Rob T. Lee

FellowChief AI Officer and Chief of Research at SANS Institute

Specialities

Artificial Intelligence, Digital Forensics and Incident Response

Connect with Rob T.

Jump to:

Profile
Student Reviews
Webcasts
Resources

About Rob T. Lee

Rob T. Lee is Chief AI Officer and Chief of Research at the SANS Institute, where he advises boards, CISOs, and government leaders on how to govern, deploy, and defend AI at scale. He authored the SANS Secure AI Blueprint, introducing the three-pillar model of Protect, Utilize, and Govern, led the development of the SANS Critical AI Security Guidelines, and published widely- cited work on Shadow AI and safe harbor protections. His forthcoming white paper, “From Asymmetry to Parity: Building a Safe Harbor for AI-Driven Cyber Defense” (Fall 2025), addresses the challenges of AI-driven cyber defense.

Rob’s career spans government, industry, and academia. As a U.S. Air Force officer and founding member of the first information warfare unit, he helped build national-level cyber operations. He later served with the NSA and CIA before becoming Director of Threat Intelligence and Threat Hunting at Mandiant, where he co-authored the first M-Trends report and advanced frontline threat intelligence practices.

Known as the “Godfather of DFIR,” Rob coined the terms DFIR (digital forensics and incident response) and CTI (cyber threat intelligence), pioneered timeline analysis, and created the SIFT Workstation, the open-source forensic platform relied on globally in critical investigations. He has authored flagship SANS courses in forensics, threat hunting, and intelligence, co-developed GIAC certifications now used worldwide, and has trained more than 100,000 professionals. Rob continues to shape the field as a FISA Court Technical Advisor on emerging threats, as a featured voice in outlets including The Wall Street Journal, CNN, Forbes, Rolling Stone, Wired, and Security Magazine, and as a speaker at global conferences and policy forums.

Students Say

Slide 1 of 3
Extremely relevant! I feel as though Rob is truly invested in my success.
Stephen McVey Macy's
Slide 2 of 3
Rob is awesome! I really enjoy how he throws in some real-world encounters.
Ryan GabetCisco Systems Inc.
Slide 3 of 3
Incredibly technical content paired with Rob's fantastic delivery helps to make the learning quite easy and enjoyable.
John MunsonDell Technologies