Rob T. Lee

Chief AI Officer, Chief of Research, @SANSInstitute | Cybersecurity Expert & Threat Hunter | Godfather of DFIR | Technical Advisor to US Govt

[Rob T. Lee @robtlee]

I'm excited to share my first ever Linkedin Learning course, on how to Become an Al Security Champion!

I built this for people who have never heard of Black Hat or RSAC. This is for marketing, legal, HR trying to get Al tools for their teams.

And they cannot figure out why security won't say yes.

l've been on both sides of this frustration between business units and security. The disconnect drives Al usage into the shadows and slows innovation. It drives security crazy when they are trying to protect the business.

Ten micro-lessons (90 seconds each!) with templates and guides for the person who helps their team get new
Al tools approved for work. (Huge thanks to the folks who bookmarked, watched, and rated this course (currently at 4.9 stars!!)

This is bigger than 'we want Al tools.' It's about a business being able to compete. Business and security need to be on the same side. This course is for the person who makes that happen.

https://t.co/W8s47EzXdp

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

[SANS Institute @SANSInstitute]

Small U.S. water, power and gas utilities: free OT security tech, deployment help and SANS training for up to 500 of you. https://t.co/lO94hvJg45

#ICS | @Accenture | @DragosInc

[Rob T. Lee @robtlee]

Come train alongside your security peers at the SANS Institute AI Cybersecurity Summit. Our registrants are from banks, hospitals, utilities, manufacturers, technology companies and government agencies, and we're all back in boot camp!

These are people you can learn with, talk through a problem with, and call after the conference.

We’ve set aside two afternoons for six hands-on workshops. Pick two:

AI incident response:
Practice responding to compromised AI workloads with Steve de Vera (AWS) and Kyle Shields, CISM, GCIH, GCPN (AWS).

AI swarms:
Investigate intrusions involving multiple AI agents with @joswr1ght (CounterHack).

Offensive AI:
Use AI to exploit vulnerable applications with Andy Dennis and and William Reyor (@Xbow)

Delegating to agents:
Practice assigning security work to agents while retaining control with @lennyzeltser (SANS Institute).

AI pentesting:
Practice AI-assisted penetration testing with @pedramamini (OPSWAT) and Adrian Wood (Dropbox / BT6).

Autonomous DFIR:
Work with Caleb Evans (Airbyte) and Mulder, his winning Find Evil! incident-response agent.

Registration closes SOON for @SANSInstitute AI Cybersecurity Summit

See you in Arlington, VA (Select Summit talks are also available live online.) Registration includes virtual access to @unpromptedconf II

https://t.co/UQY9OpDOx4

[Rob T. Lee @robtlee]

@kevinroose this was the least normal thing AI has done so far? curious why you think so. not saying this was the most predictable but given conditions and nature of ai agents, would say it was ... predictable.

[Rob T. Lee @robtlee]

@ClementDelangue @netflix @OpenAI @huggingface well... here for the sci-fi always, but come on. we do not need any more help expanding the doomer narrative.

[SANS Institute @SANSInstitute]

SANS Chief AI Officer @robtlee on @Machine_Dreams: why security belongs in AI development. https://t.co/BPfyaew7MX

[Rob T. Lee @robtlee]

Today, Rob Joyce @RGB_Lights posted today that IR firms are saturated and turning away work. I’ve heard the same thing. So why isn’t a single one of them saying it in public?

@Reuters reported today that a Chinese-speaking operator pointed AI agents at more than 1,200 e-commerce sites starting September 25 and got into more than 100, including Deere and SharkNinja. Gambit Security documented a separate September campaign: at least 27 companies breached, more than 600,000 card records taken.

None of the attacks were Mythos-class tradecraft. 

The agents won by grinding old PHP bugs, exposed credentials, and missing MFA for 23 hours at a stretch.

The response side is the same core skills this industry has always run on: log review, forensics, containment, patching. 

The scale of cyberattacks has changed. My read: the scale of attacks shows up before attack speed. Speed is close behind, and I don’t see either one leveling off.

I talk to the people running incident response at the biggest firms in this industry. The odds that the water rose across the entire industry and no one called a peer to ask “is it rising on your end?” are close to zero. A few inches at every firm means the thing changed, and we’re sitting on it.

A post on X that says “Wow, a bit busier than normal. Weird.” would do. (I’ll repost it. Low bar, I know.)

The Abyss and countless other world-ending movies gave everyone the wrong picture of a tsunami: a wall of water on the horizon. A real one starts with the water pulling off the beach while everyone stands there taking pictures, then it comes back in, and by the time anyone understands what they’re looking at, it’s inland. We’re at the taking-pictures stage.

At the White House Super Intelligence Luncheon on September 29, where the AI Accord was signed, the only cybersecurity names on the President’s own seating chart were National Cyber Director Sean Cairncross and Palo Alto Networks CEO Nikesh Arora. The Accord’s first commitment is about cybersecurity. (We got one industry seat.)

This industry is being judged on whether it belongs in the “we can contain AI” room. @ZackKorman has evangelized that point endlessly. If we can’t agree on a few inches of water line, we shouldn’t be invited in until we say it on the record as an industry, not a few firms here and there.

Right now every firm in this industry answers with its own logo. Who do we play for?

In Miracle, Herb Brooks skates his team into the ground after the Norway tie, asking one question over and over: “Who do you play for?” Nobody gets off the ice until Eruzione answers with the country instead of his college.

Kudos to Rob Joyce for saying it out loud. He’s playing Bendu from Star Wars Rebels, the one in the middle who refuses both the light and the dark and tells you what he sees. He shouldn’t be the only one.

The witches in Macbeth had it right: “By the pricking of my thumbs, something wicked this way comes.” Say it on the record, as an industry, and then ask for the seat
https://t.co/Md6qGWRPfx

[Rob Joyce @RGB_Lights]

Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. https://t.co/30wJxs7iIY

[Rob T. Lee @robtlee]

@0sm0s1z @AnthropicAI @OpenAI Facts

[Rob T. Lee @robtlee]

I don't believe AI agents are too smart to contain. Where is the cybersecurity know-how inside the companies building these models?

In 1988, the Morris worm infected roughly one in ten machines on the internet. Parts of the internet went offline for days.

Since then, cybersecurity has spent decades testing some of the world's worst malware inside sandboxes. CrowdStrike and Mandiant run these labs. If something escaped, you would have heard about it.

Frontier AI labs are reporting agents breaching systems outside their test environments. They say containment is hard. I don't believe that.

I don't see the depth of cybersecurity talent I'd expect inside these labs.

I don't think they've gone through the same discipline cybersecurity has spent decades developing.

Cybersecurity knows how to contain things that are really bad. We've been doing it for 25 years.

We need cybersecurity people working side by side with AI safety teams.

[Rob T. Lee @robtlee]

We need to stop pretending AI safety is cybersecurity. If frontier labs want to test their stuff, they need to beef up their cybersecurity component.

But their gut reaction in the response to their agents getting out is to say, “It’s not a cybersecurity problem.” It has literally become an AI safety problem, which is divorced from the cybersecurity side.

If an agent accesses another company’s systems without authorization, who is responsible?

That’s where the traceability for both liability and insurance comes into play. If a 'rogue' agent is detected, and they’re able to trace it back to the person that initiated it, liability’s going to kick in and say, “Hey, you, you broke the law, ergo, we need to prosecute.”

I spoke with Cynthia Brumfield about this for @CSOonline: https://t.co/TUQdawdcA0

[Rob T. Lee @robtlee]

[NEW RELEASE] Between March and October, the AI security field stopped asking how to roll AI out and started asking how to survive it. @IndreAltman and I serve on the @unpromptedconf AI Security Practitioner Conference team, and when we lined up March 2026’s 469 submissions against October 2026’s 490, the shift stunned us both.

A call for papers is a census nobody else gets to take. Roughly 500 submissions in each round, each is someone describing what they are actually working on before it's shaped by committee. Only a fraction are accepted, so the final program doesn't show what the whole field is chasing. The full pile does. (I have always been more curious about the pile than the program.)

The two [un]prompted CFP rounds bracket April when Glasswing and Mythos landed. The Mythos moment helped change the industry. We wanted to know whether it changed what researchers turned in. It did.

The pattern under October’s 490 has less to do with a technology than an industry anxiety.

348 submissions, 71%, touch agentic systems. The headline is not “everyone is doing agents.” It is "can we trust the agents we have already deployed," and whether we can tell you what an agent actually did after the fact.

94 submissions use the word “harness,” a term that barely existed in this field a year ago. The scaffolding around the model is the attack surface: the tools, the memory, the permissions, the execution loop wrapped around the model.

Proposals describing attacks on the harness layer rose from 12 in March to 33 in October, a 175% increase. Attackers go after that layer now, and defenders are still working out how to see into it. (We have a word for it before we have a way to secure it, which is the usual order of operations in this business.)

71% of October’s pool is agent-native: the harness, the MCP and skill supply chain, agent identity, prompt injection and its many children, agentic-browser attacks.

12% of submissions carry production evidence. The other 88% are experiment and prototype. The agents are in production and most of the research about them is not. (I keep going back and forth on whether that is people being careful or people being behind. Probably both.)

This is not the March field with a few new talks bolted on. It is a different room.

Those are a few of the findings. Indre and I wrote the rest up as the State of AI Cybersecurity report. Read it and see for yourself what changed. https://t.co/CcOkykOMFW

@unpromptedconf 27-29 Oct in SF. Almost sold out!
@unpromptedconf @SANSInstitute @gadievron @jaybeale @aaronzollman @jonsakoda @WHITEHACKSEC @dhubbard858 @brittaglade @GuanniQu @EmanuelGawrieh @GregNotch @joesu11ivan @dragosr @IdaVass1

[Rob T. Lee @robtlee]

I think we overplay the content when we talk about conferences.

In-person events create a context and a social network that allow people to solve really hard problems across organizations because they no longer feel alone.

You're watching a talk, that becomes the spark of a conversation: “Hey, what did you think about that?” Then you're forming opinions, working together on the same thing, and eventually building lifelong friendships and industry partnerships.

So many people who grew up in the digital forensics incident response community became best friends from coming to the DFIR summits. The summits are smaller, more intimate. You didn't get lost in them like you do at the big events where there's just way too much going on.

At a smaller summit, you can sit down, have a couple beverages. The statement I'm most proud to hear? "Hey, I'll see you at the next one.”

You also have the chance to sit down with the speakers a lot more because it's not overwhelming. At the larger events, they're sometimes carted off before you can have a conversation with them one-on-one.

That's the sense of community at the @SANSInstitute AI Cybersecurity Summit. Can't wait to see you all in just a few weeks!! (if you're not registered yet https://t.co/UQY9OpDOx4)

[Rob T. Lee @robtlee]

Apparently @sounilyu and I are summit overlords now. Our field is incredibly fortunate to have Sounil around and mentoring us. If you somehow haven’t met my cochair:

He holds more than 20 granted patents.

Created the Cyber Defense Matrix and the DIE Triad, and co-founded @knosticai to tackle need-to-know boundaries for AI.

During the pandemic, he also volunteered as CISO for Project N95 and helped the organization deliver 42 million pieces of PPE to hospitals. Yes, 42 million.

We’re bringing some of the best in the industry and longtime battle buddies together for two days of hard conversations, training, debate, and peer discussion at the @SANSInstitute AI Cybersecurity Summit.

We're all back in boot camp. Nobody gets to skip it this time, not even the people who wrote the old manuals. (Ask me how I know.)

If you have the time to watch even half the sessions, youf come away with knowledge you can immediately use back at work to argue for additional budget and capabilities, and understand what's coming down on us from a regulatory perspective

November 2–3 live in Arlington, VA or online: https://t.co/UQY9OpEmmC

Free virtual access to [un]prompted @unpromptedconf II included.

See you there. Bring coffee.

Summit lineup includes: @pedramamini @chrishvm @joshcorman @EppSecurity @gadievron @jeremiahg @JohnHultquist @DanielMiessler @magmill95 @k8em0 @WHITEHACKSEC @joswr1ght @lennyzeltser Morgan Adamski, Michael Collins, Andy Dennis, Steve de Vera, Jeremiah Grossman, Amy Herzog, Marcus Hutchins, Ciaran Martin, Vinh Nguyen, William Reyor, Kyle Shields, Adrian Wood

[Rob T. Lee @robtlee]

This just gives me great joy to see when you have waffle house "drop mic" on a professional weather service.

[Waffle House @WaffleHouse]

@weatherchannel Hey TWC! Unfortunately, this tracker is inaccurate and an unverified website. Here is our latest status map as of 5:30pm EST.

[Rob T. Lee @robtlee]

Think about what sits on AWS. The businesses. The governments. The data. The things people count on without ever thinking about what keeps them safe. Now think about being responsible for protecting it.

Amy Herzog has spent her career building and securing things that cannot afford to fail. Satellites to the cloud. She’s an engineer, an inventor, and a founder. She knows what it takes to defend them.

Today, she’s the CISO of Amazon Web Services (AWS) @awscloud. When pressure hits, she doesn’t get to admire the problem. She has to lead through it. We respect people who take on the incredibly tough jobs. Hers is one of them.

She spent 15 years at MITRE tackling security challenges across government and industry. She co-invented two cybersecurity patents and co-founded two businesses.

At Amazon, her work has spanned Project Kuiper, Ring, Alexa+, and advertising.

She brings a mathematics degree from Pomona and an MBA from MIT Sloan to the job.

Come train and learn with your peers with keynotes like Amy's, panels, debates, workshops. SANS Institute @SANSInstitute AI Cybersecurity Summit, November 2–3 in Arlington, Virginia or online. Registration includes [un]prompted @unpromptedconf online. https://t.co/wteGL83uJr

Summit speaker lineup includes Morgan Adamski Pedram Amini @pedramamini Chris Cochran @chrishvm Michael Collins Joshua Corman @joshcorman Andy Dennis Steve de Vera Sergej Epp @EppSecurity Caleb Evans Gadi Evron @gadievron Jeremiah Grossman @jeremiahg Trinity Harrison Amy Herzog John Hultquist @JohnHultquist Marcus Hutchins Rob T. Lee @robtlee Ciaran Martin Daniel Miessler @DanielMiessler Maggie Miller @magmill95 Katie Moussouris @k8em0 Vinh Nguyen William Reyor Kyle Shields, CISM, GCIH, GCPN Adrian Wood @WHITEHACKSEC Joshua Wright @joswr1ght Sounil Yu @sounilyu Lenny Zeltser @lennyzeltser

[Rob T. Lee @robtlee]

[25 DAYS OUT!] I get to moderate Joshua Corman @joshcorman, Michael Collins, and Daniel Miessler @DanielMiessler and I am not playing it cool. No chance. SANS Summit attendees, buckle up.

Joshua Corman @joshcorman does not think a patch is an apology. Sometimes the fix is a valve, a person, or taking the system off the network. He founded I Am The Cavalry and now leads UnDisruptable27, which is water, hospitals, food, and power staying up.

Michael Collins has spent twenty years breaking into networks. He found a crashed drone at his datacenter, built a hacking kit he could fly, and then watched someone use the idea in a real attack. Still no thank-you note. He thinks the change is writing the exploit, not finding the bug. He is a senior principal security engineer at Mastercard.

Daniel Miessler @DanielMiessler says an AI sounds smartest when you do not know the subject, and that defenders are losing to their own process. He also knows he grabs the wheel and ruins the result. He runs Unsupervised Learning and builds AI systems meant to carry a person’s goals into the work. Before that he did security at Apple, Robinhood, and HP.

@SANSInstitute AI Cybersecurity Summit, November 2–3 in Arlington, Virginia or online.

Come train and learn with us.

Registration includes [un]prompted @unpromptedconf online: https://t.co/3Fb4KrqegZ

Legendary Summit speaker lineup includes Morgan Adamski Pedram Amini @pedramamini Chris Cochran @chrishvm Michael Collins Joshua Corman @joshcorman Andy Dennis Steve de Vera Sergej Epp @EppSecurity Caleb Evans Gadi Evron @gadievron Jeremiah Grossman @jeremiahg Trinity Harrison Amy Herzog John Hultquist @JohnHultquist Marcus Hutchins @MalwareTechBlog Rob T. Lee @robtlee Ciaran Martin Daniel Miessler @DanielMiessler Maggie Miller @magmill95 Katie Moussouris @k8em0 Vinh Nguyen William Reyor Kyle Shields, CISM, GCIH, GCPN Adrian Wood @WHITEHACKSEC Joshua Wright @joswr1ght Sounil Yu @sounilyu Lenny Zeltser @lennyzeltser

[Rob T. Lee @robtlee]

We are all back in boot camp. The security profession is changing, and the job right now is to work on your skills, to get into the room, and learn what other people are seeing. Figure out what you can take back to your organization and use immediately.

Joshua Wright @joswr1ght just published the first rebuild of the SANS incident response framework in 20 years. It is called Dynamic Incident Response, and it is free in every digital format.

The old process was basically Contain. Eradicate. Recover. That worked when incidents were more linear. Now, you contain the incident, bring the systems back, and then the attacker shows up again. Or you find new evidence that changes what you thought the incident was in the first place.

Joshua Wright is a @SANSInstitute Faculty Fellow and the author of SEC504. He built coWPAtty and KillerBee. He spent 18 months writing this book, with contributed chapters from Megan Roddie-Fonseca on cloud response, Dean Parsons on OT, and Ryan Chapman @rj_chap on ransomware. John Strand @strandjs wrote the foreword.

It is 720 pages and free under Creative Commons. Run it in a real incident. Tell Josh what it missed.

But we all know the field is moving too fast for one person or one organization to have all the answers.

You cannot base your knowledge on the news or whatever you happen to see on X.

As a CISO or manager, you need to understand what is coming at you. What do you need to worry about? What capabilities do you need to build? How do you argue for additional budget?

That takes actual knowledge and actual skills. Josh will be teaching the hands on version at the SANS Institute @SANSInstitute AI Cybersecurity Summit on November 2-3, including how to scope AI swarms when the intrusion keeps regenerating identities, accounts, and infrastructure while you are trying to remove the attacker.

Get the book: https://t.co/67txdiPNxh
Summit details: https://t.co/B7AJBXRfUy

[Rob T. Lee @robtlee]

Here's who I learn from: https://t.co/q8WyNdRhrZ

[Rob T. Lee @robtlee]

I use OpenClaw. I don't buy the fearmongering, but Im a security professional, so I don't connect it to everything at once. I give it access slowly, the way I would an executive assistant, so it handles the things I'd rather not spend my time on.

Personal agents are powerful, and you're going to need one. You just need to know which one fits you.

Five companies shipped personal agents:

+Grok Bot (xAI) runs on its own cloud machine with a browser, a terminal and saved logins to your apps.

+Muse (Meta) connects to your email, calendar and payment apps, and it can buy things.

+Dots (OpenAI) are always-on agents inside ChatGPT that work in Slack and Teams.

+Hermes Agent Bot Mode (Nous Research) is a team of named bots that pass work to each other.

+Cue (Manus) gives each agent its own email address, phone number and wallet. (Yes, a wallet.)

We'll all be using personal agents by the end of the year.

Choose wisely. Choose because you learned from Kate Marshall and Samira Sohail who teach people with a lot to lose how to choose agents.

Build Your Personal AI Bot: Thursday, Oct 8, 12:30 to 2:00 PM ET.

LINK TO JOIN IN COMMENT