Enterprise security testing is pivoting away from scheduled human assessments toward autonomous, continuous threat simulation. Kevin Mandia, best known as the founder of cybersecurity startup Mandiant, which sold to Google for $5.4 billion in 2022, has structured his new venture around automated offensive logic. Armadin is offering enterprises a new kind of always-on security by reimagining defense testing for the AI era.
Rather than relying on periodic manual penetration tests where contracted human specialists search for perimeter vulnerabilities and report isolated findings, Armadin runs always-on agentic swarms that chain together vulnerabilities to hack in. The operating model targets pre-emptive remediation across enterprise digital attack surfaces, cutting down the heavy personnel costs of traditional security operations centers.
Armadin runs always-on agentic swarms, who chain together vulnerabilities to hack in.
According to Kevin Mandia, the architecture aims to help organizations find and seal security gaps before external threat actors or rogue agents from AI labs exploit agentic tooling against corporate environments. Shifting the risk from software patches to architectural resilience is the core pitch behind the startup's rapid market capture.
The technological shift toward continuous agentic offense has driven staggering capital concentration. As announced by the startup, Kevin Mandia raised $255.5 million for Armadin in a Series B funding round at a valuation of $2.5 billion, with Andreessen Horowitz and Accel leading the charge.
The investment coalition included Bain Capital Ventures, Redpoint, 8VC, Ballistic Ventures, Google Ventures, In-Q-Tel, Kleiner Perkins, and Menlo Ventures. This financing follows a $190 million Series A round completed in March, bringing Armadin's total funding to more than $445 million raised within a compressed six-month window.
Legacy penetration testing cannot match the speed of autonomous threat generation. Capital is backing automated swarms not out of blind faith, but because defensive architectures must now be tested continuously at machine velocity while human analysts sleep.