Disclosure
Mandia's startup is building an offensive nation-state hyper-attack platform
“We want to build the whole hyper attack platform. Everything a nation state would build on offense. We want to build.”
Assertion Not checkable as stated
AI-native developers are over 100x more productive than traditional engineers
“It's not 10 X. It's more than a hundred X productivity with an AI native developer working on software. We've had over a hundred commits in a day building our software. We have a different demo every two to three days. I never had that before.”
Opinion
Mandia: AI-native software developers are over 100 times more productive.
“It's not 10 X. It's more than a hundred X productivity with an AI native developer working on software.”
Prediction Open · timeframe Jul 2029
Fully autonomous cyber defense systems will arrive in two to three years
“I think AI will advantage the offense in the near term, but everybody knows that and everybody's waiting to be able to, we're gonna have a total shift change in cybersecurity where you'll have AI agents on offense Being the cheapest way to create that autonomo…”
Prediction Not checkable as stated
Major nations will restrain their advanced AI cyber offensive capabilities
“And in reality, no modern nation, even the folks that can create this capability, China, Russia, others will leverage it. Even they don't want to really, no one's ready for it.”
Prediction Not checkable as stated
Mandia: Criminals will inevitably deploy ungated frontier AI models
“The models may have gates that prevent you from doing things, but even those folks that make them probably need to remove some of the gating factors because it's so important to make sure there will be models that can think, learn, and do incredible things tha…”
Opinion
Mandia: Frontier AI models are outpacing human network security testers
“The frontier models are doing an exceptional job already in helping test the security of networks. And they're changing so fast, Joe, that I'm very confident regardless of which frontier model you use you're gonna find it's outpacing humans doing the work, you…”
Prediction Not checkable as stated
AI attack agents will operate 1,000 times faster than humans
“The day where a human would break in, and if you were 10 minutes behind the human on defense, you could stop the impact of a breach, is going to end. There's going to be an agent that breaks in, then another agent uploaded because it had remote code access, Re…”
Insight
Mandia: Nation-states will always beat private companies in cyberattacks
“When a nation state targets a company, guess who wins? The nation does, not the company... You cannot expect great blue chip companies that constantly every day pitch a perfect game on defense against nations that are targeting them. It's just an unfair fight.”
Prediction Open · timeframe Feb 2029
Mandia: Fully autonomous cyber defense systems will emerge within three years.
“Fast forward two or three years, Joe, you're going to see an autonomous defense crafted, trained by the world's best cyber offense, you know, the hyper attack platform.”
Prediction Not checkable as stated
Mandia: AI attackers will eliminate the 10-minute human incident-response window.
“The day where a human would break in, and if you were 10 minutes behind the human on defense, you could stop the impact of a breach, is going to end. There's going to be an agent that breaks in, then another agent uploaded because it had remote code access, Re…”
Prediction Open · timeframe Jul 2031
Six-second voice clones will automate social engineering attacks against help desks
“You're gonna start seeing social engineering automated, where six seconds of Joe Lonsdale's voice is gonna be used to get a help desk to do something.”
Prediction Held up
Defensive teams will run offensive AI agents to train defense systems
“There is no question that In the future, you'll have AI agents on offense run by the good guys to train the AI on defense run by the good guys.”
Prediction Not checkable as stated
Coordinated AI agent cyber swarms are coming at inhuman speeds
“That drone swarm in cyber will be coming, and the difference with that total recall it has that humans don't have, the instantaneous communication between different agents that have different objectives so they can coordinate at a speed humans cannot, this has…”
Assertion Not checkable as stated
Mandia: Mandiant and colleagues have responded to Chinese intrusions daily since 1995
“I think by 1995, until now, I would say on a daily basis, either I'm
Or someone I work with has been responding to an intrusion from a Chinese actor looking for the government.”
Opinion
Mandia: China matched Russia's elite cyber intrusion capabilities by 2020.
“And I do believe you know, Russia had the crown early, 19 nineties, early 2000, the best intrusions I saw.
Was Russian operators on our networks.
later in my career, especially around 2019, 20, 20 China, you know, really rapidly graduated to great capabilitie…”
Disclosure
Mandia: Mandiant originally aimed to build the endpoint software CrowdStrike perfected.
“Believe it or not, Mandiant was actually an endpoint company. I just executed so poorly on that dream. Nobody knows it, you know, but we were building an endpoint to detect what Symantec and McAfee missed... And since that time George Kurtz and CrowdStrike kin…”
Assertion Partly supported
Mandia: Russian SVR doctrine shifted in August 2015 toward data leaks
“I had 20 years of responding to SVR. They never hacked and then released data. They suddenly did that in August, They always hacked for security reasons, and all of a sudden we're responding to them hacking universities. I'm like, oh, they increased scope. And…”
Assertion Supported
Mandia: Uniformed North Korean government agents run cyberattacks to steal Bitcoin.
“Literally government agents in North Korea in uniform are hacking to steal Bitcoin.”
Prediction Open · timeframe Feb 2031
Mandia: Cybercrime and Espionage Will Shift from Human-Led to AI Agent-Led
“You're gonna have AI agents on offense, automating incredibly talented humans, you know, like literally that brain surgeon analogy. AI agents will be that, and you're gonna have swarms of agents that can communicate, and think, and instantiate normal, and lear…”
Prediction Held up
Mandia: Good guys will use offensive AI agents to train defensive AI
“There is no question that in the future you'll have AI agents on offense run by the good guys to train the AI on defense run by the good guys.”
Insight
Mandia: Resisting a Five-Day Offensive Red Team Is Peak Security
“If the answer is no, feel good at three to four former operators on offense. Couldn't break into your network in five to six days. It's pretty, I'd feel pretty damn good. That's the best you can do, by the way. I don't know what else you're supposed to do. And…”
Assertion Not checkable as stated
Mandia: Non-developers can bypass legacy antivirus software in under three minutes.
“We could teach FBI agents in the classroom who were not malware developers how to circumvent antivirus in under three minutes. Compress and encrypt malware. And you got past antivirus.”
Assertion Supported
Mandia: US Military Began Monitoring Its Networks Around 1993
“I started doing computer security in 1993, and that was about the year we started putting eyes on our network in the military.”
