Amazon puts Mandiant's founder on both its Audit and Security committees

An Audit Committee seat and a Security Committee seat are not the same job. One reviews controls and disclosure; the other reviews threats. Amazon's 9 September filing put Mandia on both ^[3]. Keith B. Alexander, the retired US Army general and former NSA director who left the board this year, had chaired the Security Committee ^[5][6]. Mandia's arrival takes the board from 11 members back to 12 ^[4][12].

The pay is small and slow. Amazon granted him restricted stock units for 4,086 shares, vesting in three equal annual instalments from 15 November 2027, and only if he is still a director then ^[8]. CNBC valued the award at about $1m at Amazon's 9 September closing price ^[9]. That works out to roughly $245 a share: $1,000,000 divided by 4,086 is $244.74 ^[10]. The first instalment lands about 26 months after the day he joined ^[11].

Between now and then his day job is Armadin, which uses AI to run attacks against corporate networks so that companies can test their defences, GeekWire reported ^[14][16]. "The AI shift is going to change cybersecurity more broadly and rapidly than any other transition in history," Mandia wrote in the March post that launched the company ^[17]. In the same post: "If there is a way in, the modern AI threat will find it" ^[18]. He told CNBC, according to TechCrunch, "When you have AI on offense, what you are going to get is a technology that can think, can learn, can adapt" ^[19], and said attackers would finish in minutes work that used to take days ^[20].

The funding behind that claim is substantial. Armadin announced $189.9m in seed and Series A money in March, with Accel leading and GV, Kleiner Perkins, Menlo Ventures, 8VC, Ballistic Ventures and In-Q-Tel taking part, TechCrunch reported ^[15]. Mandia co-founded Ballistic Ventures and is a general partner there ^[21]. So one of his companies' investors is a firm he part-owns, and he now sits on the audit committee of the largest cloud provider. The related-party item Amazon's filing does disclose is domestic: his sister-in-law Kristin Mandia works at Amazon on a $185,000 salary with a 2026 grant of 103 restricted stock units, and the filing says her pay is consistent with other employees at the same level ^[22]. CNBC reported she is a senior online community manager for Amazon Quick, the company's enterprise AI service ^[23].

For the person who has to answer on Friday for what the company runs on AWS, the line that matters is between what you can hold a vendor to and what only shows up later in a filing. You can hold a vendor to a contract term, a notification window, a support path, a default that changes in the console. What only shows up later in a filing: who reviews the security reports, who signs off on controls, which credential the board thinks qualifies someone for the security seat. Mandia's appointment is the second kind. It becomes the first kind the day Amazon publishes a commitment, a contract term or a related-party line that names Armadin.

The credential itself is the part with a track record behind it. Mandia founded Mandiant in 2004 and ran it as chief executive, Google bought the breach-investigation firm for $5.4bn, and the deal closed in September 2022 ^[13]. Before that he was an Air Force computer security officer at the Pentagon and a special agent in the Air Force Office of Special Investigations, and he has sat on the National Security Telecommunications Advisory Committee and CISA's Cybersecurity Advisory Committee ^[25].