Kevin Mandia's $445M Encore: 64 Names to Source First

On October 1, 2026, Kevin Mandia's new offensive security startup Armadin closed a $255.5M Series B co-led by Andreessen Horowitz and Accel at a $2.5B+ valuation, taking total funding to roughly $445M in the seven months since it exited stealth. If you source security talent, the funding number is not the story. The story is that three of three Armadin co-founders came out of Google's security org, and the list of people who look exactly like them is small enough to fit in one spreadsheet.

The hiring thesis hiding inside the Series B

Armadin's cap table and co-founder pattern spell out the next 12 months of hiring: senior Mandiant alumni still sitting inside Google Cloud Security, plus a federal-corridor skew driven by In-Q-Tel. The round itself was co-led by Andreessen Horowitz and Accel, with Bain Capital Ventures and Redpoint joining as new backers, and Google Ventures, Kleiner Perkins, Menlo Ventures, In-Q-Tel, 8VC, and Ballistic Ventures returning.

Two of those names matter more than the headline number for sourcers:

• Google Ventures returned. GV operates independently from Google Cloud, but it creates a structural awkwardness that Google HR cannot easily escalate when Armadin picks off a Mandiant principal. Call it unusual leverage for Armadin's recruiters.
• In-Q-Tel returned. IQT is the CIA-affiliated strategic investor. Its continued participation is the clearest public signal that Armadin's first-year hires will skew cleared personnel, not Bay Area generalists.

Armadin hit 60+ employees by March 2026, which pencils out to roughly 10 hires a month pre-Series B. The Series B will not slow that pace, it will concentrate it.

$445M

Why the Mandiant-at-Google alumni list is the right first list

The right list is the 64 US profiles in Refolk's index that match "Mandiant Google Cloud Security," because that is the exact bench Armadin's three co-founders came off, and the titles already match Armadin's org chart. Travis Lanham (CTO) was a Google Cloud Security principal engineer. Evan Peña (Chief Offensive Security Officer) was a Mandiant executive. David Slater (Chief Architect) was a Google SecOps engineer. The template is not subtle.

In the Refolk index for that query, the top titles cluster at:

• Principal Security Consultant
• Principal Security Analyst
• Managing Director, Mandiant Consulting Services
• Managed Defense principal engineer

Those four titles are also the four most predictable next VP-level hires at Armadin, because they map one-to-one against the Lanham/Peña/Slater pillars plus the Mandiant Consulting Services pillar that is conspicuously missing from the current exec roster.

Sourceable, not theoretical

The temptation here is to write "huge talent pool." Resist it. The sourceable population is a bench, not a market, and that is precisely why it is valuable. If Armadin keeps shipping 10 hires a month, the primary list clears in under a year.

64

How the pools stack up

The primary pool is roughly 63% the size of the entire US senior red-team market, which is a degree of concentration almost no other 2026 security startup has. Here is the full stack a competing recruiter should be working from.

If you are sourcing against Armadin rather than for it, the 21 still-inside figure is the one to watch. That is the number Google Cloud Security has to defend.

The federal corridor is where the first hires land

The Mandiant-at-Google alumni pool is federal-corridor heavy, so the first-year sourcing playbook is cleared-personnel, not Bay Area generalist. Refolk's index on the primary query puts the geographic concentration at Reston VA (2), McLean VA (1), DC (1), Dallas-Fort Worth (2), and New York (3). Combine that with In-Q-Tel's seat on the cap table and you get a very specific sourcing signature: SF-86 history, SCI eligibility, prime contractor time at the usual govcon shops, and LinkedIn profiles that have been scrubbed of program names.

This is a different playbook from a standard Bay Area security search. The signals are quieter, the inbound-response rate is lower, and the compensation anchor is not RSUs. If your tooling only indexes public job titles and current employer, you will miss most of this pool.

Google is defending two crown jewels at once

The Wiz acquisition changes the retention math on the Mandiant alumni pool. Google bought Wiz for $32 billion in 2025, which means Google Cloud is now integrating two acquired security brands at the same time Mandia is picking off the first one. When a hyperscaler rations RSU refresh budgets across two large security acquisitions, golden-handcuff strength weakens exactly when a $2.5B-valuation startup is offering early-employee upside.

Armadin's March 2026 launch funding was reported as the largest combined Seed and Series A round in cybersecurity history. That sets a compensation benchmark every one of those 21 still-inside Mandiant principals already knows about. The counter-offer math is not in Google's favor.

The secondary and tertiary pools

Once the 64-profile primary list thins, Armadin's next pools are already visible. There are three worth tracking:

• The 102-profile US senior offensive-security pool outside Google. Top employers are Sophos, Intel, Amazon, Experian, Salesforce, Deloitte, and Shopify. Expect Armadin to work this list once the Mandiant-at-Google surface starts repeating names.
• NVIDIA agent-safety engineers. On September 28, Armadin said it was contributing to NVIDIA's open-source OpenShell software. Open-source contribution lists are a sourcing surface. This one just became live.
• Horizon3 and XBOW alumni. Armadin's $445M total exceeds Horizon3's reported total and leads XBOW in the AI security funding race, which makes their engineers a tertiary poach pool. The pitch writes itself.

The Amazon board seat opens one more surface. In September 2026, Amazon appointed Mandia to its board, filling the seat vacated by former NSA director Keith Alexander. That is not a hiring channel on day one, but it is a legitimate alumni-adjacent surface for AWS security principals, and it is the kind of signal a disciplined sourcer tracks for the following year.

What this means for your pipeline this quarter

If you are sourcing for Armadin, your 90-day plan is: work the 21 still-inside Mandiant-at-Google principals first, work the federal-corridor cleared segment of the 64 in parallel, and keep the 102-profile broader red-team pool warm for Q2. If you are sourcing against Armadin at CrowdStrike, Wiz, Palo Alto Networks, or any of the smaller AI security startups, the same 64 profiles are your retention list, and you should assume Armadin's recruiters already have them.

The deeper point for anyone running security sourcing in 2026: the Mandiant diaspora is now a reproducible pattern. Mandia built the original firm, sold it to FireEye, saw it absorbed into Google via the FireEye-to-Google chain, and is now rebuilding the same leadership shape a third time. The alumni list travels with him. Ballistic Ventures, where Mandia was a VC before Armadin and which is still a backer, is a secondary network of ex-Mandiant operators-turned-investors who know where every one of the 64 is sitting right now.

A list of 64 names is only useful if your tooling can keep it fresh as those people move. Refolk's index is built for exactly this: a defined pool, tracked by role and employer transitions, so you learn about the move when it happens rather than when the announcement post hits LinkedIn.

FAQ

Who are Armadin's three co-founders and where did they come from? Kevin Mandia (CEO) founded the company in September 2025 after stepping down as CEO of the Google-owned Mandiant unit in May 2024. His co-founders are Travis Lanham (CTO), a former Google Cloud Security principal engineer; Evan Peña (Chief Offensive Security Officer), a former Mandiant executive; and David Slater (Chief Architect), a former Google SecOps engineer. All three came from inside Google's security org, which is why the Mandiant-at-Google alumni pool is the obvious first poach list.

How big is the realistic Armadin poach pool? Refolk's index returns 64 US profiles matching "Mandiant Google Cloud Security," with 21 of those still inside Google or Mandiant/Google Cloud. The broader US senior offensive-security and red-team pool is 102 profiles. The primary pool is roughly 63% the size of the entire senior red-team market, which is an unusually high concentration in one sub-org.

Why does In-Q-Tel's investment matter for sourcing? In-Q-Tel is the CIA-affiliated strategic investor, and its continued participation in the Series B signals that Armadin is building for public-sector contracts. That shifts the sourcing playbook toward cleared personnel in Reston, McLean, and DC rather than uncleared Bay Area candidates, and it changes the signals you look for: clearance history, prime contractor time, and scrubbed LinkedIn profiles rather than loud public talks.

Can Google defend the Mandiant bench? It is harder than it looks. Google is simultaneously integrating Wiz, which it bought for $32 billion in 2025, so RSU refresh budgets are being rationed across two acquired security brands at the moment Armadin is making $2.5B-valuation early-employee offers. Google Ventures is also still on Armadin's cap table, which limits how aggressively Google HR can escalate individual departures.