Hello everybody. Sanjay Poonen here, president CEO of Cohesity. I'm delighted to welcome you to the next iteration of our podcast Resilience Universe. I'm joined today by a celebrity in the cybersecurity space that needs no introduction, my good friend Kevin Mandia, who until recently was CEO and founder of Mandiant. It got sold to Google. He's now CEO of a hot new company Armada that we're going to talk about too. He's an investor in Ballistic Ventures, a partner there, and has had a tremendous reputation in the United States and across the world at fighting cybercrime. I think the cyber guys, if they're scared of one person in the world, they're scared of Kevin Mandia because of his ability to get calls often from CEOs not just to save them, but also the government when it comes to cyber crimes. So, welcome Kevin to this edition of our podcast.
Well, let's start a little bit of where you started. How did the idea of Mandiant get to bear? You were in the US Air Force. Why did you start the company and how did that company evolve into something that eventually sold to Google?
Right. So, Sanjay, I could spend the whole time talking about that. The reality is I was only good at one thing. I graduated college with a computer science degree in 1992, and in 1993 I was in the United States Air Force doing computer security. So, I kind of grew up with the birth of intrusions. From 1993 to 1998 I was responding to computer security events or intrusions for the Air Force and just kept doing it. I had a unique vantage point that as information and communications went online into the cyber domain, that's where espionage went. And then in 1995-96, people started launching their businesses in the cyber domain, so that's where crime went. So, you end up with basically crime and espionage in the cyber domain, and then you get the drive-by shooting. I kind of grew up with it. Every single company has a tech expert and then the other guy. Believe it or not, I was both when we founded Mandiant. I was the guy in the trenches responding to breaches all the way till 2012 or 13. Long story made short, you start a company because you're good at something, you love what it is, and you believe it's important. And really there was no other company on the planet in 2004 when I started Mandiant whose competence was to respond to every breach that matters so that we have first mover advantage on all the new and novel attacks. So, that's kind of the genesis.
The thing that was remarkable about Mandiant is I've met people who I consider little mini Kevin Mandias. You created a culture at the company of people who were best of breed in incident response. How did you do that?
Yeah, it's funny. All companies really are made in the image of the leaders that got there. There's no question about it. So, if you have a very technical leader at the beginning, they hire very technical people usually, and you get this culture of engineering domination. At Mandiant, we just had a natural culture of our customers' problems were our problems. If we were responding to a breach to figure out what happened and what to do about it, Sanjay, like it was our problem. We physiologically felt the impact of what the victims were going through. I remember getting calls very early in my career and it'd be like, hey, we've been breached. And I'd think literally, what are we going to do about it? It was almost like we were right there with them. If we were responding to a breach for company A, it's almost like we would put the company A swag on and let's go fight it. So, there was something very personal about it, and I think that's what was reflected in the people. And then the second thing is we were a self-funded startup at Mandiant. So, I was asking people, my first set of engineers was Dave Merkel, and I remember saying, hey, how about taking 1/3 the pay you're getting now, but join the garage band. Or I had a great leader for consulting, Steve Sordu, and I was like, hey, how about getting half the money you're getting now and leading our services. When you're asking people to sacrifice that much, you feel a social contract to make all of us better at our tradecraft while we work together. So, I think there was a big bond in Mandiant that you may work there for a year, you may work there for 15 years, but you will not leave the same person. You will leave exceptional at your tradecraft.
And one of the other things I've heard you talk about was there was a competitive culture inside Mandiant where you as maybe sometimes the older guy was trying to compete with the kids to be better than them. And that it's a little bit like the Marines, right? The older Marines like, well, I can one-up this 22-year-old, but that actually makes the organization better. Talk a little bit about that competitive culture inside the company.
Well, there's no question. Everyone leading a breach, it seemed like we'd all come back on somehow we solved every breach by Friday so we could catch our flights back to Washington, D.C. at the time. But I do recall even when I was showing up on the front lines, I remember responding to a defense industrial base intrusion in 2008. And I'm showing up with a guy who graduated MIT, and I'd gone to Lafayette College. Last I checked, MIT here, Lafayette here. But anyway, I remember I sat next to him doing forensics and I'm like, I bet I beat you. And he's like, what are you talking about? And I'm like, I'm going to find the malware first. I'm going to find the backdoor first. I'm going to find who did it first. And we raced, and I did beat him, by the way, Sanjay. That's what's funny. We had different methodologies. He was definitely smarter than me, but I'd raced more. So, but that was our culture.
Well, for some of us 50-somethings to have that type of culture even today, that's amazing.
Yeah, I'll tell you even in the AI world, I'd recommend for you and for every CEO, create your own agent, start working with Anthropic, start working with OpenAI, start working with Gemini, start working with something and get to understand it now. Dive in the ring, get front-line knowledge.
Well, let's talk a little bit about, I mean, these are all public names. There have been breaches that have been on the cover of Wall Street Journal, New York Times, whether it's SolarWinds, Colonial Pipeline, or more recently Stryker. And these are obviously incredible companies who are doing things right, but they get in the middle of something that happens. What are the lessons one takes away from them? Because almost every one of those situations you've been called. In some cases like SolarWinds, I saw you in front of Congress. Are there any common themes that are lessons one can take away from all of these name-brand attacks that have happened? And by the way, what's happening in the United States is also happening in other NATO-friendly countries or in Japan.
Well, I can tell you the first thing, you get to meet, at least I got to meet leadership at these companies under duress. And you get to see great leadership in action. I learned how to respond to my own breach, Sanjay, by inspecting the people I helped. They taught me. But first and foremost, if these companies knew about the vulnerabilities they had, they would have fixed it. They didn't know. Nobody was omniscient, and that's the problem in the cyber domain is nobody had an always-on, where are we vulnerable, and what can we do about it kind of dashboard. Never existed. Still doesn't really exist for that situational awareness. So, you would show up and you'd diagnose, here's victim zero. All these companies really had willing and able people that if they knew, they would have fixed it. If they knew, they would have done something. But there was never that omniscience of you could just tell that you had a problem. Second, sometimes we underestimate the threat. There are times where it's just hard to know how determined they are, and every once in a while I've responded to breaches where it really just wasn't fair for the victim. I hate to say it. You had men and women in uniform coming after your company on a daily basis. It just wore down the defense, and the defense really doesn't know it. Third, the biggest problem also, Sanjay, it's just unfair. Both criminal element and espionage are getting unlimited shots on goal. There's just no risk or repercussions in the cyber domain to constantly hacking. So, when you see that kind of asymmetry, it's just advantage goes to the offense because of that no risk or repercussions, invisible domain, no situational awareness at all times as to where you might have a gap in your network. And we are changing our networks all the time. Every second. New IDs are popping up. Accounts are being shut down. New apps are being published and going into production. New offices are opening up. New humans are getting hired or dismissed. That's so dynamic, nobody just had situational awareness. So, I'll kind of stop with that. There was just no magic. Nobody knew, hey, I wish I knew that one day before the attackers exploited us, we would have fixed it.
I mean, all these things because I've also been in the cyber industry 15 years, watched every one of these. Most often I hear about them, I'm calling you first to learn the learnings. It does teach us all to be humble because this could happen to any of us, and there's no arrogance. You sit in a perch, you could be next. I would like to kind of get a sense if you take the NIST framework, you talk about detect, prevent, recover, mediate. Both are important. We play at the center of resilience, and you've talked about an assumed breach mindset to resilience, which I think is a very apt phrase. We obviously built our company based on that type of mindset. Assume breach, and then you work on resilience. Are these both important? How important would you play resilience in the midst of a detect, prevent on the left side of NIST, and a recover, mediate on the right side of NIST?
