SANS CyberThreat 2026

Summit: Nov 16–17
Duration:
8 CPEs (Summit Only)
English

Roundhouse, London

Chalk Farm Rd, Chalk Farm, London NW1 8EH, United Kingdom

Exploit Chained

T-MINUS

Days

Hrs

Min

Sec

Somewhere on the network, someone is already inside. The only question is whether you find them first.

A hackable badge that fights back. A CTF that shows no mercy. Two days to prove your tradecraft.

Offense meets defense. Intelligence meets instinct.

THIS IS CYBERTHREAT. SANS CYBERTHREAT 2026.

Learn
Real-world case studies and technical insights from experts working at the forefront of cyber security. Explore state-sponsored threats, OT and critical infrastructure attacks, insider risk, and AI-driven threats, with up to 8 CPE credits across both days.
Compete
Take on the CyberThreat CTF and the digital badge challenge, two of the most technically demanding competitions in the industry. Put your skills and your team to the test, solve practical cyber challenges whilst strengthening cyber resilience.
Connect
Meet the people tackling the same cyber challenges you - red and blue teamers, researchers, security leaders and students working on similar problems. Compare approaches exchange ideas and build your technical network.

Jump to:

Highlights
Schedule
Registration / Courses
Sponsors
Hotel

See What Attackers are Doing Now – Not Last Year

Meet peers that are tackling the same problems as you.

Delivered in partnership with the NCSC, CyberThreat 2026 returns to London, bringing together Europe's cybersecurity community for another spectacular two-day conference.

Tailored for security practitioners, this event covers both offensive and defensive disciplines, compared to other CyberThreat places significant emphasis on practical and appliable techniques. It provides exceptional skills value to cybersecurity professionals at all levels, offering an environment where practitioners can share experiences, knowledge, tools, and techniques to advance the field.

CyberThreat aims to deliver the best technical conference in Europe for cybersecurity practitioners. In addition to keynotes from world-renowned industry experts and rising industry stars, CyberThreat 2026 features many hands-on team benchmarking challenges in the form of CTF events, Hackable badges, team problem solving and “Hackathon” challenges against some of the latest devices and products.

Why Should You Attend?

See what attackers are doing now - and what’s coming next.
Meet peers that are tackling the same security challenges as you.
Put your team’s cyber skills to the test. Don’t just attend. Get hands-on.

Compete in the Capture The Flag event - test your skills, challenge your team and strengthen your cyber resilience.
Digital Event Badge: You don’t just wear it, hack it - explore, attack and solve challenges throughout the event.

Learn from world-class practitioners and experts brought together by SANS and the NCSC.
Keynotes include: IBM, BAE Systems, Security Service of Ukraine, SANS Institute, Shinobi Security, and more.
Bring the knowledge and skills back to your organisation at a fraction of the cost of formal training.

The whole event was world class.
Graham BartlettSenior Technical Leader at Cisco

I really enjoyed the CyberThreat experience and my hats off to you and the team. You all pulled off one hell of a great conference!
Ryan NoletteLead Cloud Security Architect at Arrowstreet Capital

Summit Highlights

CyberThreat 2026 Government Departments Discount

We are pleased to offer CyberThreat 2026, 16-17 November tickets to members of the UK and EU Governments at half the ticket price. Similar to previous editions, we are opening a ballot for members of the government. Through the form you will be eligible for 50% off.

Learn More

The Better You Play, The Less You Pay

You’ve got the skills? Well here's an opportunity to prove it and get a discount! Solve the pre-registration challenges and unlock 25%, 50% or 75% off your ticket to this years CyberThreat 26 event in London.

Take the Challenge

What Topics to Expect From The Summit

- Cyber and geopolitical conflict: The role of cyber operations in modern conflict, including nation-state activity, strategic competition, and related developments - Artificial Intelligence (AI): The evolving role of AI in cybersecurity, from threat actor use to defensive innovation and broader ecosystem impacts - Operational Technology (OT): Security challenges, emerging risks, and real world applications across industrial and critical infrastructure environments - Supply chain security: Addressing risks, trends, and approaches related to third party ecosystems, dependencies, and interconnected systems

Who Should Attend

- Red and blue teamers - CISOs and security directors - SOC analysts, threat intelligence and DFIR practitioners - Policy advisers, risk and compliance leads - Students and career starters

Capture the Flag and Hackable Badges

The CyberThreat CTF takes place across both days. Enter alone or build a team, then work through unpredictable challenges designed to reward outside-the-box problem-solving rather than familiarity with specific tools. Every paid delegate also receives a hackable badge, a physical device loaded with layered challenges that are guaranteed to be tough. Both competitions are open to all skill levels, with the CTF winners announced on stage at the end.

Schedule

Showing 16 of 31

Filter by:

Select day:

Registration and Networking

10:00AM - 11:00AM CET

In-Person

Moderator Opening Remarks

11:00AM - 11:10AM CET

In-Person

Moderated by

Paul Chichester

Director of Operations at the National Cyber Security Centre

Ciaran Martin

Professor, Non-Executive Director, SANS Cyber Leaders Network at SANS

Capture the Flag Briefing

11:10AM - 11:20AM CET

In-Person

Presented by

Simon Vernon

Principal Technical Architect at SANS Institute

The Great Rewrite: AI, Geopolitics, and The New Rules of Cyber Defence

Cybersecurity is going through changes…perhaps the biggest changes James has witnessed in 20+ years. AI, geopolitics, and more diverse targeting such as OT environments are rapidly rewriting the rule book for the industry. The hype is unrelenting and for many, the associated fatigue, too.

James will break down the critical risks ahead and what is changing. The good news? We have the talent and tools to fight back, and the cyber community remains our strongest weapon. Join us to uncover how we can make the lives of cyber criminals miserable.

11:20AM - 11:45AM CET

In-Person

Presented by

James Lyne

Chief Executive Officer at SANS Institute

How and Why Insider Risks Move From Edge Case to Primary Threat in 2026

Malicious insiders are no longer isolated incidents. They've become a serious and growing threat across industries and geographies.

Drawing on years of incident response data, dark web research, and firsthand HUMINT and honeypot engagements, Thomas will explore how insider threats have evolved, why AI may be accelerating the risk, and what today's threat landscape looks like.

Through original research and real-world case studies, you will understand how malicious insiders operate, their tactics and techniques. What are the motivations behind insider-enabled attacks? How do criminal groups identify and exploit targets? What are the latest trends emerging from the dark web? Join us to explore one of cybersecurity's fastest evolving threats through the latest research and real-world findings

Thomas Mannie Wilkan, Head of Research – Lab-1

11:45AM - 12:15PM CET

In-Person

Lunch

12:15PM - 01:15PM CET

In-Person

We Asked Our AI Red Teaming Agent to Shut Down a Wind Farm...So It Did

Operating an AI agent inside a live operational technology (OT) environment is fundamentally different from testing a web application. When the target is critical infrastructure, safety, operational context, and physical consequences become the defining constraints.

In this session, David shares the story of taking an Agentic AI Red Teamer beyond the lab and preparing it for deployment in a real wind farm, revealing how it was tuned to understand the environment, reason through IT and OT systems, and behave like a real adversary while operating within strict safety boundaries.

How did the agent approach its objective, map remote access and control paths and identify operational leverage? Where did it require human approval, what did find, and what did it refuse to do when the safety context changed? Join us to understand what agentic AI red teaming looks like when the objective has real-world physical consequences and safety is the first constraint, not an afterthought.

David Mound, Head of Research – Shinobi Security

01:15PM - 01:45PM CET

In-Person

Sandworm's Trojan Odyssey

Sandworm has increasingly used trojanised software installers to compromise targets in Ukraine, turning trusted applications into malware delivery mechanisms.

This session shares new research, including the discovery of a previously unreported version of the Kalambur backdoor.

Through real-world investigations, you'll learn how these campaigns were uncovered, the techniques Sandworm uses for espionage operations, and the practical analysis methods that led to the discovery of new infrastructure and malware.

Tom P, Principal Intelligence Analyst – BAE Systems

01:45PM - 02:15PM CET

In-Person

Npm Install Malware: Tracking Two Years of Famous Chollima’s Obfuscation Evolution

Famous Chollima, the North Korean threat actor behind the Contagious Interview campaign, has spent years targeting Web3 and cryptocurrency developers through recruiter-themed social engineering and trojanised coding assessments.

Based on two years of research spanning more than 2,000 malicious repositories and campaign variants, Parthiban examines how the group continuously evolved its obfuscation techniques, infrastructure, and infection chains in response to public reporting and disruption efforts.

Join us to explore how Famous Chollima has evolved its tradecraft over the past two years, through real-world artifacts, code snippets, infrastructure examples, and campaign timelines practical hunting and detection techniques.

Parthiban Rajendran, Threat Intelligence Lead – Atlassian

Shiva Palaniappan, Senior Security Researcher – Microsoft

02:15PM - 02:45PM CET

In-Person

After Mythos: Operationalizing Vulnerability Remediation in the Age of AI-Driven Discovery

AI is transforming vulnerability discovery, enabling security teams to identify weaknesses faster than ever before. But as discovery accelerates, a new challenge has emerged: How do organisations prioritise and remediate vulnerabilities at the same pace?

This session explores why traditional vulnerability management approaches are struggling to keep up with AI-driven discovery. It identifies what organisations must do to close the growing remediation gap. The practical approaches to risk prioritisation, exposure management, and scalable remediation workflows will be examined.

What are the strategies for adapting vulnerability management to the AI era, reducing risk, and improving remediation outcomes in increasingly complex environments?

Sylvain Cortes, VP Strategy – Hackuity

02:45PM - 03:15PM CET

In-Person

Networking Break

03:15PM - 03:45PM CET

In-Person

Following the Relay: A DFIR Investigation into Ink Dragon’s Espionage Network

What began as the investigation of a single compromised government IIS server uncovered a much larger espionage campaign. In this session, Eli will share the forensic investigation into Ink Dragon, a Chinese threat actor targeting government and telecommunications organisations across Southeast Asia and Europe, revealing how trusted infrastructure was used to conceal a multi-victim operational network.

Join us to follow the investigation as it unfolded, from the initial compromise and lateral movement to the discovery of an IIS-based ShadowPad relay and additional victims.

Through technical findings, malware analysis, memory forensics, and real-world investigative pivots, you will gain insight into the process behind uncovering a live espionage campaign and the techniques used to expand visibility beyond a single incident.

Eli Smadja, Director, Security Research - Check Point Software

03:45PM - 04:15PM CET

In-Person

The Long Phish: The Evolution of Identity-Focused Russian Espionage Operations

Russian state-sponsored threat actors are shifting from malware to identity-focused attacks, using techniques such as adversary-in-the-middle (AiTM) phishing, Device Code abuse, and code phishing to compromise accounts without relying on passwords.

Based on previously unreported investigations by Proofpoint, this session reveals how actors including UNK_SnakeBite and UNK_AcademicFlare build trust with targets, steal identities, and gain persistent access. You'll learn how these campaigns work, why they're effective, and the practical detection and defence strategies organisations can use to stop them.

Mark Kelly, Staff Threat Researcher - Proofpoint

04:15PM - 04:45PM CET

In-Person

Closing Keynote: Ukraine’s Cyber War Playbook

Russia’s full-scale invasion of Ukraine marked a turning point in the role of cyber operations in modern conflict. Cyberattacks have become a strategic instrument of warfare, supporting military objectives while targeting critical infrastructure, government institutions, and essential national services.

In this keynote, Ivan Kalabashkin will examine the evolving cyber threat landscape and Ukraine’s response to sustained nation-state cyber aggression. Drawing on Ukraine’s experience in detecting and responding to more than 16,000 cyberattacks and incidents, the keynote will explore how these events have shaped the country’s approach to cyber resilience.

What are the key lessons learned from defending against sustained cyber warfare? How do these experiences continue to inform Ukraine’s national cybersecurity strategy and resilience efforts?

Ivan Kalabashkin, Deputy Head of Cyber Department – Security Service of Ukraine

04:45PM - 05:10PM CET

In-Person

Moderator Closing Remarks

05:10PM - 05:20PM CET

In-Person

Moderated by

Ciaran Martin

Professor, Non-Executive Director, SANS Cyber Leaders Network at SANS

Networking Drinks

05:30PM - 07:30PM CET

In-Person

Moderator Opening Remarks

09:00AM - 09:10AM CET

In-Person

Opening Keynote: When the Lights Flickered: Inside Poland's Energy Sector Attack

On 29 December 2025, energy operators in Poland noticed brief but unexplained disruptions across their monitoring systems. What initially appeared to be a routine fault soon revealed the fingerprints of a coordinated cyberattack aimed at disrupting parts of the national grid.

Maciej Siciarek of CERT Poland, unpacks how the incident unfolded, tracing the attack’s progression, the key indicators found in industrial systems, and the steps taken to restore operations and strengthen defences, especially during a time of hybrid war. Join us to gain practical insight into the realities of defending critical infrastructure when digital intrusions disrupt real-world operations.

Maciej Siciarek, Director of CSIRT Division - NASK

09:10AM - 09:35AM CET

In-Person

Inside BlueNoroff’s Fake Meeting Campaign

BlueNoroff has evolved its social engineering tactics into highly convincing, media-driven campaigns capable of compromising even security-conscious organisations.

This session will examine a real-world investigation into one of the group's fake meeting operations, revealing how carefully crafted deception, AI-generated content and rapid post-compromise activity combine to create an effective attack chain.

Drawing on forensic evidence and threat intelligence, Eoin will take you inside the campaign, exploring how the attack unfolded, the tactics employed by the threat actor, and the methods used to deceive and compromise victims.

The session will examine the evolution of modern social engineering techniques and the challenges they present to defenders. How do these campaigns operate in practice? How can you recognise the warning signs of similar attacks? What are the key considerations for improving detection, response and organisational resilience against increasingly sophisticated threat actors?

Eoin Healy, Principal Threat Researcher - Arctic Wolf

09:35AM - 10:05AM CET

In-Person

Satellite Receiver Hardware Penetration Testing

Satellite receivers are often overlooked as a security risk, yet they present a unique and increasingly relevant attack surface. How would you approach a satellite receiver from an offensive security perspective? How would you extract the firmware, identify exposed interfaces, assess the RF attack surface, and uncover the weaknesses that can lead to compromise?

Through practical examples and a live demonstration, you will gain insight into the end-to-end process of identifying and exploiting vulnerabilities in a real satellite receiver.

Whether you are new to hardware hacking or looking to expand your offensive security skillset, this session will provide a practical framework for approaching embedded devices, along with techniques and lessons that can be applied to hardware security assessments more broadly.

Salman Shakeep Abulatif, Cybersecurity Consultant - ISKRA Protect

10:05AM - 10:35AM CET

In-Person

Networking Break

10:35AM - 11:05AM CET

In-Person

Session TBC

Garry Byrne, Head of Incident Investigation & Response - Tesco

11:05AM - 11:25AM CET

In-Person

Inside Telegram's Russian Payment Gate Network

Telegram has become a key platform for cybercriminals to coordinate scams and process fraudulent payments at scale. But how do these payment ecosystems operate, and how can defenders identify and disrupt them?

Through a real-world case study, this session explores the infrastructure behind Russian-language Telegram payment gates, revealing the techniques used to map scam networks, trace payment flows, and uncover links between fraudulent operations using OSINT and threat intelligence.

You will leave with practical methods for investigating scam payment infrastructure, extracting actionable intelligence, and Improving detection and defensive reporting.

Adrian Dacka, Penetration Tester – Independent Security Researcher

11:25AM - 11:55AM CET

In-Person

Defending in a Complex World: Sense‑Making for Cybersecurity Before the Plan

Cybersecurity practitioners are increasingly required to make critical decisions in environments shaped by uncertainty, evolving technologies, and rapidly changing threats. How are you to make effective decisions when the information is incomplete, dependencies are constantly shifting, and traditional planning no longer provides the answers?

In this session, we will explore how making sense of complexity can help security leaders navigate today's most challenging cyber problems, from AI governance and post-quantum readiness to supply chain risk and multi-vendor ecosystems.

Drawing on real-world experience, Anne will examine why treating complex challenges as merely complicated can lead to brittle decisions, and how alternative approaches can improve resilience and adaptability.

Anne Leslie, Head of Cloud Risk - IBM

11:55AM - 12:25PM CET

In-Person

Lunch

12:25PM - 01:25PM CET

In-Person

When AI Agents Become Attackers

As AI agents become embedded across organisations, the boundaries between human and machine identities are becoming increasingly difficult to distinguish. New opportunities are created for attackers to exploit trusted systems.

How can organisations secure identities in a workforce where humans and AI operate side by side?

Drawing on research and a supply chain case study, Anna will explore the emerging risks of human-AI identity, examining how compromised AI credentials can evade detection and enable lateral movement across enterprise environments.

What are the practical approaches to strengthening identity governance? How is anomalous AI behaviour detected?

Anna Lena Fehlhaber, Technology Strategy Lead AI/Cyber Security - Leibniz Universität Hannover

01:25PM - 01:55PM CET

In-Person

Session TBC

01:55PM - 02:15PM CET

In-Person

Native Functionality, Native Consequences: The Engineering of Cyber-Physical Effects

Some of the most significant OT cyber-attacks have achieved their objectives by abusing legitimate OT functionality rather than exploiting software vulnerabilities. As OT systems become increasingly connected and state-backed actors continue to target critical infrastructure, understanding this growing attack surface has never been more important.

This session introduces the concept of Living Off the Plant (LOTP) and explores how adversaries leverage native OT functionality to enable stealthy cyber-physical attacks that traditional IT techniques cannot achieve.

Join us to examine how LOTP challenges conventional OT security practices. Why can legitimate engineering activity be difficult to distinguish from malicious behaviour? What does this mean for modern OT threat modelling?

You will gain a deeper understanding of engineering-focused attack techniques, the role of engineering expertise in OT cybersecurity, and the limitations of existing security controls against adversaries abusing native OT functionality.

Ric Derbyshire, Principal Security Researcher - Orange Cyberdefense

02:15PM - 02:45PM CET

In-Person

Burn After Hacking: The Effects of Countering State Espionage

A journey over the last fifteen years looking at the evolution of state actors examining the impact of disruptive action, how the dependency of core malware has changed, the emergence of external support and what the future might look like. From the famous APT1 report through to criminal support to start via election interference and hijacking crime actor infrastructure.

How did we get from in-house rigid malware families to disposable malware? Key events have accelerated the evolution of state actors, whether that be disclosures, take downs or world events, but what impact did these events have? What lessons might we learn from this and what should we expect from the future?

Alex Clarke Smith, Principal Consultant - Google Threat Intelligence Group (Mandiant)

02:45PM - 03:15PM CET

In-Person

Capture the Flag Awards

03:15PM - 03:25PM CET

In-Person

Moderator Closing Remarks

03:25PM - 03:30PM CET

In-Person

Register

£999 GBP

£999 GBP*Prices exclude applicable taxes | EUR price available during checkout

In personIncludes

Trending Talks from Industry Experts
Hackable Badge Competition
Immersive CTF Competition
Free Lunch and Snacks
Networking Opportunity with Peers
Up to 8 CPE credits for attending both days

Thank You To Our Sponsors

London, United Kingdom

Roundhouse, London

An iconic music and arts venue in Camden. Now it will be the host of CyberThreat 2026. Having hosted performances from Jimi Hendrix, Patti Smith and Pink Floyd during the 60’s & 70s. More recently, performances from Britney Spears, Radiohead, Janelle Monae, The Chemical Brothers and Wizkid have established the Roundhouse as one of London’s most memorable venues.

View Venue

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS CyberThreat 2026

Share

See What Attackers are Doing Now – Not Last Year

Why Should You Attend?

Summit Highlights

CyberThreat 2026 Government Departments Discount

The Better You Play, The Less You Pay

What Topics to Expect From The Summit

Who Should Attend

Capture the Flag and Hackable Badges

Schedule

Registration and Networking

Moderator Opening Remarks

Capture the Flag Briefing

The Great Rewrite: AI, Geopolitics, and The New Rules of Cyber Defence

How and Why Insider Risks Move From Edge Case to Primary Threat in 2026

Lunch

We Asked Our AI Red Teaming Agent to Shut Down a Wind Farm...So It Did

Sandworm's Trojan Odyssey

Npm Install Malware: Tracking Two Years of Famous Chollima’s Obfuscation Evolution

After Mythos: Operationalizing Vulnerability Remediation in the Age of AI-Driven Discovery

Networking Break

Following the Relay: A DFIR Investigation into Ink Dragon’s Espionage Network

The Long Phish: The Evolution of Identity-Focused Russian Espionage Operations

Closing Keynote: Ukraine’s Cyber War Playbook

Moderator Closing Remarks

Networking Drinks

Moderator Opening Remarks

Opening Keynote: When the Lights Flickered: Inside Poland's Energy Sector Attack

Inside BlueNoroff’s Fake Meeting Campaign

Satellite Receiver Hardware Penetration Testing​

Networking Break

Session TBC

Inside Telegram's Russian Payment Gate Network

Defending in a Complex World: Sense‑Making for Cybersecurity Before the Plan

Lunch

When AI Agents Become Attackers

Session TBC

Native Functionality, Native Consequences: The Engineering of Cyber-Physical Effects

Burn After Hacking: The Effects of Countering State Espionage

Capture the Flag Awards

Moderator Closing Remarks

Register

Register

Thank You To Our Sponsors

London, United Kingdom

Additional Information

Interested in Partnering With Us?

Registration and Networking

Moderator Opening Remarks

Capture the Flag Briefing

The Great Rewrite: AI, Geopolitics, and The New Rules of Cyber Defence

How and Why Insider Risks Move From Edge Case to Primary Threat in 2026

Lunch

We Asked Our AI Red Teaming Agent to Shut Down a Wind Farm...So It Did

Sandworm's Trojan Odyssey

Npm Install Malware: Tracking Two Years of Famous Chollima’s Obfuscation Evolution

After Mythos: Operationalizing Vulnerability Remediation in the Age of AI-Driven Discovery

Networking Break

Following the Relay: A DFIR Investigation into Ink Dragon’s Espionage Network

The Long Phish: The Evolution of Identity-Focused Russian Espionage Operations

Closing Keynote: Ukraine’s Cyber War Playbook

Moderator Closing Remarks

Networking Drinks

Moderator Opening Remarks

Opening Keynote: When the Lights Flickered: Inside Poland's Energy Sector Attack

Inside BlueNoroff’s Fake Meeting Campaign

Satellite Receiver Hardware Penetration Testing​

Networking Break

Session TBC

Inside Telegram's Russian Payment Gate Network

Defending in a Complex World: Sense‑Making for Cybersecurity Before the Plan

Lunch

When AI Agents Become Attackers

Session TBC

Native Functionality, Native Consequences: The Engineering of Cyber-Physical Effects

Burn After Hacking: The Effects of Countering State Espionage

Capture the Flag Awards

Moderator Closing Remarks

Inside BlueNoroff’s Fake Meeting Campaign

Satellite Receiver Hardware Penetration Testing

Inside BlueNoroff’s Fake Meeting Campaign

Satellite Receiver Hardware Penetration Testing