Hello everybody. Sanjay Poonen here, president and CEO of Cohesity. I'm delighted to welcome you to the next iteration of our podcast, Resilience Universe. I'm joined today by a celebrity in the cyber security space that needs no introduction, my good friend Kevin Mandia, who until recently was CEO and founder of Mandiant. It got sold to Google. He's now CEO of a hot new company, Armadin, that we're going to talk about too. He's an investor at Ballistic Ventures and a partner there and has had a tremendous reputation in the United States and across the world at fighting cyber crime. I think the cyber guys, if they're scared of one person in the world, they're scared of Kevin Mandia because of his ability to get calls often from CEOs, not just to save them, but also the government when it comes to cyber crime. So welcome, Kevin, to this edition of our podcast.
Well, let's start a little bit with where you started. How did the idea of Mandiant get to bear? You were in the US Air Force. Why did you start the company and how did that company evolve into something that eventually sold to Google?
Right. So, Sanjay, I could spend the whole time talking about that time where I couldn't, but now I can. The reality is I was only good at one thing. You know, I graduated college with a computer science degree in 1992 and 1993 I was in the United States Air Force doing computer security. So, I kind of grew up with the birth of intrusions. You know, from 1993 to 1998, I was responding to computer security events or intrusions for the Air Force and just kept doing it. So I had a unique vantage point that as you know, at first as information and communications went online into the cyber domain, that's where espionage went. And then all of a sudden in 1995, 96, people start launching their businesses in the cyber domain. So that's where crime went. So you know, you end up with basically crime and espionage in the cyber domain and then you get the drive-by shootings. So I kind of grew up with it. I do believe every single company, you have the person who's the expert, the tech expert, and then the other guy. Believe it or not, I was both when we founded Mandiant. I was kind of the guy in the trenches responding to breaches all the way till 2012 or 13. So long story made short, you start a company because you're good at something, you love what it is, and you believe it's important. And really there was no other company on the planet in 2004 when I started Mandiant whose competence was let's respond to every breach that matters so that we have first mover advantage on all the new and novel attacks. So that's kind of the genesis.
The thing that was remarkable at Mandiant is I've met not just you but the people who I sort of, Charles Carmakal, people I consider little mini Kevins. You created a culture at the company of people who were best of breed incident response. How did you do that?
Yeah, it's funny. All companies really are made in the image of the leaders that got there. There's no question about it. So if you have a very technical leader at the beginning, they hire very technical people. Usually you get this culture of engineering domination, right? At Mandiant, we just had a natural culture of we, you know, our customers' problems were our problems. If we were responding to a breach to figure out what happened and what to do about it, Sanjay, like it was our problem. We physiologically felt the impact of what the victims were going through. I remember getting calls very early in my career and it would be like, 'Hey, we've been breached.' And I would think literally, I'd be like, 'What are we going to do about it?' You know, it was almost like we were right there with them. You know, if we were responding to a breach for company A, it's almost like we would put the company A swag on and let's go. Let's go fight it. So, there was something very personal about it. And I think that's what was reflected in the people. And then the second thing is we were a self-funded startup at Mandiant. And so I was asking people, you know, my first head of engineering was Dave Merkel and I remember saying, 'Hey, how about taking, you know, one-third the pay you're getting now, but join the garage band?' Or, you know, I had a great leader for consulting, Steve Studdart, and I was like, 'Hey, how about getting half the money you're getting now and leading our services?' When you're asking people to sacrifice that much, you feel a social contract to make all of us better at our tradecraft while we work together. So I think there is a big bond in Mandiant that you may work there for a year, you may work there for 15 years, but you will not leave the same person. You will leave exceptional at your tradecraft.
And one of the other things I've heard you talk about was there was a competitive culture inside Mandiant, where you as maybe sometimes the older guy was trying to compete with the kids to be better than them and that it's a little bit like the Marines, right? The older Marines like, well, I can one-up this 22-year-old, but that actually makes the organization better. Talk a little bit about that competitive culture inside the company.
Well, there's no question everyone leading a breach, it seemed like we'd all come back on somehow we solved every breach by Friday so we could catch our flights back to Washington DC at the time. But I do recall even when I was showing up on the front lines, I remember responding to a defense industrial base intrusion in 2008 and I'm showing up with a guy who graduated MIT and I'd gone to Lafayette College. Last I checked, MIT here, Lafayette here. But anyway, I remember I sat next to him doing forensics and I'm like, 'I bet I beat you.' And he's like, 'What are you talking about?' And I'm like, 'I'm going to find the malware first. I'm going to find the back door first. I'm going to find who did it first.' And we raced. And I did beat him, by the way. Sanjay, that's what's funny. We had different methodologies. He was definitely smarter than me, but I'd raced more. So, but that was our culture.
Well, for some of us 50-somethings to have that type of culture even today. That's amazing.
Yeah. I'll tell you, even in the AI world, I'd recommend for you and for every CEO, create your own agent, start working with Anthropic, start working with OpenAI, start working with Gemini, start working with something, and get to understand it now. Dive in the ring, get frontline knowledge.
Well, let's talk a little bit about, I mean these are all public names, but there have been breaches that have been on the cover of Wall Street Journal, New York Times, whether it's SolarWinds, you know, or Colonial Pipeline or more recently Change Healthcare. And these are obviously incredible companies who are doing things right but they get in the middle of something that happens. What are the lessons one takes away from them? Because almost every one of those situations you've been called in, some case like SolarWinds I saw you in front of Congress. Are there any sort of common themes that are lessons one can take away from all of these name brand attacks that have happened? And by the way, what's happened in the United States are also happening, you know, in other NATO friendly countries or in Japan.
Well, I can tell you the first thing, you know, you get to meet, at least I got to meet leadership at these companies under duress and you get to see great leadership in action. I mean, I learned how to respond to my own breach, Sanjay, by inspecting the people I helped. You know, they taught me. But first and foremost, if these companies knew about the vulnerabilities they had, they would have fixed it. They didn't know. Nobody was omniscient. And that's the problem in the cyber domain is nobody had an always-on 'where are we vulnerable and what can we do about it' kind of dashboard. Never existed. Still doesn't really exist for that situational awareness. So you would show up and you diagnose here's victim zero. All these companies really had willing and able people that if they knew they would have fixed it. If they knew they would have done something but there was never that omniscience of you could just tell that you had a problem. Second, you know, sometimes we underestimate the threat. You know, there are times where it's just hard to know how determined they are and every once in a while I've responded to breaches where it really just wasn't fair for the victim. You know, I hate to say it, it was you had men and women in uniform coming after your company on a daily basis. It just wore down the defense and the defense really doesn't know it. Third, the biggest problem also Sanjay, it's just unfair. Both criminal element and espionage are getting unlimited shots on goal. There's just no risk or repercussions in the cyber domain to constantly hacking. So when you see that kind of asymmetry, it's just advantage goes to the offense because of that no risk or repercussions, invisible domain, no situational awareness at all times as to where you might have a gap in your network. And we are changing our networks all the time, every second. New IDs are popping up. Accounts are being shut down. New apps are being published and going into production. New offices are opening up. New humans are getting hired or dismissed. That's so dynamic. Nobody just had situational awareness. So I'll kind of stop with that. There was just no magic. Nobody knew, hey, I wish I knew that one day before the attackers exploited us, we would have fixed it.
I mean all these things because I've also been in the cyber industry 15 years, watched every one of these. Most often when I hear about them, I'm calling you first to learn. It does teach us all to be humble because this could happen to any of us and there's no arrogance. You sit in a perch, you could be next. I would like to kind of get a sense if you take the NIST framework, you talk about detect, prevent, recover, remediate, both are important. We play at the center of resilience and you've talked about an assume breach mindset to resilience which I think is a very apt phrase. We obviously built our company based on that type of mindset. Assume breach and then you work on resilience. Are these both important? How important would you play resilience in the midst of a detect prevent on the left side of NIST and a recovery remediate on the right side of NIST?
Well, I can tell you I argued with Claude about this and it says resilience is more important than prevention right now and it was interesting. Here's the reality. It depends on where a company is in its journey and what it does. But right now the AI threat is looming and coming and what I mean by that is all attacks are going to be AI enabled or just AI in the near future. It's gonna happen Sanjay because AI is faster, operates at far more scale, can research all paths into an organization all the time whereas human-based red teaming, our offense was one path in at one time, wasn't 24/7, didn't have a technology that could think, learn, instantiate and have total recall until the advent of large language models and agentic AI. So with the shift change to agentic AI, offense is going to force defense to be autonomous. Well, right now I'm not familiar with any genuinely true adaptable autonomous defense. We're working on it. There's a whole bunch of companies that are going to get there over time. But in this gap region where we're at an inflection point where AI, I think, will uniquely benefit offense. Hence, Mythos only went to some companies. It wasn't published to the world. It was Anthropic recognizing, oh, this is an advantage to offense. When you have an advantage to offense, I do think by your eyes on the prevention ball, oh, you've got to think resilience. So, I think I'm going to give resilience a little bit of a nod. But it does depend on industry. If you're in critical infrastructure, resilience is what matters most. If quite frankly, if you're running a restaurant, you can still take orders with pen and pencil if your cyber domain gets attacked.
