Armadin and TENEX.ai Run the Largest Controlled Live AI Cyberattack on Record

A joint engagement at a globally critical institution demonstrates continuous, machine-speed attack and response, the standard most organizations have not built and the one Armadin and TENEX.ai already run every day.

PALO ALTO, Calif., Aug. 3, 2026 /PRNewswire/ -- Armadin, an AI-native cybersecurity company, and TENEX.ai, a fully-agentic, human-led security operations provider, today described a joint engagement to test a safe real-world global attack for a leading global institution.

Armadin's autonomous, agentic attacker executed a safe AI attack across the entire external perimeter, internal network, and web applications. TENEX.ai's agentic platform and SOC ingested, triaged, and responded to the resulting telemetry in real time.

Over the course of the three day attack, Armadin's swarm generated 17 million offensive actions, discovering 38 validated attack paths and producing 238 security findings. TENEX.ai's agentic Security Operations platform separately triaged 100% of 101,169 alerts and reconstructed the entire attack across 231 billion raw events - a forensic effort that would have taken a five-person team approximately 2,400 hours or four months of manual analyst work.

This engagement reflects standing operating practice for both Armadin and TENEX.ai, not an isolated proof of concept. Armadin runs Hyperattacks against live environments continuously to help customers close their security gap before adversaries discover it. TENEX.ai runs fully-agentic, human-led continuous detection and response for every customer on the same operating cadence. This engagement demonstrates, under live conditions, what happens when both operating models run against each other at AI scale and speed rather than in isolation.

Why This Matters

Defenders historically relied on incomplete point-in-time assessments and signature-based scanners to discover their security gap. As AI accelerates the pace of digital change and attackers leverage agentic AI to conduct sophisticated machine-speed attacks, security programs must move towards effective autonomous security: AI-powered offense training AI-driven defense.

Armadin's platform safely delivers the most comprehensive and powerful AI attacks to identify new and novel attack paths before adversaries can exploit them and train an organization's defenses at machine speed.

TENEX.ai's platform is built on continuous detection, triage, and investigation - matching that tempo on the defensive side. This engagement shows what happens when both capabilities run concurrently against a live enterprise environment, rather than sequentially or in isolation and what it exposes about the gap between having detection tooling and having detection coverage.

How it Worked

Armadin's agentic swarm operated against the institution's external perimeter, internal network, and web applications under zero-knowledge conditions. No privileged credentials. No control-point whitelisting. No source code access.

The swarm discovered and analyzed petabytes of attack surface reconnaissance data, indexed it into a security knowledge graph, then launched 26,000 agents against the environment. Each attack leveraged models trained with the expertise, tradecraft, and judgment of elite human operators, chaining discovered exposures into validated attack paths with the sophistication of an advanced threat actor. Every action the swarm took ran through Armadin's control layer with supervision from a safety model trained with expert human feedback.

TENEX.ai's SOC ingested the resulting activity through its detection stack, correlated and triaged the alerts it generated, and escalated based on analyst judgment rather than a pre-agreed response plan.

Neither side treated the other as a test to pass. Armadin's agents adapted their tradecraft based on the defensive controls they encountered. TENEX.ai's analysts investigated and escalated based on what the telemetry showed - not a script agreed in advance.

What the Swarm Found

Armadin's swarm launched 1,300 attacks, carried out by 26,000 agents executing millions of actions and consuming tens of billions of tokens, targeting more than 25,000 services.

The engagement began at the institution's external perimeter. Armadin's swarm targeted the perimeter and identified exploitable access to the institution's systems behind a defensive security deployment that included WAFs, endpoint security, and a Security Operations Center. Over the course of the engagement, Armadin documented 238 findings and chained 38 validated attack paths. 98 of those findings were significant. Armadin's swarm is built to enumerate this class of exposure because it maps the actual, deployed dependency graph rather than relying on a static software bill of materials. That is the pattern most vulnerability management programs are not yet built to catch, because it does not read like a vulnerability in the traditional sense. It reads like ordinary engineering practice, right up until someone exploits it.

What TENEX.AI saw

During the exercise, TENEX.ai triaged all 101,169 alerts generated across the institution's security stack. Human analysts remained accountable for every investigative and escalation decision, while TENEX.ai agents traced the attacker's activity across 231 billion events, reconstructed 38 attack paths, assembled supporting evidence, and delivered evidence-backed findings for action. The scale of the investigation highlights the challenge facing modern Security Operations Centers. Attacker activity represented just one event in every 13,338 recorded during the engagement. TENEX.ai processed the entire data set while analysts directed the investigation and AI agents generated and executed queries, identified pivot points, gathered evidence, and synthesized the results.

The outcome was not a high-level summary. TENEX.ai produced evidence-backed determinations for all 238 findings. For each finding, the platform documented the attacker's actions, the affected endpoint, whether the activity could be proven from available telemetry, which existing detections identified it, and what additional detection logic would be required. Each finding was classified across 31 dimensions, including mappings to MITRE ATT&CK, OWASP Top 10, OWASP API Top 10, and CWE where applicable. The platform also performed 31 documented verification checks, recording both positive and negative results so that visibility gaps were documented rather than assumed away.

Under a traditional SOC model, each of the 38 attack paths would typically require a separate investigation. Instead, TENEX.ai established every finding from evidence, correlated 2,164 distinct source addresses across 89 alerting rules related to the attacker infrastructure, and completed the investigation as a single coordinated operation. Every conclusion was evidence-based. Based on the scope of the investigation, performing the same work manually would have required approximately 2,400 analyst-hours - more than a year of effort for a single analyst or roughly four months for a five-person team.

What This Means

The institution in this engagement proactively engaged in the critical work of testing their environment against an AI Hyperattack. They maintain a WAF, endpoint security, and SOC coverage consistent with a well-resourced, expert, enterprise security program. Armadin's swarm found and validated a real path to exploitation and proof that the exposure was genuine and not theoretical. TENEX.ai's SecOps platform, SOC, and team triaged and worked that activity in real time, exactly as its detection and response model is built to do under live adversarial pressure.

That combination, autonomous offense and human-augmented defense operating against each other at machine speed, is converging on the default operating condition for enterprise security. Continuous adversarial validation is becoming the baseline, not the exception. Organizations that build it in now will be ready for what's already here. Those still testing once a year will find their gap in production, and it will already be too late.

Executive Quotes

AI is a step-change in adversary capability that every defender must prepare for. Every organization needs to build a security program focused on effective autonomous security: red AI training blue AI. The scale, speed, and sophistication of Armadin's Ultimate Attacker creates an adversarial loop that compounds faster than human defense, helping organizations close their security gap before attackers exploit it. The organizations that mobilize first will build the institutional muscle memory that compounds over time. The ones that wait will find out what unmanaged exposure costs.
Kevin Mandia, Chief Executive Officer, Armadin

Every organization needs to prepare for the AI threat. The security gap is widening as AI accelerates digital change and democratizes advanced offensive cyber capability. The industry just watched what happens when a capable, autonomous system has nothing enforcing what it is allowed to do. We built Armadin to provide effective autonomous security with the world's most sophisticated offensive AI capability governed by a control system to ensure alignment to train machine-speed defense. Every organization needs safe Hyperattacks to discover their gap before attackers do.
Travis Lanham, Chief Technology Officer, Armadin

Watching an agentic adversary operate against a live enterprise is very different from reading a red team report after. During this engagement, our AI agents and analysts investigated activity at a scale most SOC teams were never built to respond to or even detect. This isn't a preview of where cybersecurity is headed - it's the environment organizations are operating in today."
Eric Foster, Chief Executive Officer, Tenex

"Machine-speed attacks cannot be answered with human-speed workflows. In this exercise, TENEX's AI agents traced attacker activity across billions of events, connected the pivots, and assembled the evidence. Human analysts directed the investigation and governed every escalation. That is the operating model we built: AI working at machine speed, with humans accountable for outcomes."
Venkata Koppaka, Co-Founder and Chief Technology Officer, TENEX.ai

For more information, visit hyperattack.ai.

About Armadin

Armadin is an AI-native cybersecurity company delivering the definitive effective autonomous security platform to identify and eliminate your organization's exploitable risk. As the threat of AI-driven attacks escalates, Armadin Hyperattacks empower enterprises to proactively secure their environments.

Armadin's platform safely delivers the most comprehensive and powerful AI attacks to identify new and novel attack paths before adversaries can exploit them and train an organization's defenses at machine speed.

Led by CEO Kevin Mandia, Armadin is a group of engineers, researchers, and hackers on a mission to redefine what proactive security can do in the AI era.

About TENEX.ai

TENEX.ai is an AI-native, human-led security operations platform and MDR built by operators who have previously scaled MDR and founding engineers from Google Chronicle and leading AI labs. TENEX serves enterprise customers across the Google and Microsoft security ecosystems. Its fully agentic Security Operations platform autonomously triages, investigates, hunts, and responds to threats, with elite human analysts always in the loop to provide oversight, judgment, and accountability. Backed by Crosspoint Capital Partners, Shield Capital, DTCP, Deepwork Capital, and the Florida Opportunity Fund, with its seed round led in 2025 by Andreessen Horowitz (a16z), TENEX is headquartered in Sarasota, FL, with offices in Overland Park, San Jose, and Phoenix. Learn more at TENEX.ai.

Media Contacts

Armadin: Kristy Campbell, [email protected]
TENEX.ai: [email protected] 

This press release constitutes marketing materials and promotional content prepared by Armadin. The information contained herein is intended for marketing and informational purposes only and should not be construed as investment advice, a guarantee of future performance, or an offer to sell or a solicitation to buy any product or service. Armadin makes no warranty, representation, or guarantee regarding the accuracy, completeness, or reliability of any information presented in these materials.

SOURCE Armadin