SANS Baltimore 2027

Cybersecurity Training Built Around the Whole Incident, From Alert to Attribution

SANS Baltimore 2027 is a cybersecurity training event running May 17-22 at the Baltimore Marriott Inner Harbor at Camden Yards, in-person and online. Courses cover network monitoring, incident handling, forensics, cybercrime investigations, penetration testing, application and cloud-native security, ICS security, AI, and security leadership, most leading to a GIAC certification exam.

From Packet Analysis to Cybercrime Investigations

Incidents move through stages, and each stage usually lands on a different person. Someone spots odd traffic, someone contains the affected host, someone reconstructs what the attacker did, and someone works out who was behind it. This cybersecurity training lineup covers that whole chain: network monitoring and incident handling at the front, Windows and enterprise forensics in the middle, and cybercrime investigations and open-source intelligence at the end, where the question becomes who did it.

The surrounding courses cover what that chain protects: application security, cloud-native DevSecOps, applied AI and machine learning, and ICS/SCADA security, alongside penetration testing and security architecture. Two leadership courses, one for managers and one for leaders steering AI and cloud adoption, mean an incident lead and a security manager can attend the same week.

Why Attend Baltimore 2027

• Courses are taught by instructors who are frontline experts in the field they teach, so the forensics, detection, and application security labs come from real practice.
• Most courses here have a matching GIAC certification exam, giving you a credential for the skills after the week ends.
• Baltimore sits between Washington and Fort Meade, home to the NSA and U.S. Cyber Command, so the room tends to include federal, defense, and healthcare practitioners.
• The Baltimore Marriott Inner Harbor at Camden Yards is in the city’s Arts and Entertainment district, near Oriole Park at Camden Yards and the Baltimore Convention Center.

Why Organizations Send Teams

• Federal and defense roles carry qualification requirements. DoD Manual 8140.03 sets qualification standards for DoD cyber workforce roles, and many GIAC certifications are approved for specific roles.
• Run one process from alert to root cause. When the people who monitor, respond, and investigate learn the same method together, the handoffs between them get shorter.
• Build the skills the hiring market is slow to supply. Cybercrime investigators, cloud-native engineers, and application security specialists are hard to recruit, and training existing staff is usually the faster route.
• Credentials that survive scrutiny. GIAC is accredited by ANAB under ISO/IEC 17024, so a manager can point to a recognized standard when documenting who on the team is qualified for what.

Course Highlights

• Spot intrusions in live traffic, including threats with no published signature, in Network Monitoring and Threat Detection In-Depth.
• Hunt, contain, and investigate intrusions across enterprise networks in Advanced Incident Response, Threat Hunting, and Digital Forensics.
• Track cybercriminals and trace cryptocurrency proceeds in Cybercrime Investigations.
• Plan secure AI and cloud adoption, including governance and roadmaps, in Emerging Trends for Cyber Leaders: AI and Cloud.