SANS Boston 2027

Offensive Cybersecurity Training, With the Blue Side to Match

SANS Boston 2027 is a cybersecurity training event running March 1-6 at the Hilton Boston Park Plaza, in-person and online. Courses cover red team operations at two levels, cloud and mobile penetration testing, detection engineering, ICS visibility, AI security automation, and cybersecurity governance, most leading to a GIAC certification exam.

Two Levels of Red Team, Running the Same Week

Offensive testing is how most organizations find out what their controls actually do under pressure. Two red team courses here teach that testing at different experience levels: red team operations for teams building the capability for the first time, and advanced red team operations for operators already working on evasion and covert infrastructure, where the real test is whether detection fires at all.

Cloud and mobile penetration testing cover the surfaces attackers reach first. Detection engineering and ICS visibility run the same week on the defensive side, with AI security automation sitting between the two, so sending a red and a blue practitioner together works well here.

Why Attend Boston 2027

• SANS instructors are still working practitioners, which is why the lab scenarios resemble real client environments rather than textbook examples.
• Most courses have a matching GIAC certification exam, so what you learn is testable and portable afterward.
• Boston's security community skews toward hospital systems, biotech, finance, and universities, which makes for varied hallway conversation during the week.
• The Hilton Boston Park Plaza is a 1927 landmark a block south of the Public Garden, with Arlington Station on the Green Line a three-minute walk from the door and the Theater District next door.

Why Organizations Send Teams

• Find out what your controls do before an attacker does. Offensive testing run by your own people, on your own schedule, surfaces gaps while there's still time to close them quietly.
• Sector rules apply whether or not the team is ready for them. Organizations here work under HIPAA, GLBA, PCI DSS, and Massachusetts 201 CMR 17.00, all of which expect demonstrable security practice rather than documented intent.
• Grow capability the hiring market can't supply quickly. Red team, cloud, and detection skills are among the hardest roles to fill, and developing them internally beats waiting out a search.
• Give the team a shared, external standard. GIAC certifications are independently accredited, which gives leadership a consistent measure of capability across a team.

Course Highlights

• Push past EDR basics into evasion and covert infrastructure in Advanced Red Team Operations.
• Test cloud environments the way attackers approach them in Cloud Penetration Testing.
• Write and tune the detection content your SIEM runs in Detection Engineering and SIEM Analytics.
• Build a governance and risk program that holds up to audit in Cybersecurity Governance, Risk, and Compliance.