Kevin Mandia on AI Attacks and Continuous Security Testing

David George interviews Kevin Mandia about AI and cybersecurity. Mandia previously built Mandiant and now leads Armadin, a company selling AI-enabled security testing; his claims about its products are his own and should be read in that context.

Mandia says meeting Armadin’s founding team and seeing the AI shift drew him back into building a company. He thought his security experience and relationships could help the team bring its work to customers.

He describes Armadin Red as using models to test customers’ systems for exploitable risks. The planned defensive side, Armadin Blue, is intended to help contain risks discovered through those tests.

Mandia says AI-assisted attacks can explore more paths in parallel than human operators, although current systems may repeat themselves or act noisily. He regards speed and scale as important differences, while acknowledging that coordination can improve.

He expects capable models to lower the technical barrier for attackers and make attribution harder. These are his assessments of the threat landscape, not a measurement that every AI-assisted attack is effective.

Asked to compare nation-state operations with AI attacks, Mandia contrasts targeted, selective operations with a possible future of broader parallel probing. He says operators will still have to weigh speed, stealth and the risks of revealing their activity.

He predicts that less technical attackers could appear more capable when using models, and that defenders may find it harder to distinguish who is behind a campaign. He frames this as a future concern rather than a completed change.

Mandia argues that defenders need realistic, continuous testing, comparing it to a sports defense training against a strong offense. He believes tactical responses will increasingly need automation because attacks can move quickly.

He describes an initial assessment that maps exposed services and assets, followed by checks for changes such as a new service or updated application. Further testing can focus on changed areas instead of repeating the entire assessment at full intensity.

The company aims to distinguish findings that can actually provide access from long lists of theoretical vulnerabilities. Mandia says this gives customers a clearer priority for remediation.

Mandia argues that periodic penetration testing alone cannot provide the continuous coverage he wants. His description of conventional penetration testing as merely scanning known issues is his characterization; actual testing scope varies by engagement.

He says Armadin found more than 90 zero-day vulnerabilities in production customer environments during the year discussed. That is a company claim in the interview, not an independently verified count here.

Mandia contrasts theoretical findings with demonstrated exploitable paths and says customers treat serious confirmed findings as incidents. He expects AI to make more frequent authorized red teaming economically feasible.

On defense, he describes a goal of using signals from testing to trigger fast compensating controls. He says Armadin is working with existing security vendors rather than replacing every defensive platform a customer already uses.

A temporary control is like stopping bleeding, he says: it can buy time but does not eliminate the need to investigate and fix the underlying issue. Integration with deployed security systems is part of the proposed approach.

Asked about the security operations center, Mandia predicts more automated prevention, detection and response. He also says layered defenses and assumptions of failure remain necessary when a new path has not yet been assessed.

His concern is that a successful intrusion could spread faster than a human analyst can manually respond. The practical balance between speed, false alarms and the consequences of automatic actions still needs careful design.

Mandia says security leaders are reassessing their teams and exposure as model capabilities change. He describes organizations scanning their own systems and mobilizing engineering resources to reduce risk.

The discussion turns to an incident involving Hugging Face and the difficulty of anticipating what a model may do. Mandia’s broader lesson is that AI researchers and experienced security practitioners need to design safeguards together.

For sensitive security testing, he describes layered controls such as isolated execution, proxies and monitoring. He argues for stopping or escalating activity when it crosses a boundary, while recognizing that each control can fail.

He says domain experts need to shape evaluations around the actual environment and likely failure modes. A system that appears safe in a generic test can behave differently when given tools and real access.

Mandia describes an internal comparison of open and closed models on a set of security tasks, saying results differed in speed and cost while reaching similar endpoints. The interview does not provide enough methodology to generalize that result.

He compares the need for better AI audit trails to the adjustment security teams made when cloud computing changed incident response. Organizations need to reconstruct what happened, identify what the agent did and improve controls.

Mandia argues against both fear-driven paralysis and unchecked deployment. His suggested approach is to test incrementally, inspect inputs and outputs, and pause or escalate unfamiliar activity for human judgment.

He says the team has seen technology find some recent vulnerabilities itself, while humans continue to participate. He views this as a change in how security expertise and automation are combined.

The conversation shifts to building Armadin. Mandia contrasts reactive incident response with trying to find and address weaknesses before an attacker does, while acknowledging that response remains necessary when prevention fails.

He credits the network of colleagues and alumni built through earlier security work. Relationships can help a new company reach customers, but a product still has to solve a pressing enterprise problem and earn trust.

As the company grows, Mandia emphasizes repeatedly training sales teams as the product changes. He says scaling requires clear processes and frequent testing of whether those processes still work.

The founders discuss the role of urgency in enterprise adoption and the challenge of moving quickly while retaining security discipline. Mandia’s focus is solving difficult customer problems and keeping the company aligned around them.

Mandia closes by saying security organizations will have to adapt as AI changes both attack and defense. The conversation presents his company’s strategy and forecasts, not a neutral test of its effectiveness.