Top Instructors Share Their Expertise ONLINE at SANS - Special Offers Available NOW!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

2020 SANS Cyber Threat Intelligence (CTI) Survey Panel Discussion

  • Thursday, February 13, 2020 at 1:00 PM EST (2020-02-13 18:00:00 UTC)
  • Robert M. Lee, Kyle Ehmke, Nicholas Hayden, Ryan Weaver


  • Anomali
  • DomainTools
  • ThreatConnect

You can now attend the webcast using your mobile device!



This webcast takes a deeper dive into the results of the SANS 2020 CTI Survey. SANS instructor and CTI specialist Robert M. Lee will moderate a panel that includes representatives from Anomali, DomainTools, and ThreatConnect as they explore major themes developed during the survey.

Register today to be among the first to receive the associated whitepaper written by SANS instructor and CTI expert Robert M. Lee.

Click here to register for the survey results webcast on Tuesday, February 11, 2020, at 1 PM Eastern. For this webcast, Robert M. Lee will provide analysis of survey results and share best practices in use across respondents' organizations.

Speaker Bios

Robert M. Lee

Robert M. Lee, a SANS certified instructor and author of ICS515 ICS Active Defense and Incident Response and FOR578 Cyber Threat Intelligence courses, is the founder and CEO of Dragos, a critical infrastructure cyber security company, where he focuses on control system traffic analysis, incident response and threat intelligence research. He has performed defense, intelligence and attack missions in various government organizations, including the establishment of a first-of-its-kind ICS/SCADA cyber threat intelligence and intrusion analysis mission. Author of SCADA and Me and a nonresident National Cyber Security Fellow at New America, focusing on critical infrastructure cyber security policy issues, Robert was named EnergySec’s 2015 Energy Sector Security Professional of the Year.

Kyle Ehmke

Kyle Ehmke is a senior threat intelligence researcher with ThreatConnect and has 10 years of experience as a cyber intelligence analyst. Kyle focuses on infrastructure hunting and is involved with ThreatConnect’s research into Russian election activity and targeted efforts against Bellingcat, WADA and others.

Nicholas Hayden

Nicholas Hayden is currently the Senior Director of Threat Intelligence for Anomali. For the past 20-plus years, Nicholas has dedicated his learning and commitment in the field of InfoSec and cybersecurity. A co-founder for ISC2 New Hampshire Chapter, and a leader in the USAF's cyber defense capabilities, he has participated in several national exercises in a variety of roles: lead planner, blue team member and blue team lead. Additionally, he continues to make an impact at the national level, by being a member of OASIS STIX/TAXII committee, and participating with the drafting of NERC CIPv5.

Ryan Weaver

Ryan Weaver, Lead Senior Security Researcher at DomainTools, is a security researcher with a background in incident response and security architecture. His goals are to help the security community, uncover and develop new attack and defense techniques, and make the internet just a little bit better every day.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.