google acquired Mandia's previous company for $5.4 billion. That Google is now backing Mandia's next venture — rather than competing with it — is a signal of both Mandia's credibility and the scale of the market opportunity Armadin is targeting. As digital8hub.com has reported, the AI agent revolution — from OpenClaw in China to GPT-5.4 from OpenAI — is reshaping every industry simultaneously. Cybersecurity, where the stakes of getting AI wrong are measured not in lost productivity but in national security consequences, is the highest-stakes arena in that transformation. Kevin Mandia has spent thirty years in that arena. He is not sitting on the sidelines. For the latest coverage