John Doyle

Before joining Mandiant, John served as the team lead for a transnational cyber threats and technologies team at the Central Intelligence Agency (CIA) where he drove intelligence collection, curated analytic production, and examined paradigm shifts in the cyber threat landscape. John’s CIA experience included extensive tracking of intrusion activities from Russian, North Korean, Chinese, Iranian, and emergent cyber threats to include private sector offensive actors (PSAOs). His interests largely reside in tracking adversary operations, building and enriching intrusion clusters, and identifying shifts in adversary tradecraft to drive defensive cybersecurity actions for organizations.

During his time in government service, John regularly would provide surge support to large-scale cyber incidents like WannaCry, NotPetya, OlympicDestroyer, and other high-profile media reported cyber events. He has leveraged this background since moving to the private sector to support the Department of Homeland Security’s Joint Cyber Defense Collaborative initiative and industry specific ISACs.

John has previously developed and taught cybersecurity and cyber threat courses at Mandiant, in the U.S. government, and at George Mason University. John is the coauthor for the SANS FOR478: Cyber Threat Intelligence Foundations course and is a Certified Instructor for FOR578: Cyber Threat Intelligence course. John translates two decades of tracking state-sponsored tradecraft and high-profile adversary campaigns into practical, actionable tradecraft during classroom instruction.

Qualifications Summary

• John is the Director of CTI Services at Palo Alto Networks Unit 42 leading client-facing threat intelligence and dark web monitoring service lines.
• He has more than 20 years of experience in the cybersecurity field with the past 16 years working in CTI at the CIA, Mandiant/Google, and Palo Alto Networks.
• He has helped commercial and government clients develop, mature, and improve the capabilities and capacity of their CTI programs to improve business outcomes.
• He has an extensive background in tracking adversaries, building and enriching intrusion clusters, performing attribution, and spotting shifts in the cyber threat landscape.
• John is the coauthor for the SANS FOR478: Cyber Threat Intelligence Foundations course and is a Certified Instructor for FOR578: Cyber Threat Intelligence course.