The computers Robert M. Lee worries about rarely sit on desks. They open circuit breakers, regulate pipeline pressure, purify water and keep assembly lines in rhythm. They are often old, specialized and expected to run for years without drama. When they fail, the problem escapes the screen. A darkened city or a stopped plant is an error message written at human scale.
Lee found this world before it had become a tidy market category. As a U.S. Air Force cyber warfare operations officer assigned to the National Security Agency, he helped establish a mission focused on state actors targeting industrial infrastructure. The work demanded two languages at once: the language of adversaries moving through computer networks, and the language of engineers responsible for equipment that moves, heats, cools and occasionally explodes.
That bilingual habit became his career. He investigated. He taught. He wrote. Then he co-founded Dragos, named for a ship in a childhood tale told by co-founder Jon Lavender’s grandfather. The company’s name has the romance of a voyage; its daily work concerns rather less romantic matters such as asset inventories, network traffic, malware behavior and response plans. Romance is lovely. An accurate inventory is useful at three in the morning.
One mission, four forms
01 / The inheritancePlanes first, computers later
Lee grew up with the Air Force close at hand. Both parents served as enlisted members for 25 years. His earliest memories, he has said, were of aircraft and wanting to be like his father. His father tried to steer him elsewhere - perhaps law, perhaps anything outside the military - but Lee went to the U.S. Air Force Academy and accepted a commission.
The origin story contains a useful correction to the stock image of the precocious hacker. Lee liked games and called himself a computer junkie, but computers did not become an obsession until the academy exposed him to industrial control systems. These were not isolated boxes inviting clever tricks. They were systems of systems, built across decades, with physical processes and human operators inside the loop. The puzzle had consequences. That made it interesting.
At the NSA, the young officer was given room to build a first-of-its-kind effort around threats to operational technology, or OT. The label covers the hardware and software that interact with physical processes. If information technology runs the office, OT runs much of what makes the office habitable: power, water, transport, climate and production. Protecting it requires respect for safety and uptime. The finest security control in the world is a poor bargain if installing it stops the plant.
“I would love to make it impossible to kill people through cyber industrial environments.”Robert M. Lee
02 / The teacher-builderGive the problem a language
The market Lee entered suffered from an awkward shortage: there were experienced practitioners, but too little shared vocabulary and too few routes for newcomers. He began turning field experience into instruction. At the SANS Institute he created ICS515, a course on visibility, detection and response; became lead author of FOR578 on cyber threat intelligence; and later co-authored ICS310 on industrial cybersecurity foundations.
Teaching is not a decorative side project here. It is part of the operating model. A classroom forces a practitioner to turn instinct into method. Students expose weak explanations. Real incidents upset neat diagrams. Then the refined lesson returns to the field. Lee’s preferred refrain, “ICS defense is doable,” compresses that cycle into four words. It rejects fatalism without pretending the work is simple.
He also wrote SCADA and Me, a children’s book for youngsters and managers, followed by Threat Intelligence and Me and Santa and Me with illustrator Jeff Haas. The joke is gentle and the tactic serious. If a field matters, it cannot remain legible only to the priesthood. Lee even co-wrote the Little Bobby webcomic, finding room for humor in a profession that often arrives wearing black slides and worse news.
Dragos grew from the same premise. Lee co-founded it with colleagues from the industrial-threat mission, including Lavender and Justin Cavinee. Their subject was still a niche in 2015. Then events made the consequences difficult to ignore. A cyberattack disrupted electricity in Ukraine. The following year brought another attack on Ukraine’s electric system and the CRASHOVERRIDE malware. In 2017, TRISIS targeted a safety system at a Saudi petrochemical facility. In 2022, Dragos identified PIPEDREAM, a reusable framework designed to interact with industrial equipment across sectors.
03 / The incidentsWhen code acquires weight
Lee’s public reputation rests partly on interpreting these episodes without turning them into monster stories. Industrial malware is frightening because it can manipulate physical processes, but a frightening capability is not a magic wand. An attacker still needs access, knowledge, time and an understanding of the target. Defenders, meanwhile, can inventory assets, segment networks, watch communications, build response plans and learn the normal process well enough to notice the strange.
His team’s work has placed him in rooms that rarely share the same furniture. Plant engineers want safe production. Security teams want evidence. Executives want a risk they can price and prioritize. Governments want national resilience. Lee’s job is often translation across those groups, with the physical process serving as the final referee.
That is also why he resists importing ordinary IT security wholesale into plants. A corporate laptop can be replaced or rebooted. A turbine has inertia. A chemical process has pressure. A hospital generator has a purpose larger than the data it emits. The network diagram is incomplete until it includes consequence.
- Know the terrain. Maintain an inventory of industrial assets and their communications.
- Design for defense. Use architecture and segmentation to limit an intruder’s movement.
- Watch the right things. Build monitoring around threats and the behavior of the physical process.
- Prepare the response. Create incident plans that include operators and engineering constraints.
- Control remote access. Treat the paths into industrial environments as consequential infrastructure.
04 / The returnBlue uniform, green uniform, same concern
Lee eventually left active Air Force service as a captain. He has written candidly about frustration with a military bureaucracy that treated every cyber specialty as interchangeable and about disagreements over offensive operations that could affect civilian infrastructure. He was proud of the service and equally sure it was time to go.
A decade of company building did not erase the pull. Dragos expanded, Lee advised governments, served on boards, appeared in Davos and testified before Congress. Yet one question kept returning: if geopolitical conflict brought widespread attacks on American infrastructure, how would public agencies and private operators respond together?
In February 2025, he was direct commissioned into the Army National Guard as a lieutenant colonel. The structure let him keep leading Dragos while working on OT defense and response. He described a plan to develop strategy, exercise it through Virginia’s Cyber Fortress program, train people and carry useful lessons toward a national model. The title changed. The preoccupation did not.
“We protect civilians, we protect people.”Robert M. Lee
05 / The next systemIndependence at a larger scale
In June 2026, Accenture agreed to acquire a majority stake in Dragos. The transaction was framed as expansion rather than an exit: Lee said he would remain CEO and Dragos would remain a standalone, independent company. The planned structure would bring runZero and NetRise into Dragos after regulatory approval, alongside the recently acquired Phosphorus, broadening the company from classic OT monitoring toward a wider view of connected assets, device software and exposure.
The arrangement tests a familiar founder tension. Industrial defenders want specialist depth and vendor neutrality. Global infrastructure owners operate at a scale that demands reach, capital and service capacity. Lee’s promise is that Dragos can gain the second without surrendering the first. That promise will be judged in customer meetings and incident rooms, not announcement prose.
Artificial intelligence adds another pressure. Lee’s recent writing is less concerned with a cinematic rogue machine than with mundane dependence: industrial organizations connecting more systems, using tools they may not fully observe, and forgetting to plan for an AI service or vendor to fail. His advice begins with the unglamorous knowns. Document dependencies. Monitor OT. Keep a fallback. Practice resilience.
There is a pleasing consistency to the career. The child looking at Air Force planes became an officer watching for threats to physical systems. The officer became a teacher because the field needed practitioners. The teacher became a founder because practitioners needed tools. The founder returned to uniform because tools alone cannot organize a national response.
Lee often talks about leaving the world no worse for his sons. It is a modest phrase attached to an immodest engineering challenge. Modern life hides its machinery until the machinery stops. His work asks people to notice it earlier, learn its peculiarities and defend it without theatrics. Keep the lights on. Keep the water running. Let the quiet outcome remain quiet.