The AI Attack Lifecycle: Digital Forensics and Intelligent Threats

AI cybersecurity threats are evolving faster than most organizations can respond. Attackers are using AI across the full attack lifecycle, from reconnaissance and social engineering to autonomous drones and swarm attacks, and the forensic methods used to investigate breaches haven't kept up.

In CXOTalk episode 910, Rob T. Lee, Chief AI Officer at the SANS Institute, the "Godfather of Digital Forensics and Incident Response," and a veteran of the NSA, CIA, and Mandiant, breaks down exactly how AI-powered cyberattacks work and what incident response must look like going forward. Our guest co-host, Dr. David A. Bray, Distinguished Fellow at the Stimson Center and expert witness before Congress on AI policy, brings the strategic perspective on what boards, CEOs, and CISOs need to act on now.

If you're a business or technology leader responsible for cybersecurity strategy, this conversation will change how you think about the threats already targeting your organization.

Topics Discussed in This Episode

How attackers use AI across the full cyberattack lifecycle, from reconnaissance to concealment.
Why traditional digital forensics and incident response methods are failing against AI-driven threats.
What shadow AI means for enterprise cybersecurity risk.
How autonomous systems and swarm attacks are changing the threat landscape.
What CEOs, CISOs, and board members need to understand about AI cybersecurity strategy.
How policymakers should approach AI regulation in the context of national security.

JOIN LIVE AND ASK QUESTIONS!

Friday, Feb. 27
10am PT / 1pm ET

ADD TO CALENDAR →

Watch LIVE on CXOTalk → Watch LIVE on LinkedIn →

EPISODE PARTICIPANTS

Rob T. Lee is Chief of Research and Chief AI Officer at SANS Institute, where he leads research, mentors faculty, and helps cybersecurity teams and executive leaders prepare for AI and emerging threats. Known as the “Godfather of DFIR,” Rob coined the terms DFIR (digital forensics and incident response) and CTI (cyber threat intelligence), and helped shape both fields.

Dr. David A. Bray is both a Distinguished Fellow and Chair of the Accelerator, Loomis Council at the non-partisan Henry L. Stimson Center. He is also a Distinguished Fellow with the Business Executives for National Security and a CEO and transformation leader for different “under the radar” tech and data ventures. He is Principal at LeadDoAdapt Ventures and has served in a variety of leadership roles in turbulent environments, including bioterrorism preparedness and response.

Michael Krigsman is a globally recognized analyst, strategic advisor, and industry commentator known for his deep business transformation, innovation, and leadership expertise. He has presented at industry events worldwide and written extensively on the reasons for IT failures. His work has been referenced in the media over 1,000 times and in more than 50 books and journal articles; his commentary on technology trends and business strategy reaches a global audience.

UPCOMING LIVE SCHEDULE

This schedule is subject to change. See www.cxotalk.com (bottom of page) for the latest updates and additions to our live programming schedule.

Feb 27: Rob T. Lee, Chief AI Officer (CAIO) and Chief of Research, SANS Institute, and David A. Bray, Ph.D., Distinguished Fellow and Head of the Accelerator, The Stimson Center

Mar 6: Dr. Tom Frieden, former Director, US Centers for Disease Control (CDC)

Mar 13: Bill Briggs, Principal | Chief Technology Officer, Deloitte

Apr 3: Marie Myers, Chief Financial Officer, HPE

Apr 10: Daniel Thilo Schroeder, Research Scientist, SINTEF, and Jonas R. Kunst, Professor, BI Norwegian Business School

Apr 24: Praveen Akkiraju, Managing Director, Insight Partners venture capital

May 1: Jon McNeill, Co-Founder, Partner, & CEO, DVx Ventures; former President, Tesla

May 8: Raffi Krikorian, Chief Technology Officer, Mozilla