Mandiant

Mandiant. It is a prominent American cybersecurity firm renowned for its expertise in incident response, threat intelligence, and digital forensics. Founded in 2004, the company gained international recognition for its high-profile investigations into state-sponsored cyber espionage, particularly attributing attacks to groups linked to nations like China and Russia. Its work has significantly shaped the modern understanding of advanced persistent threat actors and enterprise security practices.

History

The company was established in 2004 by Kevin Mandia, a former United States Air Force officer and computer security expert. Initially focused on incident response for corporate clients, it quickly built a reputation for technical excellence. A pivotal moment in its history came in 2013 with the publication of its landmark "APT1" report, which meticulously documented years of cyber espionage by a People's Liberation Army unit, marking one of the first major public attributions of cyber attacks to a specific nation-state actor. This report brought the firm widespread attention and cemented its role as a leader in threat intelligence. In 2014, the company was acquired by FireEye, Inc. in a deal valued at approximately $1 billion, operating for several years as the FireEye subsidiary. Following its separation from FireEye in 2021, it returned to operating as an independent public company before being acquired by Google in 2022.

Services and operations

Its core offerings revolve around proactive and reactive cybersecurity services. Its incident response teams are deployed globally to assist organizations during active breaches, employing digital forensics to contain threats and identify root causes. The company maintains a robust threat intelligence division, known as Mandiant Threat Intelligence, which researches adversary tactics, techniques, and procedures, publishing detailed analyses on groups like APT29 and FIN7. Other key services include security validation through its Mandiant Advantage platform, compromise assessments to detect hidden breaches, and consulting services for security program development. Its experts frequently testify before bodies like the United States Congress and collaborate with agencies such as the Federal Bureau of Investigation and the Department of Homeland Security.

Notable incidents and investigations

The firm has been at the forefront of investigating some of the most significant cyber incidents of the past decade. Its groundbreaking 2013 report on APT1 provided unprecedented detail on Chinese cyber espionage. In 2014, it investigated the massive Sony Pictures hack, attributing the attack to North Korea. The company played a critical role in analyzing the 2015-2016 Democratic National Committee cyber attacks, linking the activity to Russian intelligence services. It has also published extensive research on the SolarWinds supply chain compromise, the activities of the Cozy Bear and Fancy Bear groups, and ransomware operations by gangs like REvil. Its experts were instrumental in dissecting the 2020 campaign targeting the COVID-19 research sector and have consistently tracked Iran-linked threat actors like APT35.

Acquisition by Google

In March 2022, Google announced its intention to acquire the company for approximately $5.4 billion, a move seen as significantly bolstering the capabilities of Google Cloud. The acquisition was completed in September 2022, with the firm being integrated into Google Cloud as a core part of its security offerings. The deal aimed to combine its frontline intelligence and incident response expertise with Google's vast infrastructure and artificial intelligence capabilities. Following the acquisition, its services, including the Mandiant Advantage platform, have been offered alongside Google Cloud products like Chronicle and Security Command Center, creating a comprehensive security suite for enterprise clients.

Leadership and organization

The company has been led by prominent figures in the cybersecurity industry. Its founder, Kevin Mandia, served as Chief Executive Officer for many years and later as Chief Operating Officer of FireEye before returning to lead the independent company. Following the Google acquisition, Kevin Mandia was appointed to lead Google Cloud's security go-to-market strategy. Other key executives have included John Watters, who served as President, and Jurgen Kutscher, who led its services division. The organization is headquartered in Reston, Virginia, with major offices and operations centers around the world, including locations in Dublin, Singapore, and Tokyo, employing a large force of security consultants, intelligence analysts, and researchers.

Category:American companies established in 2004 Category:Google subsidiaries Category:Computer security companies of the United States