FireEye

Overview

FireEye was an American cybersecurity company founded in 2004 by Ashar Aziz that built its reputation on detecting malicious software in network traffic, went public on the Nasdaq in September 2013, and bought the incident-response firm Mandiant for about $1 billion months later (Reuters; Associated Press). In December 2020 it disclosed that nation-state hackers had breached its own network — and its investigation of that breach uncovered the SolarWinds supply-chain compromise, one of the worst intrusions of U.S. government agencies in years (Associated Press; Reuters). Then, in 2021–2022, the company was split in two and sold off in pieces: the products business and the FireEye name went to private equity firm Symphony Technology Group for $1.2 billion (merged with McAfee Enterprise as Trellix), while the remaining services business was renamed Mandiant and bought by Google for $5.4 billion (The Register; TechCrunch). FireEye no longer exists as an independent company, and “Google acquired FireEye” is the common but wrong shorthand — Google bought Mandiant, the FireEye spinout.

From sandbox startup to public company

FireEye began as a network-security company whose technology tested internet traffic inside virtual machines before letting it onto corporate networks. Founder Ashar Aziz took it public with a Nasdaq debut on September 20, 2013, and the market value more than doubled in the months after the listing (Reuters). In January 2014 the company announced it was buying Mandiant, the Virginia-based computer-forensics firm, for about $1 billion in a deal that sent FireEye shares up as much as 35 percent in a day (Reuters). Mandiant had risen to prominence in February 2013 with a report detailing what it said were links between a Shanghai-based unit of China’s People’s Liberation Army and a long list of attacks on U.S. companies — allegations Beijing denied (Reuters). The combination married FireEye’s detection technology with Mandiant’s frontline incident-response expertise, and the merged firm became a go-to investigator for major breaches.

The breach that made it famous

On December 8, 2020, FireEye disclosed that foreign government hackers with “world-class capabilities” had broken into its network and stolen the offensive “red-team” tools it uses to probe customers’ defenses — tools that mimic hacker methods (Associated Press). CEO Kevin Mandia said the attackers “primarily sought information related to certain government customers,” and the company investigated the attack alongside the FBI and Microsoft (Associated Press). At the time FireEye had about 3,400 employees, $889.2 million in annual revenue, a $257.4 million net loss, and some 8,800 customers — more than half of the Forbes Global 2000 (Associated Press). Its investigation of the intrusion led it to discover that hackers had inserted back doors into network-management software from Texas-based SolarWinds — “initially discovered by security provider FireEye Inc,” as Reuters later put it — exposing thousands of SolarWinds customers including nine federal agencies and about 100 private companies (Reuters).

The split: two companies, two buyers

Six months after the SolarWinds discovery, FireEye announced it was dividing itself in two. In June 2021 the company agreed to sell its products business — network, email, endpoint and cloud security tools plus its security-orchestration platform — along with the FireEye name itself, to private equity firm Symphony Technology Group for $1.2 billion (The Register). The remaining business — threat intelligence and incident-response services — would return to the market as a standalone company under the Mandiant name (The Register). “We believe this separation will unlock our high-growth Mandiant Solutions business and allow both organizations to better serve customers,” CEO Kevin Mandia said at the time (The Register).

The mechanics were precise. STG had already bought McAfee’s enterprise security business for $4 billion in March 2021, and it combined that business with the FireEye products business into a single entity with nearly $2 billion in revenue, more than 40,000 customers and 5,000 employees, led by CEO Bryan Palma (The Register; Dark Reading). The corporate rename took effect on October 4, 2021, when FireEye became Mandiant and its Nasdaq ticker changed from FEYE to MNDT the next trading day (Dark Reading). In January 2022 STG launched the combined products company under a new name, Trellix — evoking a trellis, “a strong and safe framework” — while McAfee Enterprise’s secure-service-edge portfolio was spun out as a separate business (The Mainstream; Dark Reading).

Meanwhile the standalone Mandiant lasted less than a year as an independent public company. On March 8, 2022, Google announced it would buy Mandiant for $5.4 billion in cash — $23 a share, about a 53 percent premium — after Microsoft had also reportedly eyed a deal (Reuters via Gadgets360). The acquisition closed on September 12, 2022, with Mandiant joining Google Cloud while retaining its brand (TechCrunch).

What this profile does not claim

• This profile does not claim Google acquired FireEye. Google acquired Mandiant — the services business that remained after FireEye sold its products business and name to STG. The products business became Trellix, which is STG-owned and has no connection to Google.
• It does not attribute the SolarWinds attack to a specific government; U.S. authorities said the Russian government was likely behind it and Moscow denied it (Reuters).
• It does not state the exact closing date of the STG acquisition of FireEye’s products business — independent sources read confirmed only that it closed in the fourth quarter of 2021.
• Founder Ashar Aziz’s pre-FireEye career history is not stated; it was not verified from a citable independent source read for this profile.
• The January 19, 2022 Trellix launch date rests on a tier3 trade item; the merger and naming are corroborated by tier2 specialist press.