INDEPENDENT BY DESIGN
Training AI defenders as fast as the attacks are changing.
Practitioner-built AI/ML security courseware informed by experience in defender training. First modules ship December 14, 2026.
Rob T. Lee / at a glance
- Name
- Rob T. Lee, creator of the SIFT Workstation
- Current roles
- Creator, sicurity.ai; Chief AI Officer, Dragos. sicurity.ai is independent of Dragos.
- Founded sicurity.ai
- Known for
- Coined DFIR; Created the SIFT Workstation; Co-created GCFA and GCFE; Named the DFIR Summit; Pioneered timeline analysis.
- Prior
- SANS Institute: former Chief AI Officer and Chief of Research; SANS Institute: Chief Curriculum Director and Head of Faculty, 2020 to 2024; built and led the DFIR curriculum; Mandiant; U.S. Air Force cyber operations and AFOSI.
FROM Rob T. Lee
Why I built this
Most of my career has been spent building training for defenders, and more than 100,000 professionals have been through it. At SANS I was the longest-serving contractor and employee combined. I built the DFIR curriculum, co-created the GCFA and GCFE certifications, and spent four years as Chief Curriculum Director and Head of Faculty, accountable for 65 courses.
My mission is to train as many AI/ML engineers as possible and help defenders keep pace with growing AI attacks. These skills are essential to protecting us.
sicurity.ai combines focused modules, hands-on practice, and regular updates as AI security evolves.
REAL PRACTITIONER. REAL ACCOUNTABILITY.
How the courseware gets built
The modules are written by practitioners doing this work right now, many of them people I've worked alongside through the [un]prompted community. Each module is developed specifically for sicurity.ai. Each author starts with one or two modules and ships roughly two a month after that, and the material is updated every month as the attacks change.
I've seen what happens when you put out the call and defenders show up. The Mythos CISO working sessions I ran with Gadi Evron reached 800 CISOs. The Find Evil! hackathon drew 3,400 entrants. (Neither of those happened because of me. They happened because people were waiting for someone to ask.) This is the same call, for courseware.
The goal is to help practitioners build and demonstrate AI/ML security skills. Course completion is not a GIAC certification. Any independent sicurity.ai credential remains proposed, and employer recognition is not established.
CREDENTIALS
Rob T. Lee
- Chief AI Officer, Dragos. sicurity.ai is independent of Dragos.
- Former Chief AI Officer and Chief of Research, SANS Institute
- Built and led the SANS DFIR curriculum; Chief Curriculum Director and Head of Faculty, 2020 to 2024
- Has trained more than 100,000 cybersecurity professionals
- Created the SIFT Workstation; coined the terms "DFIR" and "Cyber Threat Intelligence"
- Co-created the GIAC GCFA and GCFE certifications
- Helped author the first Mandiant M-Trends reports
- Former U.S. Air Force officer: cyber operations (founding member, 609th IWS) and AFOSI; later offensive cyber operations supporting CIA and NSA, then Mandiant
- Technical amicus to the Foreign Intelligence Surveillance Court
- Senior advisor, CSIS Commission on U.S. Cyber Force Generation
- Regional Judge, Presidential AI Challenge
- Instructor, "Become an AI Security Champion" on LinkedIn Learning
As seen in
CNN, The New York Times, The Wall Street Journal, Forbes, Wired, CBS News, NBC News, CNBC, Axios, Fast Company, Newsweek, The Hill, Rolling Stone
Independence
sicurity.ai is independent of Dragos, SANS Institute, and GIAC. None of them sponsor or endorse it.
THE NAME
sicurity.ai. Pronounced security.
The SI comes from Super Intelligence, the term adopted in Executive Order 14434 of September 29, 2026 for official executive-branch use. The interlocking SI symbol puts a human point of accountability inside a system that keeps changing. sicurity.ai is independent and is not endorsed or mandated by any government body.