AI Security & Incident Response · Security R&D @ Prophet Security · SANS Certified Instructor (LDR553)
I've spent 14+ years in incident response, digital forensics, and security operations, from leading large breach investigations to building SOC capabilities. Today I work in Security R&D at Prophet Security on AI-driven SOC automation. That includes securing and monitoring LLM and agentic applications in production.
I teach incident command for SANS (LDR553: Cyber Incident Management), write SANS research on AI and security operations, and speak at conferences around the world.
- AI Threat Defense: prompt injection, agent and tool abuse, and monitoring of LLM and agentic systems
- AI-Augmented SecOps: using AI to accelerate detection, triage, and response
- Incident Management: incident command, coordination, and communications for enterprise incidents
- DFIR & Threat Hunting: host and network forensics, and detection engineering
- SANS Critical AI Security Guidelines: SANS community project for securing AI deployments (repo)
- 2026 SANS AI Survey Insights: white paper on AI as both a security tool and an attack surface (Jul 2026)
- AI-Powered Incident Response That Actually Works: FIRST Regional Symposium LATAM & Caribbean (Oct 2025)
SANS LDR553: Cyber Incident Management (GIAC Cyber Incident Leader)
| Event | Location | Course start |
|---|---|---|
| SANS Cyber Defense Initiative 2026 | Washington + Virtual | Dec 14, 2026 |
| SANS Las Vegas 2027 | Las Vegas + Virtual | Feb 22, 2027 |
| SANS Amsterdam May 2027 | Amsterdam | May 10, 2027 |
Live schedule: SANS instructor profile
Also taught: Advanced Security Operations & Threat Hunting (Black Hat) · SANS FOR508 · SANS FOR572
| Date | Talk |
|---|---|
| Nov 9, 2026 | How Predictive AI Is Rewriting the Attacker Timeline (with Paul Miller) |
| Nov 19, 2026 | Fall Cyber Solutions Fest 2026: AI Track |
| Nov 20, 2026 | The Agents You Didn't Know You Had: Shadow AI and the AI Supply Chain (with Sounil Yu) |
| Dec 4, 2026 | Microsegmentation Buyer's Guide: How to Evaluate Solutions for Zero Trust and Hybrid Cloud |
| Dec 10, 2026 | Beyond the Weakest Link: New Research on Defending the Human Edge in the Age of AI |
| Dec 10, 2026 | Beyond Human Identity: Securing the Agentic Workforce with Zero Trust |
| May 26, 2027 | 2027 SANS Cyber Resilience Survey Insights: Measuring the Gap Between Recovery Confidence and Recovery Reality |
SANS white papers
- AI + Network Control: Visibility, Risk Prioritization, and Automation in the Age of Agentic NetOps (Jul 2026)
- 2026 SANS AI Survey Insights: Poisoned Wells and Pure Springs: Drawing Security and Compromise from the same AI Source (Jul 2026)
- Risk-Adaptive Data Loss Prevention: Behavioral Intelligence with DLP (Jun 2026)
- In-Depth Endpoint Forensics and Response at Scale (Apr 2026)
- When Trusted Senders Become Threats: Stopping BEC and Supply Chain Attacks with Self-Learning AI (Apr 2026)
Recent talks
- AI + Network Control: Visibility, Risk Prioritization, and Automation in the Age of Agentic NetOps (with Avishai Wool) (Oct 2026)
- SANS 2026 Government Security Forum (Jul 2026)
- Risk-Adaptive DLP Strategy Guide (with Rajan Koo) (May 2026)
- Enterprise DFIR at Scale: From Investigation to Response (with Eric Hutnyk) (Apr 2026)
- When Trusted Senders Become Threats: Stopping BEC and Supply Chain Attacks with Self‑Learning AI (with Carlos Gonzalez Gray) (Apr 2026)
The full list of papers and webcasts is on my SANS profile.
I'm a weekly guest and regular co-host on The Cybersecurity Defenders Podcast, LimaCharlie's weekly show about cybersecurity and the people who keep the internet safe.
Latest Intel Chat episodes (refreshed weekly)