How Kevin Mandia Built the Most Trusted Name in Cybersecurity

There's no doubt in our mind: within two years, all attacks are going to be AI-driven. And what's interesting to me is most humans don't understand it. The speed at which it can operate at is incomprehensible. If all offense goes to AI, that means defense has to be autonomous. You cannot have a human in the loop to defend against an AI-born threat.

The best pressure to put on a company is get deals done. Getting deals done and making customers happy literally is the fuel that makes a great company. Like we're launching Armadin and everybody's like, 'Wow, it seems like you guys are all set.' I'm like, 'We haven't really pressure tested ourselves.' The pressure test is we've got 150 customers and they're all ecstatic, and that's what matters. Because here's the dirty secret in all enterprise sales, especially in security: everybody buys what everybody else bought.

Finally, we have the tools to scale all the attacks so we can all understand what they are before they even happen. So Armadin has to build a nation-state-grade capability on offense to train the defense. And there was never a technology that allowed anyone to be aware of all the attacks that were possible. What is the art of possible on offense didn't exist with Armadin. We will be the seal of approval to give you a confidence that you can defend against the most modern attacks.

It's hard to not leverage, you know, where you spent your time. I mean, 30-something years in cyber. What are you going to do? Turn your back on it?

First off, even when you're CEO, you can use the term 'running' very loosely. You know what I mean? I often, you know, it is funny to watch companies unfold. There are, at any given time, at most, you might have 70% command and control over what you're doing. I know that sounds a little odd.

40. 43.

I was never big time.

So there's a lot that led to being on the cover of Fortune magazine. But you know, there is no overnight success, right? That was 2013. Mandiant had existed for nine years prior to that company. Yes. And I think, you know, the Snowden thing had just happened, and I think Fortune wanted to put something good on the cover, not, you know, Snowden. So you have just a whole bunch of things came to a point where we were relevant at a time, and it just worked, you know. And I wasn't the only one that's been on the cover. Remember, shortly after I was on the cover, I went and saw Ben Horowitz because he had to be—he was on the cover once too. We had that moment of dialogue of, 'Hey, remember when you were on the cover?' Yeah. And it leads to weird moments too because I was traveling with my kids in Denver, and I remember walking through the Denver airport and I look over at the store and it's like my face like all across the window of a store, you know. And then you start noticing people walking at you, looking at you, looking at that and looking at you, and I'm like, 'Oh man, this is kind of a weird moment.' But thank you to Fortune and for, you know, the folks there that got me on the cover.

Well, you know, it's maybe that happened because we didn't take any shortcuts. You know, I did do security from the front lines up, and we were a self-funded startup, which is a little bit different. We never were a hype machine. I don't believe in optics and storylining your way to victory. And we always thought myopically in a way, even at Mandiant, our goal was every customer you have—and this will sound like buzz phrases—but when you're self-funded, the only way you grow is you make every customer happy and they recommend you to the next few customers. So we just took a hard path. I think a lot of times folks meet with me and they recognize there was no overnight success to it. I mean, I was the CEO of Mandiant for, I mean, loosely 18 years. That's not an overnight. And there was never, you know, we didn't have any easy answers. You know, it was literally every time we hired someone, it was like, we have to be the best at what we do. We're not going to be second place. We just constantly pushed. And maybe over 30 years, you know, there's other people in this. I look back through my career now and you look at, you know, look at what George Kurtz is doing with CrowdStrike. You know, he and I came into this industry around the same time. He's proven to be an execution monster. He can do things nobody thought was possible. So you've got incredible talent, and maybe we've just been doing it for so long that we've just gotten to meet a lot of people. But I think what I've always represented as a security practitioner is there are no shortcuts there. You know, this is what I've done. I always want to be good at it. And anything I've ever expounded with other people was, hey, we just got to do it right. Do it better than other people. So 30-something years, sooner or later, someone's going to have a favorable opinion.

Well, you know, here's what was interesting. Maybe this did make my job different. It was never just a job, and people use the term mission. You know, I did take oaths. You know, when I was in the military, I did respond to breaches where the minute you get those calls—Josh, what's amazing about that is I go right into it's-us mode. It's we mode. It's not a customer. It's like this happened to me and them. And I think my team was like that too. It is probably similar to being a doctor and you get a patient, you want to save that thing with everything you've got. And it's teamwork. You don't care if there's a doctor from another hospital showing up or any of that. So I think the job that we had of responding to every breach that mattered does give you a closer relationship with a customer. Like you can go dark early. You know, some of the first conversations I've had with CEOs of even Fortune 100 companies—I had one where I answer my phone and right out of the gates, the gentleman was, 'We're getting ransomed and damn it, we're not paying.' And already I was like, well, that was one hour reduced down to one second. You know, we're ready, let's go. We're not paying. I'm in. What do you need? Where are you? How do we help? And so I've had a lot of conversations with folks when they're, you know, under duress. And that does create a bond. But I can tell you the teams that we've had—thousands of men and women that have worked on these incidents both at Mandiant, at CrowdStrike, at Palo Alto Networks—all of them do have an empathy for the customer where it is kind of an assault when you're responding to a breach on people that don't deserve it, you know. So that's another factor that really made me bond with the industry of cybersecurity. I can tell you this: I start a lot of presentations when I get to speak at things like RSA where I thank people for answering the call. Cybersecurity to me was a calling. For others, maybe it's just a job, and maybe people can sense that.

Myopically OCD and focused.

Maybe. I don't know. By the way, I doubt—I doubt for them to say... Yeah, I doubt my parents ever uttered the word cybersecurity. But I think, you know, my dad was an athlete. He was very into football, and it created an intensity. You know, it was about win or lose. It was, you know, early on in my life, I had to memorize a quote from Vince Lombardi: 'Winning isn't a sometime thing, it is an all-time thing. You don't just win once in a while, you win all the time. There's room for only one place, and that is first place.' And I paraphrased it there. I could have gotten it right.

Yeah. It was kind of, you know, some people learn to say their prayers before they go to bed. My dad was more like, 'Hey, man. Learn Vince Lombardi. Come on.'

You know, I don't know if he made me memorize it, but maybe he challenged me to memorize it because it happened so early in life. But no, I think there was an intensity for me anyway. I grew up a relatively intense kid based on sports, and there's a lot of people like that, right? You want to learn early to push yourself. You know, I have three kids now, and I don't know how well it works, but I always tell them, push your boundaries. You know, try to figure out how far you can go. And I've always enjoyed that process of pushing myself pretty hard. And that's not for everybody. A lot of people wake up every day, how do I make today comfortable? How do I make today a day of leisure? I'm the opposite of that. How do I make today a win? How do you get better? And as you get older, it's less about yourself. You start going, 'How do I make myself better?' And by the way, I did believe this. Every day I showed up at work, I always felt, man, I got to do better. I never showed up one day and went, 'Man, we're nailing it.' You know, it's—but as you get older, and I'm doing this now at Armadin, I'm doing, you know, this is my second go-round. It does feel different in that you feel a better energy of let's all get better. Everyone that we get in the room with, each one of us makes us all elevate to another level. But going back to your question, my parents probably thought I would be successful or die trying because I think I had a lot of drive at a pretty early age. And in reality, I don't think I've changed much from when I was...

My kids would say I'm intense, you know. And they overexaggerate in a way because my natural resting face looks pretty mean. You know what I mean? I'm not a smiley guy. So my kids will look at me and be like, 'He's always mad. He doesn't smile.' And there are times where I'm smiling at them and they're like, 'Why are you frowning?' Literally, I'm like, I was actually smiling. Or there's times they'll overhear me and be like, 'Why are you arguing?' And I'm like, 'I'm actually agreeing,' you know? So I do have an intensity. It's probably softened over the years, but it's there. So I answered every question already, right?

Yeah.

Well, when you met—like we had a tier of people at Mandiant where their bar was real high, and it wasn't lost on me that very quickly, you know, we had a guy named Steve Sdu come on board two years after we started the company, and he was exceptionally disciplined, and he taught like most of Mandiant how to be very disciplined about hiring, how to do an interview, how to make sure someone's a fit. And in hindsight, we became really hard to get a job at. And we were never easy because we were self-funded. The way we operated was, 'Hey, thanks for coming on board because you are going to build out like 80% of the time. We can now hire two engineers.' We literally attracted people by saying, 'You're going to work twice as hard, but you'll be twice as good.' That was it. There was no lifestyle.

I don't know if I knew how, and I didn't know if I had a fundable idea. I think—I mean, you know, I was coming out of the Air Force. I went to Fountain Street for a few years with George Kurtz and Steve McClure and Joel Scambray and a bunch of real smart guys. But I think we had an—I don't know if I believed we had a fundable idea, which was security breaches are inevitable. Let's respond to every breach that matters. And that is the front-row seat you need to build the best endpoint technology. So believe it or not, Mandiant was an endpoint company, but nobody knew it, because we got known for responding to every breach that matters. But we were responding to breaches solely to own that moment of seeing how Symantec and McAfee were circumvented and how to build a better solution in that. So I really thought incident response or responding to those breaches was just something you did to build better software and security, you know, and that was it. So, but we never thought about getting funding because I started the company with really smart folks, really aggressive folks, and we had work right away. So we bootstrapped it. We raised money, you know, maybe seven years in. We did a round with Kleiner, with Ted Schlein at Kleiner, and with JP Morgan Chase's One Equity Partners, and we did that. But at that time, we were already over 50 million in revenues. The year we made over 50 million revenue, I think our EBITDA was 17 million. We were a profitable company. Yeah, exactly. Times have changed. And I didn't know how rare that was. And I didn't really care how rare that was. In reality, it was—I was so maniacally focused on...