Building Defense for the Agentic Era: Kevin Mandia

Kevin Mandia returned to cybersecurity after meeting Armitin’s founding team, saying he did not want to sit out the shift to AI. His central argument is that defense in the agentic era needs AI on both sides: systems that test networks with the breadth and speed of machine-driven attacks, and defenses that can respond at a comparable pace. In his experience, agents can explore many network paths in parallel instead of following the more sequential approach typical of human attackers. He has seen 25,000 agents work together on offensive tasks and says a task AI completes in a microsecond could take 70 people.

Mandia sees vulnerability discovery as a strong fit for AI because code and processes are structured, and he says the work does not necessarily require the most advanced models. Open models are already capable enough to create cyber risk, though model cost and availability still constrain criminal use. As GPUs and models become more accessible anonymously, he expects attacks to increase. AI may make less technical attackers more effective by raising the volume of their attempts. Those attacks could be louder and sloppier than targeted operations while also being more comprehensive, complicating attribution: defenders may not know whether an operator is a nation, an individual, or someone else.

Armitin’s “hyper attack” maps network services, routes, systems, and assets, records metadata, and polls for changes such as new routes, updated services, or newly presented machines. It can then test assets that have changed. Mandia argues for triggering tests when the network or threat picture changes, or during a deliberate audit, rather than testing constantly when that would be costly; rapidly changing networks may need more frequent polling to reduce exposure windows. Since January 2026, Armitin had found more than 90 zero-days at customer sites, all in production environments and including Fortune 500 companies. Its external scanning is black-box from the internet, not source-code review, and aims to establish whether a flaw is genuinely exploitable—for example, whether it enables remote command execution and stable access. The company usually contacts the CISO within 48 hours when it finds serious issues such as remote code execution in a DMZ.

Mandia contrasts that work with traditional penetration testing, which he says can flag known vulnerabilities without proving they are exploitable and can generate irrelevant findings. He regards pentesting as a hygiene step and red teaming as a test of how a real adversary could operate; AI agents could make red teaming broadly feasible and eventually replace pentesting. They can also search for logic flaws in custom applications and exhaust routes that older tools’ hygiene checks may miss. Human red-team operators still matter: across his teams’ careers, they had red-teamed 99 of the Fortune 100, and humans found most of the more than 90 zero-days, while technology found the most recent few.

Armitin’s “Armageddon Blue” links discovery of exploitable risk to defensive platforms such as endpoint EDR and firewalls, aiming to apply compensating controls quickly. Mandia expects autonomous defense to develop through platforms CISOs have already invested in, even if initial safeguards are rudimentary. He anticipates AI governing prevention and handling detection and response faster than people, but stresses layered defenses and traps because attackers may exploit weaknesses before defenders assess them. Armitin’s agent safeguards include system security, prompt review, behavior validation, and deterministic rules that block selected activity. Mandia favors classifiers that inspect activity in both directions, learn from human feedback, and pause for human judgment on unknown situations; he says that approach had not yet produced an issue, while cautioning that overly rigid restrictions can blunt useful creativity.

In Armitin’s tests, 24 kill chains were based on real-world human activity, but no model completed more than eight. Open-weight and advanced closed models reached the same point; closed models reached exploitable risk faster, while open models matched them given more time. Mandia says cyber capabilities were less differentiated between models than capabilities in other domains, though their costs differed. He also describes agentic internal command-and-control spreading at shocking speed in tests, with systems doing “a thousand things at once” compared with a human operator. He expects nearly every cybersecurity layer to change over the next two years and says the coming year will be difficult as organizations work to address exposure. SOC processes may disappear or change, but he says it is too early to know what the future workforce or defense apparatus will look like. Stronger audit trails and forensics will be essential: Armitin logs each agent’s actions, source IP address, and timestamp so investigators can replay activity and establish what happened and when.