Grit · 6 Apr 2026 · From the week of 6 April
How Kevin Mandia Built the Most Trusted Name in Cybersecurity
These are notes on the conversation, checked against its transcript. The episode itself has the full discussion.
In brief
Kevin Mandia, founder of Mandiant and CEO of Armadin, speaks with host Joubin Mirzadegan on the Grit podcast about his path from a self-funded security firm to Mandiant's sale to Google, with his time as CEO of FireEye in between. He describes how Mandiant grew bootstrapped and profitable before taking outside money, and how he now runs Armadin around AI-driven offensive security testing. His central argument is that customer happiness and closed deals, not fundraising or marketing optics, are what compound into market leadership, and that AI-driven attacks will force defense to become autonomous.
For founders
- When self-funded, growth comes from making every customer happy so they recommend you to the next customers, according to Mandia.
- Mandia says the scorecard that matters is how many customers you have, how happy they are, and what they pay, and that getting deals done is the best pressure on a company.
- Mandia says that during a funding round more than half his brain goes to it, which he sees as a sideshow to the real work of getting customers and making them happy; host Joubin Mirzadegan added that raising money is far easier than building the company.
- Mandiant bootstrapped and only raised outside money about seven years in, when it already had over $50 million in revenue and roughly $17 million in EBITDA; Mandia says they never thought about funding because they had work right away and he doubted they had a fundable idea.
- Mandia says he hires leaders better than himself and gives them latitude, and that founders should hire sales, marketing and engineering leaders early but be careful with functions like legal and finance.
For revenue leaders
- Mandia says enterprise security buyers tend to buy what other large enterprises have bought, so winning household-name customers creates a halo effect.
- Mandia says he sets a clear quarterly commit for sales leaders, gets variable comp right up front, and then holds them to the outcome rather than telling them how to lead.
- Mandia says engineering is already ahead of marketing at Armadin, so they need a weekly Friday demo cycle to keep go-to-market current with the product.
- Mandia describes using off-site questions about career highlights and lowlights to test whether executives can speak openly, which he says builds alignment and speed.
- Mandia says that in a funded company, go-to-market professionals can be hired before the product is released, which he contrasts with a profitable company that would sequence these hires later.
What was said 23, most useful first
In enterprise security, buyers tend to buy what other large enterprises have bought, creating a contagion effect. Listen
Mandia calls this the dirty secret of enterprise sales, especially in security. He says winning large brands such as JP Morgan, Exxon, Walmart and Target leads others to want the same product. He says he saw this effect at FireEye and that it applies to companies like CrowdStrike and Palo Alto Networks.
“Everybody buys what everybody else bought.”
Listen to the episode Sales process & deals Link to this Report a problem
A founder should hire functional leaders such as sales, marketing and engineering early, but be careful with other functions. Listen
Mandia says leaders for sales, marketing and engineering are needed early. He warns that hiring functional experts too early, such as legal counsel or a CFO, can build an org that grows out of proportion, and gives the example of having 30 attorneys. He says he hires people who are better than him to run their functions.
“you got to be careful, but when it comes to the things like sales, marketing, engineering, those leaders, you need pretty early.”
Listen to the episode Hiring & team building Link to this Report a problem
He thinks $200 million could be enough for Armadin to reach an IPO. Listen
Mandia says he does not think a company now needs hundreds of engineers to build a product that can reach an IPO. He says he actually thinks $200 million could be enough to run the distance, though he is still learning about the new capital environment. He contrasts this with competitors who can raise hundreds of millions.
“I don't think you need hundreds of engineers anymore to build a product that can bring someone to IPO.”
Listen to the episode Fundraising & investors Link to this Report a problem
Mandiant recruited by promising a harder workload and better outcomes, not lifestyle perks. Listen
Mandia says that as a self-funded company, Mandiant told new hires they would be billed out about 80% of the time and that the company could then hire two more engineers. He says they attracted people by saying they would work twice as hard but be twice as good. He says there was no lifestyle selling.
“We literally attracted people by saying, you're going to work twice as hard, but you'll be twice as good.”
Listen to the episode Hiring & team building Link to this Report a problem
A CEO should stay after an acquisition as long as integration takes, which he puts at about two years. Listen
Mandia says that when you are CEO and a deal happens, you should stay as long as it takes to make the integration work, and his gut says that is two years. He says that at FireEye, where he bought seven or eight companies, he told acquired companies they owed him two years and that it was built into the price.
“hey, you owe me two years, it's built into the price.”
Listen to the episode Strategy & market Link to this Report a problem
Mandia predicts all attacks will be AI-driven within two years. Listen
Mandia says there is no doubt in his mind that within two years all attacks will be AI-driven. He argues most people do not understand how fast AI can operate, which he describes as incomprehensible. He makes this claim as the basis for Armadin's thesis.
“There's no doubt in our mind within two years all attacks are going to be AI driven.”
If offense goes fully to AI, defense has to be autonomous with no human in the loop. Listen
Mandia argues that if attackers rely on AI, defenders cannot keep a human in the defensive loop against an AI-born threat. He presents this as the reason defense must become autonomous. This is his stated view of where security is heading.
“If all offense goes to AI, that means defense has to be autonomous. You cannot have a human in the loop to defend against an AI -born threat.”
One attacker can create work for millions of defenders, and that this asymmetry has to be leveraged. Listen
Mandia describes an asymmetry in which a single offensive actor can force millions of defenders to respond. He says Armadin's approach is to use automated offense to address that imbalance. He presents this as a reason the defensive side needs a different model.
“One person on offense can create work for millions of defenders.”
Armadin plans to build nation-state-grade offensive capability to train defenses. Listen
Mandia says Armadin has to build a nation-state-grade offensive capability so it can train the defense. He says the goal is to show customers what attacks are possible before they happen. He describes the platform as a way to assess security and train defenses against the most effective attacks.
“So Armadin has to build a nation -state grade capability on offense to train the defense.”
When self-funded, the only way to grow is to make every customer happy so they recommend you to the next few. Listen
Mandia describes Mandiant as a self-funded company that never acted as a hype machine. He says its goal was to make every customer happy so those customers would refer the next ones. He says they took a hard path and there was no overnight success.
“when you're self -funded, the only way you grow is you make every customer happy and they recommend you to the next few customers.”
Listen to the episode Retention & customer success Link to this Report a problem
The best pressure on a company is getting deals done, and that deals and customer happiness fuel a great company. Listen
Mandia says getting deals done is the pressure that matters, and that deals which fit poorly hurt the company. He calls getting deals done and making customers happy the fuel that makes a great company. He says Armadin has not really been pressure tested yet, and that the true test would be having 150 customers who are all ecstatic.
“I've always learned the best pressure to put on a company is get deals done.”
Listen to the episode Strategy & market Link to this Report a problem
Optics and storyline now account for about 1% of what wins the halo effect. Listen
Mandia says he once believed you could not win with optics and storyline, citing partner counts and countries served. He says that as he has got older, he now thinks storyline matters only a little, with the halo coming from winning large customers. He notes that some optics still matter.
“Now in the back of my mind as I get older, it's about 1 % of it.”
Listen to the episode Positioning & marketing Link to this Report a problem
Fundraising can consume more than half a CEO's attention and is a sideshow to the real work. Listen
Mandia says that when doing a round of funding, half his brain, probably more, goes to it, which he calls a sideshow to the real work of getting customers and making them happy. Host Joubin Mirzadegan had noted that founders can get caught up in the fundraising game and that raising money is easier than building the company.
“And by the way, like, it's way easier to raise money than actually build the company.”
Listen to the episode Fundraising & investors Link to this Report a problem
Mandiant was profitable at over $50 million in revenue before its first outside round, around seven years in. Listen
Mandia says Mandiant was bootstrapped and raised money about seven years in, in a round with Kleiner and One Equity Partners. At that point, he says, the company had over $50 million in revenue and, he thinks, around $17 million in EBITDA. He says he did not know how rare that was at the time.
“We were a profitable company.”
Listen to the episode Metrics & finance Link to this Report a problem
A funded company hires go-to-market staff before the product is released, while a profitable company would take much longer. Listen
Mandia says at Armadin they have go-to-market professionals on board before the minimum viable product is released. He says with funding they are doing things six months ahead, such as setting funnel definitions and conversion expectations. He hypothesizes that a profitable company would have taken four times longer, having first made money and driven customers.
“We have go -to -market professionals on board before we've had product release, minimum viable product.”
Listen to the episode Hiring & team building Link to this Report a problem
A CEO should have leaders imprint culture on their teams before those leaders hire their own people. Listen
Mandia says he is not a salesy sales culture guy and needs an intermediary to run sales. He says the sales leader and other leaders must set the culture and the type of talent they want before they hire. He says this approach scales well.
“Because they have to imprint the culture before they hire somebody.”
Listen to the episode Sales team, hiring & comp Link to this Report a problem
Sales leaders to a quarterly commit forecast and to getting compensation right, rather than dictating how they lead. Listen
Mandia says he tells sales leaders up front to get pay right and then judges them on the closest-to-the-pen forecast for the quarter. He says he rarely tells a leader how to change how they operate. If he has to do that, he says, he changes the leader.
“Here's our closest to the pen for this quarter and here's what I think we're going to do.”
Listen to the episode Sales team, hiring & comp Link to this Report a problem
At around 500 people a CEO stops walking the halls and manages through roughly eight people. Listen
Mandia says he found at about 500 people that he only talks to around eight people each day. He says those people and the people they hire set the culture, which still reflects the founder. He says the CEO is not an expert at everything, so the job becomes ensuring alignment and accountability.
“Right around 500 is when I found, oh, you don't walk the halls and manage a company anymore.”
Listen to the episode Leadership & culture Link to this Report a problem
Mandia uses off-site questions about career highlights and lowlights to test whether executives can speak openly. Listen
Mandia says he asks executives to present their career lowlights and asks personal questions, such as what their parents did and how they influenced them. He says these exercises build mutual respect so people can speak their minds when things are not working. He says executives who cannot handle these questions will struggle.
“tell us what your mother did, what your father did, and how they influenced you.”
Listen to the episode Leadership & culture Link to this Report a problem
Engineering is ahead of marketing for the first time in his career at Armadin. Listen
Mandia says at Armadin engineering is ahead of marketing, which he contrasts with the usual pattern where marketing gets well ahead of the product. He says they plan to hold a demo every Friday and update the sales team on where the product is. He expects a much more rapid cycle between engineering and what is taken to market.
“For the first time in my career, engineering is ahead of marketing.”
He has never met a CEO who wanted to pay a ransom. Listen
Mandia says the CEOs he has worked with in breach response did not want to pay, and that payments he has seen were made to protect customers from data leaks or to restore hospital operations quickly. He says he does not advise paying or not paying. He says he has never seen paying as the default answer across hundreds of incidents.
“I've never met a CEO who wants to pay.”
He hires leaders who are better than him at their function and then lets them run it. Listen
Mandia says at Mandiant he looked around the leadership table and found everyone was better at their job than he was, and that was enough for them to run their businesses. He says he expects the same at Armadin, and that a leader who is not right for the discipline will not scale and must be replaced. He presents this as how he thinks about building a leadership team.
“I looked around the table and everybody there was actually better at what they did than I was.”
Listen to the episode Leadership & culture Link to this Report a problem
Mandiant's breach-response work gave it a front-row seat for building endpoint technology. Listen
Mandia says Mandiant's core idea was that breaches are inevitable and that the company should respond to every breach that matters. He says this gave them insight into how Symantec and McAfee were circumvented, and that the work was really about building a better endpoint solution. He says the company was an endpoint company though few people knew it at the time.
“And that is the front row seat you need to build the best endpoint. technology.”
Listen to the episode Strategy & market Link to this Report a problem