SANS CyberThreat Summit 2025

Wed, Dec 3 - Thu, Dec 4, 2025
12 CPEs (Summit Only)
English

Stamford Bridge

Fulham Rd., London SW6 1HS, United Kingdom

Jump to:

Speakers
Schedule
Location

Empowering Europe's Cybersecurity Sector

CyberThreat 2025 returns to London, bringing together Europe's cybersecurity community for another spectacular two-day conference. The event will take place on Wednesday, 3rd December and Thursday, 4th December 2025.

Tailored for security practitioners, this event covers both offensive and defensive disciplines, placing a significant focus on technical aspects. It provides exceptional value to cybersecurity professionals at all levels, offering an environment where practitioners can share experiences, knowledge, tools, and techniques to advance the field.

CyberThreat aims to deliver the best technical conference in Europe for cybersecurity practitioners. In addition to presentations from world-renowned cyber security experts and rising industry stars, CyberThreat 2025 features many hands-on opportunities for delegates in the form of CTF events, Hackable badges, team problem solving and “Hackathon” challenges against some of the latest devices and products.

The whole event was world class.
Graham BartlettSenior Technical Leader at Cisco

Get A Feel For CyberThreat By Looking Back At Our 2024 Event

CyberThreat 2024 welcomed hundreds of cybersecurity practitioners from across the world. Delegates enjoyed talks, presentations and an elaborate hackable badge challenge. The unique CTF competition provided an intense and entertaining experience and the high-quality networking opportunities ensured attendees thoroughly enjoyed the event. In 2024, attendees also had the opportunity to wind down between the technical presentations at the gaming area, flight and car simulators or on the retro arcade machines.

With new and exciting plans for 2025, you don't want to miss it!

CyberThreat 2024 Recap: Highlights, CTF Competition, and Key Insights

I really enjoyed the CyberThreat experience and my hats off to you and the team. You all pulled off one hell of a great conference!
Ryan NoletteLead Cloud Security Architect at Arrowstreet Capital

Why Should You Attend?

Watch inspiring keynote presentations delivered by renowned subject matter experts in the offensive, defensive and forensic fields.
Take part in the CyberThreat CTF; a super-technical, unpredictable and dynamic experience that allows you to participate as an individual or team up with your colleagues or friends.
Learn from SANS experts and hear unique insight from our founding partner - the UK's NCSC.
Network with like-minded security practitioners.
Attempt the interactive hackable badge challenge. Designed to test the most technically advanced delegates, the CyberThreat badge is, dare we say it, even more challenging than DEF CON's badges.

And much, much more...

Register

from £999 GBP

£999 GBP*Prices exclude applicable taxes | EUR price available during checkout

In personIncludes

Trending Talks from Industry Experts
Hackable Badge Competition
Immersive CTF Competition
Free Lunch and Snacks
Networking Opportunity with Peers

Advisory Board

Kirsten Ward

Threat Intelligence Manager

Kirsten Ward is the leader of Accenture’s Cyber Intelligence EMEA Consulting team, where Kirsten oversees a group of 35 threat intelligence specialists across the region.

Learn more

Dr. Xena Olsen

Exposure Management Manager

Xena is a Threat Intelligence Manager with Financial Services Company.

Learn more

Lina Lau

Founder of XINTRA

Lina is the Founder of XINTRA

Learn more

Simon Vernon

Principal Technical Architect

Simon Vernon brings more than a quarter century of experience to his role as Head of Research and Development for SANS Institute where he is responsible for the creation and operations of all Jupiter Rockets, BootUP, and Community Cyber Ranges.

Learn more

James Lyne

Chief Strategy and Innovation Officer

James has spent the past 20 years of his life chasing cybercriminals around the Internet and, as a self-professed “massive geek”, has been involved in most cyber security disciplines.

Learn more

Allison Wikoff

Global Threat Intelligence, Americas Lead

Allison Wikoff has over 20 years of experience in network defense, incident response, and cyber threat intelligence and research in private industry and consulting organizations.

Learn more

Schedule

Showing 15 of 30

Filter by:

Select day:

Registration and Networking

Day 108:15AM - 09:45AM GMT

In-Person

Opening Remarks

Day 109:45AM - 10:15AM GMT

Presented by

Ciaran Martin

Professor, Director of CISO Network

Paul Chichester

Director of Operations

In-Person

Opening Keynote – Securing The Unseen: The Future of Supply Chain Cybersecurity

As businesses grow more intertwined, threats tend to focus on vulnerable points, suchas external partners and supply networks. Whether it's tampered software patches or illicit intrusion into vendors' systems, malevolent actors manipulate trust and interconnections to achieve widespread access.

Day 110:15AM - 11:00AM GMT

Presented by

Robert Hannigan

Managing Director

In-Person

When The Dark Web Talks, The World Pays: The HELLCAT Story

In October, an innocuous-looking exchange on a well-known underground forum caught the attention of only a handful of seasoned threat watchers.

Within weeks, that conversation evolved into something far more dangerous—a fully operational ransomware group calling itself HELLCAT.

Day 111:00AM - 11:30AM GMT

Presented by

Rebecca Lois Taylor

Threat Intelligence Knowledge Manager

In-Person

Networking Break

Day 111:30AM - 12:15PM GMT

In-Person

Copilot: Bestie or Worst Enemy - The New Era of Weaponised LLMs

Large Language Models (LLMs) are rapidly being embedded into enterprise workflows. By 2025, 67% of organizations worldwide have adopted LLMs to support their operations, yet few defenders recognize them as a potential attack surface.

Day 112:15PM - 12:45PM GMT

Presented by

Rem Dudas

Senior Threat Intelligence Analyst

In-Person

How APTeens Pose a Risk to Your Enterprise and Career

How do Advanced Persistent Teenagers (APTEENS) pose a risk to enterprises and the defenders who protect them? This session explores how APTEENS have become a dominant threat in 2025, with groups like Scattered Spider turning intrusions into multi-domain crises that demand coordination across Incident Response, Legal, Executive, Communications, and Threat Intelligence teams.

Day 112:45PM - 01:15PM GMT

Presented by

Thomas Willkan

Lead Analyst and Manager, Dark Web Reconnaissance Team

In-Person

Networking Lunch

Day 101:15PM - 02:45PM GMT

Stealth and Evolved: The Story of Nimbus Manticore

For months, Check Point Research has tracked Nimbus Manticore, a threat group whose tactics and targets align with Iran’s IRGC, also known as UNC1549 or Smoke Sandstorm. Its focus – Strategic. Its hallmark – Human first deception. Targets receive convincing job offers via personalised HR emails, each containing a unique link to a fake career portal. Every credential is custom issued, allowing attackers to track victims individually.

Day 102:45PM - 03:15PM GMT

Presented by

Roi Morad

Threat Intelligence Researcher

In-Person

Stop Hitting Yourself: Turning Evasion Techniques Against Malware

Evasion techniques are among the most damaging tactics malware can employ, yet recent advances in both attacks and defenses have not been widely covered.

While some samples rely on popular and easy to defeat tricks copy-pasted from open-source GitHub projects, others reveal the hand of highly skilled developers who demonstrate deep insights of operating system internals and nearly push the techniques into an art form.

Day 103:15PM - 03:45PM GMT

Presented by

Patrick Staubmann

Team Lead Threat Analyst

In-Person

Technical Talk

Day 103:45PM - 04:05PM GMT

In-Person

Networking Break

Day 104:05PM - 04:50PM GMT

In-Person

Closing Keynote - Is Drone Warfare a Form of Cyber Warfare?

In 2025, the cyber community learned that Mikko Hyppönen, a veteran of the anti-virus era, was leaving the industry to join a counter-drone start-up. At first, this shift seems dramatic: drones involve a physical and military dimension absent from cyberspace. Yet, the parallels are striking:

Both face evolving, ambiguous threats with unclear origins and intent.
Both defend similar targets, from national security to critical infrastructure.
Both rely on analysis and reverse-engineering to detect, mitigate, and attribute attacks.
Both suffer from limited, often impractical solutions marketed as silver bullets.

Day 104:50PM - 05:35PM GMT

Presented by

Adrian Nish

Director, Europe East

In-Person

Chair Closing Remarks

Day 105:35PM - 05:40PM GMT

In-Person