Chief Information Security Officer caps remarkable 50-year journey that helped shape cybersecurity in higher education

After 50 years of dedicated service to Virginia Tech, 35 of them devoted to cybersecurity and 15 as the university's Chief Information Security Officer, Randy Marchany retired from Virginia Tech in July 2026, closing one of the most distinguished careers in academic information security. A cybersecurity pioneer from the field's formative years, he helped identify and demonstrate emerging attack techniques, develop some of the first community consensus guidance on the Internet's most exploited vulnerabilities, shape defenses against distributed denial-of-service attacks, and build collaborative models for operational security and education. His work helped shape cybersecurity at Virginia Tech and across higher education, while his teaching and mentorship prepared generations of students and professionals for leadership in the field.

Marchany's journey at Virginia Tech began in 1975 when he started as a 22-year-old IBM systems programmer. What followed was an extraordinary career that took him from mainframe computing and Unix administration to nationally recognized cybersecurity leadership, education, standards development, research, and workforce development.

Marchany’s path into cybersecurity was built on a foundation of deep technical expertise across virtually every major operating system of the computing era. His hands-on experience spanned IBM VM, Multics, VAX/VMS, and Unix variants including Solaris, Ultrix, HP-UX, AIX, Ubuntu, and Red Hat, as well as Windows systems. This breadth of knowledge across diverse platforms gave him unique insights into security vulnerabilities and defense strategies that would prove invaluable throughout his career.

In the late 1970s, Marchany was part of a team that was among the first in the country to use microcomputers to automate data acquisition for researchers’ experiments. This was pioneering work that presaged what we now call the Internet of Things. This early experience with connected devices and automated systems gave him insights into the security challenges of networked computing long before most organizations recognized these issues.

His path into cybersecurity was born of necessity. In 1991, one of his DEC Ultrix systems was hacked in an attack later detailed in the book “At Large: The Strange Case of the World’s Biggest Internet Invasion.” The incident proved transformative. Unable to find adequate resources on Unix security at the time, Marchany discovered a startup organization called the SANS Institute advertising a conference in the Washington, D.C., area in 1992.

That discovery changed everything. Marchany joined SANS that year and became one of the Institute’s original instructors. He remains to this day as instructor #2, making him the longest-running instructor in SANS history. Over the decades, he has taught cybersecurity courses around the world and helped shape the curriculum that has trained thousands of cybersecurity professionals.

Recognizing that state and local governments and educational institutions often could not afford commercial cybersecurity training, Marchany created a program with SANS that enabled public-sector IT professionals across the country to attend SANS courses at substantial discounts. The program operated for 18 years and reflected a theme that would define his career: expanding access to practical cybersecurity knowledge.

Marchany's reputation as a cybersecurity pioneer was grounded in hands-on experimentation as well as standards work. In August 1996, he and Virginia Tech colleague Tom Wilson documented a keystroke-recorder attack against a client/server environment. Their demonstration showed that readily available software could be repackaged as a Trojan horse, delivered through social engineering, silently record a user's keystrokes, and return captured information to another system. The paper emphasized a point that would become central to modern endpoint security. Even when networks and servers were protected, the client computer itself could be the weakest point in the architecture.

The 1996 experiment was striking because of how little specialized expertise it required. Marchany and Wilson reported that they built and packaged the demonstration Trojan in roughly three hours and concluded that a relatively novice attacker could use readily available tools to compromise client systems. Their recommendations anticipated later security practice: deploy anti-tampering protections on endpoints, verify software modifications, train users to resist social engineering, strengthen server access controls and logging, and periodically inventory client software.

Two years later, Marchany contributed to another foundational SANS consensus effort: Computer Security Incident Handling: Step-by-Step, Version 1.5 (May 1998). The handbook identified him as a Virginia Tech contributor to a joint product of security professionals from corporations, government agencies, and educational institutions. It organized incident response into six phases: preparation, identification, containment, eradication, recovery, and follow-up and translated practitioners' experience into a repeatable operational process for handling intrusions, denial-of-service attacks, cyber-theft, malicious code, and other security events. The 1998 guide is notable in retrospect for how much of today's incident-response discipline it already contained: management support, trained response teams, emergency communications, coordination with law enforcement and other incident response teams, chain of custody, containment, vulnerability analysis, recovery, monitoring, and formal lessons-learned reviews. Marchany's participation placed him in the practitioner community that was codifying operational cybersecurity years before incident response became a standard organizational function.

At the turn of the millennium, Marchany was part of a small group of practitioners helping turn Internet security from an ad hoc technical specialty into a discipline built around shared priorities and actionable controls. In 2000, he was one of 42 experts from academia, government, industry, CERT/CC, and the SANS Institute who developed the SANS consensus list of the Ten Most Often Exploited Internet Security Flaws. The effort grew out of the February 2000 White House meeting on distributed denial-of-service attacks and sought to answer a practical problem facing system administrators: among hundreds of known vulnerabilities, which ones demanded immediate attention? The resulting guidance identified high-priority weaknesses in services such as BIND, CGI applications, RPC, Microsoft IIS, Sendmail, file sharing, authentication, mail services, and SNMP, and paired them with concrete remediation steps.

The May 2000 SANS Security Alert printed the Top Ten consensus and listed 'Randy Marchany, Virginia Tech' first among its signatories. The same issue recognized 'Randy Marchany and the Security Team' at Virginia Tech with a 2000 Information Security Leadership Award. SANS highlighted Virginia Tech's computer incident response capabilities and described the team's STAR - Security Targeting and Analysis of Risk - technique as an innovative method for prioritizing risks, threats, and countermeasures.

Marchany also helped address the distributed denial-of-service crisis that brought Internet security to national attention in 2000. He participated in the SANS Partnership's Consensus Roadmap for Defeating Distributed Denial of Service Attacks, a multi-sector effort involving university, government, industry, and security experts. The roadmap argued that DDoS defense required coordinated action across users, system administrators, Internet service providers, software and hardware vendors, and government. Its recommendations emphasized incident-response preparation, secure configuration, ingress and egress filtering, attack traceback, safer defaults, patching, and long-term development of more secure Internet technologies.

Seen in the broader history of the field, these efforts were part of an extraordinary period of practitioner-led standards development during the 1990s and early 2000s. Long before cybersecurity became a major industry, experts across government, academia, industry, independent research, CERT/CC, MITRE, SANS, universities, and vendors were building an operational framework through consensus documents, public guidance, conference papers, training, vulnerability research, and shared incident experience. The community addressed secure configuration, recurring vulnerability classes, incident response, executive governance, awareness and human behavior, risk management, logging, segmentation, patching, and continuous improvement. His work on incident handling, the SANS Top Ten, DDoS defense, CIS benchmarks, and operational security at Virginia Tech made him an active participant in that formative community.

This work placed him in the early movement toward community-based cybersecurity: practitioners pooling incident data, agreeing on the most important weaknesses, and translating technical knowledge into prioritized defenses that organizations could actually implement. In the early 2000s, he led a Virginia Tech team that was among the early organizations contributing firewall data to the DShield project, which evolved into the Internet Storm Center. That work reflected his longstanding belief that collective defense depends on collective sharing of threat information.

His work with the Center for Internet Security (CIS) was similarly influential. He helped Virginia Tech become a charter member of CIS - the first university in the country to join. CIS later highlighted his role in its "CIS Controls Volunteer Spotlight: Randy Marchany," describing him as a "CIS Controls Community member since the beginning." The profile notes that he helped write the original CIS Unix Benchmarks and later served on the CIS Controls v8 Working Group. This continuity  from the earliest secure-configuration benchmarks to the modern CIS Controls  reflects more than two decades of volunteer participation in the consensus-driven development of practical cybersecurity standards. His work helped connect academic and operational experience at Virginia Tech with security guidance adopted by organizations around the world.

As Virginia Tech’s CISO since 2010 and Director of the IT Security Lab since 2003, Marchany implemented a “teaching hospital” model that has proven remarkably successful in developing cybersecurity talent. The lab provides hands-on experience for graduate and undergraduate students working alongside IT security analysts to solve real-time problems.

In addition to his administrative and research roles, Marchany has been a pioneering educator in cybersecurity. Starting in 1999, he taught one of the first hands-on university cybersecurity classes in the country and he has continued teaching to the present day. Over 3,000 students have taken his classes since 2000, representing one of the most sustained and impactful teaching legacies in academic cybersecurity. As a faculty member in the Department of Electrical and Computer Engineering, he has brought real-world cybersecurity challenges directly into the classroom, ensuring that students gain practical skills alongside theoretical knowledge.

Randy was instrumental in helping Virginia Tech obtain prestigious recognition from the National Security Agency as a Center for Academic Excellence in Cyber Defense (CAE-CD), Cybersecurity Research (CAE-R), and Cybersecurity Operations (CAE-CO). These designations representing excellence in education, research, and operational cybersecurity placed Virginia Tech among an elite group of institutions recognized by the NSA for their comprehensive cybersecurity programs. Marchany’s leadership was critical in developing the programs, documentation, and evidence needed to secure all three CAE designations. The achievement of all three CAE designations demonstrates the breadth and depth of Virginia Tech’s cybersecurity capabilities, which Marchany helped build and sustain over decades.

The results speak for themselves. Alumni of the IT Security Lab have gone on to become CISOs and VPs of security at major organizations worldwide from credit card companies and athletic wear manufacturers to government contractors and cyber ranges. Many alumni are military veterans and retirees who became commanders of units in the US Cyber Command. For a period, the majority of cyber instructors at the West Point Military Academy were graduates of the IT Security Lab, a testament to the quality and rigor of the training provided. He has mentored 14 PhD students and 13 master’s students, and is a co-holder of three cybersecurity patents with graduates from the lab.

His commitment to developing the next generation extended well beyond Virginia Tech. Randy was one of the founding members of the US Cyber Challenge (https://uscyberchallenge.org), a national program with the mission to significantly reduce the shortage in the cyber workforce by identifying, attracting, recruiting, and placing the next generation of cybersecurity professionals. Working alongside leaders like Karen Evans (USCC national director and former chief information officer for the federal government) and Allan Paller of SANS, Marchany didn’t just participate—he took over the curriculum development.

According to Paller, Randy was the ideal candidate for this role because he brought a unique combination of skills: cybersecurity expert and USA Volleyball Association volleyball coach. “This industry is very similar to a sport,” Paller explained. “There are few teachers who teach this. What we needed were coaches and a competitive atmosphere in which to push these kids. Randy was instrumental in creating that atmosphere. He didn’t just get involved, he took over.”

He designed intensely challenging courses for the USCC summer camps that exceeded the skill levels of even the most talented young cyber defenders. He created a unique methodology to help train the camp instructors and established a competitive atmosphere that brought out the best in participants. His approach to developing cybersecurity talent by combining rigorous technical training with the motivational and team-building techniques he learned from coaching, proved transformative. Karen Evans noted, “Randy was instrumental. He created a unique methodology to help train the teachers that few others could have developed.”

Randy understood early that cybersecurity problems could not be solved within institutional boundaries. In the early 2000s, he helped found the Virginia Alliance for Secure Computing and Networking (VASCAN), bringing together security practitioners and researchers from Virginia Tech, the University of Virginia, James Madison University, George Mason University, and other institutions. VASCAN created a forum for sharing threat information, practices, and research across the Commonwealth. The collaboration received the 2005 EDUCAUSE Excellence in Information Technology Solutions Award.

He also played a founding role in the Virginia Cyber Range and served on its executive committee. The range expanded access to realistic cybersecurity education and workforce development throughout Virginia. The Virginia Cyber Range team received the 2017 Virginia Governor's Technology Award for innovative use of technology in education.

Within higher education, Randy became a trusted national voice on cybersecurity. He served on the REN-ISAC board, participated in EDUCAUSE security initiatives focused on risk assessment and security metrics, served with the Higher Education Information Security Council, and co-authored EDUCAUSE guidance on computer and network security in higher education. His work was frequently cited or featured in higher-education and cybersecurity publications. Throughout his career, he wrote or co-authored dozens of papers and articles on cybersecurity, addressing subjects ranging from intrusion detection and moving-target defenses to IPv6 security and crisis-alert optimization. He spoke at conferences and events sponsored by organizations including EDUCAUSE, SANS, IEEE, NIST, RSA, and others, consistently emphasizing practical, evidence-based security and the importance of developing people as well as technology.

As a frequent speaker at national and international conferences including EDUCAUSE, SANS, IEEE, NIST, and RSA, Randy shared Virginia Tech’s pioneering approaches to cybersecurity. The university was among the first to offer practical cybersecurity courses starting in 1998, and under Marchany’s leadership, has remained at the forefront of cybersecurity education and research.

His expertise and leadership have been recognized beyond academia as well. Marchany was invited to join the CyberEd Board Community (cyberedboard.io), an organization focused on advancing cybersecurity education and governance. He also serves on the VigiTrust Global Advisory Board (https://vigitrust.com/advisory-board/ ), where he provides strategic guidance on cybersecurity and privacy solutions to organizations worldwide. These advisory roles reflect the high regard in which he is held by both the cybersecurity education community and the private sector.

Throughout his career, Marchany has been generous in sharing his knowledge and experiences through numerous video interviews and webcasts. Virginia Tech documented his remarkable journey in a series of video interviews as part of its IT history project, where he discusses topics ranging from how a 1991 hack led him into cybersecurity, to the evolution of Virginia Tech’s networks, to the achievements in cybersecurity education at the university.

His YouTube presence includes webcasts on critical topics such as “Zero Trust Networks: The Future is Now” at the 2019 SANS Blue Team Summit, “The 20 Critical Security Controls: From Framework to Operational to Implementation,” and timely presentations during the COVID-19 pandemic on “Making and Keeping Work at Home Operations Safe and Productive” and “Secure Video Conferencing.” These interviews and presentations showcase not only his technical expertise but also his ability to communicate complex cybersecurity concepts in accessible ways, demonstrating the teaching skills that have made him such an effective educator.

A recurring theme in his teaching is that cybersecurity expertise comes from confronting real failures, learning from incidents, and applying those lessons to better systems and processes. His willingness to discuss both successes and mistakes helped make his instruction accessible to students, practitioners, and senior leaders alike. This authenticity and willingness to share both successes and failures has made him a respected voice in the cybersecurity community.

What makes him truly unique is his parallel career as an accomplished musician. For nearly 40 years, he performed with the band No Strings Attached (https://www.enessay.com ), playing the hammered dulcimer, an instrument he took up in 1978. Acknowledged as one of the North American masters of the hammered dulcimer, Marchany composed the original theme song for National Public Radio’s nationally syndicated program “World Café.”

No Strings Attached, which recently retired, was nominated for or won multiple “Indie” awards (the independent record label’s equivalent of the Grammy) for Best Album in the string music category in 1984, 1985, 1986, 1988, and 1990. The band toured throughout the United States, UK, and Europe, opening for artists including Béla Fleck and the Flecktones, the Chicks, and Doc Watson. Their music continues to air on National Public Radio.

The connection between music and cybersecurity might seem unlikely, but he found parallels between the two. Leading a band required many of the same skills needed in cybersecurity leadership: public speaking, practice, planning, execution, teamwork, and the ability to make complex tasks look effortless. As he once explained, audiences would approach the band after concerts and say they sounded like one unit and made it look easy but that ease came from tremendous work and coordination.

In the 1980s, Marchany served as the first graduate assistant coach for the Virginia Tech women's volleyball team and also coached club volleyball. Coaching taught him lessons about motivation, team dynamics, communication, and organizational politics that later proved valuable in cybersecurity leadership. Those lessons also influenced the competitive, coaching-oriented approach he brought to the US Cyber Challenge and other workforce-development programs. His involvement with the Virginia Cyber Range as an executive committee member represented another way he combined his interests in education, technology, and competitive excellence.

Randy's contributions have been recognized across cybersecurity, higher education, and Virginia Tech. Earlier honors include the 2000 SANS Institute Security Technology Leadership Award, the 2003 Virginia Governor's Technology Silver Award, the 2005 EDUCAUSE Excellence in Information Technology Solutions Award as part of the VASCAN team, the 2016 Shirley C. Payne IT Security Advancement Award, the 2017 Virginia Governor's Technology Award as part of the Virginia Cyber Range team, and the 2021 SANS Difference Maker Award. 

In 2024, he was named a Capital ORBIE CISO Public Sector finalist and received an OnCon Top 10 CISO Award. His recognition continued with a 2025 OnCon Top 10 CISO Award, the 2025 CISO Connect Top 10 CISO Award, and recognition among CISO Connect's Top 100 CISOs in 2026. In 2025, the Virginia Tech IT Security Office was also named an OnCon Top 50 Information Security Team, recognizing the strength of the organization he led.

The year 2026 brought three especially significant honors. In May, Marchany was inducted into the Virginia Tech Department of Computer Science Academy of Distinguished Alumni, which recognizes outstanding professional achievement and impact among alumni. EDUCAUSE selected him to receive its 2026 Organizational Culture Award, honoring his transformational leadership in building a culture of learning, mentorship, collaboration, and service. EDUCAUSE specifically highlighted the IT Security Lab's teaching-hospital model, the career impact of his mentorship, his expansion of hands-on cybersecurity education, and his statewide collaborative work.

Following his retirement, the Virginia Tech Board of Visitors awarded Marchany emeritus status as University Information Technology Security Officer Emeritus in August 2026, recognizing his distinguished service and enduring contributions to the university. Together, these honors marked a fitting culmination of a career defined not only by technical achievement, but by institution-building, mentorship, collaboration, and service. 

In an era of frequent job changes, Randy's career was unusually rooted in one institution. From student and systems programmer to Unix administrator, security leader, CISO, laboratory director, educator, researcher, and mentor, his 50 years at Virginia Tech traced much of the evolution of modern computing itself. His work helped protect the university's digital infrastructure, educate generations of cybersecurity professionals, influence national security practices, and demonstrate that technical excellence and human development are inseparable parts of effective cybersecurity leadership.

The university he helped connect to the emerging internet era through projects such as the Blacksburg Electronic Village went on to operate modern IPv6 networks and sophisticated cybersecurity programs. The IT Security Office that began with a small staff grew into a multidisciplinary organization incorporating offensive security, cyber defense, security operations and awareness, and a dedicated risk-management function. 

Retirement in July 2026 ended his formal tenure as Virginia Tech's University IT Security Officer and CISO, but not his involvement in cybersecurity and education. His influence continues through the thousands of students he taught, the professionals he mentored, the standards and guidance he helped create, the organizations he helped found, the cybersecurity teams and programs he built, and his continuing teaching and advisory work.

Under his leadership, the office developed an innovative organizational model that went beyond traditional cybersecurity team structures. In addition to the conventional Red team (offensive penetration testing), Blue team (cyber defense), and Purple team (security operations and security awareness), Marchany created a Green team focused specifically on IT risk management. This forward-thinking approach to organizing cybersecurity operations recognized that risk management required dedicated focus and expertise.

The effectiveness of this model has been recognized at the highest levels. In 2025, the Virginia Tech IT Security Office team was named one of the OnCon Top 50 Information Security teams in the entire world (https://www.onconferences.com/25-team-winners-infosec ) remarkable achievement that places Virginia Tech’s IT Security Office among the elite cybersecurity teams globally, and a fitting capstone to Marchany’s leadership.

Randy Marchany's 50-year Virginia Tech career is more than a story of individual achievement. It is a chronicle of the evolution of computing and cybersecurity in higher education, told through the work of someone who did not merely witness that evolution but actively helped shape it. From IBM mainframes to IPv6 networks, from early internet incidents to modern cyber ranges, and from the first generation of hands-on cybersecurity courses to today's security workforce, he consistently combined technical depth with a commitment to teaching, collaboration, and service.

Randy has often recalled advice from his father that careers are like a river: they may go in many directions, but eventually they reach the sea. After five decades of service to Virginia Tech, his career reached that milestone with a legacy extending far beyond any single title - a legacy measured in stronger institutions, practical cybersecurity standards, and the people he prepared to lead the field after him 

After 50 years of remarkable service, Randy Marchany has earned his place among the pioneers who helped navigate the digital revolution and make it safer for everyone.

ADDITIONAL CONTRIBUTIONS BY RANDY MARCHANY

WEBCASTS:

https://www.youtube.com/watch?v=EF_0dr8WkX8 SANS Blue Team Summit 2019,  "Zero Trust Networks: The Future is Now"

https://www.youtube.com/watch?v=sm_u-ILqymQ&t=11s , IQPC Interview, Zero Trust Networks, 2019

For more webcasts with Randy, please refer to the SANS Webcast Archive.

WHITEPAPERS:

https://scholar.google.com/scholar?hl=en&as_sdt=0%2C47&q=randy+marchany&oq=

SANS / Information Systems Control Journal (2000), How To Eliminate The Ten Most Critical Internet Security Threats - The Experts’ Consensus: https://peterswire.net/archive/privarchives/How%20To%20Eliminate%20The%20Ten%20Most%20Critical%20Internet%20Security%20Threats.html

BLOG/Substack:

http://randymarchany.blogspot.com https://vtrandy.substack.com/publish/posts/published