Robert M. Lee and the Question Behind the Blackout

The gas turbine had been shut down. Then it started again. When Robert M. Lee told the story at an industrial conference in 2022, the explanation was wonderfully inconvenient for anyone expecting a foreign intelligence service: moths had landed on an illuminated outdoor touchscreen. Their wings had supplied the instructions.

It is a useful opening to Lee’s world. A screen belongs to a computer, but the computer belongs to a machine, and the machine has consequences. Before deciding who has attacked you, it helps to understand what you have built. Even the insects may have acquired operating privileges.

Lee, the co-founder and CEO of Dragos, has spent his career examining that boundary between digital commands and physical work. His investigations include the 2015 attack on Ukraine’s electricity distribution system. His teaching reaches the people responsible for keeping industrial networks running. His other explanatory instrument is a comic-strip child named Little Bobby, who can ask the awkward questions that adults in conference rooms sometimes swallow.

There is a family resemblance between the investigator, the teacher and the comic writer. Each wants someone to stop, look closely and explain what is actually happening. In an industry fluent in ominous abstractions, Lee keeps returning to the equipment.

Before the firewall, a wind turbine

Lee grew up in a small Alabama town with two parents who served in the Air Force. His early ambition was to follow his father. His father suggested other possibilities, including becoming a lawyer. The suggestion did not take. Lee went to the United States Air Force Academy and eventually became a cyber warfare operations officer.

The sequence matters because the machines caught his attention before cybersecurity did. At the academy, water filtration equipment, wind turbines and aircraft control systems drew him toward the engineering of physical processes. Computers were interesting because of what they could make happen elsewhere.

That interest also took him to Cameroon through Engineers Without Borders. He worked on water filtration and on wind turbines charging car batteries to supply evening light. The attraction was tangible: engineering could extend the useful hours of a day. A functioning control system could change what a community was able to do.

Read backward from Dragos and the trip looks like an early version of his eventual mission. Read forward from the young engineer and it looks less predetermined. He had found a class of machines he cared about. Protecting them became the next problem.

“ICS defense is doable.”

Robert M. Lee’s teaching refrain

The trouble with an empty radar screen

Assigned to the National Security Agency, Lee built and led a mission to identify threats to industrial infrastructure. He was looking for nation-state teams whose activities were poorly understood. Finding them challenged a comfortable assumption: a shortage of reported industrial intrusions could be mistaken for a shortage of industrial intruders.

In his 2018 Senate testimony, he described a collection problem. Security organizations knew more about the places where they could observe activity. Industrial networks often lacked comparable visibility. The blank space in the reporting therefore concealed an unanswered question. Who was already inside?

This became an argument for a different kind of security company. Industrial defenders needed intelligence drawn from their own environments, technology suited to their networks and people trained to interpret the evidence. Lee left government service and built in the private sector. Dragos was founded in 2016 with Justin Cavinee and Jon Lavender, colleagues from the NSA mission.

The commercial pitch required investors to care about machinery that most people only notice during an outage. In a 2026 conversation about building Dragos, Lee discussed getting more than 100 investor rejections. A mission can be obvious to its founders while remaining a difficult item on somebody else’s investment committee agenda.

Christmas, with the power off

On December 23, 2015, attackers disrupted electricity distribution in Ukraine. Approximately 225,000 customers lost power across three distribution companies. Operators restored service through manual operations, while the intrusion exposed how digital access could be converted into control over substations.

Lee worked with Michael Assante and Tim Conway on the E-ISAC/SANS analysis published in March 2016. The report assembled evidence, explained the attack and offered lessons to other defenders. It carefully distinguished the SANS analysis from separate government investigations. The work was collaborative, and its purpose was to make the next operator better prepared.

The mechanics were especially instructive. An attacker did not necessarily need an exotic software flaw to interrupt a physical process. Access, familiarity with the environment and the ability to misuse legitimate functions could be enough. Knowing how the system was supposed to work helped explain how it had been turned against its operators.

Dragos subsequently investigated the malware associated with Ukraine’s 2016 electric-system attack, known as CRASHOVERRIDE. Its later work included TRISIS, which targeted safety systems at a Saudi petrochemical facility, the operational-technology response to Colonial Pipeline, and the discovery of the PIPEDREAM industrial attack framework in 2022. These cases gave Lee’s company a working history in a field that was still developing its vocabulary.

The dates make an uneven kind of company timeline. There are financing rounds in Dragos’s history, but there are also case names. The latter explain why its founder spends so much time talking about the former’s purpose.

A child enters the intelligence briefing

Little Bobby began with an educational disappointment. While Lee was serving in the intelligence community, he spent hours explaining industrial systems to a team assigned to offensive work involving SCADA. At the end, someone asked what SCADA stood for. The introductory lesson, it seemed, needed to be more introductory.

Lee went home and wrote SCADA and Me: A Book for Children and Management. The title left very little doubt about his mood. His friend Jeff Haas, a comic illustrator, improved Lee’s drawings. The intended audience laughed and accepted the joke; they had been assigned a mission and were trying to learn.

The collaboration continued into Threat Intelligence and Me: A Book for Children and Analysts and the Little Bobby web comic. In a 2018 interview, Lee explained the appeal of letting a child interrogate technical claims. Experienced professionals can feel embarrassed asking basic questions. Bobby has fewer professional relationships to preserve.

A character can ask what a fashionable technology actually contributes, then wait for an answer. That small permission is the joke’s useful machinery. The reader gets to enjoy the punctured pomposity and keep the question. It is an economical teaching method for a profession that can make even simple doubts sound expensive.

A classroom with equipment to take home

Lee’s more formal teaching has produced SANS courses in industrial visibility and response, cyber threat intelligence and industrial cybersecurity foundations. As a SANS Fellow, he teaches practitioners who need to connect technical observations with the behavior of real equipment. The classroom is another place where an explanation has to survive contact with a machine.

ICS515 students use a programmable logic controller and a simulator board in their labs. They can take the kit home. That is a pleasingly concrete answer to the familiar problem of leaving a training course full of conviction and returning to work with nothing to practice on.

In February 2025, Lee took on the role of SANS ICS Practice Lead, reviving an initiative associated with Assante. He described teaching as part of his identity and set an initial focus on making training more accessible in Asia-Pacific. Leading a growing company had not removed the classroom from his calendar.

His advice to newcomers allows several starting points: information technology, security or control systems. The aspiration is a profession with enough shared language and foundational knowledge for new people to enter without having to invent their own floor. A company can hire specialists; a field also has to make them.

Ten years, and a larger address book

By 2026, the investor conversations had changed. Accenture announced a majority investment in Dragos in June, alongside transactions involving runZero and NetRise. Accenture’s investment closed on September 16. The acquisitions brought runZero and NetRise under Dragos, with Lee continuing to lead the business.

The combined transaction value was approximately $4.175 billion. That figure covered the three businesses and the transaction structure; it was no statement of Lee’s personal wealth. The operational proposition was to bring industrial threat detection together with asset intelligence, exposure assessment and visibility into device software.

Lee’s own June explanation returned to the expanding industrial environment. A system’s effect on a physical process mattered more than its operating system or its location on a network diagram. Control software, connected devices and cloud services had enlarged the territory industrial defenders needed to understand.

There is a leadership problem inside that technical expansion. Lee now has to carry the habits of a specialist organization across a broader platform and partner network. The question that once faced an investigator looking at an unfamiliar plant also faces the executive: what is connected to what, and who understands the consequences?

Urgency, without the theatrical fog

Lee’s public responsibilities now include service as a lieutenant colonel in the Army National Guard, board roles at the International Society of Automation and National Cryptologic Foundation, and work with the World Economic Forum. He moves between engineers, executives and policymakers, translating the same industrial problem into different institutional languages.

In an October 2026 interview in Australia, his message was urgent but practical. Industrial security programs take years to build, while connectivity, shared technologies and a wider range of attackers have accelerated the problem. He also described a funding gap: utility operators could understand the need and still struggle to pay for the work.

That is a less cinematic obstacle than malicious code and often a more awkward conversation. The protection of a water system eventually involves budgets, economic regulation and decisions about who pays. Technical clarity is necessary. It does not approve the expenditure.

Lee’s career keeps returning to the people who have to make something work: the engineer building a turbine, the operator recovering a substation, the student taking a controller home. His comic character has a role in that company too. Before anyone can defend a complicated system, somebody has to be willing to ask how it works. Preferably before the moths find the screen.