Kevin Mandia, the founder who built Mandiant into a $5.4 billion acquisition by Google in 2022, has secured $255.5 million in Series B funding for his new venture Armadin at a valuation exceeding $2.5 billion. The round, announced Thursday, was led by Andreessen Horowitz and Accel, with participation from Bain Capital Ventures, Redpoint, 8VC, Ballistic Ventures, Google Ventures, In-Q-Tel, Kleiner Perkins, and Menlo Ventures. The capital arrives just six months after a $190 million Series A in March, bringing total funding past $445 million.
From incident response to continuous agentic testing
Mandiant made its name helping organizations respond after breaches had already occurred. Armadin inverts that model. Instead of periodic penetration tests where human operators attempt intrusion and deliver a findings report, Armadin deploys persistent agentic swarms that continuously chain vulnerabilities together to gain access. The swarms operate around the clock, probing for the multi-step paths that human testers might miss or that emerge between scheduled assessments.
How the swarms work
Each swarm consists of multiple AI agents that collaborate. One agent might enumerate exposed services, another crafts an initial foothold, a third escalates privileges, and a fourth moves laterally. They share context in real time, adapting their approach as they discover new attack surface. This mirrors how sophisticated human adversaries operate but at machine speed and scale. The system records every step, producing an auditable trail that maps exactly which chained weaknesses allowed compromise.
The AI-era threat model driving demand
The fundraising momentum reflects a shift in how security leaders view the threat landscape. As AI labs release increasingly capable autonomous agents, the barrier to launching sophisticated multi-stage intrusions drops. A rogue or misused agent from a legitimate AI service could theoretically probe targets continuously, chaining vulnerabilities faster than human defenders can patch. Armadin's pitch is that only an equally persistent, agentic defense can keep pace — finding and validating fixes before the adversary's agents do.
Investor conviction in the category
The investor roster spans traditional venture, corporate venture, and strategic government-adjacent capital. In-Q-Tel's presence signals interest from the intelligence community. Google Ventures' participation is notable given Google's ownership of Mandiant. The speed of the Series B — six months after Series A — suggests the team demonstrated early technical traction that justified rapid follow-on capital at a steep valuation step-up.
What this means for security operations
If agentic swarms prove reliable at discovering chained vulnerabilities that traditional tools and periodic human tests miss, the economics of security validation change. Organizations could move from annual or quarterly point-in-time assessments to continuous assurance. The swarm's output — a prioritized, validated list of exploitable chains — feeds directly into remediation workflows, reducing the time between discovery and fix. The model also creates a feedback loop: as the swarms learn new techniques, those techniques immediately inform defensive priorities across all customers.
Early stage, high stakes
Armadin is still early in product development. The Series B will fund engineering scale-up, swarm orchestration infrastructure, and go-to-market for enterprise customers. Success depends on proving that autonomous swarms can safely operate in production environments without causing disruption, that their findings are actionable and low-noise, and that they can keep pace with evolving adversary techniques. The $2.5 billion valuation prices in not just current traction but the potential to define a new category of continuous, AI-driven security validation.