World-Class, Expert-Led Cybersecurity Training. Purpose-Built for the AI Era.

Modern OSINT Investigations: From Website Analysis to AI-Powered Threat Intelligence

In this session, SANS instructors Matt Edmondson and Ngô Minh Hiếu (Hiếu PC), CEO of ChongLuaDao, will demonstrate how modern OSINT techniques and AI-powered workflows are transforming cyber investigations.

SANS Virginia Beach 2026 - Extending Protocol-SIFT to Linux

Protocol-SIFT has been getting a lot of attention lately, but the first release was 100% focused on Windows investigations. In this talk, we'll look at what it takes to extend this to cover Linux investigations.

Intro to WinDbg Part 5: Advanced Usage - A Recommendation for SEC665

Get deeper with WinDbg in this advanced session for offensive researchers. Explore dx, variables, custom functions, memory editing, extensions, and live user- and kernel-mode debugging to build confidence for SEC665-level red team work.

Deleting the Attacker’s Advantage

In this session, Kurtis Minder examines how threat actors weaponize openly available personal data to make social engineering faster, cheaper, and more convincing, and why traditional security controls rarely account for it.

SANS 2026 Security Awareness and Culture Report: Unpacking the Data with Lance Spitzner

In this webcast, report authors Lance Spitzner and Rachael Saffer walk through the complete findings of the 2026 report. In it, they cover where the industry currently stands, how the risk landscape is shifting, and what this year's practitioner responses reveal about the state of the field today.

SANS Virginia Beach 2026 - SANS@Night Talk: Twelve Against Thousands: The Special Forces Playbook for Outnumbered Security Teams

Most security teams I’ve worked with and helped have a handful of people defending thousands. Yet we expect them to cover everything, watch everything, and control everything, like they have an army’s headcount to do it.

SANS AI Security Training August 2026 - Lunch and Learn: Securing AI in an AI Focused World

AI is a major topic of discussion today—and rightfully so. But for those of us in cybersecurity, it's crucial not only to understand how to use AI for security, but also to recognize the threats targeting AI models, their ecosystems, and how to defend and secure them effectively.

SANS AI Security Training August 2026 - SANS@Night: Evolving AppSec: Using Agentic Workflows and Building Secure AI Systems

Attendees will walk away with a clear mental model of where AI accelerates AppSec, where AI must be defended, and how to adopt vendor AI responsibly, all supported by open-source frameworks and ready to use resources.

Comparing AI Harnesses and Models for Cloud Security Use Cases

Not every AI harness fits every cloud security task. This webinar compares tools like Claude Code, Codex, and Cursor with leading models, evaluating accuracy, speed, cost, and reliability so teams can choose the right fit.

SANS Virginia Beach 2026 - Cybersecurity's Original Sin

This session argues that modern cyber incidents are not the result of novel or sophisticated threats, but of the industry’s repeated failure to fix problems we have understood since the 1990s.

Escaping Restricted Endpoints in SEC660

Initial access is only the beginning. This session shows how attackers escape endpoint restrictions and pivot from constrained environments, with a new lab focused on breaking out of a Dockerized network appliance.

The Agentic SOC: Defending With, and Against, Autonomous AI

In this session, Ismael Valenzuela, author of SANS SEC530: Defensible Security Architecture and Engineering, applies his Think Red, Act Blue approach to both sides of the agentic SOC.

AI + Network Control: Visibility, Risk Prioritization, and Automation in the Age of Agentic NetOps

In this webcast, SANS Certified Instructor Matt Bromiley will explore the operational realities of managing AI-driven environments and examine the three foundational disciplines organizations must develop to close the maturity gap: governance, visibility, and control.

AI in DFIR: Real-World Lessons, Practical Use Cases, and the Future of Incident Response

Join Josh and Phill as they discuss the latest trends, practical use cases, and the challenges of integrating AI into modern DFIR workflows. 

Closing the Gaps in Modern Data Protection

Data protection strategies haven't kept pace with where data actually lives today. This SANS Security Lab will tackle the real-world gaps in modern DLP, from cloud sprawl and tool fragmentation to the emerging risks inside AI pipelines.

Integrating AI/ML into SOC Detection Engineering: Building Smarter, Faster Defenses

Discover how to effectively incorporate artificial intelligence and machine learning into SOC detection engineering workflows.

AI Is Using Your Data. Are You Watching? See Where AI Is Exposing Sensitive Data

AI is changing how sensitive data flows across the enterprise. Learn how to identify AI-driven data exposure, reduce shadow AI risk, improve visibility into AI activity, and implement practical controls that enable secure AI adoption without slowing innovation.

From Framework to Action: Applying the SANS AI Security Maturity Model: Practical Strategies From SANS Experts and Industry Leaders for Assessing, Advancing, and Operationalizing AI Security Maturity

AI is moving fast and your security program may not be keeping up. Join SANS for an exclusive look at the AI Security Maturity Model, a practical framework for benchmarking and advancing your AI security capabilities, followed by a candid expert panel on the real-world challenges of securing agentic AI.

Post-Quantum Cryptography in 2026

The session closes on the practical part: the actions worth starting now to prepare for a post-quantum future, and the ones that can safely wait.

SANS Network Security 2026 - Featured Keynote: Offense at Machine Speed: How AI Is Reshaping the Threat Landscape

The session will demonstrate how AI can be applied as both a SAST and DAST capability for discovering and exploiting zero-day vulnerabilities in web applications, as well as its growing role in binary exploitation.