Armadin Chief Kevin Mandia Warns AI-Powered Attacks Now Outpace Human Defense

Cyberattacks amplified by artificial intelligence are entering a phase where speed becomes the primary weapon. According to Mandiant CEO Kevin Mandia's assessment, it is no longer sufficient for people to simply carefully monitor event logs, emails, and network activity: attacks will unfold faster than specialists can detect, verify, and stop them. This changes the fundamental rule of cybersecurity: if threat actors automate vulnerability discovery, phishing creation, and defense system bypass, the defense must also respond at machine speed, not just with analyst expertise.

Mandia's thesis is important because AI in cybersecurity has long ceased to be an experiment. For attackers, it is a way to dramatically reduce costs and accelerate operation preparation. Generative models help write convincing letters without language errors, imitate the style of specific employees, adapt messages to industries, and even to current events within a company.

Where previously hours of manual preparation were required, it is now possible within minutes to assemble dozens of lure variants, test them on different segments, and rapidly scale what works best. As a result, not only the quantity of attacks is growing, but also their accuracy. The next level is automation of the technical component.

AI tools can help threat actors analyze exposed attack surfaces, find weak configurations, prioritize targets, and accelerate code writing for exploiting known vulnerabilities. This is not necessarily about fully autonomous breaches, but about how each stage of a campaign—reconnaissance, scenario selection, social engineering, access consolidation—proceeds faster and cheaper. For defenders, this means reducing reaction time to minutes, and sometimes seconds.

If a security team continues to rely only on manual alert verification, it risks losing simply due to tempo. This is precisely why the conversation about defense is increasingly shifting from hiring additional analysts to automated detection and containment. Companies need systems that can themselves isolate anomalies, connect disparate signals, block suspicious actions, and escalate to humans only where high-context decisions are truly required.

This does not eliminate the role of experts: on the contrary, strong teams become even more important. But their task is changing. Instead of endless notification triage, they should design rules, test hypotheses, investigate complex incidents, and manage machine defense mechanisms.

Essentially, the human becomes an operator and architect of defense, not the sole executor. Mandia's warning reflects a broader shift in the industry. The discussion is no longer about whether AI systems will be applied to attack and defense, but about who will have better-tuned learning and response cycles.

Companies that implement automation only at isolated points may discover that too much time passes between threat detection, internal alignment, and actual blocking. This is especially critical for large companies with distributed infrastructure and long approval chains. Attackers are precisely trying to win that gap.

Therefore, cybersecurity investments are increasingly becoming not just about purchasing new products, but about restructuring processes: integrating telemetry, reducing manual steps, practicing scenarios, and regularly testing how defense performs under load. The conclusion here is quite harsh: the era in which an experienced team could compensate for lack of automation is ending. Human expertise remains critically important, but in itself no longer meets the speed of AI threats.

For business, this means a simple choice. Either defensive operations move to a level where machines help detect, analyze, and contain attacks in near-real time, or even strong specialists will constantly find themselves one step behind the adversary.