Building Cyber Defense for the Agentic Era

1. 0:00 – 1:06

   Intro

   1. KMKevin Mandia0:00

      You don't have a defense unless you have a great offense to go up against. You wanna be the Baltimore Ravens defense of 2000. You kind of wanna have your practice offense really push you. That's what Armadin's gonna do. We're gonna be the all-star team on offense coming at you so you can train your defense with what we're doing.

   2. DGDavid George0:15

      You built Mandiant, a great success. Why did you decide to get back on the field?

   3. KMKevin Mandia0:19

      I don't wanna sit out the AI shift change when I've done 30 years in security and the whole damn thing's about to change. [laughs] What AI does in a microsecond would take 70 humans. They can't even do it. It's apples to oranges.

   4. DGDavid George0:31

      This is a tsunami like has never been seen before in security.

   5. KMKevin Mandia0:34

      The whole, "Let's slow down the models. We don't want cyber risk," too late. The open models are already good enough. At Armadin since January of this year, we have found over 90 zero-days at customer sites all in production.

   6. DGDavid George0:45

      This is not, like, rinky-dink companies. Like, these are, like, Fortune 500 companies. The differences or similarities between nation state attacks compared to AI today, and then where you think AI can be in a couple of years.

   7. KMKevin Mandia0:57

      On the defensive side, we're gonna say, "We're being attacked by these models, but we're not sure who's behind them. Is it a nation? Is it a human? Is it-"

2. 1:06 – 4:19

   Why Kevin came back to the field

   1. DGDavid George1:06

      Kevin, thanks for being here.

   2. KMKevin Mandia1:07

      No, thank you.

   3. DGDavid George1:08

      Okay, so you built Mandiant.

   4. KMKevin Mandia1:09

      Yes.

   5. DGDavid George1:10

      Obviously a great success. Um, many different chapters. You know-

   6. KMKevin Mandia1:14

      Mm-hmm

   7. DGDavid George1:14

      ... it ended up, you know, inside of Google-

   8. KMKevin Mandia1:16

      Right

   9. DGDavid George1:16

      ... ultimately. Um, why did you decide to get back on the field?

   10. KMKevin Mandia1:20

       It's a good question. And, you know, I don't know if I decided it, and that'll sound weird. But I met with David Slater and with Travis Lanham, the other founders, and Evan Pena I knew. Uh, you know, I, I could say they started this company. They are the founders, you know? I met them. They had the idea. They pitched me on what they wanted to do, and I saw the talent in them. Like, Travis is a generational talent. David Slater's, and I mean this in a positive way, freak of nature. [laughs]

   11. DGDavid George1:49

       Yes. Yes.

   12. KMKevin Mandia1:50

       You know? Like, these guys are, are really, really good. Evan Pena is exceptional at what he does. And when you meet that team and you talk to them, the whole time I was listening to what they were doing, I was thinking, "I wanna be a part of this." You know, I don't wanna sit out the AI shift change when I've done 30 years in security and the whole damn thing's about to change. [laughs]

   13. DGDavid George2:10

       [laughs]

   14. KMKevin Mandia2:10

       You know, that's great. Everything I did is dead, and then everything else is new. Uh, but meeting that team and they were starting the company, and me realizing, "I'm a, I think I'm a real good fit with these guys, um, to accelerate the need." Like, what Armadin is building, every company needs now. And I, I was like, "This team that can build it, and I think I can answer the now." Let's... You know, 30 years in security, you meet a few people. Let's go to those people and say, "We've built what you need."

   15. DGDavid George2:40

       Yeah.

   16. KMKevin Mandia2:40

       You know? So I almost felt compelled to do it. I know that sounds weird, but I would not have founded a company again in my s- you know, in mid-50s

   17. DGDavid George2:50

       Yeah

   18. KMKevin Mandia2:50

       ... and I was doing venture. It wasn't like, "Oh, I'm an entrepreneur and I love starting companies." That's not it. And it wasn't, "Oh, I'm not a VC. I'm just an operational guy." That's not it. I met the team and went, "We have to do this."

   19. DGDavid George3:03

       Yeah.

   20. KMKevin Mandia3:03

       I mean, that's really it.

   21. DGDavid George3:05

       Yeah.

   22. KMKevin Mandia3:05

       Yeah.

   23. DGDavid George3:05

       And this whole AIC change was happening, right?

   24. KMKevin Mandia3:08

       Totally. Absolutely.

   25. DGDavid George3:08

       Like, that's the catalyst, right?

   26. KMKevin Mandia3:09

       Yes.

   27. DGDavid George3:10

       So-

   28. KMKevin Mandia3:10

       Yeah

   29. DGDavid George3:11

       ... tell us about what Armadin does.

   30. KMKevin Mandia3:13

       So Armadin leverages frontier models and AI on offense to test do you have exploitable risk? And the re- and that's what we do today. We call it Armadin Red. But we s- when we started the company, Travis and, and David Slater and Evan all knew the future of cybersecurity is gonna be, A, the good guys have to build the offensive cyber cannon and shoot it at networks to make sure those networks can withstand these attacks, 'cause they're the ones that are coming. But we also knew it's gonna be AI on offense built by the good guys working and training with AI on defense built by the good guys, and you have to have both. So our act one was we gotta be the best in the world at finding exploitable risk.
3. 4:19 – 7:18

   What AI attacks look like today

   1. DGDavid George4:19

      Yeah. Tell us about the nature of the capabilities of AI attacks today-

   2. KMKevin Mandia4:25

      Yes

   3. DGDavid George4:25

      ... and then where do you think it goes?

   4. KMKevin Mandia4:27

      Well, great. Th- so the nature of them is, first off, we're getting a weird window in time where we're seeing them, but not at the same level you'd expect. Like, I've seen nothing like what Armadin's already built in the wild, which is there's 25,000 agents all in concert, all working together, doing really, really smart things without going on bizarre phishing trips. Because when you respond to an AI attack, you can tell it's AI very quickly. At least I can, because I've done a, you know, I've thought about a lot of offense. I've responded to a lot of attacks in the past that were led by humans.

   5. DGDavid George5:02

      Right.

   6. KMKevin Mandia5:03

      And a human goes to point A, then to point B, then to point C through their intrusion. AI does little things, like four or five differences, but one would be it'll break into point A, then laterally move to point B. Next thing you know, it's trying to break into point A again. [laughs]

   7. DGDavid George5:16

      Yeah. [laughs]

   8. KMKevin Mandia5:16

      You know what I mean?

   9. DGDavid George5:17

      Yeah, yeah, yeah.

   10. KMKevin Mandia5:17

       It's like, I get the drone swarm-

   11. DGDavid George5:19

       [laughs]

   12. KMKevin Mandia5:19

       ... but you can probably coordinate it and think a little bit better, and that's, that's where it's at today. It'll get better and cleaner. Um, but the differences are, first and foremost, uh, w- the scale of what AI can do dwarfs humans, like in ways humans don't even get.

   13. DGDavid George5:34

       Right.

   14. KMKevin Mandia5:35

       Um, so you have a scaling problem in that humans could always find only one path into a network.

   15. DGDavid George5:39

       Yeah, they had to be selective-

   16. KMKevin Mandia5:40

       Yeah

   17. DGDavid George5:40

       ... because they had to-

   18. KMKevin Mandia5:41

       You bet

   19. DGDavid George5:41

       ... devote their limited resources-

   20. KMKevin Mandia5:42

       Yes

   21. DGDavid George5:42

       ... to one direct path, right?

   22. KMKevin Mandia5:44

       Yes. And it, and then, uh, so scale, uh, is, is a challenge. Speed, ridiculous. What AI does in m- a microsecond would take s- 70 humans. They can't even do it. It's apples to oranges. And then so what was always lacking is, is AI creative-

   23. DGDavid George6:01

       Yeah

   24. KMKevin Mandia6:01

       ... or effective? But when it comes to what we do Uh, we don't need the fanciest model. We're not trying to speak 400 languages, you know, with our models and all that kind of thing. What Armadin's doing on offense is we're finding vulnerabilities, exploitable risk. That is code. That's a structured language, a structured process. Because it's structured, AI's gonna be great at it.

   25. DGDavid George6:24

       Right.

   26. KMKevin Mandia6:24

       Right? So I really think it's already here today, like the whole, "Let's slow down the models. We don't want cyber risk." Too late. The open models are already good enough and, and these things are coming now. It's just a matter of the minute you have anonymous availability of GPUs, you'll see far more criminal attacks. [laughs]

   27. DGDavid George6:43

       Oh, interesting.

   28. KMKevin Mandia6:43

       Yeah, you know what I mean?

   29. DGDavid George6:44

       Yeah, of course.

   30. KMKevin Mandia6:44

       But until you can attack anonymously and, you know, it's hard to do crime when people know your name.
4. 7:18 – 14:34

   Nation state vs AI drone swarms

   1. DGDavid George7:18

      Okay. So you, your experience in working in the security industry for 30 years, you, um, probably saw a fair amount of nation state attacks-

   2. KMKevin Mandia7:29

      Right

   3. DGDavid George7:29

      ... right?

   4. KMKevin Mandia7:30

      Every day.

   5. DGDavid George7:30

      So every day.

   6. KMKevin Mandia7:31

      Yeah.

   7. DGDavid George7:31

      So talk about the differences or similarities between nation state attacks. And I use that-

   8. KMKevin Mandia7:37

      Yeah

   9. DGDavid George7:37

      ... just to say the most-

   10. KMKevin Mandia7:38

       Totally

   11. DGDavid George7:38

       ... sophisticated, most-

   12. KMKevin Mandia7:39

       Right

   13. DGDavid George7:39

       ... you know, m- m- most w- whatever, most successful-

   14. KMKevin Mandia7:42

       Mm-hmm

   15. DGDavid George7:42

       ... if you will, types of attacks compared to AI today, and then where you think AI can be in-

   16. KMKevin Mandia7:48

       Right

   17. DGDavid George7:48

       ... a couple of years.

   18. KMKevin Mandia7:49

       So e- everything's gonna change rapidly, right? And, uh, but I can tell you, nations on offense have never, in my opinion, they've never really been... When you're hacking for espionage and for security reasons, you hack with what I would call kind of a sniper round. You're not spraying and praying. For the most part, modern nations on offense restrict their targeting, and they go deep at very specific things, like 30 defense contractors or .mil, you know, and they go hard at that. Kind of think of it as, you know, that sniper round. With AI, I think it becomes more like a drone swarm. You know? It becomes a little bit different in the cyber domain, and I think even modern nations are thinking, "What will our protocol be? If we want to attack this company, do we swarm it and just burn tokens on it?" Because AI's gonna do a lot of things humans just wouldn't.

   19. DGDavid George8:48

       Right.

   20. KMKevin Mandia8:49

       You know? So it's a little sloppier, a little louder, but it's more effective.

   21. DGDavid George8:53

       But it's more comprehensive.

   22. KMKevin Mandia8:54

       Yeah, that's the problem.

   23. DGDavid George8:55

       Right? Like that's-

   24. KMKevin Mandia8:55

       You got it.

   25. DGDavid George8:55

       Yeah.

   26. KMKevin Mandia8:55

       It's more effective probably. 'Cause if, if the... And so there's gonna be so many things a nation's gotta think through right now, and their whole doctrine will shift as, as the AI shift change comes. Like, how does AI change what our mission is? Do we m- maybe use the cyber domain differently? Do we drone swarm sometimes, sniper round other times? How do we balance the two? Does it depend on risk, target, how surreptitious we wanna be? 'Cause right now, AI is not a surreptitious action on offense-

   27. DGDavid George9:24

       Yeah

   28. KMKevin Mandia9:24

       ... unless you've done a ton of post-training. You got a, maybe a human in the loop really looking at, are we doing smart things? Because if you just go, "Hey, here's a prompt. Hack," you know, "abc.com," AI's not gonna do it in a surreptitious and smart way. And I think even if you ask it to, it's still not going to-

   29. DGDavid George9:42

       Yeah

   30. KMKevin Mandia9:42

       ... till it's been really trained-
5. 14:34 – 18:36

   Why pen testing is dead

   1. KMKevin Mandia14:34

      on you.

   2. DGDavid George14:34

      Yeah.

   3. KMKevin Mandia14:35

      Mm-hmm.

   4. DGDavid George14:35

      It's interesting. So, um, you would kind of... Armadin, I don't know, a year ago, would probably be placed in the category of pen testing.

   5. KMKevin Mandia14:42

      Mm-hmm.

   6. DGDavid George14:43

      And you and I share history and a relationship with George-

   7. KMKevin Mandia14:46

      Right

   8. DGDavid George14:46

      ... at CrowdStrike.

   9. KMKevin Mandia14:47

      Right.

   10. DGDavid George14:47

       And so they famously redefined the category from AV to EDR.

   11. KMKevin Mandia14:51

       Yeah.

   12. DGDavid George14:51

       And of course, they did it-

   13. KMKevin Mandia14:52

       Right

   14. DGDavid George14:52

       ... incredible things.

   15. KMKevin Mandia14:53

       Sure.

   16. DGDavid George14:53

       But the category redefinition-

   17. KMKevin Mandia14:55

       Right

   18. DGDavid George14:55

       ... um, was on the back of major infrastructure changes-

   19. KMKevin Mandia14:58

       Right

   20. DGDavid George14:58

       ... and product changes.

   21. KMKevin Mandia14:59

       Mm-hmm.

   22. DGDavid George14:59

       Um, you know, and allowed them to create a product category that was far greater and bigger-

   23. KMKevin Mandia15:04

       Right

   24. DGDavid George15:04

       ... than AV. Um, talk about pen testing.

   25. KMKevin Mandia15:07

       Right.

   26. DGDavid George15:07

       What is the historical view of pen testing, and why that's not what the future is?

   27. KMKevin Mandia15:11

       Yeah, couple things. I mean, you had to do it, right? It was kind of like first gen AV, you have to buy AV. And I think when you look at Armadin, we will be as ubiquitous as AV because you have to have that AI force field of AI on offense training AI on defense. You have to do it, and you can do it, so why wouldn't you? And, um, so you look at that, and, uh, it- it's... Pen testing to me is always just scanning for what's already known, and it doesn't prove whether you're really exploitable or not.

   28. DGDavid George15:40

       Right.

   29. KMKevin Mandia15:41

       So it's always created a larger list of vulns that don't matter.

   30. DGDavid George15:45

       Right.
6. 18:36 – 21:22

   Autonomous defense explained

   1. KMKevin Mandia18:36

      coming at you would do.

   2. DGDavid George18:37

      Yeah.

   3. KMKevin Mandia18:37

      [clears throat]

   4. DGDavid George18:38

      So, um, you talked, you, you mentioned earlier, you know, obviously that's Armadin Red.

   5. KMKevin Mandia18:42

      Yeah.

   6. DGDavid George18:42

      Um, you mentioned Armadin Blue.

   7. KMKevin Mandia18:45

      Mm-hmm.

   8. DGDavid George18:45

      Talk about Armadin Blue.

   9. KMKevin Mandia18:46

      The Armadin Blue is like we can't, David, just show up and say, "Hey, you know, you're vulnerable. See you later."

   10. DGDavid George18:50

       Right. [laughs] You know? Yeah, yeah.

   11. KMKevin Mandia18:51

       And hey, the true north for every CISO should be effective autonomous response. We gotta build that. And, and we knew all along you can't just say, "Hey." We, we wanna be the best in the world at finding exploitable risk. That's-

   12. DGDavid George19:04

       Yep

   13. KMKevin Mandia19:04

       ... goal number one. But then goal number two, and be the best in the world at doing something about it. And that means Armadin Blue. And Armadin Blue will be take the information about exploitable risk and work with the defense plane, you know, whether it be endpoint EDR or firewalls, and create compensating controls at speed.

   14. DGDavid George19:25

       Yes.

   15. KMKevin Mandia19:25

       So that if we find an attack five minutes before someone else using a model finds an attack, you're already safeguarded. And these safeguards are gonna be rudimentary potentially out of the gates, right?

   16. DGDavid George19:34

       Yep.

   17. KMKevin Mandia19:34

       Over the next few months. A year from now, they're just gonna be there.

   18. DGDavid George19:38

       Yep.

   19. KMKevin Mandia19:38

       Because the whole cyber domain is progressing at a speed where you're gonna have to defend autonomously.

   20. DGDavid George19:44

       Yep.

   21. KMKevin Mandia19:44

       For better or for worse.

   22. DGDavid George19:46

       Yep.

   23. KMKevin Mandia19:46

       You know? I, I'd rather have a bad patch d- stopping a bad guy from getting in than have an intrusion.

   24. DGDavid George19:55

       Right.

   25. KMKevin Mandia19:55

       You know what I mean?

   26. DGDavid George19:55

       Yeah.

   27. KMKevin Mandia19:55

       So you gotta take your lesser of two things, and one's much more manageable. You never want an unknown person with arbitrary access on your network.

   28. DGDavid George20:05

       Yeah. [laughs] Yes.

   29. KMKevin Mandia20:06

       You know?

   30. DGDavid George20:06

       Yeah, very-
7. 21:22 – 27:04

   The future of the SOC

   1. KMKevin Mandia21:22

      You know, if I'm a CISO, I do believe my true north is effective autonomous security. You wanna keep your best people engaged. You wanna automate the processes that work for your organization. But you are absolutely saying, "What survives in the AI age and what doesn't?"

   2. DGDavid George21:38

      Right.

   3. KMKevin Mandia21:38

      And I think we're still working through that process. I think there's whole processes in the SOC that'll just go away, and for whatever reason we're automating [laughs] right now.

   4. DGDavid George21:47

      Yeah.

   5. KMKevin Mandia21:47

      You know, it, it, over time y- I can tell you this. If you have humans in the detect-and-respond loop, you're gonna be too slow.

   6. DGDavid George21:56

      Yes.

   7. KMKevin Mandia21:56

      You know what I mean? It's just not gonna work well.

   8. DGDavid George21:58

      Mm-hmm.

   9. KMKevin Mandia21:58

      So you have prevent, detect, respond. Prevent's gonna be governed by AI, and detect and respond is gonna be done by AI. And the goal in cybersecurity has always been if you have, you know, you wanna prevent [laughs] -

   10. DGDavid George22:10

       Yeah, of course. Yeah

   11. KMKevin Mandia22:10

       ... you know what I mean? You don't wanna detect and respond. So I just see the constant narrowing of the window of every phase to the point where, you know, we're really not doing a lot of detection and response, 'cause the window to do it is-

   12. DGDavid George22:23

       It all happens too fast

   13. KMKevin Mandia22:23

       ... is almost, you got it. It's a little bit too fast. So but you still gotta have that onion peel to some extent of systems backing up systems and assuming failure somewhere.

   14. DGDavid George22:32

       Right.

   15. KMKevin Mandia22:33

       You know? Like even Armadin creating the force field, sooner or later somebody's gonna get around it. Someone's gonna create an exploit before we find it somehow-

   16. DGDavid George22:40

       Yep

   17. KMKevin Mandia22:40

       ... some way, on a platform or s- or a, um, or an app that we just haven't assessed yet. It hasn't been in production at a customer site, and so we haven't looked at it. And someone else finds it. And when they do that, you will wanna have a trap behind saying, "We've got unauthorized access or unlawful access to a system." Those traps are ... They're, you just can't have a human there.

   18. DGDavid George23:03

       Yeah.

   19. KMKevin Mandia23:04

       I mean, it's just gonna ... Because we've already done it at Armadin. When we break in and have agentic-aware internal command and control, it proliferates at a speed that is shocking. You know? Like I remember as a human you're, like, typing on your keyboard, "I wanna go laterally move with this passphrase from here to here."

   20. DGDavid George23:20

       [laughs]

   21. KMKevin Mandia23:20

       And you're so slow, and you're doing one thing at a time. This thing just does a thousand things at once. It's just like pff everywhere, and you're like, "Whoa, okay, gone. Got the example."

   22. DGDavid George23:30

       Yeah, so the re-

   23. KMKevin Mandia23:31

       Yeah

   24. DGDavid George23:31

       ... so the, so the-

   25. KMKevin Mandia23:31

       [clears throat]

   26. DGDavid George23:32

       ... each one of those steps of the process-

   27. KMKevin Mandia23:34

       Yeah

   28. DGDavid George23:34

       ... has to be automated. Can't be a human in the loop.

   29. KMKevin Mandia23:35

       Yeah. It's as bad as this. I mean, I don't have great analogies. It's like the balloon popped, you know? [laughs]

   30. DGDavid George23:40

       Yeah.
8. 27:04 – 35:44

   Lessons from the Hugging Face incident

   1. DGDavid George27:04

      Yep. What about the Hugging Face incident? I'd love for you to talk about the-

   2. KMKevin Mandia27:07

      Y- you know, it's-

   3. DGDavid George27:08

      ... the learnings from that

   4. KMKevin Mandia27:08

      ... I've given that a lot of thought. I mean, I'm certain at OpenAI they're like, "Oh," or at a regular, they were like, "Oh, we coulda done this and this, and it wouldn't have happened." You know what I mean?

   5. DGDavid George27:15

      Yeah.

   6. KMKevin Mandia27:15

      So they've already figured it out. Uh, it's been my experience, in every sh- technical modality shift, we underestimate the adversary's capability, and in this case, we underestimated the model's capability because, you know, when you really read it post-facto, ah, they could've stopped that, you know?

   7. DGDavid George27:33

      Yeah, yeah.

   8. KMKevin Mandia27:33

      And, um, they could've put guardrails on it, some deterministic things, and, uh, and I think they realize that now. But I think when you're in a race, it's almost like a lunar landing race, right?

   9. DGDavid George27:43

      Yeah, yeah, yeah.

   10. KMKevin Mandia27:43

       The AI race. And you have R&D people, and they're doing the work to create models in a way where even those CEOs are like, "We can't slow it. Let's get the government to help us slow it," you know? [laughs]

   11. DGDavid George27:53

       Yeah.

   12. KMKevin Mandia27:53

       That means you can't even control your own innovation, right?

   13. DGDavid George27:56

       I have views on that, but we c-

   14. KMKevin Mandia27:57

       Yeah, yeah

   15. DGDavid George27:57

       ... we could take that to another time. Yeah.

   16. KMKevin Mandia27:58

       And so when you have... And I get that. R&D people are, like, chasing that innovation, and it's really hard to package them within, like, security, experienced security people that have the skillsets to cage that thing.

   17. DGDavid George28:11

       Yeah.

   18. KMKevin Mandia28:11

       You know? And it's hard to marry those two up because the security people don't understand the AI as well, and the AI people don't realize... One of the things that we did in our model, I mean, make no mistake, Armadin has made the beast that we're all worried about.

   19. DGDavid George28:24

       Right.

   20. KMKevin Mandia28:24

       We've made a model that attacks. We made mu- many of them. We have a system that attacks production networks and is highly successful breaking in. Well, is it safe? Well, our guys instinctively knew we gotta have obviously a secure, you know, we gotta have a hypervisor. We gotta secure this thing. We gotta lock it down host-based. We have to have a proxy. It knows the proxy. It's proxy aware. That's fine. But then our guys did something, and even I was like, "Nice job." They passively, surreptitiously look at every single prompt done. Do we like it? Do we not like it? And the majority of the time, if we kill an agent, it's probably nothing to do with safety. It's that the agent's wasting money.

   21. DGDavid George29:05

       Yeah.

   22. KMKevin Mandia29:06

       You know what I mean?

   23. DGDavid George29:06

       Yeah, that makes sense.

   24. KMKevin Mandia29:07

       So kill it. It's off on a goose chase we've already done or don't wanna do. But there were so many layers of validation that the agent was doing the right thing. And the other thing was assume every layer of your security will fail, and y- you have to have deterministic rules that eliminate certain activities. But what I did learn reading those incidents, it does take domain expertise to secure agents behaving in certain domains.

   25. DGDavid George29:34

       Yeah.

   26. KMKevin Mandia29:34

       You know what I mean?

   27. DGDavid George29:34

       Yeah, it's a great point. Yep.

   28. KMKevin Mandia29:35

       So I get that. So, like, it, it, like, without a cyber background-

   29. DGDavid George29:38

       It's validating. It becomes validating. Yeah

   30. KMKevin Mandia29:38

       ... I get how you're gonna make... You're gonna test something and go, "Oh, didn't think of that."
9. 35:44 – 47:34

   Building a company at AI speed

   1. KMKevin Mandia35:44

      finding zero-days.

   2. DGDavid George35:45

      Yeah. I wanna shift gears now to, uh, your philosophies and mindset in building a company.

   3. KMKevin Mandia35:51

      You know, they're different. Yeah, so couple things there. Like, the first time I built a company was 2004, and I wouldn't have said I was an entrepreneur. I started Mandiant in '04, February, and it was self-funded and profitable. And we were successful because in hindsight... It's like you almost learn nothing at the time-

   4. DGDavid George36:07

      Yeah

   5. KMKevin Mandia36:07

      ... and then you look back and go, "Oh, I did learn right then and there" because of the pain usually. But, uh, I, I me- You know, I look back on Mandiant now. We had a premise nobody actually believed in '04 because our first website said, "Security breaches are inevitable," and nobody believed it.

   6. DGDavid George36:24

      Hmm.

   7. KMKevin Mandia36:24

      And I don't even know how much I believed it. And, uh-

   8. DGDavid George36:27

      It's a pretty good tagline

   9. KMKevin Mandia36:28

      ... oh, by the way, [clears throat] I'm slightly off. Our first headline was, "You cannot solely rely on preventive measures." And that was so boring, but that's the same as security breaches are inevitable.

   10. DGDavid George36:39

       Yeah.

   11. KMKevin Mandia36:39

       You know?

   12. DGDavid George36:39

       S-

   13. KMKevin Mandia36:40

       Can't rely on defense

   14. DGDavid George36:40

       ... better, better ring on the security breaches headline.

   15. KMKevin Mandia36:41

       Yeah, I got it wrong because I'm not a marketing guy. But anyway, so security breaches are inevitable. And the premise was- That let's respond to every breach that matters so we have first mover intelligence on how to prevent it happening again.

   16. DGDavid George36:54

       Yeah.

   17. KMKevin Mandia36:55

       And so the first model of intel in all of cybersecurity was antivirus. You know, it was like we look for malware-

   18. DGDavid George37:00

       Yeah

   19. KMKevin Mandia37:00

       ... we have signatures for it, and if we miss, David George has to find the malware and submit it to us so we get better.

   20. DGDavid George37:07

       Yep.

   21. KMKevin Mandia37:07

       And that's a bad model. My mother's not finding malware on her laptop.

   22. DGDavid George37:10

       Right. Yeah.

   23. KMKevin Mandia37:10

       You know what I mean? It's just gonna eat her laptop alive. So that model was bad, so we decided a better model, because I had responded to breaches, and the reason I was responding to them is AV was easily evaded. And so we were like, "Well, let's learn all the, you know, let's second layer AV, 'cause it stinks."

   24. DGDavid George37:27

       Yeah.

   25. KMKevin Mandia37:27

       And that's what George now owns.

   26. DGDavid George37:28

       Yeah, of course.

   27. KMKevin Mandia37:29

       You know?

   28. DGDavid George37:29

       Yep.

   29. KMKevin Mandia37:29

       So let's second layer AV. You still have to have AV, though. I beat it up, but the reality is, is you still need it, um, or something that replaces it. So the second layer of defense was required. So AV was imaginal line to here, then you extend imaginal line with something that can learn and think. And, uh, so we wanted to do that. And I actually look at Armadin as just the third wave of intel. Like, why are we waiting for a victim and learn from that? That's ridiculous. You've gotta find your own problems first. Don't wait for, you know, defense contractor A to be compromised and then quickly share the information to make sure it never happens again. Now, that model still needs to exist for the things that are somehow get there, that beat you, but, um, we got that model now, and it's just not good enough. So back to your question, uh, you know, Mandiant was f- self-funded. There's not a l- I don't know of self-funded companies these days [laughs] David.

   30. DGDavid George38:21

       Well, the speed-

Episode duration: 47:49