Armadin CEO Kevin Mandia warns AI-driven attacks are already outpacing human defenders

Cyberattacks boosted by artificial intelligence are entering a phase where speed is the main weapon. According to Armadin CEO Kevin Mandia, it is no longer enough for people to simply watch event logs, emails and network activity closely: attacks will unfold faster than specialists can spot, verify and stop them. That changes the basic rule of cyber defense: if attackers automate vulnerability hunting, phishing creation and the evasion of security systems, defense must also respond at machine speed, not just rely on the experience of analysts.

Why AI empowers attackers

Mandia's argument matters because AI in cybersecurity stopped being an experiment a long time ago. For attackers, it is a way to sharply cut the cost and time of preparing operations. Generative models help write convincing emails free of language errors, imitate the style of specific employees, and tailor messages to an industry or even to current events inside a company. Where hours of manual preparation were once required, it is now possible to assemble dozens of lure variants in minutes, test them on different segments and quickly scale whatever works best. As a result, not only the number of attacks grows, but also their precision.

Automating the technical side of attacks

The next level is automating the technical side. AI tools can help attackers analyze exposed attack surfaces, find weak configurations, prioritize targets and speed up writing code to exploit known vulnerabilities. This does not necessarily mean fully autonomous hacks; it means that every stage of a campaign — reconnaissance, scenario selection, social engineering, establishing persistent access — goes faster and costs less. For defenders, this means response time shrinking to minutes, and sometimes to seconds. If a security team still relies only on manual alert review, it risks losing simply because of tempo.

Defense shifts toward automation

That is why the conversation about defense is increasingly moving away from hiring more analysts and toward automated detection and containment. Companies need systems that can cut off anomalies on their own, connect scattered signals, block suspicious actions and bring in a human only where a decision with high context is truly required. This does not eliminate the role of experts; on the contrary, strong teams become even more important. But their job changes. Instead of endlessly sorting notifications, they must design rules, test hypotheses, investigate complex incidents and manage the machine-driven defense mechanisms. In essence, the human becomes an operator and architect of defense rather than its sole executor.

A broader shift in the industry

Mandia's warning reflects a broader shift in the industry. The debate is no longer about whether AI systems will be used in attack and defense, but about who will have the better-tuned learning and response loop. Companies that adopt automation only at isolated points may find that too much time passes between detecting a threat, internal approval and actual blocking.

This is especially critical for large companies with distributed infrastructure and a long chain of approvals. Attackers are precisely trying to win that gap. So cybersecurity investment increasingly comes down not only to buying new products, but to rebuilding processes: integrating telemetry, cutting manual steps, rehearsing scenarios and regularly testing how defenses behave under load.

The conclusion is fairly blunt: the era in which an experienced team could make up for a lack of automation is ending. Human expertise remains critically important, but on its own it no longer matches the speed of AI threats. For business, this means a simple choice.

Either defensive operations move to a level where machines help notice, analyze and contain an attack almost in real time, or even strong specialists will constantly be one step behind the adversary.

In brief:

• Armadin CEO Kevin Mandia warns that AI attacks unfold faster than people can notice and stop them.
• Generative models make phishing, reconnaissance and vulnerability exploitation cheaper; defense is shifting toward automated detection and containment.
• An experienced team can no longer make up for a lack of automation — machine-speed response is needed.