Cybersecurity Vanguard Dave Luber Departs NSA Amid Global Digital Shifts
Summary
- Dave Luber, head of the National Security Agency’s Cybersecurity Directorate, will retire on May 30, 2025, after 38 years at the NSA.
- He is leaving through traditional retirement, not the early-retirement option the NSA is offering as it cuts its civilian workforce.
- His deputy and the directorate’s chief operating officer are also leaving, according to The Record.
- The departures come weeks after the firing of NSA and Cyber Command chief Timothy Haugh.
Another Leadership Exit at the NSA
Dave Luber, the NSA’s Director of Cybersecurity, will retire at the end of May 2025, The Record from Recorded Future News reported, citing three sources. Luber was named to the post in 2024. A 38-year NSA veteran, he spent his entire career at the agency. His exit is another leadership change at an agency dealing with the firing of its chief and mandated cuts to its workforce. The NSA declined to comment.
Luber’s Legacy at the NSA
Luber was the third head of the Cybersecurity Directorate since it was set up in 2019. He previously served as the directorate’s No. 2. He pushed the agency to improve intelligence sharing on digital threats and to work more closely with critical infrastructure operators and industry.
A Long Career Inside the Agency
Before leading the directorate, Luber was executive director of U.S. Cyber Command, its third-in-command and highest-ranking civilian. Over nearly four decades he also served as director of NSA Colorado and chief of the Remote Operations Center within Tailored Access Operations, the NSA’s elite hacking unit. Former NSA Deputy Director George Barnes noted that Luber “started as a high school work study program participant and worked his way to leading NSA’s cybersecurity mission.”
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Working with Industry
Under Luber, the NSA worked more openly with private companies and foreign partners. In April 2025, the NSA and other U.S. agencies joined international partners in an advisory on fast flux, a technique state-sponsored hackers and cybercriminals use to hide their infrastructure.
The China Threat He Warned About
That collaboration has become more urgent after Chinese campaigns known as Volt Typhoon and Salt Typhoon burrowed into U.S. critical infrastructure and telecom networks. “They’re going to continue to develop tradecraft and look for ways to even evade some of the hunt guides that we’ve put in place,” Luber told reporters at the RSA Conference in 2024.
Turmoil at the Top
Luber’s exit follows a rough stretch for U.S. cyber leadership. In April 2025, he was withdrawn from giving the annual “State of the Hack” address at RSA. Cyber Command Executive Director Morgan Adamski and other officials also cancelled appearances days after Haugh was fired.
Who Comes Next
The NSA has not named a successor. With Luber’s deputy also leaving, the directorate will need new leadership at the top. That comes as the agency works to cut about 8% of its civilian staff.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What It Means for Defenders
The Cybersecurity Directorate’s advisories and threat guidance are widely used by companies and government agencies. A smooth handoff matters, because state-backed hackers are not slowing down. “Dave’s presence will be missed at NSA and in the national security arena,” Barnes said.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.