Armadin's AI agents found 90 zero days in Fortune 500 production

1. Offense trains defense — ▶ 3:12

   Armadin runs AI on offense, built by the good guys, to train AI on defense. Act one, Armadin Red, is to be the best in the world at finding exploitable risk. Being 5 minutes ahead of a nation state or criminal is enough. Act two, Armadin Blue, stops what Red finds. Mandia's sports framing: there is no defense without a great offense to practice against, like the 2000 Baltimore Ravens. The offense must also be continuous, and in the AI age no human can sit in the loop for tactical autonomous defense.

2. AI attack fingerprints — ▶ 4:27

   Mandia has seen nothing in the wild like Armadin's own system of 25,000 agents working in concert. Real AI attacks today are clumsy: break into point A, move laterally to B, then try to break into A again. But scale dwarfs humans, and what AI does in a microsecond would take 70 humans. Finding exploitable risk is code, a structured language, so AI is already good at it. Open models are good enough, so slowing the models is moot. Criminal attacks will surge once GPUs are anonymously available. It is still the first inning.

3. Sniper becomes swarm — ▶ 7:48

   Nation states hack with a sniper round, going deep at specific targets like 30 defense contractors. With AI that becomes a drone swarm: sloppier, louder, more comprehensive, and more effective. Mandia expects nations to rethink doctrine, mixing swarm and sniper by risk, target and how surreptitious they need to be. AI is not surreptitious today without heavy post-training and a human in the loop. The bigger shift is the equalizer: less technical attackers will appear far more successful, and defenders will struggle to say whether a nation, a human or something else is behind an attack.

4. Hyperattack and heartbeat — ▶ 11:40

   Continuous attack is cost-prohibitive and unnecessary, so Armadin runs a hyperattack: a drone swarm of agents maps every service, route and asset into terabytes of metadata, a twin of the network as the attacker sees it. It then polls that map like a heartbeat and attacks only the change. Triggers are new models or intelligence, network changes, or a board meeting tomorrow. When a zero day hit a popular product over a weekend, the heartbeat already had the answer. The goal is to know if a CVE is actually exploitable before bad guys do. Polling costs will fall.

5. Beyond pentesting — ▶ 15:11

   Pentesting scans for the known and produces larger lists of vulnerabilities that do not matter. Armadin carries out and verifies each exploit, so there are no false positives, and finds logic flaws in custom apps. Since January 2026 it has found over 90 zero days in production at Fortune 500 sites, black box from the internet, with models post-trained by real red teamers. Scanning source code for thousands of bugs, as in the Mythos moment, is noise. Mandia calls a CISO within 48 hours with remote code execution in the DMZ. He expects this to replace pentesting and become as ubiquitous as antivirus.

6. Blue: bad patch beats intrusion — ▶ 18:46

   Armadin Blue feeds exploitable-risk data to the defense plane, EDR and firewalls, so they can apply compensating controls at speed. Mandia says CrowdStrike and Palo Alto know this has to exist, and Fortinet and others need to be informed. Early controls will be rudimentary over the next few months; a year out they will just be there. His position: "I'd rather have a bad patch stopping a bad guy from getting in than have an intrusion." He likens it to field dressing a wound, not the hospital. Autonomous defense will arrive even if a CISO never asks for it.

7. Humans are too slow — ▶ 21:14

   If humans are in the detect-and-respond loop, they will be too slow. Prevent, detect and respond all go to AI, and the windows keep narrowing until automated response is itself prevention. Armadin's agentic internal command and control proliferates at a shocking speed, doing a thousand things at once, and when it gets in the defense apparatus is like a popped balloon. Layers and traps behind the force field still matter because someone will eventually find an exploit Armadin has not. CISOs are re-examining workforce, headcount and process, but it is too soon to tell where the SOC lands.

8. The window of exposure — ▶ 24:30

   Near term, AI advantages offense, period. Attackers in Iran or Russia feel desperate to get in now, and defenders are desperate to patch every window. Mandia knows of no large enterprise not scanning for exposure in real time. CIO, CISO, product and business teams run war rooms. One sophisticated company moved a large share of its engineers and researchers to fortifying its own walls, within the last few months. The Mythos moment was a firm stamp that AI offense is coming. There is no way to make the next year pretty. The long-term gain is AI defense, trained by AI offense, beating humans peering at packets.

9. Caging the beast — ▶ 27:04

   Mandia says the labs underestimated their models' capability in the Hugging Face incident, and deterministic guardrails could have stopped it. He admits "Armadin has made the beast that we're all worried about." Its controls are a hypervisor, host lockdown, a proxy, and passive review of every prompt; most killed agents are just wasting money. Assume every layer fails, so add deterministic rules and classifiers, and pause and escalate to a human when output is unrecognized. Too deterministic loses creativity, so it stays a gray area, with no 100% certainty. Evals must be written by red teamers, not only AI people.

10. Twenty kill chains, eight — ▶ 30:04

    Armadin built 20 full kill chains that humans had executed in the real world at victim sites. No model completed more than 8. Open-weight models and the most advanced closed models all ended at the same 8, at diminishing returns. Closed models got there faster, but that gap is shrinking, and the open ones just ran longer. The difference showed up only in cost. Humans still found most of the 90-plus zero days, with AI doing 90-plus% of the tedious work. But the last few zero days were found by the technology alone.

11. Building at AI speed — ▶ 35:51

    Mandiant was self-funded in 2004 on a premise nobody believed, with no competition. Armadin has an "80 mph tailwind" but no sales force, no go-to-market and no international presence, so it must raise capital and build ahead of demand. Mandia cites Wiz reaching over $100 million in ARR in 18 months and says Armadin will try to beat it. Sales needs training weekly because the product changes every 2 weeks. IP may last 6 months. The halo comes from money center banks, retail and airlines made ecstatic: get customer, make customer happy, repeat. Engineers sit in one room.

A defense you have never attacked is not a defense. That is the premise Kevin Mandia has built Armadin on. The company runs swarms of AI agents against real production networks, finds what is exploitable, and uses that pressure to train AI on defense. The bar is modest and brutal. If Armadin is 5 minutes ahead of a nation state or a criminal crew, the customer is safe. If it is 5 minutes behind, nothing else matters.

Why AI on offense, and why now? Because the attacker's economics have already changed. A human intruder picks one path and commits limited resources to it. An AI swarm does not need to choose. What it does in a microsecond would take 70 humans. Armadin has built a system of 25,000 agents working in concert, and Mandia has seen nothing like it in the wild yet. Real AI attacks today are clumsy. They break into point A, move laterally to B, then try to break into A again. They are loud. But finding exploitable risk is code, a structured language, and structured work is where models excel. No frontier-grade creativity is needed. That is why Mandia dismisses calls to slow the models. Open models are already good enough. What holds criminals back is anonymity and cost. Once GPUs are anonymously available, he expects far more criminal attacks. He puts us in the first inning.

The sophisticated end changes shape too. Nations hack with a sniper round, going deep on 30 defense contractors. With AI that becomes a drone swarm: sloppier, louder, more comprehensive. Mandia expects national doctrine to shift, with a mix of swarm and sniper depending on how surreptitious the mission must be. AI is not surreptitious by default. It takes heavy post-training and a human in the loop. The larger effect is the equalizer. Less technical attackers will look far more successful, and defenders will struggle to say whether a nation, a criminal or a hobbyist is behind a swarm. Attribution gets harder.

Armadin's own results are the evidence that this works. Since January 2026 it has found more than 90 zero days at customer sites, all in production, at Fortune 500 companies. It comes in black box from the internet, with no source code, and calls a CISO, usually within 48 hours, to say it has remote code execution in the DMZ. Customers treat it as an incident, not a report. Mandia contrasts this with scanning source code for thousands of bugs, which he calls noise, and with pentesting, which scans for the known and produces lists of vulnerabilities that do not matter. Armadin verifies every exploit, so there are no false positives. Its models are post-trained by real red teamers who write exploits. Most of the 90 were found by humans using AI for the tedious 90%. But the last few were found by the technology alone. Mandia thinks this replaces pentesting and becomes as ubiquitous as antivirus.

Doing this continuously is the engineering problem. A permanent assault is too expensive and unnecessary. So Armadin runs a hyperattack, mapping every service, route and asset into terabytes of metadata, a twin of the network as an attacker sees it. Then it polls that map like a heartbeat and attacks only the change: a new app, a new route, a new machine. It also attacks when new models or intelligence appear, or when a board meeting is coming. When a zero day hit a popular product over a weekend, the heartbeat already had the answer. Model choice matters less than expected. Across 20 full kill chains that humans had executed in the real world, no model completed more than 8. Open-weight and closed models all ended at 8. Closed models were faster. The open ones simply ran longer.

Finding the hole is half the job. Armadin Blue passes exploitable-risk data to the defense plane, EDR and firewalls, so they can apply compensating controls at speed. Mandia says CrowdStrike and Palo Alto know this has to exist. The first controls will be rudimentary. He accepts that: he would take "a bad patch stopping a bad guy from getting in" over an intrusion. The deeper claim is that humans cannot sit in the detect-and-respond loop. Agentic command and control, once inside, does a thousand things at once, and the defense apparatus pops like a balloon. Prevention, detection and response all go to AI, and the lines between them blur, because fast automated response is prevention. Layers still matter, with traps behind them, since someone will eventually get around Armadin's force field.

The transition is the dangerous part. Mandia is blunt that AI advantages offense in the near term. Attackers in Iran or Russia are racing to get in now. Defenders are racing to patch. He knows of no large enterprise that is not scanning for exposure in real time, and one sophisticated company put a large share of its engineers and researchers on fortifying its own walls. The Mythos moment, he says, was a firm stamp that AI on offense is coming. His conclusion is that there is no way to make the next year pretty. The long-term bet is that autonomous defense, trained by AI offense, will be more diligent than humans peering at packets.

The obvious objection is that Armadin is building the thing everyone fears. Mandia concedes it: "Armadin has made the beast that we're all worried about." His answer is layers. A hypervisor, host lockdown, a proxy, passive review of every prompt. Most agents Armadin kills are wasting money, not misbehaving. Every layer is assumed to fail, so deterministic rules back it up. Every action is logged with source IP and time, so incidents can be replayed instead of taking 2 weeks of forensics. Classifiers watch traffic in and out, and anything unrecognized is paused and escalated to a human. But he names a limit himself. Over-constrain the model and you lose the creativity you wanted. So you release a little and find the line. No one, he says, can claim 100% certainty. He reads the Hugging Face incident as a lab failure: the labs underestimated their own models, and deterministic guardrails could have stopped it. Security people do not understand the AI and AI people do not understand security, so the evals have to be written by red teamers. The same gray area applies to the autonomous defense he wants enterprises to adopt.

The business has to move at the same speed. Mandia self-funded Mandiant in 2004 on a premise nobody believed, that breaches are inevitable, and had no competition. Armadin has an 80 mph tailwind, no sales force, no international presence and a crowded field. It needs funding, a brand and a go-to-market built ahead of demand. He cites Wiz reaching over $100 million in ARR in 18 months and says Armadin will try to beat it. Sales has to be retrained weekly, because the product changes every 2 weeks. The differentiator is simple: win the money center banks and airlines, make them ecstatic, repeat. And IP will not protect anyone. What Armadin does today, someone else will be doing in 6 months. Whether the customer halo outruns that clock is unresolved. So is the shape of the SOC. Mandia says it is too soon to tell where it lands.