Talk With an Expert

Rob Lee

FellowChief of Research and Head of Faculty at SANS Institute

Specialities

Digital Forensics and Incident Response

Connect with Rob

Rob Lee

About Rob Lee

Rob T. Lee is Chief of Research and Chief AI Officer at SANS Institute, where he leads research, mentors faculty, and helps cybersecurity teams and executive leaders prepare for AI and emerging threats. Known as the “Godfather of DFIR,” Rob coined the terms DFIR (digital forensics and incident response) and CTI (cyber threat intelligence), and helped shape both fields. He built several of SANS’s core courses in digital forensics and incident response, including the flagship threat hunting course, co-created GIAC certifications now used worldwide, developed the SIFT Workstation, the industry standard tool in forensic investigations, and led the development of the AI Cybersecurity Critical Security Controls, helping guide secure AI implementation across critical infrastructure and enterprise systems. A former U.S. Air Force officer and founding member of the first information warfare unit, Rob has led major investigations, advised congressional committees, and trained thousands across the FBI, the military, and Fortune 500 companies. He also serves as a US government FISA Court Technical Advisor on cybersecurity and emerging threats.