a16z Podcast: Kevin Mandia on AI-Driven Cyber Defense in the Agentic Era

SPEAKER_1 (0:01)

So we need to talk about Kevin Mandia coming back into cybersecurity. After building Mandiant and essentially being able to retire, he's jumping back in with Armadin. Why now?

His reasoning is pretty straightforward—he didn't want to miss the AI shift after thirty years in security, but what really caught my attention was his blunt take on defense strategy: "You don't have a defense unless you have a great offense to go up against." That's a strong statement. And Armadin is putting that philosophy into practice, right? They're using frontier models offensively to stress-test systems against tomorrow's attacks. The numbers are striking— since January alone, they've found over 90 zero-day vulnerabilities at Fortune 500 companies while those systems were still in production. Which brings us to the core argument here. Mandia says AI fundamentally changes the nature of attack. Human attackers are limited by time, attention, and resources. But AI can coordinate thousands of agents simultaneously, move laterally, and test many paths at once. Right, and he describes this shift in nation-state tactics as moving from a sniper model to a "drone swarm" approach—louder and sloppier, but far more comprehensive. As AI becomes more accessible, it becomes a great equalizer for less technical attackers. That's honestly terrifying. It really is. So how does Armadin's product strategy address this reality?

They've got two main components. Armadin Red uses what they call "hyper-attacks" to map network metadata continuously and test whether vulnerabilities are actually exploitable. Then Armadin Blue is being built for autonomous response, working with tools like EDR and firewalls to create machine-speed compensating controls.

The goal being to automate the "tourniquet" phase before damage spreads. Mandia's vision for CISOs is clear: "the true north for any CISO is effective autonomous security," which leads to a bigger prediction about the future SOC. Exactly. Prevention, detection, and response are all narrowing toward AI-driven automation. He says you must get prevention right and then have an immediate lockdown on detection and response, because human- in-the-loop processes will eventually be too slow.

Though he does stress layered defense, logging, validation, and careful agent safety—including detailed audit trails that can be replayed after the fact. It's not just about speed.

Building on that point, Mandia also connects the technology shift to the business fundamentals of building a company. Security startups now need funding, speed, branding, scalable leaders, and a disciplined go-to-market motion. His formula is refreshingly simple: "get the customer, make the customer happy, and repeat." In a crowded market, that customer feedback loop plus relentless execution is what separates the best from everyone else.

Power, speed, and cyber defense are colliding, and it's reshaping the entire industry.