Mandiant

What Mandiant actually does

Mandiant investigates breaches. They’ve responded to more major cyber incidents than arguably any other firm, and that experience feeds back into their threat intelligence, which is some of the most actionable in the industry. The core offerings are incident response, compromise assessments, and threat intelligence subscriptions.

The incident response service deploys investigators who trace exactly how attackers got in, what they accessed, and whether they’re still present. The compromise assessment is the proactive version — Mandiant hunts through your environment for signs of existing compromise before a breach is detected. Both draw on real-world attacker knowledge that comes from handling thousands of engagements.

The threat intelligence platform (now integrated with Google Cloud) provides finished intelligence reports, indicators of compromise, and adversary profiles. It’s used by SOC teams for detection engineering and by leadership for understanding the threat landscape. The IR retainer gives you pre-negotiated access to Mandiant’s response team with guaranteed response times.

Who it’s best for

• Organizations that want an IR retainer with a top-tier response firm
• Security teams that need actionable threat intelligence for detection engineering
• Companies that want proactive compromise assessments to find existing breaches
• Enterprises in critical industries that need proven IR capabilities on speed dial
• Cyber insurance carriers and legal counsel that recommend Mandiant by name

Pricing reality check

Mandiant is the most expensive option in almost every category it competes in. IR retainers are significant annual commitments. Threat intelligence subscriptions are priced for enterprises. Compromise assessments are billed as consulting engagements. This is not a budget play.

The IR retainer is worth understanding in detail. You pay an annual fee for guaranteed access. If you don’t have an incident, some retainers allow you to apply unused hours toward other Mandiant services like compromise assessments or readiness exercises. Read the terms carefully and make sure unused retainer hours don’t simply evaporate.

Alternatives to consider

• CrowdStrike Services — Strong IR capability tied to the Falcon platform. Good if you’re already a CrowdStrike customer.
• Secureworks — IR and managed security with more accessible pricing. Solid but less brand cachet.
• Recorded Future — Threat intelligence platform with broad coverage. More accessible pricing for intel-only needs.
• Unit 42 (Palo Alto Networks) — IR and threat research. Strong if you’re in the Palo Alto ecosystem.

The Charting Cyber take

Mandiant’s reputation exists for a reason. When a major breach hits the news, there’s a good chance Mandiant is in the room investigating. That depth of experience translates into threat intelligence that’s genuinely more useful than what most competitors produce. The adversary profiles and campaign tracking are informed by real investigations, not just open-source collection.

The reality check: most organizations don’t need Mandiant. If you’re a mid-market company with a reasonable security program, a Mandiant IR retainer may be over-buying. CrowdStrike Services, Secureworks, or a strong regional IR firm can handle most incidents. Where Mandiant earns its premium is in nation-state incidents, complex multi-month investigations, and situations where the adversary is sophisticated and persistent. Know what you’re buying and why. If the answer is “because our board heard the name,” that’s a valid reason — but not a technical one.