This is W's Edge and I'm John Waters. Join me as we have real conversations with the defenders and innovators shifting the balance of power in cyber security. W's Edge is sponsored by ICounter, leading the third wave of cyber security with the industry's first counter threat operating system.
Kevin Mandia, thank you for joining me today on W's Edge. Appreciate you taking the time, man.
Hey, I like the title, by the way. I didn't know that's what you were going to call it. W's Edge.
You know, we both operated at the edge of security innovation for our entire careers and both understood that we needed to maintain the pace of the adversary, which required us to be in the intelligence business. We took two very different approaches. You made a career and built a legendary reputation educating the industry on how to investigate and respond to breaches and built a wonderful company behind it. And I was so happy to be a part of it towards the end when we sold it to Google. So, thanks for everything you've done for the industry.
So, I've been both a friend and an admirer for 25 years. Learned a lot from you in the history. We're going to learn a lot from you today. So, the audience, this is a special treat to have Kevin Mandia join us here. And I think as we move through the orientation of Kevin's history, how he developed and built companies through multiple economic cycles and the maturity of the cyber security industry, that really sets the context for how he's going to help us navigate the future of the cyber security industry.
Hey, you know, John, there are days where I wake up and I go, I'm going to live my life today. What would John Waters do? I never do it, but I wish I would.
Kevin. Well, it takes all forms, right? Different styles, same mission. So, let's go back to when we first met. 2002, November, Foxwoods Casino. I had bought iDefense out of bankruptcy for 10 bucks. Didn't know what I was doing. New to the industry, and I realized I had to hire somebody to run this company. I flew up to Foxwoods Casino in the snow just to meet with you. We hung out a while, ended up playing bocce in the snow, and that's where our journey and our relationship began. And you made a great decision to go out on your own. But of course, we stayed in touch over the last 25 years.
Yeah, it's weird how I remember that day with such clarity because you did catch me at a transition time. You know, I remember the snow. I remember knowing I was going to be doing something different. You know, I enjoyed the Foundstone days, John. But the reason I remember it is how many folks say, 'Hey man, meet me tomorrow at 9:00 a.m. We'll go play some bocce.' In my whole life, no one's ever invited me to play bocce before. Start with that. And there was a foot of snow outside. And I showed up thinking there's no chance you were going to be there. And sure enough, you're there with a 12-pack of Miller Lites and waiting for me. So, we played bocce in a foot of snow.
Yeah, that was crazy. We did play bocce in a foot of snow and think about the Foundstone days. You, George Kurtz, Stewart McClure, I mean you guys all grew up to be legends in the industry and that was those early days of cyber really a lot of fun. So Kevin, we move on from the bocce in the snow. You stayed at Foundstone for another year, spun out on your own, started what I believe was Redcliffe Consulting and then that became Mandiant. Tell me about those early formative days, what it was like to get in the game, the state of the industry. Help the audience understand what that early day of entrepreneurship looks like.
You know, it's not very flattering in a way when I describe it to myself. My internal voice is going to come out now. I remember thinking at the time, I was like 32 years old, 33 years old, John, and you know how you are at that age, you feel invincible. Yeah, I remember leaving Foundstone and starting my own company really because I felt I was the best in the world at incident response. Like it was confidence bordering on arrogance almost. It was obvious to me and you know this because you are in my opinion the threat intel guy because you kind of put all your chips on the table for threat intel. I remember thinking at the time the best company in the world would have to be a company in cyber security that got closer to the adversary. So when we started Mandiant, I remember thinking, let's respond to every breach that matters, not to become an incident response company. By the way, it was to learn about the new and novel attacks and have first mover advantage with that intel. So even the name, you remember it was originally called Redcliffe.
During World War II, I read I think it's John Keegan's book on what's the, you know, intelligence at war or intelligence in war. And I remember thinking during World War II, the Enigma decryption was being called Orange Leonard. You know, there was this whole thing that when the British were decrypting Enigma, they couldn't tell the world, hey, we can decrypt the German codes. So they had to come up with a cover story for it. So instead of Colin Nandian at the time, you know, or I'm wanting to call it Orange Leonard, the best source of intelligence during World War II was Orange Leonard, whoever this Luftwaffe major was. And it was all fake. It was something else. So I read that intelligence and war book and started Mandiant because I felt we needed a better model in cyber security where you had to learn from the adversary and Mandiant was supposed to be an endpoint company. You know, I like to say I executed so poorly nobody knows that, you know, but we were responding to breaches as a means to an end to build a better endpoint that could detect all the attacks everybody else was missing. But you'd understand it because to me we changed how threat intel was done. It became something that mattered and you know when we talk about Armadin later I feel like it's really just another threat intel company in some ways but that was it was the 33 years old confident had a skill set that I you know was well oiled I'd been doing it for six seven years with US military and what a great time to start a business you know and then with Foundstone kind of going through the startup with George Kurtz, Jim Mcclure, there was a bunch of great talent there. Joel Scambray, you know, just being young, hungry, you know, it was just the perfect time to start a company.
So, yeah, it's really remarkable the three of you guys built such incredible businesses. Two of the three building endpoint businesses, you building the incident response business and really launching that industry and I helped pioneer the intelligence industry, but we're all getting into the intelligence quotient the same way. We all needed to understand the adversary so you can figure how to defend against them. Intelligence leads operations, every element of warfare, it certainly was going to be warfare in cyberspace. So when you set the bar at Mandiant, you set it really high for you, your employees, for your customers in the industry. And that takes a lot of guts. When you go out to the marketplace and you are claiming that you're the best in the world at what you do, people expect performance. And man, you delivered. At every turn, you delivered. And that's really what built the reputation and trust that you have in the industry today.
Well, we had no sales staff. So, we started Mandiant in February of 2004 as Redcliffe Consulting, kind of bootstrapped it. So, we didn't take funding. Didn't have board meetings. And we just really believed in the premise if you make a customer happy, you just found your next five customers. Word of mouth. And then we believed in a premise, John, that actually I don't know if we had competition. And that's why we were successful is we believe security breaches were inevitable. And at that time, nobody did. So that meant we were it. So if you had a problem and you knew it, we became the number to call. And here's the weirdest thing. I have no idea how people found us, but we were doubling in size every year easily with no sales staff, no outbound. My cell phone would ring. No idea how people got it. And it'd be an inbound, hey, we've been compromised. We hear you're the guy to call. Maybe there's just nowhere else to turn. You know, maybe that's the only reason we won is there was nobody else. There's no other, you know, 1-800 help us number.
Yeah. You know, whatever it took, customers always knew you had their back. I mean, I worked side by side with you. And when there was a breach that happened, you were on it. Everybody in the company was on it. Became top priority. Your reputation was at risk. The company's brand was at risk. And you got after it. So, that was really fun to see. And that's where the trust is built over time. So those early days of Mandiant, let's go through the recession of 2008 to 2012 where money dried up. There was no innovative capital. Banks stopped investing in cyber and we saw that inflection point where cyber crime in 2009 surpassed narcotics as the most profitable line of business for organized crime. So that was a meaningful inflection point. We tend to see when there's innovation stagnation on defenders, you see innovation acceleration on attackers. China got in the game in a big way and moved forward and you had a ringside seat to all that. So tell me what was like with Mandiant going through that period of time. It kind of seems like you just skated through.
Well, I think you're right. The FBI did help bootstrap the company and then of course China went on offense in 2004. Was the first time I saw what I saw in the military hit the private sector and went okay good timing. But 2008 we didn't even notice it. I mean I read that there was a recession going on but people were still being compromised. We just John we just we operated profitably. Mandiant existed from 04 to essentially 2014 for 10 years. We're profitable every year of our existence except one. We even bought a company for $10 million based on money we made. We had an EBITDA at one point we had 34 million in revenue and we had 17 million in EBITDA that year. So pretty thrifty you know when you don't have a go to market team and you're doing inbounds but at that scale you know at some point we took an investment and stuff but back to your question 2008 didn't even notice it you know it's we just doubled in size.
Kevin, the reason the phone called is because you guys had the brilliant idea of training all the FBI forensics agents at Mandiant. So, all these guys are in the field getting calls for breaches and they were saying the go-to guy in the industry is Kevin Mandia. So, that's why your phone was ringing up is brilliant marketing. You didn't need a sales force. You had crazy inbound activity and it was just a great idea and it obviously paid huge dividends.
Well, a lot of first off back in 2007 or 2008 it was didn't even know what to call that unit that was taking all the fingerprints of every intrusion we were responding to and codifying it right I remember we created a schema internally that nobody paid attention to called open indicators of compromise we had like 735 criteria as we responded to every breach John and we got the forensics that trace evidence we'd codify it kind of bucketize it and kind of track Oh, it's these guys or it's that group. And we really did it to scale our consulting. So when we get a phone call and we kind of diagnose what's going on, we go, 'Oh, it's that group.' And of course, we only named them by numbers because we don't have attribution, you know.
Okay. So now we're coming out of the recession, Kevin. It's 2012, 2013. And what I always thought was a Jack in the Box moment really for this whole cyber intelligence segment was the APT1 report. You on the cover of Forbes and profiled Chinese nation state activity targeting United States critical infrastructure. That was a game changer. Walk us through that.
That came about by Travis Reese and his team. You know, Travis was president of Mandiant. He had a team of folks that just had the idea during the Chinese New Year in 2013. It was, you know, to use a big term, it was multifactorial why we did it. You had Mike Rogers and the House Intelligence Committee wanting to do an information sharing law and we felt, hey, he could use an example of how to share information. So, there was that. There was dealing with the defense industrial base being compromised by China. All of them were compromised but none of them were really talking and there was just a confluence of events where our internal team primarily former military from the United States were like let's just during this Chinese New Year burn their infrastructure go out with 5,000 IPs they're using go out with all the trace evidence all the indicators who they are and just give the government kind of a tool to use to maybe have bilateral dialogue about rules of the road in cyber domain. So, it came at me from the team and all I did is edited the damn document, you know, which by the way needed a lot of editing. But that came out just it felt like the right thing to do and the timing was right and everybody inside baseball knew the Chinese were hacking everybody, but nobody was really talking about it. So, and I guess you know David Sanger once told me, 'Hey, you never thanked me.' You know, my words, not his. But in reality, David Sanger, Nicole Perlroth, that the intrusion in New York Times might have been the catalyst for it as well, because they said they were going to go public about being compromised by China. And maybe without them, we wouldn't have done it. But there's so many factors that hit us. I had, you know, Mike Rogers, I was like, I want to give him something to help him. You know, Nicole Perlroth and David Sanger saying, 'Hey, this is a big story.' And by the way, I'll never forget that. The first time I ever talked to David Sanger, he goes, 'This is a big story.' And I was like, 'No, it's not. No one's going to care.' Randomly questionable right to his face. You know, no, you're wrong. But he was right. I was wrong. But it was kind of the team internally, those former military folks that were like, 'We're tired of watching this happen. We're getting sucker punched in cyberspace. Let's do something about it.' And we knew we were right. We had responded to that group 141 times. Trace evidence aligned. We saw the building get built that they were using. So the team made it happen. A lot of other factors and we went live and I can tell you I don't think I could have stopped it if I even tried. You know how sometimes you're CEO and people like oh you run the place loosely I run 80%. There's always something going on you can't control. And you know it was one of those they came at me. I was like hey you know we don't have a choice. By the time it hit my desk John I knew you know the toothpaste was out. This team wanted to do it and we were doing it period.
