BONUS: Armadin's Kevin Mandia | Redefining Security in a New Age of Threats | Spotlight On | AccelVC

I remember responding to an intrusion. Alexei Ivanov and Vasili Gorchkov, 2002, 2003, 2004. They're hacking US companies, extorting them for $5,000. They would steal credit card numbers, then sell fake stuff on eBay, then buy it with stolen credit card numbers. It was all scripted. Now, in the world of agents, an agent can think, learn, instantiate normal, have total recall, and attack you. Everybody's going to have to have a better defense.

Ping, thanks for having me here.

When I talk about my new company, Armadin, the first sentence I have in the one-liner sounds like 10 other companies' one-liners. We're going to build the ultimate attacker. We're going to use AI agents to automate offense. And then I have the longer story. So why are we doing that? And Ping, a couple thoughts. First, you know, after 30 years in cybersecurity, there was no way I was going to sit out the AI shift change. I was getting off the sidelines to get involved. There's never been a tech shift change like this in history, right? No doubt what I've observed in 30 years of cyber and the reason we're doing Armadin is I think fundamental truth one: all attacks are going to be done by agents in the future at the speed of compute. If you look at every single technical advance in the cyber domain, attackers that performed espionage, crime, or warfighting always used those technical advances even before the defense did, you know. So I've lived through so many shift changes in technology, whether it be mobile, cloud, where as soon as they could, attackers would take advantage of tech to make money or to get information or to steal and pilfer. That you see the shift to AI, the same thing's going to happen, and you see AI agents armed. And Armadin wants to do that ahead and in advance of the bad guys or the element that does unlawful or unauthorized or unacceptable access to your networks. So the one-liner: we're building the ultimate cyber cannon, meaning nation-state offense, but we're doing that so that you can see a future five years out where you're going to have AI on offense, training AI on defense to have autonomous defense, no real human in the loop. And I think that's going to happen. I think you're going to see that. You're going to see that play out over the next few years. So you asked a simple question: what is Armadin all about? We're going to build the ultimate offense so that you can have the ultimate defense.

That's a great question. I went to college in 1988 at a small school called Lafayette College. Studied computer science, which back then at a liberal arts school was a small program. And I feel, Ping, like you, I mean, I remember Pong when it came out in the '70s, right? I remember Atari, and so I kind of grew up with the PC starting right in the late '70s. You get the Apple II, Apple IIe, the TRS-80 Color Computer. Why, I had, you know, I had the Okidata...

You got it, the printers. And those things. So we grew up at the beginning of the computer age, right? Where you could see these things in people's homes. So, long story made short, grew up with computers, was one of the first kids to have one in my, you know, in my class, you know, I think it's by sixth grade. I had a computer. So that means when I go to college, I want to do computer science.

It was a thing, but not the thing maybe yet. And the reason I give you that history is because you said, 'So what did I do?' I'm the youngest of four boys. First two brothers never went to college. The first one joined the Army. Second one joined the Navy. Third one went up into Rochester, New York for school. And so when I went to school, if I wanted to go, I was going through a scholarship. So I applied for an ROTC scholarship, which was Air Force. You know, when I graduated college, I served for over five years in the United States Air Force.

Yeah. So 1993, I'm stationed at the Pentagon. You know, I had to wait in line to get my job. I'm a second lieutenant. I'm in uniform. It's May or June of 1993. And they gave me six options, Ping, and they all sounded horrible to a 22-year-old kid, you know. And I remember you could do job control language programming or JCL. You could work on the president's budget. I was in what's called the Seventh Communications Group, and I listened to all six options. And right at the end, the O-6 or colonel giving me the job options, he looks at me and he goes, 'We have one slot.' It was almost like a by the way. He's like, 'Oh wait, we have one other job. By the way, we have one computer security officer slot left, just one.' And I'm a sucker for 'there's only one left.' So literally, I got into cybersecurity because of that. By 1995, I cross-trained into the Air Force Office of Special Investigations. And with a computer science degree, and while I was doing computer security officer at the Pentagon, I got my forensic science degree. I was like a perfect blend of you have comp sci, you have forensic science, be a special agent in the Air Force Office of Special Investigations and investigate computer...

Yeah, it was definitely the summer of '96. We were responding to Chinese espionage. It was in '96, and the Russians were already on the radar as well. So it was espionage, right? It was through the goalpost for governments to hack governments. So that was normal. We did see that by 1995. So it was happening. It was happening, but there was no consequence to it till you start seeing flag officers use email. You know, you get almost like a boiling frog. You get a rising tide of importance of compute, internet, mobile. You know how businesses start to sustain their whole business using technology. But in the first intrusions I saw that were espionage in '95, '96, and then on the criminal side, it was mostly attractive nuisances, websites, defacements, things like that that nobody cared about. But right around 1996, you have Windows NT come out, and that allowed a graphic user interface web server, and you can make money. People started selling flowers. I think the first thing you know on the internet sold was flowers in '95. You basically had web servers that accepted credit card numbers to sell stuff. The minute you have that, those things kind of congeal together, you got it. The criminal element hits. So I'd say by 1996, people are hacking for profit and gain. By 1998, it's rampant. So it goes like this. Okay. So I'm in the military '93 to '98. I'm responding to espionage cases '95, '96, and '7. China was definitely doing it. It was the primary target. I think the best was the SVR out of Russia at the time. You know, we definitely responded to cases where great counter-forensics, absolutely surreptitious. If we caught them, they would go away. That's kind of the rules of engagement. That was mostly Russia, and China was more of the tank through the cornfield. Okay. But I can tell you, I'll share this detail. In the summer of 1996, I responded to an intrusion on behalf of the Air Force. Where how we responded back then, Ping, is I would show up at a victim site, sometimes a university, sometimes an Air Force base. And on this case, it was at a university on the West Coast. And I showed up, I was like, 'Hey, listen. You know, there's an account being used at this university, and they're logging in to Air Force bases. Do you mind? Can I have consent to monitor?' And they gave us consent to monitor. And I put a monitor on their network. Really literally physical... basically you just... it's another computer, and you put it... you got it, TCP. I mean, we literally just use standard commands and watch the traffic, but we'd limit it. And everybody would think, 'Oh, the government was spying.' Not at all. We had to brief the judge advocate general every day: 'Are we getting anything from this consensual monitoring?' And so I set up a consensual monitor in summer of '96 at this site. And the first day I'm monitoring, somebody logs in from basically Beijing, uses an account at this university, logs in and hacked well over 30 different military installations day one. All they were doing is telnetting, the old protocol, telnet, user ID, passphrase check. It was like Wright-Patterson Air Force Base, Los Alamos National Labs, Lawrence Livermore, Oak Ridge. They were just logging in. Every one of them was successful, and I just happened to have one tap at that place. So immediately you have the thought: am I seeing 1% of their activities or 99%? It was probably 1%, and we had over 30 victim government sites the first day I tapped, and that was summer of '96.

Enterprises weren't relying on the internet. Yeah. Right. Other than maybe credit card theft. We dealt with a whole bunch of credit card theft and monetization between '98 and 2000.

You know, for me, you'd love to have a great answer like I mapped out my career and then lived it. Not at all. In 1996, Khobar Towers happens in Kuwait. I think it was 1996. It was a bunch of airmen were killed. Bomb goes off in a van, and that's when we realized we got to secure our own perimeters. And that created for the Air Force Office of Special Investigations a lot of shifts by 1998 where people were being asked to go do things. I was a computer science major, forensic science master's degree, doing computer crime. And then I got in 1998, I think it was an assignment to go do something more like force protection. We have to protect our own overseas now. And I just felt in 1998, economy is going like this. I had an opportunity at that time to join some folks to train the FBI. So I got out of the military solely because I felt I was getting, you know, my number came up, and it was like, you're going to do force protection and go do this. And I felt more aligned to now go train the FBI because I felt akin with the FBI when I was in the Air Force Office of Special Investigations. I'd respond to breaches to figure out what happened, what to do about it. And if you want to impose risk of repercussions, I mean, that's what the FBI does. They go catch people, you know, and that's what I was doing in Air Force OSI. So, you know, we wrote a class and wrote many classes from '98 to essentially almost like 2001. That was my primary role was working on cases with the FBI as a contractor or teaching at the FBI Academy and on the road. You know, if you're going to rob banks, if you're going to investigate bank robberies, you got to know how to rob a bank. If you're going to investigate computer intrusions, learn how to hack. So that's what got me out of the military. An assignment that didn't fit my skill set.

Well, a couple reasons why. One, I was only good at one thing: responding to computer security breaches. When you have a decade run, you know, essentially from 1995. Mandiant starts in 2004. There's a nine-year run in my life where all I'm doing is trying to respond to a breach to figure out what happened and what to do about it.

There was not a lot of people. You know, it was pretty interesting at the time when I was in the government responding to breaches. A lot of times agents would fly in to help me. Yeah. And I use 'help' in quotes because they had no idea what was going on, you know, and it was still that first generation of response and investigations into computer intrusions. And then I did go to Foundstone in 2000 and work with George Kurtz and with Stuart McClure. We had a guy named JD Glasser there. I remember every time I needed a forensic tool, JD just seemed to write it. Joel Scambray, just a bunch of great talented young individuals. And did Foundstone from 2000 to 2003. Started Mandiant at the beginning of '04 because I'd seen all the antivirus, every safeguard everybody had was just so easily evaded. That hey, we got to create a company that goes out and learns on the front lines. Let's respond to every breach that matters so we see how companies, you know, basically how software is evaded. Yeah. And we were Mandiant, and this is how bad my execution was. Mandiant was an endpoint company. Nobody knew it. But what we were going to do is respond to every breach that matters and build an endpoint that detects what Symantec and McAfee miss. Like we were going to be the second line of defense. Probably a terrible business plan, right? You have your first line of defense on a pre-existing platform. That's billions of dollars in revenue. We're going to squeak in as the second line of defense for no one who thinks they need that second layer. But what ended up happening that made Mandiant successful is nobody believed in the premise security breaches were inevitable. But we did.

No. No.

You know, I used the phrase 'boiling of the frog' earlier. I think there's been a gradual incrementalism in the cyber domain my whole career. Okay. There's always been an up and to the right. And because businesses' dependency in the cyber domain kept going up and to the right, you know, nowadays if you can't get online, it's like you can't breathe, and you just go home from work. You know, the internet's out, you all go home. You know, and but that was not always the case. So I think it's been a gradual incrementalism. And the reason companies didn't think they need a Mandiant is again, we were only known for one thing. And many startups only get known for one thing, no matter what the reality is. We were known as the 'oh crap' button. If you have a problem and you need to know what happened and what to do about it, you call these guys. And we didn't even have a marketing department. We had a website. It was in 2004 we started responding to breaches. You're always busy during election years. But in 2006 is when the Chinese started hacking the whole defense industrial base, and we got...