Mandiant
| Company type | Subsidiary |
|---|---|
| Industry | Cybersecurity |
| Founded | 2004 |
| Founder | Kevin Mandia |
| Headquarters | United States |
Key people | Kevin Mandia (CEO) |
| Products | Incident response, security advisory, incident management solutions, Mandiant Advantage (SaaS platform) |
| Parent |
Mandiant, Inc. is a U.S.-based cybersecurity company operating as a subsidiary of Google. The firm rose to international attention in February 2013 after issuing a report that directly linked cyber espionage activities to China. In December 2013, Mandiant was purchased by FireEye for $1 billion. Subsequently, in June 2021, FireEye divested its product portfolio, brand, and workforce to Symphony Technology Group for $1.2 billion.
Google declared its intent to acquire Mandiant for $5.4 billion in March 2022, incorporating the company into its Google Cloud segment. This integration was finalized by September 2022.
Founding
Kevin Mandia, previously an officer in the United States Air Force and the current CEO, established the company initially as Red Cliff Consulting in 2004 before rebranding it as Mandiant in 2006. In 2011, the firm secured investments from Kleiner Perkins Caufield & Byers and One Equity Partners, enabling expansion of its workforce and business-to-business services. Mandiant provides incident response, security advisory, and incident management solutions to international corporations, government bodies, and Fortune 100 enterprises.
History
Mandiant developed OpenIOC, a flexible XML framework designed to identify technical indicators of threats and hacker tactics. By 2012, the company's revenue surpassed $100 million, marking a 76% increase compared to the previous year.
In February 2013, Mandiant released an investigation revealing cyber intrusions conducted by Unit 61398 of the People's Liberation Army, which had targeted over 141 organizations across the United States and other English-speaking nations since 2006. This espionage group was designated "APT1" in the study.
FireEye acquired Mandiant in December 2013 for $1 billion to strengthen its cybersecurity offerings. In October 2020, Mandiant introduced Mandiant Advantage, a subscription-based SaaS platform that combines threat intelligence with cyber incident response data. Later that year, the company played a key role in examining a significant supply chain breach involving SolarWinds software that impacted U.S. government systems.
In May 2021, Mandiant supported Colonial Pipeline during recovery efforts following a ransomware attack that disrupted fuel distribution on the East Coast of the United States. The next month saw Mandiant's separation from FireEye amid FireEye’s acquisition by Symphony Technology Group. In August 2021, Mandiant broadened its service offerings by acquiring Intrigue, a specialist in surface management.
During 2022, Mandiant uncovered a pro-China disinformation campaign aimed at American voters prior to the midterm elections. On May 4, 2023, the company announced new integrations with MISP, Splunk SIEM, and SOAR platforms to improve delivery of threat intelligence services.
Acquisition by Google
In March 2022, Google completed the purchase of the company for $5.4 billion, incorporating it into its Google Cloud division. Although antitrust issues were a consideration, Fortune highlighted that this acquisition might actually foster greater competition within the cybersecurity sector.
The transaction underwent scrutiny by the United States Department of Justice Antitrust Division to ensure compliance with federal antitrust laws and received approval by July 2022. Likewise, the Australian Competition & Consumer Commission (ACCC) raised no objections to the deal.
The acquisition was finalized on September 12, 2022, marking the start of its integration with Google Cloud. Mandiant remains a distinct subsidiary, maintaining its brand identity while utilizing Google's extensive global infrastructure to broaden its cybersecurity offerings.
Flare-On
Since 2014, the company has organized the annual Flare-On challenge focused on cybersecurity reverse engineering. This event draws participants worldwide and serves to strengthen the company's presence in the industry.