Mandiant
Threat intel and incident response firm, now a Google Cloud subsidiary.
On the record
Checkpoint: Alphabet Q3 2026 earnings call, watch for any separate security-services disclosure
The call
Mandiant's breach data and reputation still pull in the biggest cases, while its own parent quietly automates the analyst tier underneath it.
Mandiant helps companies respond to hacks and figure out who attacked them. It has a real advantage: a huge database of attack patterns from 500,000-plus hours of real incidents per year, and years of credibility in naming who did what. Google, which owns Mandiant, is fast-tracking AI agents that do the same work Mandiant's mid-level analysts do, with confirmed plans to shift hiring toward AI in 2026. The main question is whether the company's elite experts (the ones who solve the hardest attribution cases) stay valuable enough to survive, or whether Google merges them into its own security products and lets the rest of the analyst jobs disappear.
Why
01
AI pressure: Google's own SecOps Alert Triage and Investigation agents. Google is automating Tier-1/Tier-2 analyst work with agents built partly from Mandiant's own detection content, then cutting the humans who did it. Could AI do the core job? Only partly.
02
Bigger players: Microsoft Sentinel and Defender bundled into E5 licenses. Microsoft folds SIEM and XDR into licenses enterprises already pay for, squeezing standalone security-services budgets. Could a giant copy it? No, they are blocked.
03
What protects it. Its 500k+ hours a year of real breach data and Mandiant's name still get called first for the incidents that end up in the news.
What would change this call
Whether a second Google layoff round hits Mandiant/GTIG staff within 6-12 months. Would show the parent is shrinking, not scaling, human analyst headcount.
Whether Kevin Mandia's startup Armadin announces hires from Mandiant or wins government/enterprise IR contracts. Would show senior talent and clients are leaving Mandiant for a rival founded by its own founder.
Whether Alphabet's Q2/Q3 2026 earnings break out Mandiant or security-services revenue separately. Would show whether Mandiant's business is growing enough to warrant separate disclosure or being absorbed into Cloud.
Whether Kevin Mandia's startup Armadin announces hires from Mandiant or wins government/enterprise IR contracts. Would show senior talent and clients are leaving Mandiant for a rival founded by its own founder.
Whether Alphabet's Q2/Q3 2026 earnings break out Mandiant or security-services revenue separately. Would show whether Mandiant's business is growing enough to warrant separate disclosure or being absorbed into Cloud.
Key numbers
- $5.4B all-cash Google acquisition
- 2025 attacker dwell time: 14 days, up from 11
- June 2026 layoffs hit Mandiant and GTIG staff
Named risks
- Parent Google is laying off Mandiant/GTIG staff while reallocating budget to AI agents (June 2026).
- No standalone financial disclosure since 2022 acquisition obscures true unit performance.
- Founder Kevin Mandia now runs a rival AI-security startup that could poach talent or clients.
- Unit 42 and CrowdStrike directly contest Mandiant's flagship threat-report credibility.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Palo Alto Networks (Unit 42) | contesting | Published competing 2026 Global IR Report on 2026-02-17 to rival Mandiant's M-Trends |
| CrowdStrike Services | contesting | Competes directly in managed detection, response, and IR consulting engagements |
| Microsoft Sentinel/Defender | contesting | Bundled into E5 licenses, pressuring SIEM/SOC platform market Mandiant intel feeds into |
| Google SecOps agentic AI (internal) | losing to | Alert Triage and Investigation agents shipped 2026-06-16 automate Tier-1 analyst work, tied to June 2026 layoffs |
| Armadin (Kevin Mandia startup) | gaining on | Mandiant founder launched AI-native security startup in 2025 after leaving the company |
Questions people ask
- Is Mandiant still an independent company?
- No. Mandiant became a wholly owned subsidiary of Google/Alphabet when the $5.4B all-cash acquisition closed on September 12, 2022, after being announced in March 2022 at $23.00/share. It now operates inside Google Cloud Security, keeping its brand but reporting no separate financials.
- Is Mandiant profitable today?
- Unknown publicly. Mandiant's last standalone reported revenue was about $483 million in 2021, before Google's acquisition. Since the September 2022 deal closed, Mandiant's financials are folded into Google Cloud's broader security segment, with no discrete revenue or profit figures disclosed as of mid 2026.
- Will AI replace Mandiant's threat analysts?
- Partly already happening. Google's own SecOps Alert Triage and Investigation agents, unveiled at Cloud Next on June 16, 2026, automate Tier-1 analyst tasks, and Google laid off Mandiant and Threat Intelligence Group staff in early June 2026 while reallocating toward AI investment.
- Who is Mandiant's biggest competitor?
- Palo Alto Networks' Unit 42 is the most direct challenger, publishing its own 2026 Global Incident Response Report on February 17, 2026 explicitly positioned against Mandiant's flagship M-Trends. CrowdStrike Services and Microsoft Sentinel/Defender also contest the incident response and SOC market.
- Did Mandiant's founder Kevin Mandia leave the company?
- Yes. Kevin Mandia stepped down as Mandiant CEO on May 31, 2024, took an advisory role at Google, became a General Partner at Ballistic Ventures on June 26, 2024, and reportedly founded a new AI-security startup called Armadin in 2025.
- What makes Mandiant hard for AI startups to replace?
- Mandiant's frontline incident-response dataset, over 500,000 hours of investigations logged in 2025 alone feeding its M-Trends 2026 report published March 23, 2026, plus attribution credibility built from naming state-linked hacking groups, are proprietary assets AI-only competitors cannot easily replicate.
Timeline
- 2026-07-01Google-commissioned IDC study claims $4.3M annual benefit from Mandiant Consulting (vendor-claimed)
- 2026-06-16Google Cloud unveils agentic SecOps Alert Triage and Investigation agents at Cloud Next 2026
- 2026-06-04Reports confirm Google layoffs hit Mandiant and Threat Intelligence Group staff
- 2026-03-23M-Trends 2026 report published, notes rising attacker dwell time
- 2026-03-13Mandiant publishes AI risk and resilience report with GAIA Top 10 framework
- 2026-02-17Palo Alto's Unit 42 publishes competing 2026 Global IR Report
- 2025-08-12Forrester TEI study cites 240% ROI for Google Security Operations (vendor-claimed)
- 2024-06-26Kevin Mandia named General Partner at Ballistic Ventures
- 2024-05-31Kevin Mandia steps down as Mandiant CEO
- 2022-09-12Google closes $5.4B all-cash acquisition of Mandiant
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Google Announces Intent to Acquire Mandiant (2022-03-08)
- Mandiant
- New IDC study: How Mandiant transforms security into a competitive advantage (2026-07-01)
- Forrester study: Customers cite 240% ROI with Google Security Operations (2025-08-12)
- Google Cloud cuts its own cyber threat hunters as Mandiant layoffs hit security division (2026-06-04)
- M-Trends 2026 (2026-03-23)
- New Mandiant AI security report (2026-03-13)
- Google named a Leader in IDC MarketScape SIEM 2026 Vendor Assessment (2026-06-16)
- Kevin Mandia to step down as CEO of Mandiant (2024-05-21)
- Cybersecurity Veteran Kevin Mandia Named General Partner of Ballistic Ventures (2024-06-26)
- This Buzzy Cyber Startup Wants to Take On Dangerous AI Threat
- 2026 Unit 42 Global Incident Response Report (2026-02-17)