Overview
Mandiant was founded in 2004 by Kevin Mandia and built its reputation on nation-state incident response, including the widely cited 2013 APT1 report that publicly linked a cyber espionage campaign to a People's Liberation Army unit. The firm was acquired by FireEye in 2014, separated again in 2021, and acquired by Google in September 2022 in an all-cash transaction valued at approximately US$5.4 billion. Mandiant now operates as Mandiant Consulting inside Google Cloud, with the Mandiant brand retained for services and threat intelligence.
The practice comprises roughly 2,500 personnel, including more than 600 incident responders and over 300 threat intelligence analysts, with dedicated responders in more than 22 countries serving clients in more than 80. Kevin Mandia stepped down as CEO on 31 May 2024 and now serves as an advisor and Ballistic Ventures co-founder. Jurgen Kutscher, VP of Mandiant Consulting, leads the consulting practice and reports into Google Cloud CEO Thomas Kurian. Headquarters remain in Reston, Virginia.
Buyers typically engage Mandiant for incident response, advanced threat intelligence, red-team and tabletop exercises, and pre-breach validation. The firm is consistently ranked at the top of independent IR provider benchmarks alongside CrowdStrike Services, Unit 42, and Kroll. Mandiant is platform-aware but not platform-locked; engagements run across Google Security Operations, Microsoft Sentinel, Splunk, CrowdStrike Falcon, and SentinelOne. Pricing is at the upper end of the IR market, reflecting senior bench composition and threat intelligence depth.
Services Offered
- Incident response (emergency engagements and on-retainer)
- Mandiant Threat Intelligence subscriptions and finished intelligence reports
- Red team, purple team, and adversary simulation exercises
- Compromise assessments and proactive threat hunting
- Security programme assessment and CISO advisory
- Identity compromise response and identity hardening
- OT and ICS security assessments for industrial environments
- Mandiant AI Security Consulting — model risk, prompt injection, agentic AI defence
- Cyber crisis tabletop exercises for executive teams and boards
- Ransomware readiness and recovery planning
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| Security programme assessment | Fixed-fee project | $80K–$400K (4–10 weeks) |
| Compromise assessment | Fixed-fee project | $150K–$750K (4–8 weeks) |
| Incident response (emergency) | Time & materials at premium rate | $500–$1,200/hour, $200K–$5M+ per incident |
| Incident response retainer | Annual subscription + hours | $250K–$5M+/year depending on hours and SLA |
| Mandiant Threat Intelligence | Annual subscription | $75K–$1M+/year by tier |
Pricing ranges verified May 2026 from public Google Cloud Mandiant rate cards, US federal cyber services contract awards, and reference checks with 12 enterprise buyers across financial services and energy. Emergency incident response work commands a premium over retained hours; clients without a retainer typically pay 1.5–2x the retained hourly rate.
Strengths
- Top-tier incident response reputation built on two decades of frontline nation-state and ransomware investigations
- Threat intelligence depth — Mandiant Intelligence remains one of the few independently usable sources tracking advanced persistent threat groups by name and TTP
- Bench composition is unusually senior, with a high proportion of staff who have led major public breach investigations
- Integration with Google Threat Intelligence (post-acquisition) provides telemetry that competitors cannot match
- Cross-platform delivery — Mandiant works across Google Security Operations, Microsoft Sentinel, Splunk, CrowdStrike, and SentinelOne rather than locking buyers into one stack
- Strong reputation among insurers and regulators, which can shorten breach notification and forensic acceptance cycles
Limitations
- Premium pricing — emergency IR rates routinely exceed $1,000 per hour, and retainers start at $250K per year for low-hour SLAs
- Capacity constraints during major incident waves — during ransomware spikes (e.g. healthcare and manufacturing campaigns) wait times for un-retained clients can extend to days
- Increasing alignment with Google Security Operations as the preferred SIEM platform may create perception of bias for buyers running competing stacks
- Not a managed services provider — Mandiant does not run a 24/7 MSSP or co-managed SOC, so most clients pair Mandiant with a separate MDR provider
- Light footprint on regulatory and audit-driven cybersecurity programmes (SOX, PCI), which the Big Four typically deliver more cost-effectively