Eric O'Neill
Boards understand cybersecurity as a compliance line item. They do not understand it as an active counterintelligence problem, where adversaries study the organisation, build trust with employees, and move on patient timelines. The same psychological playbook now drives AI-generated deepfakes, voice cloning and synthetic identity attacks against finance teams, executives and supply chains.
Eric O’Neill is the former FBI operative who caught Robert Hanssen, and now advises organisations on how to defend against the same human and AI-enabled deception tactics nation-state actors use.
Full Profile
Why organisations work with Eric O’Neill
- He has run the highest-stakes counterintelligence operation in modern US history. When he describes how a long-running insider threat actually unfolds, he is describing his own case file, not a model.
- His framing reorients cyber defence around the human, not the firewall. Hanssen was an FBI veteran with full system access. Most of today’s breaches still begin with someone trusted being manipulated.
- He translates espionage tradecraft into language CFOs, general counsel and HR leaders can act on. Deepfake CEO fraud, voice cloning, social engineering and ransomware are explained as familiar intelligence techniques running on new infrastructure.
- He brings two published books from major trade houses, Gray Day (Crown, 2019) and Spies, Lies, and Cybercrime (HarperCollins, 2025), giving audiences a substantive body of work to follow up with.
- He is one of the few cybersecurity speakers buyers can hand to a non-technical executive audience without losing them. The Hanssen narrative carries the room; the security argument arrives inside it.
Biography highlights
- Conducted the FBI undercover investigation that led to the arrest of Robert Hanssen, a 25-year FBI veteran convicted on 15 counts of espionage.
- Author of Gray Day (Crown, 2019) and Spies, Lies, and Cybercrime (HarperCollins, 2025).
- Founder of The Georgetown Group, a Washington DC investigative and security consultancy, and Nexasure AI.
- Portrayed by Ryan Phillippe in the 2007 Universal Pictures film Breach.
- Honours graduate of Auburn University and the George Washington University Law School; admitted to the Maryland and DC bars.
- Featured across NPR Fresh Air with Terry Gross, CNN, C-SPAN, Fox, Newsweek and TechCrunch.
Biography
Robert Hanssen had been spying for Moscow for almost two decades when a 26-year-old FBI operative was placed in the office next to him. Hanssen was a 25-year bureau veteran with full clearance, deep technical fluency and a track record of compromising US assets. The operation that exposed him hinged on a single quiet act, the download of an encrypted Palm Pilot, returned to the desk before it was missed. The arrest came on 18 February 2001.
That case sits at the centre of Eric O’Neill’s work, but it is not the product. The product is what the case taught him about how serious adversaries actually operate. They study the organisation. They build trust. They exploit the people closest to the asset, not the perimeter. The same logic now drives AI-generated deepfakes, voice-cloned executive fraud, synthetic identity attacks and supply chain compromise.
He has built a second career around that translation. The Georgetown Group, his Washington DC consultancy, handles counterintelligence, economic espionage, internal investigations and security risk for corporate clients. Nexasure AI focuses on AI-era threat advisory. Gray Day (Crown, 2019) is the inside account of the Hanssen case. Spies, Lies, and Cybercrime (HarperCollins, 2025) is the operating manual that followed it.
He is also a lawyer, admitted to the Maryland and DC bars after law school at George Washington University. That matters in the room. He briefs general counsel, CISOs and boards on cyber and insider risk in language that lands legally as well as operationally, and he does it with the rare authority of someone who has actually run the case.
Key speaking topics
- Cybersecurity and the human attack surface
- AI-enabled fraud, deepfakes and synthetic identity
- Insider threat and counterintelligence for corporates
- Economic espionage and intellectual property protection
- Ransomware and extortion economics
- National security lessons for private sector boards
- Social engineering in the age of generative AI
Ideal for
- Boards, audit committees and CEOs reframing cyber as enterprise risk rather than IT spend
- CISOs, CIOs and CSOs briefing non-technical executives on insider threat and AI-era attack methods
- General counsel and CFOs exposed to deepfake fraud, business email compromise and wire authorisation risk
- Industry conferences in financial services, defence, technology, healthcare and critical infrastructure
Audience outcomes
- A working mental model of how adversaries plan and execute insider compromise, drawn from a real FBI case
- A practical view of where AI is changing the cost and speed of social engineering, deepfake and identity attacks
- Specific behavioural and procedural defences against voice cloning, deepfake video and CEO fraud
- A board-level vocabulary for cyber and counterintelligence risk that does not depend on technical jargon
Talks
The inside account of the Hanssen investigation, used as a frame for how modern insider and cyber attacks unfold.
Key takeaways:
- How nation-state and criminal actors profile targets inside organisations
- Why technical controls fail when trust is the attack vector
- What a counterintelligence mindset looks like inside a corporate security function
An operator’s view of the AI-enabled threat landscape facing executives, finance teams and HR leaders.
Key takeaways:
- How voice cloning, deepfake video and synthetic identity are being used in live attacks
- Where existing fraud controls break down against AI-generated content
- Practical verification and escalation behaviours for executives and assistants
A board-level briefing on cyber risk as a counterintelligence problem, not a compliance one.
Key takeaways:
- Why insider threat remains the highest-impact vector
- How economic espionage targets IP, M&A and supply chain
- What boards should be asking CISOs that they currently are not