Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
“The Godfather of Digital Forensics,” Rob Lee, discusses vulnerability and exploit discovery in the age of AI and increasingly intelligent cyber threats.Rob is the Chief of Research and Head of Faculty at SANS Institute and runs his own consulting business specializing in information security, incident response, threat hunting, and digital forensics. Rob co-authored the book Know Your Enemy, 2nd Edition, and is course co-author of FOR500: Windows Forensic Analysis and FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics.Rob graduated from the U.S. Air Force Academy and served as a founding member of the 609th Information Warfare Squadron, the first U.S. military operational unit focused on information operations. Later, he was a member of the Air Force Office of Special Investigations (AFOSI) where he led a team conducting computer crime investigations, incident response, and computer forensics.
Listen to the episode
S4 E4 · The Offense Catch-up GameWE'RE IN! Podcast · 32 min
Key takeaways
AI levels the attacker playing field Lee warns that one or two hacktivists using AI could reach nation-state capability, without the attribution and escalation concerns that keep nation states from attacking power grids.
Competition is eroding model guardrails In his team's testing, guardrails present in one OpenAI model were missing in the next release, and they could still generate spear phishing emails. He attributes this to labs rushing models to market.
AI-assisted intrusions are here now Lee says the evidence is mostly anecdotal, but OpenAI and Google have both reported removing nation-state actors from their AI platforms, and intrusion velocity suggests outside help.
Executives need hands-on AI experience He compares building an AI strategy without using the tools to planning for the internet in 1998 without ever opening a web browser or sending email.
Forensic artifacts reveal human habits Windows artifacts show not just what was run but how, such as taskbar versus menu, typed URL versus bookmark, which helps tell the real user from an intruder.
Notable quotes
What we're going to be able to see with AI is the ability for a hacktivist to leverage the same capabilities as a nation state…
So it's kind of fascinating that the real risk is competitiveness and moving fast.
…you're making business strategies based off technologies you don't understand.
And so you're gonna be always playing this catch up game with offense, and that's traditionally always been the case.
Questions this episode answers
Why is Rob T. Lee called the godfather of digital forensics?
Robert M. Lee called him that while presenting on his impact at a SANS digital forensics and incident response summit, and the name stuck. Lee says he resisted using it until his PR team insisted. Read this section
Are attackers already using agentic AI in real breaches?
Lee says it is happening now, though direct evidence is limited. He points to OpenAI banning nation-state accounts and Google reporting adversary use of Gemini, and says defenders are playing catch-up with the speed of offense. Read this section
Is AI more like the move to the cloud or the arrival of the internet?
Lee says the cloud was a transparent layer most people never notice, while AI will touch every part of daily life. He sees the internet, or even the invention of writing, as the closer comparison. Read this section
Do you need a technical background to take SANS FOR500?
No. Lee designed the course with law enforcement in mind, and everything is guided, though students learn where Windows artifacts live and what they mean instead of only running tools. Read this section
Who does Rob T. Lee look up to in cybersecurity?
He names Cliff Stoll, an early incident response investigator, and futurist Alvin Toffler, author of Future Shock and The Third Wave, whose idea of learning, unlearning, and relearning he shares. Read this section
Where What the heck is a PTaaS? There's a lot of confusion around penetration testing as a service or PTaaS. Let's start with what it's not. PTaaS is not just a new name for traditional pen testing with its clunky dot PDF reports. PTaaS offers more. It's a modern approach to pentesting that continuously clears up vulnerabilities. Synack's PTaaS platform is powered by hundreds of global security researchers ready to test your most critical assets for software flaws. Learn more about how PTaaS is helping defenders keep up with AI enabled threats at synack.com. That's synack.com.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and joining me today is none other than Rob T. Lee, chief of research at the SANS Institute. Rob, thanks so much for joining the podcast.
The other Robert Lee, Robert M. Lee, there was a digital forensics sensor response summit. They were kind of presenting a, you know, my impact on digital forensics. They had Robert M. Lee go up there and says, you know, Rob is the godfather of digital forensics. And everyone was like, that's perfect. It was during that that it came around and stuck. Thankfully, I did not self moniker because I think that's just weird when people do that. But just like call signs from the Air Force, which I'm wearing right here is that you're given your call sign, you're not able to veto it is what it comes down to.
to use it? I am a very... Like, it's everyone else. I like helping out folks in the mission. It's one of the reasons I've always enjoyed teaching is that you're arming people for the front lines of what they're going to experience. And if I'm able to help them do that, that's great. Not in it to be a hood ornament or do this for ego. I actually kinda like being behind the scenes. People remember, hey. I'm where you're at because I took your class. And I'm like, oh, great. So you're writing books and all this stuff, and I was able to get you started. I'm more of I don't like the spotlight. I was vetoing it for a long time, but then someone else said, mostly my PR team, said, nope. You gotta use it. And I'm like, alright.
Well, and I feel like if it's coming from Rob M. Lee as well, also a friend of the podcast incidentally, you know, that that also cements it even even more there. Yeah. You've worked at the SANS Institute for many years in a variety of roles. It's obviously an organization that's just been central to your career. Many WE'RE IN listeners are no doubt familiar with SANS and its resources, certs, and and courses. But for those that aren't in the know or are new to the SANS Institute, how would you bring them up to speed, and and and how can you describe your roles there?
Probably end up getting pulled into SANS is they identify a practitioner in the field and say, hey. You know, would you give a talk based off of what you're discovering? And that's really how I started. And for nearly twenty years, I'm a contractor practitioner in the field doing cybersecurity, starting businesses, working with Mandiant, ManTech, Air Force. They basically have someone to teach, but then go back and fight the battle. And we still have that. Four years ago, they asked me to come on board as one of their executives because they need more content people to be a part of their executive team. So I decided to join full time at that point. So officially, I've only been an employee for four years. But the impact what SANS has overall is why I'm there. Alan Paller, our founder, really live by the moniker that we're the most trusted cybersecurity capability for both training certifications knowledge.
And it's that last piece knowledge that it really drives me. It's like the other piece that are... Honestly, they're products of ours and we sell them. But in reality, like SANS creates a lot of assets, resources, and capabilities for the community for free. We have a lot of, you know, resources that, you know, dedicated to training the workforce. And it's that mission impact because being formed a military, the battles that are being fought by our country and the adversaries are not on a military frontline. They're on corporate financial systems, medical systems, obviously, water, you know, the critical infrastructure systems. But you attack any one of these and you able to get people to, like, worry about their retirement in four zero one k and be able to withdraw from it. And I tell people and military commanders this all the time, even if these folks leave the military, they're leaving to go to the front lines. Front lines are not, you know, defending air force bases from cyber attack.
Now let's talk a little bit about your military service. You've got the air force shirt on. You've got... And you were a founding officer at the six zero ninth information warfare squadron. Really designated as my understanding the first warfare division of its kind in US history. How has that military background shaped your approach to cyber and and and digital forensics throughout your career?
Greatly. Both my father and my grandfather were career were career in the US Air Force. And little bit of an interesting fact, my grandfather was the first deputy director of the NSA. So we have this long history of service. So I went to the Air Force Academy. I have this massive mission drive to help people to drive businesses to the right area. Right now, call it my massive transformative purpose is helping businesses align to AI business transformation in a secure way. And we'll talk about that in a little bit, but the more I'm able to do that, the more I truly believe that not only are defending these systems from adversarial attacks, but helping these businesses weather the AI transformation that's ongoing. You don't have businesses go out of business, that you're able to maintain structure and maintain what you're doing, have a way to do that, that's secure and risk averse.
Of course. And you kind of alluded to this in earlier comments, the almost fluidity between military service or institutes like SANS that are trying to tap into the frontline practitioners who really know their stuff, not only talk the talk, but have walked the walk, and organizations that you worked at, like Mandiant. And my understanding, you've been involved in creating the M-Trends APT report. Some of these private sector cybersecurity firms, they've almost grown to behave like their own intelligence apparatus. And I mean that in a good way in the sense of producing quality research that's used not only by industry, but frankly, informed indictments and things of that nature and is pretty intense. What are you watching out for next when it comes to APT activity?
First of all, you're you're spot on because the front lines are actually civilian infrastructure, whether it's a pharmaceutical industry or whether it's financial firm, Dow Chemicals, anything. We need taking a look at that. Of course, when we're able to look at these reports, and I remember sitting back in Mandiant, We were coming out with our first APT report, and everyone was like afraid in the community. I said, you can't name China. That is all classified information. I'm like, well, we're staring at it. And, you know, when we're doing these instant response engagements, and so we felt, exposing it more and more was part of our duty. Even the term APT, it's gestation, where did it really come from? So the nation state adversaries, I've been investigating them ever since 1998 when... If you go Google this, it's kind of an interesting fun fact. Moonlight Maze was one of
first official Russian based attacks against US laboratories, you know, to gain information. That led to the formation of JTF CMD, Joint Task Force Computer Network Defense, and later became Cyber Command. Being a part of those investigations, been fighting nation state adversaries all along has been fascinating. Where things are kind of trending now is nation state capabilities required hundreds of people to potentially do the development of the tools, operations, and more. I get a little bit sideways here because before you ended up having the most advanced folks in the nation state adversaries, but it also was a reverse sparing. You also employed the massive amount of funds to accomplish that. Organized crime one level down, activists. What we're going to be able to see with AI is the ability for a hacktivist to leverage the same capabilities as a nation state, which gets interesting quick because if you have a single group out there, one or two individuals that say, Hey, we want to knock out a power grid.
It is theoretically possible with AI based capabilities that they're going to be able to leverage the same type of power as a nation state more quickly than they were before. It's a leveling... AI is a leveling aspect against the different groups out there that are using... Attacking infrastructure. And so that's a concern of mine because before nation state actors will obviously not take care of parallel grid because of potential attribution and that likelihood of it crossing over to a kinetic combat. You know, obviously, bullets flying, you know, saying you disrupt,
Yeah. Now you're gonna potentially have, you know, one or two people that could affect, you know, the same type of destruction, the same, like, group with the dirty bomb. You know, these kind of things hasn't happened, obviously, but I keep on raising the flag a little bit that AI is a great leveler, that's going to occur in our... At least the adversary groups that we're looking at.
That's so interesting. And you hear the AI companies, you know, Anthropic, of course, comes to mind trying to do some work on AI safety, crafting models in such a way that they can't be abused to help create a recipe for a dirty bomb, or they can't be used to say, hey. Find all the low hanging fruit vulnerabilities in this power grid system and give us a a foothold in the ICS or the industrial control system, what have you. It sounds like you're skeptical that those safeguards might keep out the attackers.
Well, talking about two different things, AI enabling capabilities, meaning you can move faster with greater velocity. So if you have a single individual wanna code up a butt... A swarm... Think of it like drones. I can see these swarms of drones, like attack a ship or something. It's very similar where you have a single individual that can swarm a target with multiple different agents. What you just referenced there is the ability to establish guardrails and restrictions in the different models. So someone can't write malicious code, they can't write spear phishing emails, they can't look up, how do I create a bomb? Now having said that, the competitiveness in the different groups, Anthropic, OpenAI, DeepSeek, and the others, when you end up taking a look at how competitive it is for them to release models, it is fascinating to see that even the difference between GPT-four point and 4.1, we've been able to test both models and the guardrails that were on 4.0 didn't exist in 4.1.
And it's not like they're trying to take them out. It's just they're rushing things to the market as quick as possible, remain competitive, and they're not putting in testing the guardrails to be able to make sure that people can't do weird things. But we're able to create spear phishing emails even using terms of be as evil as possible, evil this, evil that, and it still... It was creating the emails. So it's kind of fascinating that the real risk is competitiveness and moving fast. We're trying to slow them down and be able to say, do we have the security safeguards in place? Both of these things end up being cross dynamic and creating friction when you're trying to basically satisfy investors. And it's again, that's where we see people fail is adopting the proper security culture when you're being driven to innovation and revenue.
I do want to flip back to some of your SANS work soon, but this AI conversation is just too fascinating. And honestly, at my organization, we talk a lot about the potential for adversaries to start leveraging agentic AI. That's something that we've started to see possibilities with some of these agents that they're powerful enough to exploit certain low hanging fruit type vulner vulnerabilities. Right? Like, if something's a pretty obvious cross site scripting or something's a pretty obvious, you know, iDOR or whatever it is that is not gonna be three zero one level, needs a human in the loop really looking under the hood at that some zero day or whatever. But that said, well, the writing might be on the wall there, and I think it's kind of accepted that these agentic threats, I mean, certainly would enable the bad actors you're referring to to scale way more than they ever had the chance to. But have you really seen evidence of these sorts of breaches playing out, like, in the wild? Is this is this a here now kind of thing, or is it more like a year or two on the horizon?
some We more have direct evidence of it. Anecdotally, yes. Even Google's come out and said the velocity of intrusions has increased so fast that it's not possible to get these gains without some help. It's all of sudden seeing a friend, all of sudden just like being muscled out and you're like, okay, I know that's not a natural growth. Are you taking HCH or something like that? That's essentially what we're seeing. Do we actually have videotape and monitoring of them using this? So recently, OpenAI released a report actually was kind of a notification that they've, you know, recently booted a bunch of foreign actors from their systems. Primarily using chat GPT and others that they had accounts and they were able to detect somehow that there was being done. So this kind of the digital forensics of the future, which is be able to tell that this is a bad actor.
They're employed by nation state and so forth. OpenAI, you know, real big hat to them for not only finding them, acknowledging it and saying get off our systems and banning those accounts. It's not gonna stop the nation state adversaries. It's pretty easy to replicate accounts. But I think they're signaling very much so that we could see what you're doing. But that is, you know, that's hard proof that even Google said they were able to take adversaries, you know, using Gemini. So are we leaning into more agentic? Yes. How fast? I have to assume a lot of the stuff... Because of what I used to work for on the offensive side in the US government that so many of those aspects of it are really closely guarded capabilities. And how fast and how vicious that groups like Salt Typhoon and Volt Typhoon are able to penetrate both telecommunications and critical infrastructure networks and to stay there and not be able to be fully remediated is a drastic concern.
Now they're starting to leverage AI to assist there? Undoubtedly. Are they fully coding agentic, obviously reasoning, drone type capabilities inside a network? No one's detected it yet, but again, the velocity may be so fast that, you know, we don't have the defenses that are able to match velocity. So it's it's kinda like a supersonic missile and we just like, okay. Our interceptors are used to, you know, catching something a lot less, you know, fast than that. And so you're gonna be always playing this catch up game with offense, and that's traditionally always been the case.
Well, I imagine it's really hard to go reverse engineer these and say for sure something was an AI enabled adversarial threat. Right? I'm in the content business. Right? I I do a lot of communications work. I'll use AI to help write something or sharpen an email. And I don't expect the receiving end person on the other end to know that I used AI for that. They might make some assumptions. But I I... Are there similar challenges playing out where attributing something to an AI agent is technically just not feasible?
It's possible. The greatest thing that we're seeing right now is used by organized crime and scams using deepfakes. And again, they might be... And we've seen this on more of the celebrity stuff they might see on social media or something sent to you is like, hey, I'm Elon Musk. And I have the greatest deal ever. You invested this Bitcoin thing. And is what I advise, only have like ten days to get in the initial round or whatnot. Then they'll send a takedown order and all of sudden 10 different variants now pop up. So this chasing be illegal is becoming more problematic. Just using deep fake technology, what it exists today is fairly convincing, and organized crime is definitely utilizing those type of technologies. So when you talk about AI, it's not just agentic, it's all these technologies. And you can save from scams all the way down to political influence operations.
I feel like with somebody with your background and and varied career, I mean, you mentioned earlier Moonlight Maze. You're probably familiar with eligible receiver in some of these early exercises and whatnot. You've witnessed several technological transformations. I feel like sometimes new changes like the AI and generative AI era can be helpfully put into context by previous shifts. Right? One that comes to mind for me, and I'd be curious to hear your thoughts, is shift to the cloud. How has that impacted the field of digital forensics, particularly for for Windows environments?
Yeah. I guess we could start with a comparison between AI and cloud. I feel like, you know, I've seen some analysis that, like, back in 2011, people were sick of seeing cloud everywhere as a buzzword. Right? And now it's like people are sick of seeing AI everywhere as a buzzword. And now... Guess what? We're still operating in the cloud. That hasn't gone anywhere. I expect ten years from now, we'll still have AI to some extent. But, you know, what what analogs are there from past? And maybe not even cloud if there are other examples that spring to mind that can help put into context what AI is doing to this industry.
Well, I mean, first of all, cloud is a transparent layer. Like, no one... Like, your sister, brother, you know, partner, parents, kids, they really don't know if something's in the cloud or not. They don't really care. And in fact, it's not like, here, there's cloud thing that's in the cloud, you have to deal with it. However, a good analogy is this thing. And you end up taking a look at their phones, like everyone has a phone now. AI is very similar to a technology that is going to permeate into every aspect of everyone's lives. It'll be very clear. Unlike Cloud, it's a tech stack that basically move things from data centers and co locations where you work into a data center, which is again tied to software as a service in the Cloud, Exchange Online, O365 and whatnot, you it to Cloud segments. But the key here is really looking at the implications of what this technology is.
And the way I view it, and again, I don't even think it's an extreme view, is that the Internet when people are predicting what this is gonna be in, early nineties, like AT and T had these massive really cool commercials called the You Will commercials. Go Google that. It's just eye opening. No one knew what email was. No one knew what web browsing was, and they're talking about flat screen TVs to be able to watch movies at any time. And you're like, oh, you know, that still took fifteen years to really come to fruition, but they predicted it. The Internet is probably the closest analogy. You and I and others will remember life before, life after Internet. And, you know
To listeners. It's that kind of thing where human executives, I tell them today, I said, listen, you're making business strategies based off technologies you don't understand. And I put it in context for them. It's like you're sitting back in 1998 trying to make a business strategy for the Internet, and you never use a web browser and email. Now I'm not saying you need to be an expert in this, but you need to start touching the fundamental technologies for what it means. Taking a step further, I believe AI is such a significant change in, you know, human condition that... And it's so rapid and onset that for most individuals, it is going to a, going to be overwhelming, but b, it is likely as significant as the human race being able to write. That is massive technological change from being able to record history and be able to write things down, whereas AI is gonna have that significant impact.
In fact, I'm gonna go as far as saying in twenty years, you're not gonna remember who's the president of The United States. In fact, you'll probably have to think about it. What you will remember though is this is when AI happened. This is the before and after. And you'll remember maybe four times, after times, and, you know, your kids' kids will... Like my kids today, 13, they will be part of that before and after because that's the same age I was. They will remember, how did you do that before AI? I'm like, I don't know. What did they teach you in school? It's going to be completely different. They're going to say, I was in the classroom and I had these teachers, and their kids are going look at them like they're nuts. Very similarly, another analogy is this, is everybody gonna put out of jobs? No. There's gonna be brand new jobs. It's basically are using... Utilizing AI. But like if you told your parents, like, I hire someone to meet me at the gym, and they tell me to lift heavy things, and they're gonna count for me while I lift these heavy things.
And they're called personal trainers. And they're like, you pay someone to do this job? I mean, you could see this disconnect that would occur if we told someone what a future job is going to do. And they're gonna be, I don't understand why I... Why would you pay someone to do that? These jobs don't exist yet, but they will exist. And I get excited about it because I'm more on the, you know, very positive outlook on the way AI is going to change everything and for the better. I just think everyone's jobs will just change, and you'll be doing something else. That's gonna be exciting.
Well, I guess we'll have to check back and invite you back on for season 24 of of WE'RE IN and and see how it all plays out. But, no, I I agree. I think personally, I fall into the more excited camp as well. I wanna talk about forensics 500 for a minute because it's it's such a mainstay for anybody wanting to to enter the field. How would you recommend somebody just starting out prepare for a course like that?
When I was initially designing the course, we knew a lot of law enforcement would be taking this course. And so in that mindset, do you have to have a deep technical background? The answer is no. I always tell people, I said, listen, if you come to the class, everything is guided. As long as you don't reject a mouse and a keyboard, it's gonna teach you skills. So do you have to have like a computer science degree? I'm like, no. I'm trying to train law enforcement to potentially put bad guys away. And most of them don't have computer science degrees. If we set the class at that tone, but we also don't want to have the auto forensics here run these tools against it and boom, here's a report. You need to understand the basics enough on the Windows system to be able to say, here's where these artifacts are. And in my opinion, they're no different than DNA fingerprints, gun residue. These are the things that most law enforcement are trained.
But again, very scientific. If someone's saying, hey, that's DNA. Do you understand what that means? You have to understand the core of it. What it can mean for your case? How are you going be able to use this in court? What are you asking the lab folks to potentially go back and do? But when you're in a crime scene, it's one of the reasons like no one touched anything because you're aware DNA exists. It doesn't mean you have to be a genome using a CRISPR technology to be able understand how this fits together. I tell folks, as long as you're able to identify DNA, gun residue, fingerprints, you know, hair follicles, you know, what does that all show you? You could do digital forensics because you just change the name of things, and it's exactly the same.
What are some of those analogies? Because I love that analogy. I think that's really helpful to kind of imagine what what is meant by this field. Like, what are some of the equivalents... The digital equivalents of fingernails, hair follicles, and whatnot?
So on a Windows system... And it's great you you asked that. I categorize things by evidence of categories. You know? For example, you go through, can you tell someone executed a program and specifically how they executed that program? So if you're executing things from your taskbar or it's on your desktop, if you're launching a menu, we're able to detect that. You get into human habits myself and Heather Barnhart have consulted with the FBI's behavioral analytical unit. That's the criminal minds on the TV show. And they're very interested in finding out, can you tell human habits from these forensic artifacts? I'm like, yes, because you could see... For example, you have a very habitual way of what you do things in the morning when you get on your system, which websites you go to. All of these things add up to... We could watch if you're opening up files, which websites you're going to, how you're executing things.
Do you type it in? Are you clicking on a bookmark? All of these things, I'm able to tell the human behind it, not just that someone did it, how they got to it. And because of that very rigorous path, very similar to what you have on your hands, you have a very habitual way of approaching technology. Do you save everything to your downloads folder, or do you put them in a specific folder? All of these things, I could see what you downloaded, what you opened, how you opened it, how you executed things, which programs you used. How do we know it's you versus Wendy, you know, who was on your computer system? It's because the next one that's gonna come up is like, prove it to me it's not AI. The AI is gonna have to monitor exactly the way you do things on a daily basis and replicate that for it to be AI. But having someone else sit down at your keyboard and start doing things, it is such a different fingerprint that's on the system and the way you do things, your very clear habits, that it's nearly impossible to have someone argue that it, you know, it's the same person unless they've watched you specifically and do all these things.
If you see me with inbox zero, you know it's an impostor. Alright? You know? Exactly. Exactly. No. That's that's really interesting. And it's a good point that these digital habits that we might not even consciously think of, but that we're leaving everywhere like breadcrumbs that a forensic investigator such as yourself could swing in and piece together. Hey. Wait a minute. No. This account was hijacked because they're they're doing something very different all of a sudden Yeah. That doesn't track with your, you know, your morning Washington Post and New York Times reading or what what have you. Right? I would be curious, who do you look up to in cyber, and and who would you most like to rope into teaching a SANS course?
Oh, that's a great question. I have a huge fanboy feeling toward Cliff Stoll. Like, I've seen him present. I've met him multiple times, and he is just, you know, telling the story of, you know, the initial and some response investigations that he was a part of. And it's worth, you know, a lot of people are like, who the hell is he? So you go back in history, he's like one of the first, you know, did it. But now he has this very fascinating, almost Doc Brown from back to the future style to him, in which it's still engaging. He still insists on using... What was the old, like, you know, projector with, you know, like written slides for your presentations?
Yep. It's losing, but it's that. He was was like, I'm not using PowerPoint. I'm using... Know, it's kind of like, you know, forcing function because he has this, you know, discussion down and everything. But Cliff Stoll is one of these individuals that is just having a drink and a, you know, a beer with him, and you could sit there for, like, five, six hours and not get tired. It's individuals like that pioneers. Like, another one is a big... And, of course, the individual passed away now is Alvin Toffler. And not many people know who he is, but he was in the 70 or early seventies, 1970, in fact, published a paper on the future of computing and AI in society and ended up writing two books, Future Shock and The Third Wave. And in Future Shock, he is the one who kinda coined information overload and things like techno, which the entire music industry, you know, like bought into.
It's like, that's what we're gonna call this. He was so future thinking that, you know, a lot of his predictions came true. It's a fascinating book to read now in 2025 when you go back and look what he wrote in 1970. Just sitting down with someone who is just so prescient and able to look at things pragmatically and saying what the impact is on humans. What's going to occur, not just from, hey, I predict in the future, you know, people will be watching plastic and TVs, but more of like the social impact of what the changes, you know, will be to the average individual. And he was also diving into AI a lot too. And one of his key phrases, and I love this about him, is really talking about human beings in this fifty year period here, from when he wrote that till now, is those who can learn, unlearn, and relearn as this cycle that we kind of as a society kind of think, you go to grade school, go to high school, go through college, and you're you're now learn...
You know, done. That the idea of, like, perpetual learning is... Needs to be, you know, kind of the set. You know, that's one of the reasons SANS Institute and others exist is, like, you're never done. Learn and learn and learn. Learn and learn and learn. It's just this cycle you're gonna be going through again and again and again until you pass away. And, again, that's something I wanna teach my kids is like, hey. School's never done. You're always in school. It just changes, you know, how you potentially perceive it.
Well, and I I... That's especially apt, of course, for the cybersecurity industry as tech stacks evolve. People are constantly layering on new software, new things that we haven't even thought of yet. AI agents, you know, we spent a lot of the podcast talking about. There's never a dull moment. That's for sure. And it's great that institutes, of course, like SANS exist to help guide. And to hear to hear more, definitely check out, Rob Tee Lee's courses at SANS. Quite famous, I I should add. We are talking to the to the godfather here, so, had to bring that up one more time.
I know. I know. Well, before you do, I do have one question that we ask all of our guests in the podcast, which is what's something that we wouldn't know about you, Rob, just by looking at your LinkedIn profile?
It goes back to my kids. Like, I have a 13 year old boy and girl twins. And, you know, just how much I love being a father. And it's it's tough because you sit there and you're like doing all this nerd stuff all the time and you wanna expose them to it, but you're also 13 years old. You just don't pick up on, you know, someone's mentality when it comes to, you know, the family side and what you like to do with your kids and what you expose them to and what's like a day in the life for you. I mean, kind of a hint behind the stuff I'm into, but that's like tertiary compared to trying to be the best person you can, both in your day job and what your principles are and so forth. But none of that stuff comes across in your profile. I always tell coworkers, it's like we run around each other all the time and run Zooms, all we do is focus on the Zooms. No one knows what each other's spouses are and their kids' names in many cases.
I think we've gotten away from that a little bit society wise because of remote work and whatnot. Think it's important for people to know who their family is, the kids, and so forth. It's hard because it's really... You have to get in someone's mind. But I think from an aspect of people just glance at it, they won't know I'm a dad of twins. That's kind of the key.
That's that's really special. And as as a father of of one, a 20 old, I I can certainly respect raising twins. I I... That's impressive. Honestly, you probably should list that on your LinkedIn because that is one heck of a skill is, dad to twins, and, I'm sure they appreciate that
as well. Go back into the massive long, you know, like father of twins, you know, like, the twins, you know, like, breaker of genes and everything else.
There you go. I should have intro'd you, right right at the answer Well, with thank you so much for for joining me on the podcast, Rob. Really appreciate your perspectives and and really fascinating discussion.
No. It's great. The the work you guys do on these podcasts is very important because I do believe that this is one of the key reasons how people learn is by having these discussions and getting them to think. Really happy to you for doing these and because it's a lot of work. You don't know on the front side of it because it looks like it's all polished. But, you know, everyone in your team and what you're trying to do here, it takes a lot of work to get these out. So hat tip to you guys.
