Kevin Mandia: AI Found 90-Plus Zero-Days at Fortune 500s, and Defense Must Go Autonomous

Armadin, a startup founded by Kevin Mandia — the man who built the incident-response giant Mandiant and sold it into Google — says it has found more than 90 zero-day vulnerabilities at customer sites since January. All of them in production environments. All at Fortune 500-class companies. All found by AI agents working "black-box" from the internet, with no source code access.

That number, shared by Mandia on a recent episode of the a16z podcast, is the most concrete evidence yet that AI-driven offensive security has moved from theory to operational reality. It is also, in Mandia's framing, the opening of a shift change in security after 30 years — one where the human-in-the-loop model collapses entirely.

"The whole 'let's slow down the models, we don't want cyber risk' — too late," he said. "The open models are already good enough."

The implication is blunt: the window to constrain AI's offensive cyber capability through model governance has closed. What matters now is whether defense can become autonomous faster than offense scales.

The drone swarm replaces the sniper round

Mandia's central argument is that AI changes the fundamental character of cyber attack. Historically, nation-states and sophisticated criminals behaved like snipers — careful, surreptitious, and deeply targeted against a narrow set of high-value systems. AI changes the calculus toward what he calls a "drone swarm": broader, noisier, and less surgical, but ultimately more effective because it is more comprehensive.

AI brings three advantages to offense, he said: scale, speed, and comprehensiveness. A human attacker picks one path into a network because resources are limited. An AI attacker can deploy "25,000 agents in concert" to probe many paths at once. A human works sequentially, one keystroke at a time. "What AI does in a microsecond would take 70 humans," Mandia noted. And while a human attacker is necessarily selective, AI "exhausts all routes all the time."

The tradeoff is stealth. Mandia is direct that current AI attacks are detectable because they are "a little sloppier, a little louder" — an agent will break into point A, move to point B, then try A again, creating a repeating signature no careful human would produce. But he expects that to change as models improve.

The net effect, he predicts, is an equalizer: less capable, less technical attackers will appear far more successful because volume substitutes for skill. That has consequences for attribution, too. Defenders will increasingly know they are being attacked by models — but not whether the operator is a nation-state, a criminal group, or a lone individual.

The kill-chain benchmark: all models stall at 8 of 20

Armadin built 20 full kill chains — complete attack sequences that human red teamers have executed in the real world, at real victim sites — and ran both open-weight and frontier closed models against them. The result was striking.

"We had no model go through the entire kill chains of more than eight," Mandia said. "We tested the open weight ones and the most advanced closed models, they all found eight."

That finding has two implications. First, AI attackers still fall short of completing a full human intrusion chain. Second, and more contrarian, the capability gap between open and closed models in the cyber domain is essentially zero.

"So in the cyber world, the differentiation between closed and open is not as great as in other domains," he noted.

The remaining difference is speed and cost. Closed models get to exploitable risk faster, but open models run longer reach the same place. Mandia predicts that speed advantage will compress over time, and that open and closed models will converge in cyber capability.

This matters enormously for the policy debate over pausing or slowing frontier AI development. If open-weight models already match closed models on offensive cyber tasks, no amount of frontier lab caution changes the threat landscape. The open models are out.

Why pen testing is dead — and what replaces it

Mandia's deepest corporate critique is reserved for penetration testing, the decades-old practice of hiring humans to probe a network for weaknesses on a periodic schedule.

"Pen testing to me is always just scanning for what's already known, and it doesn't prove whether you're really exploitable or not," he said. "So it's always created a larger list of volumes that don't matter."

Armadin's alternative is what Mandia calls a "hyperattack": a drone swarm of agents thrown at a network to map every service, route, system, and asset — generating potentially terabytes of metadata. That metadata becomes a "twin" of the attacker's view of the network. Armadin then polls that twin like a heartbeat, looking for change: did an app change, did a route change, did a new machine appear — and attacks the change.

The logic for continuous but not constant pressure has three triggers: the threat changes (new models, new intelligence), the network changes, or the organization wants a self-audit. Mandia's example: "we have a board meeting tomorrow, let's see how we do."

The key difference from traditional scanning is verification. Armadin carries the exploit all the way out — remote code execution or data exfiltration — so there are no false positives. Mandia says Armadin typically calls a CISO within 48 hours with remote code execution in their DMZ, and the affected companies go straight into incident mode.

He also draws a sharp line against source-code scanning tools, which he dismisses as noisy by comparison. "Mythos came out and you can scan source code and find vulnerabilities and you find thousands of them. That's noise."

The reason Armadin's approach works, Mandia said, is that vulnerability discovery is a structured problem. "It's a structured language, a structured process." And structured processes are where AI excels. Critically, "when you have an AI-based attack, it'll find logic flaws rather than code flaws in custom applications" — a qualitative shift beyond known-CVE scanning.

The closing window for human defenders

Armadin's product roadmap has two acts. Act One is Armadin Red — finding exploitable risk. Act Two is Armadin Blue: taking those findings and working with the defense plane — endpoint EDR, firewalls — to create compensating controls at speed. Mandia describes it as field dressing rather than a hospital: stop the bleeding now, do the slower human work later.

He names CrowdStrike and Palo Alto as partners already engaged, and argues that CISOs will get autonomous defense whether they ask for it or not, because their existing platforms will ship it.

His broader claim the security operations center is uncompromising: any human in the detect-and-respond loop is too slow. Prevention will be governed by AI; detection and response will be done by AI. The goal has always been to prevent rather than detect and respond, and the window for each phase keeps narrowing. But Mandia still insists on layered failure — "assume every layer of your security will fail" — and on traps behind the force field for the case where someone finds an exploit Armadin hasn't assessed.

The urgency comes from experience. "When we break in and have an agentic, aware, internal command and control, it proliferates at a speed that is shocking... This thing just does a thousand things at once. It's just everywhere."

He is explicit that no one knows where this lands. CISOs are examining workforce, headcount, and process, but "it's too soon to tell where it lands." He describes the current moment as two-sided desperation: offense is desperate to get in now while its advantage holds; defense is desperate to patch every window. Both are correct, he said, because the near-term advantage belongs to offense, while the long-term gain goes to autonomous defense trained by autonomous offense.

"You have to marry those two up": the domain expertise problem

When Mandia talks securing autonomous agents, he rejects the idea that AI safety is purely an AI problem.

"It does take domain expertise to secure agents behaving in certain domains," he said. "Security people don't understand the AI as well and the AI people don't realize — you have to marry those two up."

Armadin deliberately staffs its evals and safety work with red teamers and exploit developers rather than pure AI researchers. Only people who understand exploitation can anticipate what an agent will do, Mandia argued. He points to the Hugging Face incident as a case where AI people without security domain expertise underestimated what a model could do — and he predicts the same class of mistake will recur with each modality shift.

His prediction is that model companies will improve logging, audit trails, and forensic capability for agent activity, and will be "materially better at this than they were three months prior." He cites the fact that figuring out what happened when an agent goes rogue should not require two weeks of forensics — something that does happen today — as the kind of gap that must close.

Mandia also describes Armadin's own operational controls: a hypervisor, host-based lockdown, a known proxy, and passive inspection of every prompt with human thumbs-up/thumbs-down classification. Most agent kills are cost control, not safety — an agent off on a goose chase. He warns against over-determinism: cage the beast, but "cage it too much, release a little bit. Find the line," because excessive restriction throws away the model's creativity.

Building Armadin: speed, brand, and "raving customers"

Mandia is remarkably direct that Armadin cannot be built the way Mandiant was. Mandiant started in February 2004, self-funded and profitable, with a premise nobody believed — its first headline was "you cannot solely rely on preventive measures," which he admits was a boring way of saying breaches are inevitable.

Armadin faces the opposite conditions: an 80-mile-an-hour tailwind, no sales force, no go-to-market, no international presence, and a crowded field. Mandia lists four differences from the Mandiant era: funding, speed, brand mattering, and go-to-market having to be built far faster.

He uses Wiz as the benchmark — over $100 million in ARR in 18 months from first release — and says Armadin will try to beat it. That requires hiring scalable leaders immediately and industrializing process, because "you can't win with grit, gut, and moxie." It also creates a training problem he hasn't solved: sales used to be trained once at January kickoff, but in the AI age the product changes every two weeks, so sales has to be retrained weekly. He still believes people buy from people, and that the faster tech changes, the more the customer needs a human to explain it.

On differentiation, his answer is almost anticlimactic: "Get a customer, make the customer happy, repeat."

He argues there will be no repeat of Mandiant's uncontested premise. "There's more founders today than ever before... you will have competition in anything you choose to do." The only moat is a customer base that raves.

"There is nothing else that will differentiate you other than your customer base raving you. So you better go do that."

That is why Armadin targets the 1A enterprise first — money-center banks, top retailers, airlines — chasing the "halo" that comes from landing marquee logos. He also keeps all engineers in one room, arguing that managing distributed teams is more complex than standing up and asking questions of 20 people.

The economics of continuous attack

Mandia concedes a real tension in his model: constant full attacks on large, fast-changing networks are cost-prohibitive. The continuous polling that Armadin's heartbeat requires is expensive, and the cost gap between closed and open models persists even where the capability gap has closed.

His prediction is that the cost of continuously polling networks for change will decline over time, making continuous AI-driven attack testing more affordable even on large, frequently changing networks. He doesn't offer a timeline, but the direction is clear.

That cost curve is the unresolved question. Whoever solves the economics of continuous autonomous testing — not just the capability — sets the pace for the category Mandia is trying to define.

The counterintuitive framing: offense begets defense

Mandia's most provocative argument is that you should welcome AI-driven offense — because it is already happening, and the only way to build an effective defense is to train it against the real thing.

"You're already getting some pressure on your network from an unseen force that's not well intentioned," he said. "You might as well have a better force built by the good guys constantly putting pressure on you."

This is the logic of "AI versus AI" security, and it has profound market implications. It means the buying decision for enterprises shifts from "should we buy this" to "which incumbent ships it first." The CrowdStrike and Palo Alto partnerships matter more than Armadin's standalone positioning, because autonomous defense will arrive through the platforms enterprises already use.

Armadin's 90-plus zero-days, found since January at production sites, serve as the proof point for the model. Mandia says the company's AI agents — not its human red teamers — found the most recent zero-days, a threshold he says most offense-oriented teams have already passed. If that holds, the 90-plus figure is a floor, not a ceiling, and the 48-hour CISO notification becomes a competitive benchmark.

The unresolved tension is cost. Mandia's prediction that continuous polling will get cheaper over time is plausible but unproven. The closed/open model gap persists on cost even where it has closed on capability. Whoever cracks that cost curve — and makes continuous autonomous offensive testing as ubiquitous as antivirus, which is Mandia's explicit ambition — will define the era of security infrastructure.

AI Security Firm Armadin Raises Approximately ¥40 Billion in Series B, Valuation Tops ¥400 Billion

AI Giants Charge Toward IPOs While Wearable Unicorns Hit the Brakes

KB Kookmin Bank Customer Data Breach Exposes 100+ Records; South Korea's FSS Launches Emergency On-Site Probe

Nikkei Stock Average surges 2,203 yen to 68,956 on concentrated buying in AI and semiconductor stocks

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.