How the answers frame Mandiant
In this snapshot, taken 29 September 2026 across ChatGPT, Claude, Gemini, Perplexity and Grok, no benchmark question named Mandiant. It surfaced in 43 of 1,250 answers to 250 questions. By provider, Grok named it 17 times, Gemini 9, ChatGPT and Perplexity 7 each, and Claude 3. The five answers supplied here are a sample of those 43, so the framing below describes those five and not every appearance.
The context is narrow. Claude's answer on nation-state detection led its list with Mandiant and described it as the top choice for government, critical infrastructure and large enterprises facing advanced persistent threats. Gemini's answer on clear postmortems after an incident called Mandiant "now part of Google Cloud" and put its incident-response services among the most respected. Perplexity's answer for a journalist grouped Mandiant with CrowdStrike and SentinelOne as research operations that publish threat reports, and added that readers should check for underlying evidence and researcher attribution.
In two answers Mandiant appeared as a supporting name rather than a subject. ChatGPT's answer on firms in trouble with regulators mentioned Mandiant only in its own working notes and settled on SolarWinds as the fitting example. Grok's answer on breached security vendors listed "FireEye/Mandiant" among vendors that have experienced breaches, and said those breaches do not inherently prove flaws in the core products.
The visibility figures by question intent match that pattern. The highest were incident transparency at 11%, trust at 9% and detection effectiveness at 6%. Value and leadership were 0%. The credit categories logged for Mandiant were sparse: Not Substantive twice, Reliability & Operations once and Customer Experience once.
Widely considered the gold standard for incident response.
What the press is saying
The PeakMetrics news index shows 904 mentions of Mandiant in the last 30 days, 22 of them with the brand in the headline. Recent headlines fall into three groups. One is threat research: "ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns." Another is hiring, with incident response consultant postings for Google Cloud, Mandiant. The third is corporate and product news: Amazon adding Mandiant founder Kevin Mandia to its board, and Google Cloud launching AI-powered security agents with Palo Alto, CrowdStrike and Mandiant.
Coverage is small against the sector. Microsoft Security has 21,221 news mentions, Cisco 22,216 and CrowdStrike 15,010. Mandiant's 904 sits close to Wiz at 932 and Proofpoint at 966.
Mandiant's frontline breach response experience gives it deep visibility into advanced threat actor behaviour and nation-state attack techniques.
The gap
The press and the assistants agree on the subject: Mandiant as a source of threat intelligence and incident response. Both also attach it to Google Cloud. The difference is scale. In the sector table, Mandiant's 43 answer appearances tie with Wiz, well behind Microsoft Security at 520, CrowdStrike at 442 and Palo Alto Networks at 404. Its news count is only slightly below Proofpoint's, yet Proofpoint appeared in 57 answers.
Only one of the five sampled answers presented Mandiant as a primary recommendation, and that was the narrowest question, on nation-state detection. In the others it was one name among several, or was mentioned in passing. Press headlines carry a live, named voice ("Mandiant warns"). The answers lean on a reputation for incident response and add little about current research.
What to watch
For a comms team, this snapshot suggests the brand's AI presence depends on a few question types: incident transparency, trust and detection. Broader questions on reliability, value, leadership and fit did not surface it. Whether that reflects the brand's positioning or how the assistants treat Google Cloud's security portfolio cannot be told from this data.
Two framings deserve tracking. One is the "FireEye/Mandiant" label, which surfaced in a breached-vendor answer from Grok. The other is the "now part of Google Cloud" descriptor, which appeared in Gemini's answer. These are single snapshots, and live answers vary between runs, so repeat the benchmark questions before treating any of it as a pattern.