AArmadin provides an AI-native cybersecurity platform that helps large enterprises prepare for AI-driven cyber threats. Its system uses a swarm of specialized AI agents that simulate attacker behavior to continuously reason, plan, and adapt, seeking exploitable vulnerabilities and kill chains across an organization’s attack surface. Unlike traditional scanners, Armadin’s agents return proof of what can be exploited, enabling proactive remediation and a reduction in testing time from days to minutes. The company differentiates itself through autonomous, attack-minded AI that operates at machine speed, combining red-teaming expertise with AI research to detect and validate risks across multi-modal, rapid campaigns (hyperattacks). The goal is to shift security from reactive checks to proactive, continuous testing that keeps pace with AI-enabled threats, serving Fortune 100 enterprises on a subscription basis.
Work here?Claim your company
Industries
Company Size
51-200
Company Stage
Series B
Total Funding
$469.5M
Headquarters
Redwood City, California
Founded
2025
See people who can refer or advise you
Help us improve and share your feedback! Did you find this helpful?
Total Funding
$469.5M
Above
Industry Average
Funded Over
3 Rounds
Industry standards
Kevin Mandia's $2.5B Armadin startup uses AI agent swarms to reinvent enterprise security. Tl;dr. * Former Mandiant CEO Kevin Mandia has launched Armadin, raising $255.5M at a $2.5B valuation to build autonomous AI agent swarms for enterprise defense. * Armadin deploys teams of offensive and defensive AI agents that continuously attack, detect, and remediate networks in real time without human bottlenecks. * Backed by top-tier Silicon Valley investors, the massive debut signals a shift from human-led SOCs to always-on, machine-scale cyber defense. The legend behind Mandiant is back. Kevin Mandia doesn't start companies for fun. He builds them when the defensive model is broken. The former U.S. Air Force officer turned founder of Mandiant defined modern incident response. After FireEye acquired Mandiant for over $1 billion in 2013, Mandia led the combined company, took it back to the Mandiant name, and then steered its $5.4 billion sale to Google in 2022. He stayed to integrate Mandiant into Google Cloud Security, then quietly stepped away. Now, just as AI-driven attacks are overwhelming enterprise security teams, Mandia is returning with what he calls his final architecture: Armadin. Announced this week, Armadin has come out of stealth with a staggering $255.5 million in funding at a $2.5 billion valuation, one of the largest cybersecurity seed-to-Series A debuts on record. What is Armadin building? Security as A swarm. Armadin isn't another AI copilot for analysts or a chatbot layered on top of a SIEM. It's a complete rethink: a swarm of autonomous AI agents that live inside the enterprise and fight as a coordinated unit. The platform fields dozens to hundreds of specialized agents working in parallel. Red agents continuously probe for weaknesses, mimicking ransomware gangs, nation-state APTs, and insider threats. Blue agents monitor telemetry, hunt for anomalies, and triage alerts. Purple agents in the middle validate exploits, kill false positives, and autonomously deploy fixes, from isolating endpoints to rewriting firewall policies and rolling back identities. Instead of annual penetration tests and alert queues that take days to clear, Armadin promises continuous, live-fire testing and defense at machine speed. Human analysts move from the front line to commanders' intent, setting rules of engagement while the swarm executes. Mandia has described it as going from castle walls to an immune system. Inside the $255.5M mega-raise. The scale of the raise reflects both Mandia's track record and the urgency around AI security. According to the company, the $255.5 million round was raised across stealth seed and Series A tranches, led by Andreessen Horowitz and Sequoia Capital with participation from Lightspeed Venture Partners, ICONIQ Growth, and strategic angels including former CISOs from Fortune 100 banks and tech giants. The $2.5 billion valuation puts Armadin instantly into decacorn-track territory, ahead of even Wiz and Abnormal at a similar stage. Sources close to the deal say the round was heavily oversubscribed, with investors betting that Mandia can repeat the Mandiant playbook of trust with CISOs and government leaders. Armadin says it already has design partners in financial services, healthcare, critical infrastructure, and federal-adjacent sectors, and will use the capital to scale its engineering team in Northern Virginia, Austin, and Silicon Valley, plus build sovereign-ready data centers for regulated customers. Why investors are betting big on autonomous defense. The timing is no accident. In 2026, enterprise SOCs are drowning. AI-generated phishing, deepfake social engineering, polymorphic malware, and automated vulnerability discovery have collapsed attacker dwell time from days to minutes. Meanwhile, there is a global shortfall of nearly 5 million cybersecurity professionals. Venture firms see agent swarms as the only way to close that gap. Static rules and single-agent assistants can't keep up with attacker swarms that probe thousands of vectors at once. Only a defensive swarm can match scale with scale. Mandia brings something few AI founders can: two decades of frontline breach credibility from the Sony hack to SolarWinds to Colonial Pipeline. For boards terrified of AI breaches, that trust is the moat. What it means for the future of cyber defense. If Armadin delivers, it could kill the security model as Androguider know it. The era of human-led alert triage, quarterly red teaming, and 100-plus tool sprawl would give way to lean, autonomous platforms where testing and response happen continuously. Rivals won't sit still. CrowdStrike, Palo Alto Networks, Google Mandiant, and a wave of AI-native startups like XBOW and Seven AI are all racing toward agentic security. Expect rapid consolidation, talent wars for AI red-team researchers, and fierce debate over guardrails: who is liable when an autonomous agent quarantines a hospital network or blocks a trading desk? Mandia acknowledges the stakes. Armadin is launching with a containment-first architecture, human override controls, full audit trails, and FedRAMP and SOC 2 Type II compliance in progress. But his message to CISOs is blunt: attackers already have swarms. Defenders now need their own. AndroGuider Team Articles written by the AndroGuider team. Androguider try to make them thorough and informational while being easy to read.
From cybersecurity expert to unicorn founder: what kevin Mandia's $2.5B Armadin raise teaches African entrepreneurs. The Armadin story: how a cybersecurity legend built a $2.5B company. Kevin Mandia, the founder of Mandiant (acquired by Google for $5.4 billion), just proved that legendary entrepreneurs can do it again. His new startup, Armadin, has raised $255.5 million in funding at a $2.5 billion valuation - making it a unicorn before most companies reach their first anniversary. But this isn't just another Silicon Valley success story. Armadin's breakthrough approach to cybersecurity using "agent swarms" - autonomous AI systems that test and protect enterprise networks - reveals critical lessons for African founders building the next generation of tech companies. What makes Armadin's funding round significant. Armadin's $255.5M Series A represents more than just a big check. It signals investor confidence in founder credibility, innovative technology, and massive market demand. Here's what stands out: * Founder pedigree matters: Mandia's track record as a serial founder made this raise possible. Investors bet on people, not just ideas. * Solving real problems: Enterprise cybersecurity is a $200+ billion market. Armadin addresses genuine pain points with AI-powered solutions. * Timing and technology: The rise of AI agents caught investor attention at exactly the right moment. Why this matters for founders. If you're building in Africa, you might think billion-dollar valuations are out of reach. They're not - if you understand what attracts institutional capital: 1. Build on proven expertise: Mandia didn't start from zero. He leveraged 20+ years of cybersecurity credibility. What's your domain expertise? How can you position yourself as the go-to founder in your space? 2. Target massive markets: Armadin isn't solving a niche problem. Enterprise security affects every company globally. African founders should think big - your market isn't just Nigeria or Kenya; it's the continent and beyond. 3. Demonstrate traction before the big raise: While details are limited, investors typically don't write $255M checks without proof of concept. Start small, show results, then scale. 4. Focus on defensible technology: Agent swarms are complex, hard to replicate, and solve critical problems. Build something that creates genuine competitive advantage. The fundraising playbook. Armadin's raise teaches FundNaija, Inc. that successful fundraising requires three elements: a credible founder, innovative technology solving a real problem, and a massive addressable market. Whether you're raising $500K or $255M, these principles remain constant. African founders often underestimate their potential. But the global investor community is increasingly looking beyond Silicon Valley. If you're building something that solves real problems for enterprises or consumers at scale, institutional capital is within reach. Want to check your funding readiness? Try FundNaija's free FundScore to assess your startup's investment potential, identify gaps, and get personalized recommendations for your next funding round. Get funding-ready today. Create an AI-powered business plan and discover funding opportunities tailored to your business.
Armadin targets autonomous remediation with $255.5M Series B. Company Plans to Extend Compensating Controls Across MDR and WAF Platforms Michael Novinson (MichaelNovinson) - October 2, 2026 A startup led by Kevin Mandia raised $255.5 million at a $2.5 billion valuation to provide rapid, near-real-time defenses against critical vulnerabilities and emerging threats. The Andreessen Horowitz and Accel-led Series B funding will help Silicon Valley-based Armadin provide autonomous remediation by integrating with MDR providers and building out compensating controls such as web application firewalls, said co-founder and Chief Offensive Security Officer Evan Pena. He said this will help Armadin address the growing challenge of AI-powered attacks. "We need this capital to truly scale what is needed in the moment," Pena told ISMG. "Everyone has nation-state adversaries, insider threats, essentially people that are attacking our customers and everyone pretty much in the space, and so we need to scale." The company is led by Mandia, who previously spent two decades at threat intelligence and incident response firm Mandiant. He first sold Mandiant to FireEye in 2013, became FireEye's CEO in 2016, sold the company's product portfolio to Symphony Technology Group for $1.2 billion in 2021 and then sold the services business - renamed Mandiant - to Google for $5.4 billion in 2022. He left Google in 2024 (see: How AI-Based Red Teaming Agents Can Reduce Cyber Risk). How Compensating Controls can block exploits. Armadin wants to develop compensating controls or stopgaps that can be deployed at machine speed to block exploits while customers work on permanent fixes, which Pena said can take days or weeks. The first integration was with CrowdStrike's Falcon MDR, which Pena said enables users to push a block rule with a single button to stop a kill chain. Armadin wants to expand this capability to SentinelOne and Microsoft. "It generally takes longer than five minutes," Pena said. "It could take days. It could take weeks. And so, what can you do in the meantime to prevent that from happening?" Pena said managed detection and response was chosen as the starting point because it's less disruptive and AI can effectively craft specific block rules with the right context to thwart adversarial activity on endpoints such as remote code execution. From there, Pena said the team plans to integrate with web application firewalls to block application-layer attacks such as SQL injection. "Adding different compensating controls at different layers of the network stack or the OSI model - that's where you can try to cover your full stack for protection and defense," Pena said. A key challenge in developing compensating controls for WAFs is ensuring they don't block legitimate user activity, and Armadin is addressing this with existing customers that provide dev/staging environments for testing and iteration. For MDR, the risk of blocking legitimate activity was lower, and monitoring the Falcon dashboard helps the team ensure they weren't generating false negatives. "It's not a silver bullet," Pena said. "We bypass WAFs all the time, but it will definitely help for a small period of time before it gets bypassed again." How Armadin flags which customers are susceptible to issues. Pena said the Series B funds also will be used to add more integrations for ticketing and remediation tracking beyond Jira and ServiceNow and to improve the emerging threat pipeline. This includes notifications within the platform - in addition to email - and integrations into chat platforms such as Slack. Existing customers will test and validate Armadin's new features in non-production environments. "We don't want to just tell you where you're bad, we want to tell you how to fix it," Pena said. "And so what we would do is we'd integrate it with ServiceNow and Jira. And so, if you put a remediation ticket in, whenever you close it out, we can auto retest to see if it's actually remediated or not." The company is investing in its internal threat intelligence team, which researches how to get AI agents to create proofs of concept for new vulnerabilities. Pena said building a proprietary intel pipeline will help the company rapidly identify which customers are susceptible to emerging threats - suc as the recent Citrix NetScaler CVEs - and provide them with actionable notifications within 24 hours. "We built it so fast because we're able to scale with AI," Pena said. "And the last thing I'll harp on is it's not only that we're able to scale with AI. We were doing this manually our entire careers." Success for the Series B funding will be measured by revenue growth, which is forecasted based on headcount increases. Pena said Armadin also will track the number of new integrations developed, the number of attack simulations run, the number of agents deployed, inference cost, and the overall cost of goods sold, with a goal to improve efficiency and lower costs over time. "Brace for impact, and I say that very genuinely because what we're seeing in the industry, what we're finding even at Armadin, we know adversaries can do the same," Pena said. "The moment is now." Executive Editor, Business, ISMG Novinson is responsible for covering the vendor and technology landscape. Prior to joining ISMG, he spent four and a half years covering all the major cybersecurity vendors at CRN, with a focus on their programs and offerings for IT service providers. He was recognized for his breaking news coverage of the August 2019 coordinated ransomware attack against local governments in Texas as well as for his continued reporting around the SolarWinds hack in late 2020 and early 2021.
Armadin raises $255.5 million to expand AI offensive security platform. Security · 01 Oct 2026, 19:16 · 4 views Armadin has raised $255.5 million in Series B funding co-led by Andreessen Horowitz (a16z) and Accel that brings the company's valuation to over $2.5 billion. The round includes participation from new investors Bain Capital Ventures (BCV) and Redpoint. Existing investors 8VC, Ballistic Ventures, Google Ventures, In-Q-Tel, Kleiner Perkins, and Menlo Ventures also returned, reflecting their continued confidence, bringing Armadin's total funding to $445 million. Seven months after emerging from stealth, Armadin is running agentic attack … More → The post... No comments yet.
Mandiant founder's Armadin banks $255.5M for AI offense. The Palo Alto cybersecurity startup has raised a Series B at a valuation above $2.5B, seven months after leaving stealth. Last updated: October 2, 2026 2:36 am Very few cybersecurity startups travel from stealth to a multibillion-dollar valuation in seven months. Palo Alto's Armadin has just done exactly that. The offensive-security company, led by Mandiant founder Kevin Mandia, has raised $255.5M in Series B funding at a valuation above $2.5B. Andreessen Horowitz and Accel co-led the round. Bain Capital Ventures, Redpoint, 8VC, Ballistic Ventures, Google Ventures, In-Q-Tel, Kleiner Perkins and Menlo Ventures also joined, lifting Armadin's total raised to $445M. The company sells what it calls an autonomous swarm of specialized agents that reason across a customer's attack surface. Rather than scanning for a list of known problems, the agents chain individually minor weaknesses into validated attack paths, which security teams can then cut before an intruder finds them. Armadin says it runs these agentic attack campaigns inside production environments for Fortune 500 and government customers. The pitch reflects a wider shift in cybersecurity, where defenders are adopting the same agentic tooling attackers use. The company argues that continuous, automated offense is the only way to keep pace with software that changes daily. The round stands out in a market where investors, scarred by thin AI wrappers, now favor companies tied to real operational decisions.
Find jobs on Simplify and start your career today
Industries
Company Size
51-200
Company Stage
Series B
Total Funding
$469.5M
Headquarters
Redwood City, California
Founded
2025
Find jobs on Simplify and start your career today