Armadin Raises $255.5M for Autonomous Security

Armadin has raised a $255.5M Series B to expand an autonomous offensive-security platform built around a simple problem: a security team can have thousands of findings and still lack proof of the attack path that can reach a critical system today. Andreessen Horowitz and Accel co-led the October 1, 2026 financing.

The company says the round values Armadin at more than $2.5B and takes total funding to $445M, seven months after its public launch. The money will support the platform, research, training, and go-to-market work as Armadin tries to turn elite red-team tradecraft into software that can run continuously across enterprise and government environments.

What Happened

Bain Capital Ventures and Redpoint joined the Series B as new investors. 8VC, Ballistic Ventures, GV, In-Q-Tel, Kleiner Perkins, and Menlo Ventures returned. Armadin announced the financing after launching in March 2026 with a combined $189.9M Seed and Series A led by Accel.

Armadin reports that the new round brings its total funding to $445M. The disclosed rounds add to $445.4M, so the company figure appears rounded; the underlying close-by-close ledger was not disclosed. Armadin also reports a valuation above $2.5B, a transaction figure corroborated by Reuters rather than an independent appraisal.

From Vulnerability Findings to Attack Paths

The company's argument starts with the limits of periodic testing and isolated severity scores. An exposed service, an identity misconfiguration, and an overly permissive cloud role may each look manageable on their own. Connected in the right order, those weaknesses can become a path from an internet-facing system to sensitive cloud infrastructure.

Armadin says its platform deploys specialized autonomous agents across external assets, cloud, identity, internal networks, and applications. The agents reason through possible routes, attempt controlled exploitation, and return validated kill chains showing reachability and blast radius. The practical promise is prioritization based on what can be exploited as a connected system, rather than another queue organized around individual findings.

The company says its safety architecture uses hardened sandboxes, deterministic policy proxies, and behavioral monitoring. Armadin has also announced work with NVIDIA's Open Agent Safety Platform and a partnership with CrowdStrike, positioning its offensive layer as an input into the defensive systems enterprises already operate.

Why the Investor Bet Arrived So Quickly

Armadin's March launch already carried an unusually large pool of capital and a founding team with recognizable security credentials. The company now says it is running agentic attack campaigns in production for Fortune 500 enterprises and government customers. Those customers are unnamed, and Armadin has not disclosed audited revenue, retention, pricing, or customer counts.

The investor thesis is clearer than the commercial evidence available in public. As frontier models reduce the time and expertise required to discover and combine weaknesses, a quarterly or annual assessment describes a security environment that keeps changing after the report is delivered. Continuous offensive validation becomes more valuable if it can show which paths are exploitable now and help teams confirm that remediation actually severed them.

Armadin has published campaign examples involving 100 simultaneous attacks and nearly 1M autonomous actions, as well as another engagement spanning more than 25,000 services and 1,300 attacks. Those figures illustrate the scale the company wants to automate, but they remain company-reported examples rather than independent benchmarks.

The Team Behind Armadin

Kevin Mandia, Armadin's founder and CEO, previously founded Mandiant and led FireEye. Mandiant's incident-response history gives Armadin a founder who has seen how sophisticated intrusions move through large organizations after preventive controls fail.

Travis Lanham, founder and CTO, previously led technical work for Google Cloud Security Operations. Evan Peña, founder and Chief Offensive Security Officer, spent 13 years at Mandiant and helped build its red-team program. David Slater, founder and Chief Architect, previously led large-scale data-platform engineering at Google SecOps.

That mix matters because autonomous offensive security has two obligations that can fight each other. The system must behave enough like an attacker to find connected risk, yet remain constrained enough to run safely inside production environments. Armadin is asking customers to trust software with adversarial capability around the systems they most need to protect.

What the Series B Changes

The $255.5M round gives Armadin resources to scale the platform and the research and training systems behind its agents. It also expands the go-to-market requirement. A technically impressive controlled attack becomes a durable business only when customers can deploy it repeatedly, interpret the evidence, connect it to remediation, and justify the spend against existing tools and services.

For security leaders, the useful measure will be whether Armadin reduces the distance between discovering a real attack path and proving that the path has been closed. For investors, the question is whether an offensive-security system can become persistent infrastructure without becoming another high-volume source of alerts. The capital shortens Armadin's time to build, while the attack surface it intends to model keeps changing underneath the work.