Armadin raises $255.5M: agent swarms that attack you first
Kevin Mandia's Armadin raised $255.5M at a $2.5B valuation for AI agent swarm security testing. Small businesses should fix the small bugs swarms chain together.
Kevin Mandia, who founded Mandiant and sold it to Google for $5.4 billion, has raised $255.5 million for Armadin at a valuation above $2.5 billion, TechCrunch reports. Armadin uses swarms of AI agents to attack a company's systems continuously, the way a real attacker would. When this much money goes into automated attack, assume the same technique is already in the hands of people who do not send you a report.
What actually happened
Per TechCrunch:
- Round: a $255.5 million Series B led by Andreessen Horowitz and Accel. Bain Capital Ventures, Redpoint, 8VC, Ballistic Ventures, GV, In-Q-Tel, Kleiner Perkins and Menlo Ventures joined.
- Prior funding: a $190 million Series A in March 2026, which puts the total above $445 million.
- Product: continuous security testing. Autonomous agents chain vulnerabilities together to simulate attacks, so a company can patch gaps before someone else finds them.
The target buyer is the enterprise. That is not you. The pattern is the part to copy: continuous automated pentesting is replacing the once-a-year audit.
Why agent swarm security testing matters for your business
Swarms chain small bugs. A human pentester skips the "low" findings. A swarm does not get bored. An old WordPress plugin, a staff account without MFA and an admin panel on a public URL are each minor. Together they are a breach. Fix the lows.
Your exposure is mostly your vendors. For a small shop, the attack surface is the store platform, the plugins, the booking app and the email account. Write down every login that can touch customer data or money. If you cannot list them, nobody is testing them.
Test on a schedule, not once. You do not need a $2.5 billion company. Run a free external scanner against your domain every month, turn on your platform's security alerts, and put plugin and app updates on a calendar.
Ask your developers one question. "What happens if someone gets the admin password?" If the answer is "everything," add MFA and split the roles this week.
Key takeaways
- Armadin raised a $255.5M Series B at a $2.5B+ valuation, led by a16z and Accel
- It runs AI agent swarms that chain vulnerabilities to simulate real attacks
- Total funding is above $445M after a $190M Series A in March
- Automated attackers chain low-severity bugs, so fix the small stuff
- List every login that touches money or customer data, then scan monthly
Not sure what an attacker would find first? We audit the stack small businesses actually run (store, plugins, logins, automations) and close the gaps. Book a review or see our services.
Sources: TechCrunch.
- #armadin
- #security-testing
- #ai-agents
- #penetration-testing
- #funding
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Inworld buys Ultravox: your voice agent vendor just changed
Inworld acquired Ultravox, the real-time voice agent platform. Inworld voices got a free TTS-2 upgrade; third-party voices got 'nothing changes today.'
Read itChatGPT Space: OpenAI's shared workspace wants your team docs
ChatGPT Space adds shared Pages that teammates, ChatGPT and Dots agents edit together. Decide where your SOPs and docs live before your team picks for you.
Read it