Kevin Mandia, who built Mandiant into one of the world's best-known cybersecurity firms before selling it to Google for $5.4 billion in 2022, has raised $255.5 million for his new venture, Armadin, at a $2.5 billion valuation.
The financing arrives just six months after Armadin closed a $190 million Series A in March, bringing the company's total raised to more than $445 million. The pace — two nine-figure rounds inside half a year — places Armadin among the fastest-capitalized security startups in recent memory.
Armadin's product is built around what the company calls an "agent swarm": networks of autonomous AI software agents that detect, investigate, and respond to intrusions with minimal human direction. The approach aims at the security industry's long-running staffing problem, in which alert volumes outpace the analysts available to triage them.
Mandia's track record is the clearest explanation for the funding speed. He founded Mandiant in 2004 and led the company through the investigation of some of the highest-profile breaches of the past two decades, including the 2013 disclosure of Chinese military-linked hacking of U.S. companies and the 2020 SolarWinds campaign attributed to Russian intelligence. Google acquired Mandiant in a deal that closed in 2022, and Mandia later served as strategic adviser at Google Cloud.
The valuation reflects how aggressively venture investors are pricing AI-driven security tools. CrowdStrike, Palo Alto Networks, and Microsoft have all pushed generative and agentic AI into their detection platforms over the past two years, and startups including Abnormal Security and Wiz have commanded multibillion-dollar valuations on the strength of automation claims.
Whether autonomous agents can be trusted to take remediation actions — isolating machines, revoking credentials, blocking traffic — without a human in the loop remains an open technical and liability question. Security teams have historically resisted handing response authority to software that can misread an attack and disrupt legitimate business operations.
Armadin has not disclosed its customer count or revenue. The company joins a crowded field of startups promising to compress the time between intrusion and containment, a metric that Mandiant's own incident response work showed often stretches to weeks or months.
