Sounil Yu: "The bigger risk is not using LLMs at all"

Sounil Yu describes LLMs this way: "A highly competent individual, but with criminal, racist, and misogynistic tendencies."

I've heard hundreds of AI risk framings. This one is the most useful and the most uncomfortable I've encountered. (Which is exactly why it's useful.)

I am thrilled to have him back keynoting the 2026 SANS AI Cybersecurity Summit in DC. Sounil built the Cyber Defense Matrix because security teams needed a common language, and nobody had made one that was actually used. He built the DIE Triad because resilience needed reimagining from scratch.

His credentials include three decades of influential work, 20+ patents, a SANS Lifetime Achievement Award, and a Cyber Security Hall of Fame induction. He's spent his career identifying structural problems and building things to fix them.

He walked away from a role at Bank of America that most people would never leave. His reason: "The longer I stayed away from the heat of the battle, the more my ideas were becoming theoretical."

He co-founded Knostic and now builds knowledge segmentation for AI; need-to-know access boundaries for systems that are very good at inferring what you're trying to hide.

“The bigger risk is not using LLMs at all, since that's a surefire recipe for falling behind, whether against competitors or against attackers.”

“AI empowers both attackers and defenders, and we should expect both sides to leverage AI at the risk of falling behind. While attackers may initially get the upper hand, over the longer term, defenders will likely gain a greater advantage.”

This is someone who's watched defenders consistently underestimate what they can accomplish with these tools offensively.

One more thing: during the pandemic, he volunteered as CISO for Project N95 and helped move 42 million pieces of PPE to hospitals. (Just saying it directly because that detail matters.)

Sounil's last keynote clips hit hundreds of thousands of views. Don't miss this one.

We’re only 48 days out from the SANS AI Cybersecurity Summit in Arlington, VA, April 20-21. Will I see you there?

Rob T. Lee