SANS AI Cybersecurity Summit Fall 2026

Summit: Nov 2–3
Duration:
12 CPEs (Summit Only)
English

Hilton Arlington Rosslyn The Key & Virtual (ET)

1900 Fort Myer Dr, Arlington, VA 22209, United States

▸Hit Play. Engage Transmission.

A 2-minute intel drop from the frontlines of AI security.

Turbo Boost Engaged

T-MINUS

Days

Hrs

Min

Sec

In the unlit corridors of the network, threats move faster than policy can follow.

One defender stands watch between the perimeter and the breach — unseen, unsleeping, unyielding.

Every login is a test of trust. Every packet, a possibility.

THIS IS THE WATCH. AI CYBERSECURITY SUMMIT — FALL 2026.

SANS AI Cybersecurity Summit attendees in the main session room

Fireside discussion panel at the SANS AI Cybersecurity Summit

Technical Talks
Keynotes, fireside discussions, and lightning talks from practitioners building and defending with AI today.
Hands-On Workshops
Get hands-on with emerging AI security challenges, tools, and techniques.
Connect with Practitioners and Peers
Connect with speakers and fellow attendees to compare approaches, share what’s working, and talk through the hard problems.

Jump to:

Speakers
Schedule
Registration / Courses
Advisory Board / Summit Chairs
Sponsors
Hotel

Featured Speakers

Morgan Adamski

Principal, Cyber, Data, and Tech Risk Leader

PWC

Michael Collins

Senior Principal Security Engineer

Mastercard

Sergej Epp

CISO

Sysdig

Gadi Evron

Founder and CEO

Knostic

Jeremiah Grossman

Chief Executive Officer

Root Evidence

Katie Moussouris

Founder and CEO

Luta Security

Summit: Nov 2-3 | Summit Co-Chairs: Rob T Lee and Sounil Yu | CPE Credits: 12

What's Next in AI Security

The SANS AI Cybersecurity Summit brings together many of today's most influential voices in AI and cybersecurity to explore how AI is being applied across the security community. From using AI to strengthen security operations to understanding AI-powered attacks, you'll hear practical perspectives from practitioners who are testing, building, and defending with these technologies every day.

Join us in Arlington, VA, to connect with cybersecurity professionals, AI and machine learning experts, and peers who are sharing real-world experiences, innovative approaches, and lessons learned. Through keynotes, technical sessions, lightning talks, and hands-on workshops, you'll discover practical ways to evaluate, adopt, and apply AI in your own environment.

Whether you're leading an AI strategy, evaluating new capabilities for your organization, or putting AI to work in day-to-day security operations, you'll leave with practical insights you can apply right away, along with new connections to a community helping shape what's next.

"The Summit was incredibly insightful, bridging the gap between theoretical AI and practical cybersecurity execution. The focus on both offensive and defensive AI capabilities is exactly what the industry needs right now." - Khaled Ahmed Mossad

What Attendees Say

Slide 1 of 4
This is a critical information-sharing and educational experience, and certainly among the best that SANS hosts. I’d recommend this summit for anyone involved with AI.
Geoff ParkerDiebold Nixdorf Inc.
Slide 2 of 4
The workshop I selected was excellent, with a strong focus on practical labs, and I walked away feeling much more equipped to handle upcoming challenges in machine learning security.
Previous SANS AI Cybersecurity Summit Attendee
Slide 3 of 4
We can always rely on SANS for excellent educational data straight from the trenches.
J. Michael Butler
Slide 4 of 4
Wide array of relevant topics of concern for AI use and risk considerations. One of the best virtual events I've attended.
Eric Vollman

Schedule

Showing 16 of 32

Filter by:

Select day:

Breakfast and Credential Pick Up

Check in at the registration desk to pick up your Summit credentials, then enjoy a hot breakfast, freshly brewed coffee, and a selection of hot teas before the day’s sessions begin.

08:00AM - 09:00AM EST

In-Person

Opening Remarks

09:00AM - 09:10AM EST

In-Person & Virtual

Presented by

Rob T. Lee

Chief AI Officer and Chief of Research at SANS Institute

Sounil Yu

Co-founder and Chief AI Safety Officer at Knostic

KEYNOTE

09:10AM - 09:30AM EST

In-Person & Virtual

Presented by

Morgan Adamski

Principal, Cyber, Data, and Tech Risk Leader at PWC

KEYNOTE

09:35AM - 09:55AM EST

In-Person & Virtual

Presented by

Amy Herzog

VP/CISO at AWS

KEYNOTE

10:00AM - 10:20AM EST

In-Person & Virtual

Presented by

Vinh Nguyen

Senior Fellow for Artificial Intelligence at Council on Foreign Affairs

Break and Solutions Expo

Step away from the morning sessions to recharge and connect with fellow attendees. Enjoy coffee, tea, assorted soft drinks and juices, fresh fruit, and a featured snack. Be sure to visit the Solutions Expo to meet our Summit sponsors and explore the tools, services, and resources they offer.

10:25AM - 10:50AM EST

In-Person & Virtual

KEYNOTE

Speaker announcement coming soon!

10:50AM - 11:10AM EST

In-Person & Virtual

Fireside Chat with Keynote Speakers

11:15AM - 12:10PM EST

In-Person & Virtual

Panelists

Morgan Adamski

Principal, Cyber, Data, and Tech Risk Leader at PWC

Vinh Nguyen

Senior Fellow for Artificial Intelligence at Council on Foreign Affairs

Amy Herzog

VP/CISO at AWS

Lunch and Solutions Expo

Join your fellow Summit attendees for a delicious lunch and an opportunity to connect. After lunch, visit the Solutions Expo to meet our Summit sponsors and explore the tools, services, and resources they offer.

12:10PM - 01:10PM EST

In-Person & Virtual

Threat Intelligence Brief on AI

Speaker: John Hultquist, Chief Analyst, Google Threat Intelligence Group

01:10PM - 01:40PM EST

In-Person & Virtual

No Filter: An Unscripted Ask Us Anything

No-holds-barred Q&A. Ask your toughest questions.

Everyone's got an opinion on AI. Almost nobody says the quiet part out loud on stage. This session flips that. No slides, no talking points, no PR-approved answers, just Chris Cochran in the hot seat, taking your hardest, most uncomfortable questions live and unrehearsed.

Call for questions: We're opening a call for questions ahead of the Summit, submit the ones you've always wanted answered but never had the venue for. And we’ll be taking questions live from the room at the event, so come ready to put Chris on the spot.

Bring the questions people whisper about in hallway tracks but never dare put on a mic. The ones about the vendors overselling, the strategies quietly failing, and the uncomfortable truths the industry would rather leave in the parking lot. If it's a question worth asking, it's fair game here.

Questions like:

What's really driving AI layoffs?
Are we automating away the junior talent pipeline that the whole industry runs on?
When the AI screws up, who actually takes the fall, the vendor, the analyst, or the CISO who bought the dream?

01:45PM - 02:40PM EST

In-Person & Virtual

Presented by

Chris Cochran

Field CISO and Vice President of AI Security at SANS Institute

Break: Afternoon Refreshment

As you transition to workshops, enjoy an afternoon pick-me-up featuring coffee, tea, assorted sodas and juices, fruit, and a featured snack.

02:40PM - 03:00PM EST

WORKSHOP | Scoping AI Swarms: A Dynamic Approach to Incident Response

AI agent swarms continuously regenerate identities, accounts, and infrastructure, turning incident scoping and investigation into a moving target. Conventional incident response models are not designed to handle this new reality.

In this hands-on workshop, analysts will learn the Dynamic Approach to Incident Response (DAIR), a model that meets the needs of modern investigations, as they investigate a swarm intrusion. Bring your system to practice the dynamic response cycle: detect, verify, triage, scope, analyze, and rescope as the evidence changes. No AI account or prior forensics experience is required for the workshop.

03:00PM - 05:00PM EST

In-Person

Presented by

Joshua Wright

Director and Senior Security Analyst at CounterHack

WORKSHOP | Investigating AI Threats: Extending Incident Response to the Generative AI Layer

As organizations adopt generative AI on AWS, security teams need to extend their investigation capabilities into the AI layer. In this hands-on workshop, participants work through a realistic multi-phase incident.

Participants will trace a compromised credential from initial exposure through privilege escalation into Amazon Bedrock knowledge bases and AI agents. Using Amazon GuardDuty, AWS Security Hub, Amazon CloudTrail, and Amazon Athena, attendees reconstruct the full attack chain and walk away with the skills to detect, investigate, and respond when threat actors pivot from traditional cloud resources into generative AI workloads.

03:00PM - 05:00PM EST

In-Person

Presented by

Kyle Shields

Security Specialist Solutions Architect at AWS

WORKSHOP | Offensive AI in Practice - Hands on Exploitation of Vulnerable Applications Using Open Source Pentest Tools

Join us for a hands on lab experience focusing on the implementation side of AI based pentesting. Attendees will learn how to actively run open source AI backed pentest tools, and exploit open-source applications.

03:00PM - 05:00PM EST

In-Person

Presented by

Andy Dennis

Head of Field Engineering at XBOW

Bill Reyor

Lead Solutions Architect at XBOW

Summit Social

After a full day of AI insights, take the Summit experience to new heights at the SANS Evening Summit Social. Enjoy drinks and food while connecting with fellow attendees, speakers, and SANS experts.

05:30PM - 07:30PM EST

In-Person

Breakfast

Join us for networking and a hot breakfast, freshly brewed coffee, and a selection of hot teas before the day’s sessions begin.

08:00AM - 09:00AM EST

In-Person

Opening Remarks

09:00AM - 09:10AM EST

In-Person & Virtual

Presented by

Rob T. Lee

Chief AI Officer and Chief of Research at SANS Institute

Sounil Yu

Co-founder and Chief AI Safety Officer at Knostic

KEYNOTE

09:10AM - 09:30AM EST

In-Person & Virtual

Presented by

Joshua Corman

Executive in Residence for Public Safety and Resilience, Lead of UnDisruptable27 at Institute for Security and Technology (IST)

KEYNOTE

09:35AM - 09:55AM EST

In-Person & Virtual

Presented by

Michael Collins

Senior Principal Security Engineer at Mastercard

KEYNOTE | Rethinking the AI Harness

10:00AM - 10:20AM EST

In-Person & Virtual

Presented by

Daniel Miessler

Break and Solutions Expo

10:25AM - 10:50AM EST

In-Person

KEYNOTE

Speaker announcement coming soon!

10:50AM - 11:10AM EST

In-Person & Virtual

Keynote Fireside Chat

11:15AM - 12:10PM EST

In-Person & Virtual

Panelists

Michael Collins

Senior Principal Security Engineer at Mastercard

Daniel Miessler

Joshua Corman

Executive in Residence for Public Safety and Resilience, Lead of UnDisruptable27 at Institute for Security and Technology (IST)

Moderated by

Rob T. Lee

Chief AI Officer and Chief of Research at SANS Institute

Lunch and Solutions Expo

12:10PM - 01:10PM EST

Panel Discussion: The Looming AI Cyber Disaster - Myth or Reality

New speaker announcement coming soon!

01:10PM - 02:10PM EST

In-Person & Virtual

Panelists

Katie Moussouris

Founder and CEO at Luta Security

Gadi Evron

Founder and CEO at Knostic

Jeremiah Grossman

Chief Executive Officer at Root Evidence

Sergej Epp

CISO at Sysdig

Marcus Hutchins

Cybersecurity Speaker | Principal Threat Researcher | Ex-Hacker

Facilitated by

Ciaran Martin

Professor, Non-Executive Director, SANS Cyber Leaders Network at SANS

Find Evil! Hackathon: How the Winners Built Autonomous DFIR Agents

The SANS Find Evil! Hackathon challenged participants to build open-source, autonomous DFIR agents capable of analyzing real forensic evidence, tracing conclusions back to verified artifacts, and correcting their own mistakes.

Join first-place winner Caleb Evans and second-place winner Trinity Harrison as they share how they approached the challenge and built two distinct investigative agents. Caleb will introduce Mulder, which conducts a five-phase investigation across disk, memory, network, mobile, and log evidence, then challenges its own conclusions before producing a report. Trinity will discuss TRUDI, a hypothesis-driven agent that uses independent reasoning and adversarial review to identify unsupported claims and reconsider its findings when the evidence disagrees. Caleb and Trinity will walk through how they built their agents, what broke along the way, and where autonomous AI helps and where it still needs a human investigator. Both winning tools are open source, and both are expected to be included in a future release of the SANS SIFT Workstation.

02:10PM - 02:40PM EST

In-Person & Virtual

Presented by

Caleb Evans

Software Engineer, Agents at Airbyte

Trinity Harrison

Principal Software Engineer

Break and Workshop Transition

As you transition to workshops enjoy an afternoon pick-me-up featuring coffee, tea, assorted sodas and juices, fruit, and a featured snack.

02:45PM - 03:00PM EST

In-Person

WORKSHOP | Delegating Security Work to AI Agents Without Losing Control

Security teams are starting to hand their AI agents real work, such as triaging alerts, isolating endpoints, and disabling accounts. Each team must decide how much of that work its agents may do without a person approving each action. In this workshop, you’ll learn to choose which tasks an agent may handle on its own, and where a person must approve, override, or roll back its actions.

I’ll walk you through how one security operations team made those choices for its AI agents. In small groups, you’ll then debate the decisions you’d change, such as letting an agent isolate endpoints without approval. You’ll leave ready to run the same debate with your own team.

03:00PM - 05:00PM EST

In-Person

Presented by

Lenny Zeltser

WORKSHOP |Finding Evil with Mulder: A Hands-On Autonomous DFIR

What does an autonomous digital forensic investigation look like in practice? In this hands-on workshop, Find Evil! Hackathon winner Caleb Evans will introduce participants to Mulder, his open-source, agentic DFIR platform built for the SANS SIFT Workstation. Participants will explore how Mulder moves through a five-phase investigation, cataloging forensic evidence, extracting and correlating artifacts across systems, developing findings, challenging its own conclusions, and producing a structured incident report.

Caleb will demonstrate how Mulder uses established forensic tools while maintaining an auditable trail that connects every finding to the underlying evidence.

Along the way, participants will learn how Mulder addresses some of the greatest challenges associated with autonomous AI, including hallucinations, unsupported conclusions, incomplete analysis, and the need for human-verifiable results. Attendees will leave with a practical understanding of how AI agents can accelerate DFIR investigations while preserving evidence integrity, transparency, and analyst oversight.

03:00PM - 05:00PM EST

In-Person

Presented by

Caleb Evans

Software Engineer, Agents at Airbyte

WORKSHOP | AI-Assisted Penetration Testing: Driving Pedram Amini Agents Against Live Targets

Most AI security sessions show you a tool. This one puts attendees behind the keyboard driving one.

Attendees work in an isolated firing range, using an agent to run a real assessment workflow end to end: reconnaissance against a live target subnet, web application testing, and code analysis. A short demonstration opens each segment and the rest is hands-on. Attendees extend the agent with their own skills and tool definitions, then check its output and learn where it is trustworthy and where it is confidently wrong.

The material is drawn from SEC590, the five-day AI-driven penetration testing course we are building for the Offensive Operations curriculum, with an alpha run planned for early 2027. This is the first public look at it.

Key takeaways:

- How to scope and prompt a coding agent for recon and web application testing, rather than treating it as a chat window

- How to extend an agent with custom skills and tool definitions that persist across engagements

- How to verify agent findings and recognize the failure modes: invented vulnerabilities, false confidence, unsafe actions

- An honest read on what AI can and cannot do in an offensive engagement today

- Working agent configurations attendees keep and reuse after the Summit

Target audience: Intermediate. Penetration testers, red teamers, and security engineers who are comfortable on a command line and have done some offensive testing. No AI or machine learning background needed. We start from the practitioner's view, not the researcher's.

03:00PM - 05:00PM EST

In-Person

Presented by

Pedram Amini

Chief Scientist at OPSWAT

Cyber Leaders Podcast Recording!

03:00PM - 05:00PM EST

In-Person

Register

Summit Registration

$100 USD

$525 USD*Prices exclude applicable local taxes

In personIncludes

Keynotes, fire-side discussions, lightning talks
Hands-on workshops
Unmatched Networking
Evening Reception
Access to Solutions Expo
Light Breakfast, Lunch, and Breaks with Snacks and Beverages
First Access to Approved Recordings and Decks
A SANS AI Cybersecurity Summit registration includes virtual access to [un]prompted II, October 27-29, 2026, in San Francisco, CA, at no additional cost. Access details will be sent to online ticket holders.

Attend In PersonLogin to register

$100 USD*Prices exclude applicable local taxes

Live onlineIncludes

Access to Select Talks
Interactive Chat on Slack
First Access to Approved Recordings and Decks
A SANS AI Cybersecurity Summit online registration includes virtual access to [un]prompted II, October 27-29, 2026, in San Francisco, CA, at no additional cost. Access details will be sent to online ticket holders.

Important Dates

Refund Deadline:: October 14, 2026
Hotel Group Discount Deadline:: October 9, 2026

Summit Chairs

Rob T. Lee

Chief AI Officer and Chief of Research

Rob T. Lee is Chief AI Officer and Chief of Research at SANS Institute, where he leads research, mentors faculty, and helps cybersecurity teams and executive leaders prepare for AI and emerging threats.

Learn more

Sounil Yu

Co-founder and Chief AI Safety Officer

Sounil Yu is the Founder and CTO of Knostic, and a leading voice in AI cybersecurity innovation. He is the creator of the Cyber Defense Matrix and the DIE Resiliency Framework.

Learn more

Thank You To Our Sponsors

Hilton Arlington Rosslyn The Key

Hotel Special Rates and Reservations

A special discounted rate of $229.00 S/D plus applicable taxes will be honored based on space availability. A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID.

Overnight self-parking will be discounted to $30 for attendees who book through the links below. Daily drive-in self-parking will be discounted to $20 for SANS attendees.

These rates include Internet in your room and are only available through Friday, October 9, 2026.

Book a Regular Reservation Book a Government Per Diem Reservation

3 Reasons To Stay At The Event Venue

Ultimate Convenience
Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities - all in one centralized, convenient location.
Seamless Networking Opportunities
Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders - from impromptu conversations in the lobby to exclusive after-hours events.
All Day, All Event Access
SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.

Business People Shaking Hands and Smiling

Additional Information

Overnight self-parking will be discounted to $30 for attendees who book in the SANS room block. Daily drive-in self-parking will be discounted to $20 for SANS attendees. Venue Parking Details - Self-Parking: $45 per day Rate listed is prevailing and subject to change. Alternative Parking Options - SANS recommends researching nearby parking facilities for more options. Popular parking apps that can help you locate and reserve space during your training: SpotHero, ParkMobile, and ParkWhiz. Distance from Nearby Airport: - Reagan Washington National Airport (DCA): Approximately 4.0 miles. - Dulles International Airport (IAD): Approximately 2.8 miles

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS AI Cybersecurity Summit Fall 2026

Share

Featured Speakers

What's Next in AI Security

What Attendees Say

Schedule

Breakfast and Credential Pick Up

Opening Remarks

KEYNOTE

KEYNOTE

KEYNOTE

Break and Solutions Expo

KEYNOTE

Fireside Chat with Keynote Speakers

Lunch and Solutions Expo

Threat Intelligence Brief on AI

No Filter: An Unscripted Ask Us Anything

Break: Afternoon Refreshment

WORKSHOP | Scoping AI Swarms: A Dynamic Approach to Incident Response

WORKSHOP | Investigating AI Threats: Extending Incident Response to the Generative AI Layer

WORKSHOP | Offensive AI in Practice - Hands on Exploitation of Vulnerable Applications Using Open Source Pentest Tools

Summit Social

Breakfast

Opening Remarks

KEYNOTE

KEYNOTE

KEYNOTE | Rethinking the AI Harness

Break and Solutions Expo

KEYNOTE

Keynote Fireside Chat

Lunch and Solutions Expo

Panel Discussion: The Looming AI Cyber Disaster - Myth or Reality

Find Evil! Hackathon: How the Winners Built Autonomous DFIR Agents

Break and Workshop Transition

WORKSHOP | Delegating Security Work to AI Agents Without Losing Control

WORKSHOP |Finding Evil with Mulder: A Hands-On Autonomous DFIR

WORKSHOP | AI-Assisted Penetration Testing: Driving Pedram Amini Agents Against Live Targets

Cyber Leaders Podcast Recording!

Register

Summit Registration

Summit Chairs

Rob T. Lee

Sounil Yu

Thank You To Our Sponsors

Hilton Arlington Rosslyn The Key

3 Reasons To Stay At The Event Venue

Ultimate Convenience

Seamless Networking Opportunities

All Day, All Event Access

Additional Information

Hilton Arlington Rosslyn The Key

Travel Arrangements and Directions

Hilton "Find Your Perfect Match" Status Match Promotion

Save on Delta Flights to SANS Events

Save On United Flights To SANS Events

SANS North America Summits Volunteer Program

Breakfast and Credential Pick Up

Opening Remarks

KEYNOTE

KEYNOTE

KEYNOTE

Break and Solutions Expo

KEYNOTE

Fireside Chat with Keynote Speakers

Lunch and Solutions Expo

Threat Intelligence Brief on AI

No Filter: An Unscripted Ask Us Anything

Break: Afternoon Refreshment

WORKSHOP | Scoping AI Swarms: A Dynamic Approach to Incident Response

WORKSHOP | Investigating AI Threats: Extending Incident Response to the Generative AI Layer

WORKSHOP | Offensive AI in Practice - Hands on Exploitation of Vulnerable Applications Using Open Source Pentest Tools

Summit Social

Breakfast

Opening Remarks

KEYNOTE

KEYNOTE

KEYNOTE | Rethinking the AI Harness

Break and Solutions Expo

KEYNOTE