Mandiant’s M-Trends 2026 report shows nation states and financially motivated threat actors use AI to accelerate the attack lifecycle as they move from mass email campaigns toward hyper-personalized, rapport-building social engineering. Vishing now holds the number two slot in how threat actors successfully attack companies. Ransomware attackers also target backup infrastructure, identity services, and virtualization management planes to block company recovery. I watch this escalation closely because AI agents require broad access to work, which creates new risks when an agent suffers a prompt injection or a supply chain attack. If an AI agent with privileged access discloses confidential information inappropriately, who carries the legal liability? Security professionals must educate employees in human resources, help desks, and customer service to mitigate these social engineering tactics. Industry leaders like Neeraj Abhyankar expect 2026 to favor AI integration architects who embed agentic workflows into enterprise systems. As AI evolves from a tool into autonomous agents, businesses must prioritize AI observability and safety tools to monitor behavior in real time. Josh Taylor from Fortra expects AI to empower threat actors to craft adaptive, scalable attacks that bypass static defenses. While 49 percent of organizations reported improvements to their overall security posture through AI, 60 percent of AI projects fail because they lack AI-ready data foundations.
Recorded Future’s Machine-Speed Response
Recorded Future fights these threats by using its Intelligence Graph to correlate signals across the dark web, open web, and adversary infrastructure. The Insikt Group adds human analysis to ensure findings stay accurate. While 60 percent of AI projects fail because they lack AI-ready data foundations, Recorded Future uses agentic processing to turn new threat disclosures into production-ready detection signatures in 31 minutes. This speed matters because attackers weaponize vulnerabilities faster than manual workflows can track. Recorded Future provides intelligence to over 1,900 customers, including government agencies and Fortune 500 companies like T-Mobile and Verizon. In 2024, Mastercard acquired Recorded Future for $2.65 billion, following a $780 million acquisition by Insight Partners earlier that year.
| Capability | Recorded Future Approach |
|---|---|
| Detection Speed | 31 minutes for signatures |
| Data Correlation | Intelligence Graph |
| Human Analysis | Insikt Group |
| Defense Type | Autonomous Threat Operations |
The company provides specialized intelligence for various domains. The platform delivers Brand Intelligence to defend against threats to executives and employees, and SecOps Intelligence to help incident response teams make fast decisions. Fraud Intelligence uses dark web sources to reduce exposure to payment fraud, while Third-Party Intelligence provides insights into supply chain risk. You should understand that intelligence-led security moves a program from reacting to incidents to preventing them before they occur. The company also maintains The Record, a news site that launched in August to tell stories about the cybersecurity field. To further its reach, the company launched the Intelligence Fund to invest in startups building novel intelligence data sets.
The Cloud Security Power Struggle
Google plans to acquire Mandiant for $5.4 billion to expand the Google Cloud security portfolio. This follows Google’s $500 million purchase of Siemplify to improve its threat management stack. Mandiant previously operated as a unit within FireEye before emerging as an independent company in June 2021. After the Google deal closes, Mandiant will join Google Cloud to help organizations manage complex multi-cloud requirements. Mandiant also sold its network, endpoint, and email security product business to Symphony Technology Group for $1.2 billion, which makes its SaaS platform vendor agnostic. Google’s recent layoff of dozens of cloud support staff also contradicts a strategy focused solely on scale. Microsoft maintains a dominant position in this space with its Sentinel platform and Defender for Cloud, which provides posture management across the three largest clouds. Microsoft’s security business generated over $15 billion in revenue in the last 12 months, which is triple the size of Palo Alto Networks. I find Google’s bid for Mandiant to be a strategic attempt to compete with Microsoft and Amazon, but the company must prove it can provide the same level of trust that AWS and Azure offer. Mandiant reported $483 million in revenue in 2021, which marked a 21 percent increase from the prior year.
