Section 01 · Public Positioning
How Mandiant positions publicly
Mandiant, now part of Google Cloud, is the defining brand in nation-state incident response and threat intelligence. The offensive practice (Red Team Assessment, Purple Team, ransomware-readiness exercises) sits next to that IR and intel work, and inherits the brand premium that comes with it.
Section 02 · Market Read
Where Mandiant actually plays
Mandiant's gravitational center is APT-grade incident response and threat intelligence. The offensive line is genuinely strong, particularly around nation-state TTP emulation and ransomware-readiness exercises, but it is a feature of the broader brand rather than the brand itself. Since the Google Cloud acquisition, the engagements we see increasingly route through Google Cloud Security accounts, Mandiant Advantage subscriptions, and the enterprise procurement cycles that come with them.
Section 03 · Where We Fit
Where Alacrinet sits next to them
Mandiant owns the nation-state IR conversation, and we are not in it. If your threat model is a foreign intelligence service, you should be talking to them. For everything from a regulated mid-market environment through enterprise that wants offensive depth without enterprise procurement overhead, this is where we live. Named operator, no Google Cloud paperwork, no subscription bundle.
Section 04 · Side By Side
Side by side, on the dimensions that actually separate us
| Dimension | Alacrinet | Mandiant |
|---|---|---|
| 01 Threat-model fit | Realistic mid-market to enterprise adversaries: ransomware crews, opportunistic intrusions, insider abuse. | Nation-state and top-tier financially motivated APT emulation. |
| 02 Surrounding portfolio | Offensive testing, with no intel subscription or platform attached. | Mandiant Advantage subscription, Google Cloud Security alignment, IR retainer, threat intel feeds. |
| 03 Procurement | MSA and SOW directly with Alacrinet. | Google Cloud paper, enterprise procurement cycle, often a bundled commitment. |
| 04 Pricing | Mid-market accessible. | Enterprise pricing reflecting the brand and the IR-led delivery cost structure. |
| 05 Who runs the engagement | Bailey named on scope, delivery, and report. | Senior consultant lead with a delivery team pulled from a large global bench. |
Section 05 · Buyer-Side Honesty
When each firm is the right pick
When Mandiant is the right pick
- You credibly model nation-state actors and need TTP emulation drawing on first-party APT intel.
- You are already on Google Cloud Security paper and consolidating cyber spend on that contract.
- You need IR retainer plus offensive plus intel under one logo at hyperscale, and have enterprise procurement runway.
When Alacrinet is the right pick
- Your real adversaries are ransomware, opportunistic intrusions, and insider abuse, not nation-state APTs.
- You want offensive testing without a Google Cloud or Mandiant Advantage subscription attached.
- You want a named senior operator on the scoping call, not an account team handoff.
- You want enterprise-grade testing depth without enterprise procurement overhead.
Section 06 · The Tiebreaker
How to decide without a bake-off
Send the twelve-question checklist to both firms and require written answers in the proposal. The answers will sort the fit faster than a demo or a sample report. If Mandiant is the right call for your scope, the checklist will say so. If we are, the same checklist will say that too.
Section 07 · Frequently Asked
Frequently asked questions
Q1 Do you do APT-style red team work?
Yes, against realistic adversaries for the buyer's threat model. We will not pretend to emulate a specific nation-state actor at the fidelity Mandiant can, because we do not run a primary-collection intel program.
Q2 Can you handle ransomware-readiness exercises?
Yes. Tabletop, technical readiness assessment, and live-fire purple team against ransomware TTPs are all in-scope and run regularly.
Q3 If we are a Google Cloud shop, does that change the decision?
It changes procurement, not the testing question. Plenty of Google Cloud customers run their offensive program with us and keep Mandiant for IR retainer and intel. The two roles do not have to live on the same contract.