Rob Joyce: An NSA Hacker Explains How to Stop Intruders

In January 2016 the head of the NSA's hacking unit walked onto a stage in San Francisco and explained how to keep him out.

Rob Joyce ran Tailored Access Operations, the team that breaks into foreign networks for the United States, and he'd spent his career in the agency's shadows. The Snowden leaks had dragged TAO into the light, and Joyce decided to make use of it.

Over the next decade he'd advise a president, represent the NSA in London, run the agency's defensive directorate and retire with more than 34 years of service. And in 2026 he'd call an AI breach the most consequential hack since the Morris worm.

Rob Joyce at a Glance

• Joyce studied electrical and computer engineering at Clarkson University and electrical engineering at Johns Hopkins, joined the NSA more than three decades ago and entered the Senior Executive Service in 2001.
• In April 2013 he became chief of Tailored Access Operations, weeks before the first Snowden leaks exposed the unit.
• His January 2016 Enigma talk, "Disrupting Nation State Hackers," was a defender's manual written by the attacker.
• In 2017 he joined the White House as special assistant to the president and cybersecurity coordinator, serving at times as acting homeland security adviser. He left in 2018, and the job was eliminated behind him.
• He then served as the NSA's senior cryptologic representative in the United Kingdom, posted to the US Embassy in London.
• In January 2021 the NSA named him its Director of Cybersecurity, and in February 2022 he became a founding member of the Cyber Safety Review Board.
• He retired at the end of March 2024 after more than 34 years of federal service and three Presidential Rank Awards.
• Since then he's advised Beacon Global Strategies, joined company boards and, in 2026, warned that AI is pushing attacks to machine speed.

The Life of Rob Joyce

Joyce's Engineering Start

Rob Joyce trained as an engineer, with a bachelor's degree in electrical and computer engineering from Clarkson University and a master's in electrical engineering from Johns Hopkins University.

He joined the National Security Agency and stayed. By 2001 he'd entered the Senior Executive Service, the government's top career tier, and by the time he first spoke in public he had more than 25 years at the agency behind him.

Almost none of it was visible. That was the point of the place.

Running TAO

In April 2013 Joyce became head of Tailored Access Operations, the NSA's elite hacking division, responsible for breaking into the systems of foreign adversaries and, as Wired put it, occasionally allies.

Weeks later the first documents from Edward Snowden appeared in the Guardian, and TAO, which had existed in the shadowy recesses of the agency, suddenly had its tools and methods on the front page.

Joyce's response was unusual for a spy. Rather than disappear further, he started talking.

Disrupting Nation State Hackers

On January 27, 2016, at the USENIX Enigma conference in San Francisco, Joyce gave a talk titled "Disrupting Nation State Hackers", listed in the program as chief of Tailored Access Operations. He admitted it was "very strange" for someone in his position to be on a stage at all.

The talk was a manual for defenders, delivered by the man they were defending against. "Don't assume a crack is too small to be noticed, or too small to be exploited," he said. If 97 things pass a penetration test and three obscure ones fail, those three are what a nation state will use.

"We put the time in ... to know [that network] better than the people who designed it and the people who are securing it," he told the room. Zero-days were overrated: "persistence and focus will get you in, will achieve that exploitation without the zero days."

He also offered the NSA's view of its own nightmare: an out-of-band network tap producing logs, plus a smart administrator who actually reads them.

The White House Years

In 2017 Joyce moved to the White House as special assistant to the president and cybersecurity coordinator on the National Security Council, and at times served as acting deputy homeland security adviser and acting homeland security adviser.

In April 2018, days after publicly detailing a Russian hacking campaign, he announced he was leaving to return to the NSA. The following month the White House eliminated the coordinator position altogether.

Joyce's next posting was quieter: the US Embassy in London, as the NSA's senior cryptologic representative in the United Kingdom.

Director of Cybersecurity

On January 15, 2021, the NSA named Joyce its Director of Cybersecurity, the head of the agency's defensive arm. He started that April.

His tenure ran through a war and a new kind of adversary. In October 2022 he said the invasion of Ukraine was pushing the agency to share more intelligence with industry, and in November 2023 the NSA joined Britain's NCSC and CISA in issuing joint guidance on securing AI systems.

In March 2024, with weeks left in the job, he told an audience that the United States was still chasing down pieces of a Chinese hacking operation. He'd also become, in February 2022, a founding member of the Cyber Safety Review Board, alongside Dmitri Alperovitch and Google's Heather Adkins.

On February 20, 2024, the NSA announced his retirement, effective at the end of March, after more than 34 years of federal service. He left with three Presidential Rank Awards.

Life After Fort Meade

Retirement didn't mean silence. In June 2024 Joyce joined Beacon Global Strategies as a senior adviser, and in January 2025 he moved into venture capital and took a board seat at BlueVoyant. In August 2025 the AI security startup Starseer added him to its advisory board.

He also kept scoring the government's own work. In March 2025 he called the mass firing of probationary federal employees "devastating" to cyber and national security.

Then AI changed the threat. In March 2026 he described a wave of attacks carried out through Anthropic's Claude as a "Rorschach test" for the security community, and in August, after the Hugging Face breach, he called it the most consequential hack since the Morris worm of 1988. By the end of that month he was telling The Cipher Brief that AI was moving cyberattacks to machine speed.

Rob Joyce: The Attacker Who Switched to Defense

Joyce spent half his career breaking into networks and the other half explaining, in public, how to stop people like him. Few people have seen both sides of the glass so clearly.

His Enigma talk is still quoted a decade on, because the advice hasn't changed: know your network better than the attacker does, read your logs, and assume the smallest crack is the one that matters.

He's retired from the NSA, but he's still working on defense. The adversaries he described haven't retired either.