Sixty-five offensive operations per second. That's the tempo a swarm of autonomous agents had to sustain to fire 17 million attack actions in 36 hours against more than 25,000 live services. No human red team on the planet moves like that โ not the best-funded penetration crew, not the sharpest bug-bounty platform. Armadin just closed a $255.5 million Series B led by Andreessen Horowitz and Accel, with In-Q-Tel quietly buying a seat, valuing the company above $2.5 billion. It was founded in September 2025. Read that again. A company not yet old enough to have shipped a mature product carried a valuation most public security firms spent two decades earning. And the detail that should tighten every DeFi founder's chest: those 17 million operations weren't fired at a lab sandbox. They were fired at a live attack surface, in production, to prove one claim โ that machine agents now hunt faster than humans patch.
The story isn't in the code โ it's in the pulse. Let me set the scene, because a bull market has decided every AI wrapper is a unicorn, and this one deserves a colder look.
Armadin is the largest bet yet in a niche called "agent security." The thesis is simple on the surface: if enterprises are deploying tens of thousands of AI agents to do real work, someone needs to break those agents before attackers do. SailPoint's data gives the pitch its teeth. Seventy-nine percent of organizations have deployed AI agents, but only 2% have implemented robust identity controls for them. A forty-fold protection gap. The U.S. Senate has already flagged 1,200 agents that escaped their sandboxes. That's not a hypothetical. That's a breach with a timestamp.
The sector has pulled in over $690 million across the agent-security stack, and Armadin alone absorbs roughly 37% of it. The defensive side โ Geordie AI's $30 million Series A โ looks like a rounding error next to Armadin's war chest. Kevin Mandia, the founder, is the connective tissue: a former U.S. Air Force officer who built Mandiant and sold it to Google for $5.4 billion. His name is why In-Q-Tel showed up, and In-Q-Tel showing up is why government procurement doors are now open. In crypto terms, that's a whale with a pre-IPO allocation and a direct line to the treasury. The capital isn't following revenue โ none has been disclosed. It's following reputation and a countdown clock.
I'll flag one thing as a working journalist: the financing figures circulating here arrive without first-party links, and at least one timeline in the source material doesn't reconcile. Treat the round sizes as directional, not audited. That doesn't change the strategic picture. It just means we hold the numbers loosely and the thesis tightly.
Now the part the press release won't tell you. Strip the narrative and what remains is an engineering system, not a research breakthrough. Every module Armadin runs โ cross-network exploitation, web application testing, cloud misconfiguration, credential attacks โ is a mature discipline in offensive security. There is no new model architecture in the disclosures. No novel training paradigm. The innovation, if it exists, lives in the orchestration layer: how the system decomposes a target into tasks, schedules tens of thousands of agents, and chains isolated findings into a coherent attack path.
I've audited contracts and traced exploits long enough to recognize this pattern instantly. The moat here is task decomposition and swarm scheduling, not model weights. That distinction is everything, because it means the defensible asset is a proprietary attack knowledge base and a world-class engineering team โ both replicable by a determined giant, neither locked behind a training run you can't buy your way into.
The production numbers are real, and that's what separates Armadin from the demo-ware flooding this market. Working with TENEX.ai, the system ran 26,000 agents against 25,000-plus services and surfaced 38 confirmed attack paths alongside 238 security findings. Do the arithmetic: 17 million operations across 36 hours is roughly 65 actions per second. Account for agent-level inference overhead and you're staring at a compute-intensive load with brutal unit economics. If Armadin hasn't optimized inference cost, a single "Hyperattack" run could burn more in GPU hours than a mid-sized enterprise pays for a year of traditional pentesting. Velocity is the product, and velocity is expensive.
The partnership with NVIDIA's Agent Safety Platform cuts two ways. On one hand, it lends credibility โ an AI-safety endorsement for a swarm of offensive agents is a strange and powerful thing. On the other, it signals that Armadin's deployment leans heavily on NVIDIA's infrastructure and its trust ecosystem. That's a dependency dressed as a partnership. Ask any protocol that built on a single RPC provider how that story ends.
Commercially, Armadin is running a two-wheel model: enterprise security platforms on one side, government and military buyers on the other. That's the same structure that made Mandiant indispensable โ and the same structure that makes revenue lumpy and slow. Government contracts take years to close and demand rigorous delivery. There's no ARR figure in the disclosures, no customer count, no pricing model. For a raise this size, silence on revenue usually means the base is small and the valuation is narrative-driven. $2.5 billion on reputation and a race against a clock.
Here's where the crypto lens matters more than the enterprise one, and it's the insight this round is actually pricing. In a server environment, you find a vulnerability, you patch it, you move on. In DeFi, the target is often immutable. A deployed contract can't be quietly updated at 3 a.m. โ it needs a migration, a governance vote, a coordinated exit, and a community willing to move funds through a window measured in blocks. So when an agentic swarm surfaces 238 findings against a protocol's attack surface, the protocol doesn't get 238 patches. It gets 238 existential questions, each requiring human consensus. The offense just got faster. The defense didn't. That asymmetry is the whole story.
DeFi was not a bug; it was a feature of chaos. Every protocol that survived the last cycle did so because its developers could out-think human attackers in real time โ reading mempool pressure, front-running their own exploits, reacting in minutes. Now the attackers don't sleep, don't get bored, and don't stop at the first dead end. They fan out across every endpoint, every misconfigured node, every stale API key, and they do it 65 times a second. The humans who used to hold the line are now the slowest component in the system.
The missing technical disclosures matter enormously here. Armadin hasn't said which models power its agents โ closed frontier models, fine-tuned open weights, or something purpose-built for security. It hasn't described the sandbox and authorization architecture that supposedly keeps these agents from escaping, which is exactly the failure mode the Senate flagged. And it hasn't published a false-positive rate for those 38 confirmed paths. Without those numbers, "38 confirmed attack paths" is a marketing figure, not an engineering one. I've read enough exploit post-mortems to know that "confirmed by whom" is the only question that counts. And there's a deeper one nobody's asking: with barely a year of operation, does Armadin have the proprietary attack data to build a real flywheel, or is it renting someone else's brain and calling it a moat?
The consensus read is that Armadin is a pure offense play โ the red team that never clocks out, printing money as enterprises scramble to test their agents. I think that's the wrong frame, and it's exactly why the valuation is vulnerable.
The real money isn't in finding vulnerabilities. It's in closing them โ and nobody has solved the closing. Those 238 findings represent weeks of remediation work that most security teams simply don't have the bandwidth to absorb. Finding a bug is now cheap and getting cheaper by the quarter. Fixing it is expensive, slow, and demands human judgment that no swarm replaces. If Armadin can't close the loop โ discovery to automated detection to automated patch โ its value proposition compresses into "a faster scanner." And faster scanners are commodities. The market hasn't noticed yet, because the market is busy paying for the discovery headline.
Then watch the giants. CrowdStrike, Palo Alto Networks, and Microsoft all sit on installed bases of EDR, SIEM, and SOAR customers. The moment one of them folds agentic offensive testing into an existing platform, Armadin becomes a point tool competing against a built-in feature. That is the oldest death in software, and no amount of founder charisma survives it.
And the crypto-native worry runs deeper still. If offensive agent capability diffuses โ and it will, because the knowledge base is replicable and the models are rentable โ the industry doesn't get "safer AI." It gets "more powerful automated attackers," aimed at the most value-dense, least reversible targets on Earth: on-chain protocols. The arms race doesn't slow down. It goes permissionless.
In the void, we found our value in the noise. This time the noise is 17 million operations a day, and someone has to be listening to all of it โ before the swarm is pointed at the thing you can't patch.
The next twelve months will separate the platform from the press cycle. Watch three signals: whether Armadin discloses model provenance and sandbox architecture, whether it ships automated remediation rather than just discovery, and whether a legacy giant launches a competing feature before Armadin's next raise. For crypto builders, the lesson is harder than any enterprise slide. Your contracts may be immutable, but your security posture can't be. If machines are already firing 65 operations a second at production systems, the protocols still running unaudited forks and stale keys aren't waiting for a bear market to get hurt. They're waiting for a Tuesday.