Mandiant
Professional services
UnclaimedCybersecurity company specializing in incident response, threat intelligence, cyber investigations, and security consulting.
Last updated October 18, 2026
Overview
Mandiant is a United States cybersecurity company focused on helping organizations investigate, contain, and recover from sophisticated cyberattacks. Its work combines incident response, threat intelligence, digital forensics, security validation, managed defense, and strategic consulting. The company serves major corporations, governments, and other institutions that require specialized assistance during or after security incidents. Kevin Mandia, a former United States Air Force officer, founded the business in 2004 as Red Cliff Consulting. It adopted the Mandiant name in 2006. In its early years, the company concentrated on business-to-business incident response and broader security consulting, while also developing tools and methods for incident management. Funding from Kleiner Perkins Caufield & Byers and One Equity Partners in 2011 supported staff expansion and growth in its enterprise activities. Mandiant became particularly influential in threat intelligence through its investigations of advanced persistent threats and its development of OpenIOC, an extensible format for describing technical indicators of compromise. In February 2013, the company published a widely cited report attributing a long-running cyber-espionage campaign against organizations in the United States and other English-speaking countries to a unit of the People's Liberation Army. Mandiant called the group APT1 and associated it with PLA Unit 61398. The report helped make commercial threat intelligence and public attribution central parts of the cybersecurity industry. FireEye acquired Mandiant in December 2013 for approximately $1 billion. Under FireEye, Mandiant continued its consulting and incident-response activities while becoming closely associated with investigations of high-impact intrusions. In October 2020, the business announced Mandiant Advantage, a subscription software platform intended to combine Mandiant threat intelligence with information from incident-response engagements and help security teams automate and improve their response processes. Mandiant investigated the 2020 SolarWinds supply-chain compromise and assisted with the response to the 2021 ransomware attack affecting Colonial Pipeline. In 2021, FireEye sold its product business, name, and employees to Symphony Technology Group for approximately $1.2 billion; Mandiant became an independent company again in that transaction. It subsequently expanded its capabilities through the acquisition of Intrigue, a company focused on attack-surface management. Google announced in March 2022 that it would acquire Mandiant for approximately $5.4 billion. The transaction received regulatory review, including scrutiny by the United States Department of Justice Antitrust Division, and closed on September 12, 2022. Mandiant was integrated into Google Cloud but retained its brand and continued operating as a specialized cybersecurity business. Its later work has included research into influence operations and assistance with investigations of the 2024 Snowflake-related data-theft campaign. Mandiant also operates Flare-On, an annual global reverse-engineering and malware-analysis challenge.
History
Mandiant began in 2004 when Kevin Mandia founded Red Cliff Consulting. Mandia's background as a United States Air Force officer informed the firm's emphasis on disciplined investigation, forensic analysis, and response to sophisticated intrusions. The company adopted the Mandiant name in 2006 and developed a business serving large organizations, governments, and Fortune 100 companies. Its early offering combined emergency incident response with general security consulting and incident-management products. In 2011, investment from Kleiner Perkins Caufield & Byers and One Equity Partners supported expansion of its staff and business-to-business operations. Mandiant also developed OpenIOC, an extensible XML-based format for representing indicators of compromise and sharing technical descriptions of malicious activity. The company's public profile grew sharply in February 2013, when it published a report on a cyber-espionage group it named APT1. Mandiant said the activity had affected at least 141 organizations in the United States and other English-speaking countries and connected the campaign to PLA Unit 61398 in Shanghai. The report was influential because it publicly linked technical evidence from intrusions with an alleged state-sponsored actor, helping establish commercial threat intelligence as a major cybersecurity discipline. FireEye acquired Mandiant in December 2013 for about $1 billion. Mandiant continued to operate as the incident-response and investigation center of expertise within the enlarged cybersecurity company. Its investigators subsequently worked on several prominent incidents, including the SolarWinds supply-chain compromise disclosed in 2020. In October 2020, the company introduced Mandiant Advantage, a subscription-based software platform designed to combine Mandiant's intelligence with information from incident-response work and give security teams more automated support. FireEye announced in 2021 that it would sell its product business, brand, and employees to Symphony Technology Group for approximately $1.2 billion. Mandiant was separated from that transaction and operated independently. During this period it continued responding to major incidents, including the ransomware attack affecting Colonial Pipeline, and acquired Intrigue in August 2021 to strengthen attack-surface management. Google announced its proposed acquisition of Mandiant in March 2022 for approximately $5.4 billion. The transaction underwent regulatory scrutiny, including a review by the United States Department of Justice Antitrust Division. The DOJ approved the deal, and the Australian Competition & Consumer Commission announced that it would not oppose the transaction. The acquisition closed on September 12, 2022, and Mandiant was incorporated into Google Cloud while retaining its name and identity as a cybersecurity business. After the acquisition, Mandiant continued publishing threat research and supporting investigations. Its researchers reported on a pro-China influence campaign aimed at American voters before the 2022 midterm elections. In 2023, the company announced integrations for MISP and Splunk SIEM and SOAR environments. In 2024, it assisted with investigations into a major Snowflake-related data-theft and extortion campaign. Separately, Mandiant has organized Flare-On, an annual reverse-engineering challenge held since 2014 for participants around the world.
- 2024
Snowflake-related breach investigations
[1]Mandiant assisted investigations into a major data-theft and extortion campaign involving Snowflake customers.
- 2023
Security-platform integrations announced
[1]Mandiant announced integrations with MISP and Splunk SIEM and SOAR environments.
- 2022
Google announces acquisition
[1]Google announced a proposed $5.4 billion acquisition of Mandiant.
- 2022
Integrated into Google Cloud
[1]The Google acquisition closed on September 12, 2022, and Mandiant began integration into Google Cloud.
- 2021
Separation from FireEye
[1]Mandiant became independent after FireEye sold its product business, name, and employees to Symphony Technology Group.
- 2021
Intrigue acquired
[1]Mandiant acquired Intrigue to expand attack-surface management capabilities.
- 2020
Mandiant Advantage announced
[1]The company introduced a subscription platform combining threat intelligence and incident-response information.
- 2014
Flare-On begins
[1]Mandiant began its annual Flare-On reverse-engineering and cybersecurity challenge.
- 2013
APT1 report published
[1]Mandiant published research attributing a major cyber-espionage campaign to PLA Unit 61398.
- 2013
Acquired by FireEye
[1]FireEye acquired Mandiant for approximately $1 billion.
Showing the 10 most recent.
Products and positioning
A high-end cybersecurity partner for advanced threat investigations, incident response, threat intelligence, and resilience programs serving complex enterprises and government organizations.
Incident response and digital forensics
Mandiant Incident Response
Mandiant's incident-response practice helps organizations investigate suspected compromises, determine the scope and mechanics of an attack, contain adversary activity, preserve evidence, and recover operations. It is designed for urgent breaches as well as preparedness and response-retainer arrangements.
Cybersecurity software platform · 2020
Mandiant Advantage
Mandiant Advantage was introduced as a subscription-based software platform that combines Mandiant threat intelligence with information gathered through incident-response engagements. Its purpose is to help security teams prioritize threats, improve investigation workflows, and automate elements of response.
Threat intelligence
Mandiant Threat Intelligence
This offering provides intelligence on threat actors, campaigns, malware, vulnerabilities, and indicators of compromise. It draws on Mandiant's investigations and research to support detection, attribution, strategic risk assessment, and security operations.
Security validation
Mandiant Security Validation
Security validation services assess whether an organization's defensive controls can detect and respond to realistic attack behaviors. The offering is intended to identify gaps between documented security capabilities and operational performance.
Open cybersecurity standard
OpenIOC
OpenIOC is an extensible XML schema created by Mandiant for describing technical characteristics that can indicate compromise. It supports structured communication of forensic evidence, malicious activity, and attacker methods.
Cybersecurity competition · 2014
Flare-On
Flare-On is an annual reverse-engineering challenge organized by Mandiant. It attracts participants internationally and focuses on malware analysis, reverse engineering, and related technical problem-solving skills.
Controversies
2026
MyMichigan Health investigates cyberattack claims
MyMichigan Health stated that it is investigating a group's claim that it stole data. According to the organization, the investigation has so far found no unauthorized system access or compromise of patient information. MyMichigan Health also hired Mandiant to help assess the claims. The event was reported on October 16, 2026.
Marketing campaigns
- 2014Flare-On
Global
Mandiant launched an annual autumn reverse-engineering challenge for cybersecurity practitioners and researchers worldwide.
Outcome. The challenge became a recurring global technical event associated with Mandiant's research and engineering community.
Brand decisions
2023
Integrate MISP and Splunk environmentsProduct launchBackground
Customers increasingly required threat intelligence and response tools to interoperate with existing intelligence-sharing and security-operations platforms.
Action taken
Mandiant announced integrations for MISP, Splunk SIEM, and Splunk SOAR.
Aftermath
The integrations were intended to improve interoperability between Mandiant capabilities and customers' existing security workflows.
2022
Join Google CloudM&ABackground
Google sought to expand its cloud cybersecurity capabilities, while Mandiant offered established incident-response expertise, threat intelligence, and investigation services.
Action taken
Google announced and completed the acquisition of Mandiant, integrating the company into Google Cloud while preserving the Mandiant brand.
Aftermath
Mandiant became a Google Cloud subsidiary after regulatory review and the transaction's September 12 closing.
Acquisition value. $5.4 billion (Announced March 2022; completed September 12, 2022)
2021
Separate from FireEyeM&ABackground
FireEye agreed to sell its product business, name, and employees to Symphony Technology Group.
Action taken
Mandiant was separated from the FireEye transaction and continued as an independent company.
Aftermath
Mandiant retained its consulting, investigation, and threat-intelligence identity while FireEye's former product operations moved to Symphony Technology Group.
Transaction value for FireEye product business, name, and employees. $1.2 billion (June 2021)
2020
Launch Mandiant AdvantageProduct launchBackground
Security teams increasingly sought subscription software that could connect threat intelligence with operational incident-response workflows.
Action taken
Mandiant announced Mandiant Advantage as a subscription-based SaaS platform combining its intelligence and incident-response data.
Aftermath
The launch broadened Mandiant's proposition beyond consulting toward recurring software-supported security operations.
2013
Accept FireEye acquisitionM&ABackground
Mandiant had established a strong position in incident response and threat intelligence, while FireEye was expanding its cybersecurity platform and services portfolio.
Action taken
FireEye acquired Mandiant in December 2013 for approximately $1 billion.
Aftermath
Mandiant continued its incident-response and investigation activities within FireEye.
Acquisition value. $1 billion (December 2013)
Recent events
- 2024
Mandiant assists investigation of Snowflake-related data theft[1]
Other
Mandiant assisted with investigations into a large data-theft and extortion campaign targeting customers of Snowflake, including several major businesses.
- 2023
Mandiant announces integrations with MISP, Splunk SIEM, and SOAR[1]
Product launch
Mandiant announced integrations intended to connect its intelligence and security capabilities with MISP and Splunk security information, event management, and orchestration platforms.
- 2022
Google announces acquisition of Mandiant[1]
M&A
Google announced an agreement to acquire Mandiant for approximately $5.4 billion, with the business planned for integration into Google Cloud.
- 2022
U.S. antitrust review of Google-Mandiant transaction[1]
Regulation · M&A
The United States Department of Justice Antitrust Division reviewed the proposed acquisition for potential federal antitrust issues. Mandiant later disclosed that approval had been granted.
- 2022
Google completes Mandiant acquisition[1]
M&A · Leadership change
The acquisition closed on September 12, 2022, after which Mandiant was integrated into Google Cloud while retaining its operating brand.
- 2022
Mandiant researches pro-China influence campaign[1]
Other
Mandiant researchers identified a pro-China disinformation campaign that targeted American voters ahead of the 2022 midterm elections.
- 2021
Mandiant assists Colonial Pipeline ransomware response[1]
Other
Mandiant was engaged to assist with the response to a ransomware incident affecting Colonial Pipeline, a major fuel-pipeline operator serving the United States East Coast.
- 2021
Mandiant becomes independent after FireEye transaction[1]
M&A
Symphony Technology Group acquired FireEye's product business, name, and employees for approximately $1.2 billion, leaving Mandiant as an independent company.
- 2021
Mandiant acquires Intrigue[1]
M&A
Mandiant acquired Intrigue to expand its capabilities in attack-surface management and external exposure assessment.
- 2020
Mandiant Advantage subscription platform announced[1]
Product launch
Mandiant announced a subscription software platform intended to combine threat intelligence and incident-response data to support and automate security operations.
Showing the 10 most recent.
Sources3 sources
Cite this profile: Cite the canonical profile. /brand-wiki/mandiant · Editorial policy · How profiles are compiled