Mandiant
Cybersecurity company specializing in incident response, threat intelligence, cyber investigations, and security consulting.
Last updated November 2, 2026
AI crawler reads
19requests
3companies- OpenAI11
- Amazon4
- ByteDance4
- Profile
- 13
- Controversies
- 6
- JSON · MD
- 0
- First read
- Oct 29, 2026
- Latest read
- Oct 31, 2026
From this site's server log
Overview
Mandiant is a United States cybersecurity company focused on helping organizations investigate, contain, and recover from sophisticated cyberattacks. Its work combines incident response, threat intelligence, digital forensics, security validation, managed defense, and strategic consulting. The company serves major corporations, governments, and other institutions that require specialized assistance during or after security incidents. Kevin Mandia, a former United States Air Force officer, founded the business in 2004 as Red Cliff Consulting. It adopted the Mandiant name in 2006. In its early years, the company concentrated on business-to-business incident response and broader security consulting, while also developing tools and methods for incident management. Funding from Kleiner Perkins Caufield & Byers and One Equity Partners in 2011 supported staff expansion and growth in its enterprise activities. Mandiant became particularly influential in threat intelligence through its investigations of advanced persistent threats and its development of OpenIOC, an extensible format for describing technical indicators of compromise. In February 2013, the company published a widely cited report attributing a long-running cyber-espionage campaign against organizations in the United States and other English-speaking countries to a unit of the People's Liberation Army. Mandiant called the group APT1 and associated it with PLA Unit 61398. The report helped make commercial threat intelligence and public attribution central parts of the cybersecurity industry. FireEye acquired Mandiant in December 2013 for approximately $1 billion. Under FireEye, Mandiant continued its consulting and incident-response activities while becoming closely associated with investigations of high-impact intrusions. In October 2020, the business announced Mandiant Advantage, a subscription software platform intended to combine Mandiant threat intelligence with information from incident-response engagements and help security teams automate and improve their response processes. Mandiant investigated the 2020 SolarWinds supply-chain compromise and assisted with the response to the 2021 ransomware attack affecting Colonial Pipeline. In 2021, FireEye sold its product business, name, and employees to Symphony Technology Group for approximately $1.2 billion; Mandiant became an independent company again in that transaction. It subsequently expanded its capabilities through the acquisition of Intrigue, a company focused on attack-surface management. Google announced in March 2022 that it would acquire Mandiant for approximately $5.4 billion. The transaction received regulatory review, including scrutiny by the United States Department of Justice Antitrust Division, and closed on September 12, 2022. Mandiant was integrated into Google Cloud but retained its brand and continued operating as a specialized cybersecurity business. Its later work has included research into influence operations and assistance with investigations of the 2024 Snowflake-related data-theft campaign. Mandiant also operates Flare-On, an annual global reverse-engineering and malware-analysis challenge.
History
Mandiant began in 2004 when Kevin Mandia founded Red Cliff Consulting. Mandia's background as a United States Air Force officer informed the firm's emphasis on disciplined investigation, forensic analysis, and response to sophisticated intrusions. The company adopted the Mandiant name in 2006 and developed a business serving large organizations, governments, and Fortune 100 companies. Its early offering combined emergency incident response with general security consulting and incident-management products. In 2011, investment from Kleiner Perkins Caufield & Byers and One Equity Partners supported expansion of its staff and business-to-business operations. Mandiant also developed OpenIOC, an extensible XML-based format for representing indicators of compromise and sharing technical descriptions of malicious activity. The company's public profile grew sharply in February 2013, when it published a report on a cyber-espionage group it named APT1. Mandiant said the activity had affected at least 141 organizations in the United States and other English-speaking countries and connected the campaign to PLA Unit 61398 in Shanghai. The report was influential because it publicly linked technical evidence from intrusions with an alleged state-sponsored actor, helping establish commercial threat intelligence as a major cybersecurity discipline. FireEye acquired Mandiant in December 2013 for about $1 billion. Mandiant continued to operate as the incident-response and investigation center of expertise within the enlarged cybersecurity company. Its investigators subsequently worked on several prominent incidents, including the SolarWinds supply-chain compromise disclosed in 2020. In October 2020, the company introduced Mandiant Advantage, a subscription-based software platform designed to combine Mandiant's intelligence with information from incident-response work and give security teams more automated support. FireEye announced in 2021 that it would sell its product business, brand, and employees to Symphony Technology Group for approximately $1.2 billion. Mandiant was separated from that transaction and operated independently. During this period it continued responding to major incidents, including the ransomware attack affecting Colonial Pipeline, and acquired Intrigue in August 2021 to strengthen attack-surface management. Google announced its proposed acquisition of Mandiant in March 2022 for approximately $5.4 billion. The transaction underwent regulatory scrutiny, including a review by the United States Department of Justice Antitrust Division. The DOJ approved the deal, and the Australian Competition & Consumer Commission announced that it would not oppose the transaction. The acquisition closed on September 12, 2022, and Mandiant was incorporated into Google Cloud while retaining its name and identity as a cybersecurity business. After the acquisition, Mandiant continued publishing threat research and supporting investigations. Its researchers reported on a pro-China influence campaign aimed at American voters before the 2022 midterm elections. In 2023, the company announced integrations for MISP and Splunk SIEM and SOAR environments. In 2024, it assisted with investigations into a major Snowflake-related data-theft and extortion campaign. Separately, Mandiant has organized Flare-On, an annual reverse-engineering challenge held since 2014 for participants around the world.
- 2024
Snowflake-related breach investigations
[1]Mandiant assisted investigations into a major data-theft and extortion campaign involving Snowflake customers.
- 2023
Security-platform integrations announced
[1]Mandiant announced integrations with MISP and Splunk SIEM and SOAR environments.
- 2022
Google announces acquisition
[1]Google announced a proposed $5.4 billion acquisition of Mandiant.
- 2022
Integrated into Google Cloud
[1]The Google acquisition closed on September 12, 2022, and Mandiant began integration into Google Cloud.
- 2021
Separation from FireEye
[1]Mandiant became independent after FireEye sold its product business, name, and employees to Symphony Technology Group.
- 2021
Intrigue acquired
[1]Mandiant acquired Intrigue to expand attack-surface management capabilities.
- 2020
Mandiant Advantage announced
[1]The company introduced a subscription platform combining threat intelligence and incident-response information.
- 2014
Flare-On begins
[1]Mandiant began its annual Flare-On reverse-engineering and cybersecurity challenge.
- 2013
APT1 report published
[1]Mandiant published research attributing a major cyber-espionage campaign to PLA Unit 61398.
- 2013
Acquired by FireEye
[1]FireEye acquired Mandiant for approximately $1 billion.
Products and positioning
A high-end cybersecurity partner for advanced threat investigations, incident response, threat intelligence, and resilience programs serving complex enterprises and government organizations.
Incident response and digital forensics
Mandiant Incident Response
Mandiant's incident-response practice helps organizations investigate suspected compromises, determine the scope and mechanics of an attack, contain adversary activity, preserve evidence, and recover operations. It is designed for urgent breaches as well as preparedness and response-retainer arrangements.
Cybersecurity software platform · 2020
Mandiant Advantage
Mandiant Advantage was introduced as a subscription-based software platform that combines Mandiant threat intelligence with information gathered through incident-response engagements. Its purpose is to help security teams prioritize threats, improve investigation workflows, and automate elements of response.
Threat intelligence
Mandiant Threat Intelligence
This offering provides intelligence on threat actors, campaigns, malware, vulnerabilities, and indicators of compromise. It draws on Mandiant's investigations and research to support detection, attribution, strategic risk assessment, and security operations.
Security validation
Mandiant Security Validation
Security validation services assess whether an organization's defensive controls can detect and respond to realistic attack behaviors. The offering is intended to identify gaps between documented security capabilities and operational performance.
Open cybersecurity standard
OpenIOC
OpenIOC is an extensible XML schema created by Mandiant for describing technical characteristics that can indicate compromise. It supports structured communication of forensic evidence, malicious activity, and attacker methods.
Cybersecurity competition · 2014
Flare-On
Flare-On is an annual reverse-engineering challenge organized by Mandiant. It attracts participants internationally and focuses on malware analysis, reverse engineering, and related technical problem-solving skills.
Controversies
2026
MyMichigan Health investigates cyberattack claims
MyMichigan Health stated that it is investigating a group's claim that it stole data. According to the organization, the investigation has so far found no unauthorized system access or compromise of patient information. MyMichigan Health also hired Mandiant to help assess the claims. The event was reported on October 16, 2026.
2022
News Corp discloses cyberattack affecting employee accounts and documents
News Corp disclosed that digital intruders broke into email accounts and compromised data belonging to a limited number of employees, including journalists. The company said the breach was discovered in late January, and Mandiant said it had contained the breach. Mandiant assessed that those behind the activity had a China nexus; the source reports that this was an assessment, not a determination of responsibility.
2021
T-Mobile CEO addresses data breach and security response
In August 2021, T-Mobile CEO Mike Sievert spoke publicly after a data breach affecting more than 50 million people. He said the breach was contained and that the investigation was substantially complete. T-Mobile also said it was partnering with Mandiant and KPMG to improve security. The statements addressed the company's response to the incident and its planned security measures.
2021
Neiman Marcus discloses customer data breach
Neiman Marcus Group informed 4.6 million customers about a breach involving possible illegal access to personal information, including account credentials and payment details. The company said the breach took place in May 2020, reported the incident to law enforcement, and was working with Mandiant and law enforcement to investigate.
Marketing campaigns
- 2014Flare-On
Global
Mandiant launched an annual autumn reverse-engineering challenge for cybersecurity practitioners and researchers worldwide.
Outcome. The challenge became a recurring global technical event associated with Mandiant's research and engineering community.
Brand decisions
2023
Integrate MISP and Splunk environmentsProduct launchBackground
Customers increasingly required threat intelligence and response tools to interoperate with existing intelligence-sharing and security-operations platforms.
Action taken
Mandiant announced integrations for MISP, Splunk SIEM, and Splunk SOAR.
Aftermath
The integrations were intended to improve interoperability between Mandiant capabilities and customers' existing security workflows.
2022
Join Google CloudM&ABackground
Google sought to expand its cloud cybersecurity capabilities, while Mandiant offered established incident-response expertise, threat intelligence, and investigation services.
Action taken
Google announced and completed the acquisition of Mandiant, integrating the company into Google Cloud while preserving the Mandiant brand.
Aftermath
Mandiant became a Google Cloud subsidiary after regulatory review and the transaction's September 12 closing.
Acquisition value. $5.4 billion (Announced March 2022; completed September 12, 2022)
2021
Separate from FireEyeM&ABackground
FireEye agreed to sell its product business, name, and employees to Symphony Technology Group.
Action taken
Mandiant was separated from the FireEye transaction and continued as an independent company.
Aftermath
Mandiant retained its consulting, investigation, and threat-intelligence identity while FireEye's former product operations moved to Symphony Technology Group.
Transaction value for FireEye product business, name, and employees. $1.2 billion (June 2021)
2020
Launch Mandiant AdvantageProduct launchBackground
Security teams increasingly sought subscription software that could connect threat intelligence with operational incident-response workflows.
Action taken
Mandiant announced Mandiant Advantage as a subscription-based SaaS platform combining its intelligence and incident-response data.
Aftermath
The launch broadened Mandiant's proposition beyond consulting toward recurring software-supported security operations.
2013
Accept FireEye acquisitionM&ABackground
Mandiant had established a strong position in incident response and threat intelligence, while FireEye was expanding its cybersecurity platform and services portfolio.
Action taken
FireEye acquired Mandiant in December 2013 for approximately $1 billion.
Aftermath
Mandiant continued its incident-response and investigation activities within FireEye.
Acquisition value. $1 billion (December 2013)
Recent events
- Unconfirmed
Reported
MyMichigan Health investigates cyberattack claims[3]
MyMichigan Health says it is investigating a group's claim that it stole data, has found no unauthorized system access or compromise of patient information so far, and hired Mandiant to help assess the claims.
Reported
Google announces planned acquisition of Mandiant[8]
Google announced that it would acquire cybersecurity company Mandiant for $23 per share in cash, valuing the transaction at approximately $5.4 billion, including Mandiant's net cash. Mandiant would join Google Cloud after the transaction closes.
Reported
Google announces acquisition of Mandiant[9]
Google announced an all-cash agreement to acquire cybersecurity company Mandiant for $5.4 billion, with Mandiant to join Google Cloud. The article says Google expected the acquisition to strengthen its cloud business.
Reported
Ardalyst announces All-Threat Zero Trust offering[10]
Ardalyst announced an All-Threat Strategy approach to Zero Trust Architectures, developed with partners Mandiant and Microsoft to assist government agencies and federal contractors in achieving cyber resiliency.
Reported
News Corp discloses cyberattack affecting employee accounts and documents[5]
News Corp disclosed that digital intruders broke into email accounts and compromised data belonging to a limited number of employees, including journalists. The company said the breach was discovered in late January, and Mandiant said it had contained the breach. Mandiant assessed that those behind the activity had a China nexus; the source reports that this was an assessment, not a determination of responsibility.
Reported
News Corp reports cyberattack affecting employee emails and documents[6]
News Corp was targeted in a cyberattack affecting emails and documents of some employees, including journalists. The attack was discovered on January 20; the company said the threat was contained and that systems housing financial and customer data were not affected.
Reported
Neiman Marcus discloses customer data breach[7]
Neiman Marcus Group informed 4.6 million customers about a breach involving possible illegal access to personal information, including account credentials and payment details. The company said the breach took place in May 2020, reported the incident to law enforcement, and was working with Mandiant and law enforcement to investigate.
Reported
ZeroFox and Mandiant announce global strategic partnership[11]
ZeroFox announced a global strategic partnership with Mandiant, under which ZeroFox will be offered as part of the Mandiant Advantage SaaS platform.
Reported
T-Mobile CEO addresses data breach and security response[4]
T-Mobile CEO Mike Sievert spoke publicly after a data breach affecting more than 50 million people. He said the breach was contained and the investigation was substantially complete; T-Mobile also said it was partnering with Mandiant and KPMG to improve security.
Reported
T-Mobile announces cybersecurity partnerships with Mandiant and KPMG[12]
T-Mobile announced that it was partnering with cybersecurity firm Mandiant and consulting firm KPMG to adopt best-in-class practices and transform its approach.
Sources19 sources
- 1Mandianten.wikipedia.org
- 2Mandiant official websitemandiant.com
- 3MyMichigan Health investigates cyberattack claimswsgw.com
- 4T-Mobile CEO addresses data breach and security responsetheverge.com
- 5News Corp discloses cyberattack affecting employee accounts and documentsfreebeacon.com
- 6News Corp discloses cyberattack affecting employee accounts and documentshumanevents.com
- 7Neiman Marcus discloses customer data breacheconotimes.com
- 8谷歌宣布计划收购Mandiantsiliconangle.com
- 9Google宣布收购Mandiantnewtalk.tw
- 10Ardalyst宣布推出All-Threat零信任方案prnewswire.com
- 11ZeroFox 与 Mandiant 宣布全球战略合作siliconangle.com
- 12T-Mobile宣布与Mandiant和KPMG开展网络安全合作geekwire.com
- 13T-Mobile宣布与Mandiant和KPMG建立网络安全合作businessinsider.com
- 14谷歌宣布以每股23美元现金收购网络安全公司Mandiant 总额约54亿美元finance.sina.com.cn
- 15Google acquires Mandiant to enhance Google Cloud security suitecsoonline.com
- 16News Corp hit by cyberattack with suspected link to Chinayahoo.com
- 17News Corp Suspects China Behind Cyberattack on Its Systemvoanews.com
- 18Rupert Murdoch's News Corp hit by cyberattack it says was from Chinabusinessinsider.com
- 19T-Mobile CEO apologizes for data breach, announces security partnership with Mandiant - Engadgetengadget.com
Cite this profile: Cite the canonical profile. /brand-wiki/mandiant · Editorial policy · How profiles are compiled