Kevin Mandia

Male

White

Coarse public-record coding; race is a noisy, interpretive category.

not established

No source reviewed documents specific national-origin or ancestry detail. His surname is consistent with Italian-American heritage, but nothing in the sourced record confirms this, so coded.ethnicities uses the broader "European American" bucket rather than a more specific tag.

Descendant, multi-generational American

No documented recent-immigration history; coded from absence of evidence.

not established

Not documented in the sources reviewed.

English

Inferred from a Rochester, NY childhood; not directly documented.

A stable family home through childhood; when his parents divorced during his senior year of high school he moved with his father to Pittsburgh rather than facing any housing gap. No housing precarity is documented at any point in his life.

When he founded Red Cliff Consulting in 2004 he had already spent twelve years building a paid track record — an Air Force officer's salary, then director-level roles at Sytex and Foundstone — and the firm was a consulting business generating revenue from its first clients rather than one requiring outside salary support to survive.

not established

No period of documented hardship, chosen or imposed, appears in the record.

Father worked as a human resources specialist; mother sold Mary Kay cosmetics as a direct-sales consultant.

A parent worked for themselves, the strongest known predictor of founding.

Mary Kay consultants operate as independent contractors selling on commission; counted here as self-employment in the strict sense, though it was a single-parent side income rather than a family business.

not established

Not documented in the sources reviewed.

not established

No documented multigenerational wealth or institutional standing.

not established

How his Lafayette College tuition was funded is not documented.

His parents divorced during his senior year of high school in Rochester, New York, and he relocated to Pittsburgh, Pennsylvania to live with his father.

Commissioned into the U.S. Air Force in 1992 upon graduating from Lafayette College; served as a computer security officer at the Pentagon, then as a special agent in the Air Force Office of Special Investigations investigating computer intrusions.

Rochester, New York through most of childhood and adolescence, then Pittsburgh, Pennsylvania for his final year of high school.

not established

Public or private schooling in Rochester or Pittsburgh is not documented.

Neither Rochester nor Pittsburgh in the 1970s-80s was a notable computing or cybersecurity cluster; his path into the field ran through a military commission rather than childhood proximity to the industry.

Rochester, NY (childhood) → Pittsburgh, PA (senior year of high school) → Easton, PA (Lafayette College) → the Washington, D.C. area (Air Force, Sytex, Foundstone, George Washington University, and eventually Mandiant's Alexandria/Reston, Virginia headquarters).

not established

No cross-border migration is documented; not applicable.

Twelve years across the Air Force Office of Special Investigations, Sytex (later Lockheed Martin), and Foundstone (later McAfee) supplied the technical skill, case history, and professional reputation — he co-authored a widely used incident-response manual — that let him start his own forensics consultancy in 2004.

Skill, Credibility, Network

His prior employers supplied technical training, a published professional reputation, and referral relationships rather than capital or the underlying business idea, which he developed himself.

not established

No co-founder is documented; Red Cliff Consulting/Mandiant is described as a solo founding.

22

Commissioned into the Air Force in 1992 upon college graduation.

12

From his 1992 Air Force commission to founding Red Cliff Consulting in 2004.

not established

No documented sustained apprenticeship under a single named mentor.

3

U.S. Air Force, Sytex, and Foundstone, before founding his own firm.

Master of Science in forensic science, George Washington University; Bachelor of Science in computer science, Lafayette College (1992).

not established

Not established — how Lafayette College and the George Washington University master's were financed (scholarship, ROTC, employer, family, or loans) is not documented in the sources reviewed. coded credentialFunding is coded "military" at low confidence as the best available inference from the direct undergraduate-to-commission pathway, not from a confirmed ROTC scholarship or tuition-assistance record.

Direct — a private undergraduate computer-science degree into an immediate military commission, with a graduate forensic-science degree layered on afterward rather than a community-college or transfer route.

Lafayette College is not documented as a specific pipeline into cybersecurity; his professional network formed afterward, inside the Air Force Office of Special Investigations and then Sytex and Foundstone.

not established

The specific amount or source of his first invested dollar into Red Cliff Consulting is not documented.

It paid its own way from the start. Revenue came before any outside money.

Red Cliff Consulting/Mandiant operated as a fee-generating incident-response and consulting business from its 2004 founding, reaching roughly 500 employees and over $100 million in revenue while still privately held, before any outside investment.

Founded in 2004 from consulting revenue and his own savings after twelve years of paid Air Force and private-sector security work, rather than from family capital or outside investors.

Kleiner Perkins Caufield & Byers and One Equity Partners invested in Mandiant in 2011, seven years after founding, to expand its incident response and security-consulting operations — the company's first documented outside capital, coming after it was already large and profitable.

Specific amount raised in the 2011 round is not documented in the sources reviewed.

Self-funded and profitable to roughly 500 employees and over $100 million in annual revenue before its first outside investment in 2011, then acquired by FireEye for about $1 billion in cash and stock in December 2013 — ending independent ownership in exchange for a stake in, and later leadership of, a public company.

Rather than cashing out of the 2013 FireEye deal and leaving, he stayed on as an executive at the combined company — senior vice president and chief operating officer, then president, then CEO in 2016 — effectively reinvesting his time and remaining equity into growing the larger public company rather than converting the acquisition into liquid wealth immediately.

Prior professional experience — years of hands-on computer-intrusion investigation for the Air Force and then in private-sector forensics convinced him there was a standalone market for incident-response and threat-intelligence consulting.

As of the proxy statement filed May 27, 2022 — shortly before Google's all-cash acquisition at $23.00 per share, announced that March — Mandia beneficially owned about 3,556,753 shares of Mandiant, Inc. common stock, roughly 1.52% of the company. That stake would have been worth approximately $82 million at the deal price, though it excludes any shares sold earlier in FireEye's public-company history (2013-2022) and any options or RSUs that vested or accelerated at the close of the Google acquisition in September 2022.

0

No documented failed venture prior to Red Cliff Consulting/Mandiant, which was profitable from its early years.

43

FireEye acquired Mandiant in December 2013; born approximately 1970.

Founded in 2004 as enterprise incident-response and forensics were becoming distinct disciplines, and grew through a decade of high-profile, publicized nation-state and criminal breaches (RSA in 2011, the wave of retail and government intrusions through the 2010s) that pushed corporate and government demand toward the kind of attribution and response work Mandiant specialized in.

Washington, D.C. area (Mandiant was headquartered in Alexandria, Virginia).

Built — Red Cliff Consulting/Mandiant was created from scratch, not acquired.

34

Founded Red Cliff Consulting in 2004; born approximately 1970.

20

From the 2004 founding to his May 2024 departure as CEO, continuously at the same organization through its FireEye and Google ownership periods.

Built in the Washington, D.C./Northern Virginia corridor rather than Silicon Valley — a real center of federal cybersecurity and defense contracting, but a different hub than the venture-capital and consumer tech centers most founder profiles in this set are built around.

Cybersecurity (digital forensics, incident response, and threat intelligence)

not established

No disclosed aggregate net-worth figure exists; he is not tracked by Forbes or a comparable real-time wealth tracker. coded.magnitude (band 4, $100M-1B) is built up rather than sourced from a single figure: his SEC-disclosed May 2022 stake (see d7.controlVsOwnership) was worth roughly $82 million at Google's acquisition price alone, and his reported total compensation ran $7.4-7.8 million a year from 2019-2021 (see peakAnnualIncome), almost all in equity, across roughly nine years as a public-company executive before the Google deal and nearly two more after it. That combination plausibly clears $100 million but there is no basis to place it more precisely, and it should not be read as a disclosed net-worth figure.

7780218

Total compensation reported in FireEye/Mandiant's Summary Compensation Table for fiscal year 2021: $440,000 salary, $6,946,880 in stock awards, $391,820 non-equity incentive compensation, and $1,518 other compensation. Comparable totals were reported for 2020 ($7,454,718) and 2019 ($7,728,166), a consistent pattern of heavily equity-weighted CEO pay.

Proxy statement

His cash salary stayed flat at $440,000 a year while nearly all of his reported compensation, and by extension his wealth, came from stock awards and the appreciation of his Mandiant/FireEye equity rather than cash pay.

Named Ernst & Young Entrepreneur of the Year for the Greater Washington region in 2011; co-authored the widely used manual "Incident Response: Investigating Computer Crime"; the 2013 APT1 report is credited with changing how publicly attributed nation-state cyberattacks are discussed, and the 2020 disclosure of FireEye's own breach in the course of uncovering the SolarWinds campaign was widely cited as an unusually transparent moment for a security vendor.

9

From founding Red Cliff Consulting in 2004 to FireEye's acquisition of Mandiant in December 2013.

Uncapped

Public-company equity compensation and, since 2024, a venture-partner role rather than a salaried or credentialed ceiling.

not established

No personal regulatory, criminal, or civil action against Mandia is documented. FireEye's stock and business performance were sometimes volatile as a public company (a common pattern for cybersecurity vendors through 2018-2019), which is an ordinary business-performance matter rather than a conduct finding, and no shareholder litigation naming Mandia personally was located in the sources reviewed.

FireEye publicly disclosed in December 2020 that its own systems had been breached and its red-team tools stolen, rather than concealing the intrusion — a self-initiated disclosure that led directly to uncovering the broader SolarWinds campaign.

widely regarded as a pioneer of modern incident response and threat intelligence, credited with popularizing nation-state cyberattack attribution, praised industry-wide for FireEye's transparent disclosure of its own 2020 breach

Press

5

Wikipedia, Lafayette College, Ballistic Ventures, SEC filings, and Cybersecurity Dive, among others reviewed.

Before

His reputation as a leading incident-response practitioner predates both the FireEye and Google acquisitions.

Asset

The reputation accrued from behaviour rather than being manufactured.

His reputation grew from documented technical achievements — the APT1 report, published incident-response work, and the SolarWinds discovery — rather than a deliberate personal-brand campaign.