Kevin Mandia's AI-attack startup raises $255.5 million, the fourth 'AI security' mega-round of 2026

Kevin Mandia's newest company tripled its valuation in roughly the time most Series B rounds take to close. Armadin -- the agentic-security startup the former Mandiant chief executive launched in March 2026 with an already-record $189.9 million combined seed and Series A -- raised $255.5 million in a Series B that values the company at over $2.5 billion, the company said Oct. 1. That brings Armadin's total raised to $445 million in seven months, and makes it the fourth AI-security startup this year to close a nine-figure-or-larger round at a billion-dollar-plus valuation.

Andreessen Horowitz and Accel co-led the round, joined by new investors Bain Capital Ventures and Redpoint alongside returning backers 8VC, Ballistic Ventures, Google's GV, In-Q-Tel, Kleiner Perkins, and Menlo Ventures -- a lineup that pairs ordinary venture money with In-Q-Tel, the CIA's nonprofit venture arm, a signal of the government-customer side of Armadin's business alongside its Fortune 500 clients.

Mandia's name is doing real work in that investor lineup. He founded Mandiant in 2004, built it into the firm that helped uncover the SolarWinds breach, sold its product line for $1.2 billion in 2021, then sold the remaining services business to Google for $5.4 billion in 2022 and stayed on as CEO inside Google Cloud until he left to found Armadin. “When attacks move at machine speed, defense must become autonomous,” Mandia said at Armadin's March launch. “It will not be feasible to have a human in the loop for every defensive decision and expect to win.” That March launch -- $189.9 million in combined seed and Series A funding -- is what this week's $255.5 million actually adds to, bringing the seven-month total to $445 million almost exactly.

“The only way to build a defense that keeps pace is to train it against the best offense available, every day.” — Kevin Mandia, Armadin CEO

What Armadin actually sells is autonomous AI agents that attack a customer's own infrastructure on purpose. The platform deploys swarms of specialized agents that, per the company's own description, reason across an organization's attack surface like a skilled adversary, chaining individually minor weaknesses into validated attack paths a real intruder could follow -- continuous, automated red-teaming instead of the periodic, human-run penetration tests most enterprises still rely on.

Armadin isn't the only large AI-security check written in 2026, and the four biggest rounds aren't funding the same idea. Island's $400 million Series F, which closed a week earlier at a $6.4 billion valuation, builds browser-level governance that blocks a company's own AI agents from acting somewhere they shouldn't. Cyera's $600 million round in June -- the largest of the four, at a $12 billion valuation -- sells data classification: knowing what sensitive information exists and what any AI agent is allowed to touch. Dream, co-founded by former NSO Group chief executive Shalev Hulio and former Austrian chancellor Sebastian Kurz, raised $260 million -- led by Bicycle Capital and Group 11 -- at a $3 billion valuation to build sovereign national cyber-defense platforms for governments. Line up all four and the thing being sold under one label, "AI security," is four different products solving four different problems, unified mostly by the size of the checks being written.

None of the four companies' announcements disclose revenue, annual recurring revenue, or customer counts a reporter can check against the valuation -- every number in this article is a raise and a price, not a business. Bank Info Security's own analysis of Cyera's round posed the question directly: whether the fastest path for a company valued at roughly 80 times one analyst's ARR estimate is an IPO or a sale, because the math doesn't obviously support staying private much longer.

The checks keep coming because the category keeps getting bigger on paper. Crunchbase data cited in a March 2026 industry roundup put the ten most-funded agentic AI-security startups at a combined $3.6 billion raised to that point -- before Armadin had even left stealth -- and Gartner projects the broader AI-cybersecurity market growing from roughly $26 billion in 2025 to $172 billion by 2029. Against that growth story, a company tripling its valuation in seven months reads to investors less like an outlier and more like the pace the category is supposed to move at.

Set against the archive of every AI-related raise this publication has tracked, Armadin's $255.5 million is a mid-pack figure -- smaller than Cyera's or Island's, larger than most -- which is itself a sign of how normal a quarter-billion-dollar security round has become in 2026.

What none of this week's coverage answers is whether Armadin's agents actually find attack paths a skilled human red team would miss, or just automate the ones any team already finds eventually. That is harder to check than a funding round, and -- unlike the dollar figures above -- no independent party has published an answer yet. Betting $255.5 million that autonomous offense beats autonomous defense before an outside evaluator settles that question is either the obvious next move in a market already building autonomous attackers, or the newest version of an old security-industry habit: writing a very large check for whatever this year's most fundable noun happens to be.