AIS247: AI Security Essentials for Business Leaders

Essential Skill Level | 2 Hours (Self-Paced) Unveil the prevalent risks, discover mitigation tactics, and gain insights into AI-related cybersecurity and policy development. Designed for AI adopters to decision-makers, this training ensures a comprehensive grasp of GenAI's transformative impact on both personal and professional realms. Embrace the AI evolution with confidence and competence.Access Course Preview Now | Learn More About the Course

SEC411: AI Security Principles and Practices: GenAI and LLM Defense

Intermediate Skill Level | 14 Hours (Self-Paced) | 2 Hands-On Lab(s) Defend GenAI and LLMs at every stage with SEC411’s hands-on, real-world AI security labs. Always current. Always hands-on. Always relevant.Access Course Preview Now | Learn More About the Course

SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG

Essential Skill Level | 7 Hours (Self-Paced) Is your organization seeking to create useful AI solutions? Has your organization struggled to get the project off the ground? SEC495 will supercharge your efforts to build a Large Language Model (LLM) based solution for internal and customer facing applications. More importantly, this fully hands-on class walks you through how to build effective Retrieval Augmented Generation solutions (RAG) that leverage LLMs while also protecting against prompt injection and implementing access controls based on information sensitivity levels.Access Course Preview Now | Learn More About the Course

SEC401: Security Essentials - Network, Endpoint, and Cloud

Essential Skill Level | 6 Days (Instructor-Led) | 46 Hours (Self-Paced) | 20 Hands-On Lab(s) Information security is about focusing your defenses on the areas that matter most, particularly as they relate to the unique needs of your organization. In SEC401: Security Essentials – Network, Endpoint, and Cloud, you’ll learn foundational knowledge in information security, focusing on network, endpoint, and cloud defenses tailored to organizational needs. The course covers detecting and responding to threats to secure systems effectively and minimize impact.Access Course Preview Now | Learn More About the Course

SEC406: Linux Security for InfoSec Professionals

Essential Skill Level | 5 Days (Instructor-Led) | 30 Hours (Self-Paced) | 30 Hands-On Lab(s) In today's fast-paced threat landscape, proficiency in Linux is not optional - it's essential. Hackers know how to use Linux and a single unsecured Linux box could be all it takes for your organization to fall victim to a devastating cyberattack. Whether you are defensive, offensive, performing incident response, or working in mobile or ICS, this course will equip you with the fundamental proficiency, knowledge, and tools needed to stay ahead of the game. Acquire yours by taking our practical, hands-on training.Access Course Preview Now | Learn More About the Course

SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 22 Hands-On Lab(s) SEC450 is a SOC Analyst training course ideal for those working in cyber defense operations or building and improving a SOC. It offers six days of training, hands-on labs, and a Capstone competition, covering the mission, mindset, and techniques needed for modern cyber defense. The course, paired with the GIAC GSOC certification, provides essential skills for detecting and halting advanced cyberattacks, making it the gold standard in security operations training.Access Course Preview Now | Learn More About the Course

SEC497: Practical Open-Source Intelligence (OSINT)

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 29 Hands-On Lab(s) SEC497 is based on two decades of experience with open-source intelligence (OSINT) research and investigations supporting law enforcement, intelligence operations, and a variety of private sector businesses ranging from small start-ups to Fortune 100 companies. The goal is to provide practical, real-world tools and techniques to help individuals perform OSINT research safely and effectively. One of the most dynamic aspects of working with professionals from different industries worldwide is getting to see their problems and working with them to help solve those problems. SEC497 draws on lessons learned over the years in OSINT to help others. The course not only covers critical OSINT tools and techniques, it also provides real-world examples of how they have been used to solve a problem or further an investigation. Hands-on labs based on actual scenarios provide students with the opportunity to practice the skills they learn and understand how those skills can help in their research. Access Course Preview Now | Learn More About the Course

SEC501: Advanced Security Essentials - Enterprise Defender

Intermediate Skill Level | 6 Days (Instructor-Led) | 38 Hours (Self-Paced) | 25 Hands-On Lab(s) Cyber reskilling and upskilling are significant concerns for enterprises both large and small. Technologists must have a broad range of knowledge and certain basic skills in multiple areas. Every member of a security team, increasingly extended into Information Technology and DevOps, must prepare to ensure that any system, software, or infrastructure that is coded, built, and deployed is resilient to attack. Team members must have the knowledge necessary to identify the adversaries in their midst, which requires knowledge of the adversaries' tactics, techniques, and procedures, as well as familiarity with real-world tools that reveal their activities within the enterprise. Adversaries must be contained when uncovered-controlling their lateral movement and limiting the extent of their infiltration minimizes the risks of disclosure, alteration, and destruction of mission-critical enterprise data. Critically, having all hands on deck is key to eradicating the adversary, remediating compromised systems, and recovering lost assets. Prevent. Detect. Respond.Access Course Preview Now | Learn More About the Course

SEC503: Network Monitoring and Threat Detection In-Depth

Intermediate Skill Level | 6 Days (Instructor-Led) | 46 Hours (Self-Paced) | 37 Hands-On Lab(s) SEC503: Network Monitoring and Threat Detection In-Depth training delivers the technical knowledge, insight, and hands-on training you need to confidently defend your network, whether traditional or cloud-based. You will learn about the underlying theory of TCP/IP and the most used application protocols so that you can intelligently examine network traffic to identify emerging threats, perform large-scale correlation for threat hunting, and reconstruct network attacks. Access Course Preview Now | Learn More About the Course

SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

Intermediate Skill Level | 6 Days (Instructor-Led) | 46 Hours (Self-Paced) | 18 Hands-On Lab(s) In today's rapidly evolving threat landscape, traditional cybersecurity measures are no longer sufficient. This advanced training addresses the challenge by equipping practitioners with cutting-edge skills in cybersecurity engineering and advanced threat detection for cloud, network, and endpoint environments. Featuring 18 hands-on labs, a final capstone project, plus gamified bootcamp challenges, it immerses you in real-world scenarios. Master NDR, EDR, and MITRE ATT&CK to build a robust SOC with threat-informed defenses. Elevate your expertise and stay ahead of adversaries with this comprehensive course.Access Course Preview Now | Learn More About the Course

SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 24 Hands-On Lab(s) This course is designed to help students establish and maintain a holistic and layered approach to security, while taking them on a journey towards a realistic 'less trust' implementation based on Zero Trust principles, pillars and capabilities. Effective security requires a balance between detection, prevention, and response capabilities, but such a balance demands that controls be implemented on the network, directly on endpoints, within cloud environments, and ultimately, around the data we are trying to protect. The strengths and weaknesses of one solution complement another solution through strategic placement, implementation, and continuous fine-tuning. To address this need, this course focuses on combining strategic concepts of infrastructure and tool placement while also diving into their technical application.Access Course Preview Now | Learn More About the Course

SEC547: Defending Product Supply Chains

Intermediate Skill Level | 18 Hours (Self-Paced) | 13 Hands-On Lab(s) The threat landscape has changed and gone are the days when erecting a strong perimeter is sufficient to keep adversaries at bay. Supply chain attacks are one of the many effective ways to circumvent traditional perimeter-based controls. In these difficult to spot attacks, organizations unintentionally invite the adversary inside using unvalidated but "trusted" technologies, effectively leading to self-compromise. SEC547: Defending Product Supply Chains teaches how to minimize the risk of supply chain attacks via in-depth supply chain risk management strategies and tactics. The course covers the threat landscape and provides critical skills for defenders across 13 custom tailored labs, provides real-world examples of how these attacks work and how to stop them from happening to you. You'll leave this course with the industry best practice required to inject security and assurance into your organization's technology acquisitions.Access Course Preview Now | Learn More About the Course

SEC555: Detection Engineering and SIEM Analytics

Intermediate Skill Level | 5 Days (Instructor-Led) | 30 Hours (Self-Paced) | 18 Hands-On Lab(s) Many organizations have logging capabilities but lack the people and processes to analyze them. In addition, logging systems collect vast amounts of data from a variety of data sources which require an understanding of the sources for proper analysis. This class is designed to provide training, methods, and processes for enhancing existing logging solutions. This class will also provide the understanding of the when, what, and why behind the logs. This is a lab-heavy course that utilizes SOF-ELK, a SANS-sponsored free SIEM solution, to train hands-on experience and provide the mindset for large-scale data analysis.Access Course Preview Now | Learn More About the Course

SEC573: Automating Information Security with Python

Advanced Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 128 Hands-On Lab(s) The challenges faced by security professionals are constantly evolving, so there is a huge demand for those who can understand a technology problem and quickly develop a solution. If you have to wait on a vendor to develop a tool to recover a forensics artifact, or to either patch or exploit that new vulnerability, then you will always be behind. It is no longer an option for employers serious about information security to operate without the ability to rapidly develop their own tools. This course will give you the skills to develop solutions so that your organization can operate at the speed of the adversary. SEC573 is an immersive, self-paced, hands-on, and lab-intensive course. After covering the essentials required for people who have never coded before, the course will present students with real-world forensics, defensive, and offensive challenges. You will develop a malware dropper for an offensive operation; learn to search your logs for the latest attacks; develop code to carve forensics artifacts from memory, hard drives, and packets; automate the interaction with an online website's API; and write a custom packet sniffer. Through fun and engaging labs, you'll develop useful tools and build essential skills that will make you the most valuable member of your information security team.Access Course Preview Now | Learn More About the Course

SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis

Advanced Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 28 Hands-On Lab(s) With Open-Source Intelligence (OSINT) being the engine of most major investigations in this digital age the need for a more advanced course was imminent. The data in almost every OSINT investigation becomes more complex to collect, exploit and analyze. For this OSINT practitioners all around the world have a need for performing OSINT at scale and means and methods to check and report on the reliability of their analysis for sound and unbiased reports. In SEC587 you will learn how to perform advanced OSINT Gathering & Analysis as well as understand and use common programming languages such as JSON and Python. SEC587 also will go into Dark Web and Financial (Cryptocurrency) topics as well as disinformation, advanced image and video OSINT analysis. This is an advanced fast-paced course that will give seasoned OSINT investigators new techniques and methodologies and entry-level OSINT analysts that extra depth in finding, collecting and analyzing data sources from all around the world.Access Course Preview Now | Learn More About the Course

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Advanced Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 30 Hands-On Lab(s) SEC595 provides students with a crash-course introduction to practical data science, statistics, probability, machine learning, and AI. The course is structured as a series of short discussions with extensive hands-on labs that help students to develop useful intuitive understandings of how these concepts relate and can be used to solve real-world problems. The best analogy is that we are using an apprenticeship approach to bring you from beginner to journeyman in AI and related fields. If you've never done anything with data science or machine learning but want to use these AI techniques, this is definitely the course for you!Access Course Preview Now | Learn More About the Course

SEC673: Advanced Information Security Automation with Python

Advanced Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 27 Hands-On Lab(s) SEC673 is designed as the logical progression point for students who have completed SEC573: Automating Information Security with Python, or for those who already familiar with basic Python programming concepts. We jump immediately into advanced concepts. SEC673 looks at coding techniques used by popular open-source information security packages and how to apply them to your own Python cybersecurity projects. We'll learn from the best of them as we spend the week making information security for our project, named SPF100, as easy to develop and maintain as that of the most popular cybersecurity projects. Discover how to organize your code and use advanced programming concepts to make your code faster, more efficient, and easier to develop and maintain.Access Course Preview Now | Learn More About the Course

SEC480: AWS Secure Builder

Essential Skill Level | 16 Hours (Self-Paced) | 8 Hands-On Lab(s) Data breaches of cloud infrastructure can often be traced back to inadvertent misconfigurations made by non-security personnel. Cloud developers, engineers, architects, and other security-adjacent roles require platform-specific training to effectively prioritize security and reduce the likelihood of harmful breaches. SEC480: AWS Secure Builder fulfills this requirement by equipping technical professionals with the skills needed to embed security fundamentals into Amazon Web Services (AWS) workloads from the start. This course features eight comprehensive modules, each accompanied by a hands-on lab, ensuring participants gain practical experience in building secure AWS environments.Access Course Preview Now | Learn More About the Course

SEC510: Cloud Security Engineering and Controls Leadership

Advanced Skill Level | 5 Days (Instructor-Led) | 38 Hours (Self-Paced) | 52 Hands-On Lab(s) Today's organizations depend on complex, multicloud environments which must support hundreds of different services across multiple clouds. These services are often insecure by default and require substantially different methods to protect depending on the Cloud Service Provider (CSP) that hosts them. It is vital that security teams have a deep understanding of AWS, Azure, and Google Cloud services to lock them down effectively.Access Course Preview Now | Learn More About the Course

SEC522: Application Security: Securing Web Applications, APIs, and Microservices

Advanced Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 21 Hands-On Lab(s) Applications used in accounting, security monitoring, and industrial control systems have one thing in common: they are based on web applications and APIs. Understanding web vulnerabilities is essential to protect any organization, whether on-premises or in the cloud. SEC522 equips security professionals with the skills to identify and mitigate common vulnerabilities in web applications, cloud-native services, and APIs while integrating industry best practices into development processes.Access Course Preview Now | Learn More About the Course

SEC540: Cloud Native Security and DevSecOps Automation

Advanced Skill Level | 5 Days (Instructor-Led) | 38 Hours (Self-Paced) | 35 Hands-On Lab(s) Organizations are moving to cloud native, Kubernetes, and public cloud infrastructure to enable digital transformation and reap the benefits of cloud computing. However, security teams struggle to understand the DevOps toolchain and how to introduce security controls in their automated pipelines responsible for delivering changes to cloud-based systems. Without effective pipeline security controls, security teams lose visibility into the changes released into production environments. SANS SEC540 training provides security professionals with a methodology to secure modern Cloud and DevOps environments. By embracing the DevOps culture, students will walk away from SEC540 training battle-tested and ready to build to their organization's Cloud Native & DevSecOps Security Program.Access Course Preview Now | Learn More About the Course

SEC541: Cloud Security Threat Detection

Advanced Skill Level | 5 Days (Instructor-Led) | 30 Hours (Self-Paced) | 22 Hands-On Lab(s) While shifting to cloud infrastructure offers many benefits, it also exposes organizations to new and continuously evolving threats. Many organizations are unaware of the critical differences between on-premises and cloud environments, leading to challenges in understanding what to log and how to detect threats effectively. Unlike other, primarily theoretical courses, SEC541: Cloud Security Threat Detection provides hands-on-keyboard experience through 21 practical labs, covering AWS, Azure, and Microsoft 365. This course empowers your team to master cloud-native logging, threat detection, and monitoring, solving hidden, low-hanging but high ROI issues. Equip your team with the skills to necessary to enhance your organization's cloud security posture and stay ahead of potential breaches with SEC541.Access Course Preview Now | Learn More About the Course

SEC545: GenAI and LLM Application Security

Advanced Skill Level | 3 Days (Instructor-Led) | 18 Hours (Self-Paced) | 11 Hands-On Lab(s) SEC545 explores GenAI security, from core concepts like LLMs and RAG to real-world risks like prompt injection and supply chain threats. Students learn to build, secure, and deploy GenAI apps using best practices for tools like LangChain, agents, and cloud platforms such as AWS Bedrock.Access Course Preview Now | Learn More About the Course

SEC549: Cloud Security Architecture

Advanced Skill Level | 5 Days (Instructor-Led) | 30 Hours (Self-Paced) | 35 Hands-On Lab(s) Organizations are migrating infrastructure and applications to the cloud at a rapid pace. As migrations take place, security architects are struggling to design hybrid and cloud-native solutions to meet their organization's security requirements. Shifting to the cloud requires a deep understanding of the threats introduced by a cloud migration, and how each provider mitigates those threats using their well-architected framework. SEC549 teaches security professionals how to design an enterprise-ready, scalable cloud organization. With nearly 20 hands-on labs, students will learn to design cloud solutions for their organization at any stage of the cloud journey, whether planning for the first workload, managing complex legacy environments, or operating in an advanced cloud-native ecosystem.Access Course Preview Now | Learn More About the Course

SEC275: Foundations: Computers, Technology & Security

Beginner Level | 38 Hours (Self-Paced) | 80 Hands-On Lab(s) SANS Foundations is the perfect starting point for anyone new to cybersecurity or looking to build a solid technical base. Designed with beginners in mind, this cybersecurity foundations course covers essential concepts like operating systems, networking, security principles, and hands-on skills with tools used by professionals in the field. Whether you're exploring a new career, supporting security teams, or preparing for advanced training, SEC275 provides the critical knowledge needed to understand and engage with cybersecurity. With engaging content, practical labs, and expert instruction, you’ll gain the confidence and capability to take your next step in the cyber world. No prior experience required just curiosity and a drive to learn.Access Course Preview Now | Learn More About the Course

SEC301: Introduction to Cyber Security

Beginner Level | 5 Days (Instructor-Led) | 30 Hours (Self-Paced) | 14 Hands-On Lab(s) SEC301 is designed for cyber-adjacent professionals, managers, HR, legal, auditors, and other non-technical roles who need a strong foundation in cybersecurity fundamentals. Through engaging instruction and relatable examples, this course builds confidence in key areas like threats, risks, defenses, and cyber hygiene. Whether you're supporting a security team, shaping policy, or guiding business decisions, SEC301 helps you understand the language of cybersecurity and your role in protecting the organization. No technical experience required just curiosity and a desire to be cyber smart.Access Course Preview Now | Learn More About the Course

SEC402: Cybersecurity Writing: Hack the Reader

Essential Skill Level | 12 Hours (Self-Paced) | 12 CPEs Want to write better? Learn to hack the reader! Discover how to find an opening, break down your readers' defenses, and capture their attention to deliver your message-even if they are too busy or indifferent to others' writing. This unique course, built exclusively for cybersecurity professionals, will strengthen your writing skills and boost your security career.Access Course Preview Now | Learn More About the Course

SEC403: Secrets to Successful Cybersecurity Presentation

Essential Skill Level | 6 Hours (Self-Paced) | 6 CPEs SEC403 shows you how to put together an effective security briefing, secure the interest and engagement of your audience, and confidently deliver presentations to a variety of groups. You will learn effective techniques to secure management approval for new security projects and tools, as well as how to handle the toughest questions and adjust on-the-fly. Designed exclusively for cybersecurity professionals, this course covers best practices for common security presentations such as penetration testing reports, security assessment reports, incident updates, after-action reports, security awareness briefings, and more.Access Course Preview Now | Learn More About the Course

FOR498: Digital Acquisition and Rapid Triage

Essential Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 20 Hands-On Lab(s) FOR498, a digital forensic acquisition training course, provides the necessary skills to identify the many and varied data storage mediums in use today, and how to collect and preserve this data in a forensically sound manner despite how and where it may be stored. It covers digital acquisition from computers, portable devices, networks, and the cloud. It then teaches the student Battlefield Forensics, or the art and science of identifying and starting to extract actionable intelligence from a hard drive in 90 minutes or less.Access Course Preview Now | Learn More About the Course

FOR500: Windows Forensic Analysis

Essential Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 22 Hands-On Lab(s) FOR500 builds in-depth and comprehensive digital forensics knowledge of Microsoft Windows operating systems by analyzing and authenticating forensic data as well as track detailed user activity and organize findings. It teaches students to apply digital forensic methodologies to a variety of case types and situations, allowing them to apply in the real world the right methodology to achieve the best outcome.Access Course Preview Now | Learn More About the Course

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 35 Hands-On Lab(s) Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems. The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done worse damage to the organization. For the incident responder, this process is known as "threat hunting".FOR508 teaches advanced skills to hunt, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivists.Access Course Preview Now | Learn More About the Course

FOR509: Enterprise Cloud Forensics and Incident Response

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 23 Hands-On Lab(s) FOR509: Enterprise Cloud Forensics and Incident Response addresses today's need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the Cloud.Access Course Preview Now | Learn More About the Course

FOR518: Mac and iOS Forensic Analysis and Incident Response

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 23 Hands-On Lab(s) FOR518 is the first non-vendor-based Mac and iOS incident response and forensics course that focuses students on the raw data, in-depth detailed analysis, and how to get the most out of their Mac and iOS cases. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device.Access Course Preview Now | Learn More About the Course

FOR528: Ransomware and Cyber Extortion

Intermediate Skill Level | 4 Days (Instructor-Led) | 24 Hours (Self-Paced) | 13 Hands-On Lab(s) Ransomware attackers have become more sophisticated, and their techniques constantly evolve. It is a threat that requires an immediate response, especially in the enterprise. FOR528: Ransomware and Cyber Extortion covers the entire life cycle of an incident, from initial detection to incident response and postmortem analysis. While there is no way to prepare for every scenario possible, our course uses deftly devised, real-world attacks and their subsequent forensic artifacts to provide you, the analyst, with all that you need to respond when the threat become a reality.Access Course Preview Now | Learn More About the Course

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

Advanced Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 20 Hands-On Lab(s) Whether you handle an intrusion incident, data theft case, employee misuse scenario, or are engaged in proactive adversary discovery, the network often provides an unparalleled view of the incident. SANS FOR572 covers the tools, technology, and processes required to integrate network evidence sources into your investigations to provide better findings, and to get the job done faster.Access Course Preview Now | Learn More About the Course

FOR577: LINUX Incident Response and Threat Hunting

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 23 Hands-On Lab(s) FOR577 teaches the skills needed to identify, analyze, and respond to attacks on Linux platforms and how to use threat hunting techniques to find the stealthy attackers who can bypass existing controls. The course addresses today's incidents by teaching the hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to combat real-world breach cases. Access Course Preview Now | Learn More About the Course

FOR578: Cyber Threat Intelligence

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 20 Hands-On Lab(s) Cyber threat intelligence represents a force multiplier for organizations looking to update their response and detection programs to deal with increasingly sophisticated advanced persistent threats. Malware is an adversary's tool but the real threat is the human one, and cyber threat intelligence focuses on countering those flexible and persistent human threats with empowered and trained human defenders. During a targeted attack, an organization needs a top-notch and cutting-edge threat hunting or incident response team armed with the threat intelligence necessary to understand how adversaries operate and to counter the threat. FOR578: Cyber Threat Intelligence will train you and your team in the tactical, operational, and strategic level cyber threat intelligence skills and tradecraft required to make security teams better, threat hunting more accurate, incident response more effective, and organizations more aware of the evolving threat landscape.Access Course Preview Now | Learn More About the Course

FOR585: Smartphone Forensic Analysis In-Depth

Essential Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 22 Hands-On Lab(s) FOR585: Smartphone Forensic Analysis In-Depth course provides examiners and investigators with advanced skills to detect, decode, decrypt, and correctly interpret evidence recovered from mobile devices. The course is continuously updated to keep up with the latest file formats, malware, smartphone operating systems, third-party applications, acquisition shortfalls, extraction techniques (how to get full file system or physical access) and encryption. It offers the most unique and current instruction to arm you with mobile device forensic knowledge you can immediately apply to cases you're working on the day you get back to work.Access Course Preview Now | Learn More About the Course

FOR589: Cybercrime Intelligence

Intermediate Skill Level | 5 Days (Instructor-Led) | 30 Hours (Self-Paced) | 20 Hands-On Lab(s) The cybercrime landscape is perpetually evolving, driven by technological advancements, increased investments by nation-states in offensive cyber operations, and a dynamic cybercrime ecosystem that continuously lowers the barriers for novice criminals to collaborate with more sophisticated actors. FOR589 offers a comprehensive exploration of the cybercrime underground, detailing a broad spectrum of tactics and techniques used by cybercriminals to target organizations. This course includes over twenty hands-on labs and a final capstone exercise, equipping analysts with the skills necessary to enhance their organization's defenses, proactively gather critical intelligence, trace cryptocurrency proceeds of crime, and generate actionable insights to protect their organization preemptively.Access Course Preview Now | Learn More About the Course

FOR608: Enterprise-Class Incident Response & Threat Hunting

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 20 Hands-On Lab(s) FOR608: Enterprise-Class Incident Response & Threat Hunting focuses on identifying and responding to incidents too large to focus on individual machines. By using example tools built to operate at enterprise-class scale, students learn the techniques to collect focused data for incident response and threat hunting, and dig into analysis methodologies to learn multiple approaches to understand attacker movement and activity across hosts of varying functions and operating systems by using an array of analysis techniques.Access Course Preview Now | Learn More About the Course

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Advanced Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 48 Hands-On Lab(s) Learn to turn malware inside out! This popular course explores malware analysis tools and techniques in depth. FOR610 training has helped forensic investigators, incident responders, security engineers, and IT administrators acquire the practical skills to examine malicious programs that target and infect Windows systems.Access Course Preview Now | Learn More About the Course

FOR710: Reverse-Engineering Malware: Advanced Code Analysis

Advanced Skill Level | 36 Hours (Self-Paced) | 12 Hands-On Lab(s) Developing deep reverse-engineering skills requires consistent practice. FOR710: Reverse-Engineering Malware - Advanced Code Analysis prepares malware specialists to dissect sophisticated Windows executables, such as those that dominate the headlines and preoccupy incident response teams across the globe. This course not only includes the necessary background and instructor-led walk throughs, but also provides students with numerous opportunities to tackle real-world reverse engineering scenarios during class.Access Course Preview Now | Learn More About the Course

ICS310: ICS Cybersecurity Foundations

Beginner Level | 6 Hours (Self-Paced) | 3 Hands-On Lab(s) The world relies on Critical Infrastructure for all aspects of daily life. All sectors within critical infrastructure have integrated ICS and OT into key operational components of the services they provide. With the movement toward these unique digital devices, there is a corresponding need for a uniquely skilled, diverse workforce with an understanding of Engineering, Operations, IT/OT, and cybersecurity skills. With many practitioners entering the field and a demand to rapidly expand capabilities and ICS maturity around the world, we have introduced a short, easily consumable, foundational ICS course for those individuals entering this space. This short course can act as the foundation for those looking to expand their understanding of operations and ICS or gain a better understanding of the cybersecurity threats they are facing, or potentially identify some immediate cybersecurity controls to pursue. The course may also serve as a great prerequisite for other ICS courses. Covering key topic areas and including hands-on labs to expose those new to the field, the ICS310 course is a great fit for the critical infrastructure workforce of the future.Access Course Preview Now | Learn More About the Course

ICS410: ICS/SCADA Security Essentials

Essential Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 15 Hands-On Lab(s) ICS410: ICS/SCADA Security Essentials provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. The course is designed to ensure that the workforce involved in supporting and defending industrial control systems is trained to keep the operational environment safe, secure, and resilient against current and emerging cyber threats.Access Course Preview Now | Learn More About the Course

ICS418: ICS Security Essentials for Leaders

Essential Skill Level | 12 Hours (Self-Paced) | 12 Hands-On Lab(s) The ICS418: ICS Security Essentials for Leaders course empowers leaders responsible for securing critical infrastructure and operational technology environments. The course addresses the need for dedicated ICS security programs, the teams that run them, and the skills required to map industrial cyber risk to business objectives to prioritize safety. ICS418 will help you lead the people, processes, and technologies necessary to create and sustain lasting ICS cyber risk programs while promoting a culture of safety, reliability, and security.Access Course Preview Now | Learn More About the Course

ICS456: Essentials for NERC Critical Infrastructure Protection

Essential Skill Level | 5 Days (Instructor-Led) | 31 Hours (Self-Paced) | 23 Hands-On Lab(s) The ICS456: Essentials for NERC Critical Infrastructure Protection course empowers students with knowledge of the what and the how of the version 5/6/7 standards. The course addresses the role of the Federal Energy Regulatory Commission (FERC), North American Electric Reliability Corporation (NERC), and Regional Entities, provides multiple approaches for identifying and categorizing BES Cyber Systems, and helps asset owners determine the requirements applicable to specific implementations.Access Course Preview Now | Learn More About the Course

ICS515: ICS Visibility, Detection, and Response

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 22 Hands-On Lab(s) ICS515: ICS Visibility, Detection, and Response will help you gain visibility and asset identification in your Industrial Control System (ICS)/Operational Technology (OT) networks, monitor for and detect cyber threats, deconstruct ICS cyber attacks to extract lessons learned, perform incident response, and take an intelligence-driven approach to executing a world-leading ICS cybersecurity program to ensure safe and reliable operations. Note: This class was previously named ICS515: ICS Active Defense and Incident Response. The course has gone through a significant update changing much of the content, most of the labs, and adding a day in course length.Access Course Preview Now | Learn More About the Course

SEC504: Hacker Tools, Techniques, and Incident Handling

Essential Skill Level | 6 Days (Instructor-Led) | 38 Hours (Self-Paced) | 44 Hands-On Lab(s) Transform your incident response skills and get into the mindset of attackers with SEC504 training. Through 30+ hands-on labs, you'll learn to investigate cybersecurity incidents, develop threat intelligence, and apply defense strategies against real-world threats. From password attacks to MFA bypass techniques on cloud services, this course takes you deep into the latest hacker tactics. Engage with cutting-edge tools and simulate live attacks to sharpen your defensive capabilities, all while preparing for the GIAC GCIH certification. You'll leave ready to defend both cloud and on-premises environments against evolving cyber threats.Access Course Preview Now | Learn More About the Course

SEC542: Web App Penetration Testing and Ethical Hacking

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 35 Hands-On Lab(s) SEC542 enables students to assess a web application's security posture and convincingly demonstrate the business impact should attackers exploit the discovered vulnerabilities. You will practice the art of exploiting web applications to find flaws in your enterprise's web apps. You'll learn about the attacker's tools and methods and, through detailed hands-on exercises, you will learn a best practice process for web application penetration testing, inject SQL into back-end databases to learn how attackers exfiltrate sensitive data, and utilize cross-site scripting attacks to dominate a target infrastructure. Access Course Preview Now | Learn More About the Course

SEC556: IoT Penetration Testing

Intermediate Skill Level | 3 Days (Instructor-Led) | 18 Hours (Self-Paced) | 13 Hands-On Lab(s) SEC556 facilitates examining the entire IoT ecosystem, helping you build the vital skills needed to identify, assess, and exploit basic and complex security mechanisms in IoT devices. This course gives you tools and hands-on techniques necessary to evaluate the ever-expanding IoT attack surface.Access Course Preview Now | Learn More About the Course

SEC560: Enterprise Penetration Testing

Intermediate Skill Level | 6 Days (Instructor-Led) | 36 Hours (Self-Paced) | 30 Hands-On Lab(s) SEC560 prepares you to conduct successful penetration testing for entire modern enterprises, including on-prem systems, Azure, and Entra ID. The course doesn't just focus on network devices, Windows, Linux, macOS, identity systems, etc. - instead, it focuses on the combined business risk of the entire enterprise. You will learn the methodology and techniques used by real-world penetration testers in large organizations to identify and exploit vulnerabilities at scale and show real business risk to your organization. The course material is complemented with 30+ practical lab exercises concluding with an intensive, hands-on Capture-the-Flag exercise in which you will conduct a penetration test against a target organization and demonstrate what you've learned.Access Course Preview Now | Learn More About the Course

Test Drive World-Class SANS Cybersecurity Training Courses

Preview real course content, watch industry-leading instructors in action, and determine the difficulty level that aligns with your experience—all before you enroll.

Jump to:

AI
Cyber Defense
Cloud
Essentials
DFIR
ICS
Offensive Operations
Leadership

Get a Free Hour of SANS Training

Experience SANS Cyber Security Training through course demos, available for 65+ courses. Preview course content, see our top instructors in action, evaluate difficulty level, and try out our OnDemand training platform.

Register for your course from within the demo or navigate to your preferred course page to learn more, search training formats, and register.

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Test Drive World-Class SANS Cybersecurity Training Courses

Get a Free Hour of SANS Training

Artificial Intelligence Course Previews

Cyber Defense Course Previews

Cloud Security Course Previews

Cybersecurity and IT Essentials Course Previews

Digital Forensics & Incident Response Course Previews

Industrial Control Systems Course Previews

Offensive Operations, Pen Testing and Red Teaming Course Previews

Cybersecurity Leadership Course Previews

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Test Drive World-Class SANS Cybersecurity Training Courses

Get a Free Hour of SANS Training

Artificial Intelligence Course Previews

AIS247: AI Security Essentials for Business Leaders

SEC411: AI Security Principles and Practices: GenAI and LLM Defense

SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG

Cyber Defense Course Previews

SEC401: Security Essentials - Network, Endpoint, and Cloud

SEC406: Linux Security for InfoSec Professionals

SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

SEC497: Practical Open-Source Intelligence (OSINT)

SEC501: Advanced Security Essentials - Enterprise Defender

SEC503: Network Monitoring and Threat Detection In-Depth

SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

SEC547: Defending Product Supply Chains

SEC555: Detection Engineering and SIEM Analytics

SEC573: Automating Information Security with Python

SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

SEC673: Advanced Information Security Automation with Python

Cloud Security Course Previews

SEC480: AWS Secure Builder

SEC510: Cloud Security Engineering and Controls Leadership

SEC522: Application Security: Securing Web Applications, APIs, and Microservices

SEC540: Cloud Native Security and DevSecOps Automation

SEC541: Cloud Security Threat Detection

SEC545: GenAI and LLM Application Security

SEC549: Cloud Security Architecture

Cybersecurity and IT Essentials Course Previews

SEC275: Foundations: Computers, Technology & Security

SEC301: Introduction to Cyber Security

SEC402: Cybersecurity Writing: Hack the Reader

SEC403: Secrets to Successful Cybersecurity Presentation

Digital Forensics & Incident Response Course Previews

FOR498: Digital Acquisition and Rapid Triage

FOR500: Windows Forensic Analysis

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

FOR509: Enterprise Cloud Forensics and Incident Response

FOR518: Mac and iOS Forensic Analysis and Incident Response

FOR528: Ransomware and Cyber Extortion

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

FOR577: LINUX Incident Response and Threat Hunting

FOR578: Cyber Threat Intelligence

FOR585: Smartphone Forensic Analysis In-Depth

FOR589: Cybercrime Intelligence

FOR608: Enterprise-Class Incident Response & Threat Hunting

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

FOR710: Reverse-Engineering Malware: Advanced Code Analysis

Industrial Control Systems Course Previews

ICS310: ICS Cybersecurity Foundations

ICS410: ICS/SCADA Security Essentials

ICS418: ICS Security Essentials for Leaders

ICS456: Essentials for NERC Critical Infrastructure Protection

ICS515: ICS Visibility, Detection, and Response

Offensive Operations, Pen Testing and Red Teaming Course Previews

SEC504: Hacker Tools, Techniques, and Incident Handling

SEC542: Web App Penetration Testing and Ethical Hacking

SEC556: IoT Penetration Testing

SEC560: Enterprise Penetration Testing

SEC565: Red Team Operations and Adversary Emulation

SEC575: iOS and Android Application Security Analysis and Penetration Testing

SEC580: Metasploit for Enterprise Penetration Testing

SEC588: Cloud Penetration Testing

SEC598: AI and Security Automation for Red, Blue, and Purple Teams

SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses

SEC617: Wireless Penetration Testing and Ethical Hacking

SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking

SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control

SEC699: Advanced Purple Teaming - Adversary Emulation & Detection Engineering

SEC760: Advanced Exploit Development for Penetration Testers

Cybersecurity Leadership Course Previews

AIS247: AI Security Essentials for Business Leaders

LDR414: SANS Training Program for CISSP® Certification

LDR419: Performing A Cybersecurity Risk Assessment

LDR433: Managing Human Risk

LDR512: Security Leadership Essentials for Managers

LDR514: Security Strategic Planning, Policy, and Leadership

LDR516: Strategic Vulnerability and Threat Management