Hack & Defend Summit & Training 2025

Tue, Oct 28 - Tue, Nov 4, 2025
9 Courses
12 CPEs (Summit Only)
1 NetWars Tournament
English

Omni Austin Hotel Downtown & Virtual (CT)

700 San Jacinto at 8th Street, Austin, TX 78701

Jump to:

Event Highlights
Courses
Speakers
Schedule
Location

Offense Informs Defense. Defense Informs Offense.

Organizations face a critical disconnect between offensive security experts who identify vulnerabilities and defensive teams tasked with protecting systems. The Hack & Defend Summit brings these different security professionals together to learn from each other and build better protection strategies. By working together instead of separately, we can create stronger defenses against real threats.

Slide 1 of 2
Slide 2 of 2

Join us this October in Austin, TX for practical workshops, presentations from experts, and network with other security professionals. Whether you're interested in finding vulnerabilities, defending systems, or managing security teams, the Hack & Defend Summit will help you learn new skills and protect against cyber-attacks.

What Attendees Say

Slide 1 of 4
An enriching experience that exceeded my expectations. The comprehensive range of expert-led sessions provided valuable insights into the latest cybersecurity trends and cutting-edge techniques.
Mahima Dharmasena
Slide 2 of 4
This is an amazing opportunity to learn from the best and to network with the most encouraging people.
Amanda D.
Slide 3 of 4
Overall, all the presenters were great. I not only learned a lot. I realized I have a lot to learn.
Richard B.
Slide 4 of 4
The Summit was relevant to what I do, the problems my company faces, our challenges, etc...The speakers are icons in this space.
Jonathan Heese

Summit Highlights

Highly Technical Talks and Sessions

Two simultaneous tracks — Defense and Offense — Choose your path.

DFIR Summit & Training 2025, Highly Technical Talks

Hands-On Workshops and Challenges

If you're joining us in Austin, you'll have the chance to gain real-world experience through both offensive and defensive hands-on workshops, interactive labs, and capture-the-flag (CTF) challenges.

Connect With Offensive and Defensive Legends in the Community

Numerous opportunities for deep-dive discussions, and casual chats over breaks, meals, and evening receptions.

Summit Night Out

The days will be filled with the latest in Red and Blue, but the fun goes up a notch at night for those joining us in Austin.

World-Class SANS Courses

Enhance your knowledge base and add to your toolkit by bundling your Summit experience with a hands-on, immersive course taught by top SANS instructors and course authors.

Register

Summit and Course Registration

from $8,780 USD

In personIncludes

Course: Live Instructor Training with Hands-on Exercises
Summit: Talks, Presentations and Workshops
Core Netwars Tournament

Select course to Enroll

Live onlineIncludes

Course: Virtual Live Instructor Training with Hands-on Exercises
Summit: Select Talks and Content
Summit: Interactive Chat on Slack

Select course to Enroll

Summit Registration Only

from Free

$525 USD*Prices exclude applicable local taxes

In personIncludes

Free Lunch and Snacks

Attend In PersonLogin to register

Free

Live onlineIncludes

Interactive Chat on Slack
Talks and Sessions

Important Dates

Refund Deadline:: October 13, 2025
Hotel Group Discount Deadline:: October 3, 2025

Courses

Looking for Group Purchasing? Contact Us

Showing 9 of 9

Filter by:

SEC503: Network Monitoring and Threat Detection In-Depth

SEC503Cyber Defense, Artificial Intelligence

GIAC Certified Intrusion Analyst
6 Days
46 CPEs
Andrew Laman

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC504: Hacker Tools, Techniques, and Incident Handling

SEC504Offensive Operations

GIAC Certified Incident Handler
6 Days
38 CPEs
Ron Hamann

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC542: Web App Penetration Testing and Ethical Hacking

SEC542Offensive Operations

GIAC Web Application Penetration Tester
6 Days
36 CPEs
Hassan El Hadary

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC560: Enterprise Penetration Testing

SEC560Offensive Operations

GIAC Penetration Tester
6 Days
36 CPEs
Christopher Elgee

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

SEC511Cyber Defense, Artificial Intelligence

SEC511: Continuous Monitoring and Security Operations

GIAC Continuous Monitoring Certification
6 Days
46 CPEs
Tim Garcia

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses

SEC599Offensive Operations

GIAC Defending Advanced Threats
6 Days
36 CPEs
Michel Coene

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

SEC530Cyber Defense

GIAC Defensible Security Architecture
6 Days
36 CPEs
Greg Scheidel

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

SEC450Cyber Defense, Artificial Intelligence

SEC450: Blue Team Fundamentals: Security Operations and Analysis

GIAC Security Operations Certified
6 Days
36 CPEs
David Mashburn

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC588: Cloud Penetration Testing

SEC588Offensive Operations

GIAC Cloud Penetration Tester
6 Days
36 CPEs
Moses Frost

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

Advisory Board

Stephen Sims

Research Fellow

Stephen Sims, an esteemed vulnerability researcher and exploit developer, has significantly advanced cybersecurity by authoring SANS's most advanced courses and co-authoring the "Gray Hat Hacking" series.

Learn more

John Hubbard

Consultant

John redefined modern SOC operations by engineering globally adopted blue team strategies and co-creating the GSOC cert. Through the Blueprint podcast and SANS leadership, he’s unified thousands of defenders around real-world detection tactics.

Learn more

Huáscar Tejeda

Huáscar Tejeda is a seasoned cybersecurity expert with 20+ years of notable achievements in IT and Telecommunications. Huáscar is co-author of the Gray Hat Hacking 6th edition.

Learn more

Ingrid Parker

Senior Manager of Threat Hunting

Ingrid is currently the Manger of Intelligence at Red Canary.

Learn more

Jason Ostrom

Founder and Principal Consultant

Jason Ostrom has revolutionized cybersecurity by developing open-source tools like PurpleCloud and Automated Emulation, enabling scalable adversary emulation in cloud environments.

Learn more

Jeff McJunkin

CEO

Jeff McJunkin, Rogue Valley InfoSec founder, has led Fortune 100 pen tests and shaped Core NetWars. His key role in SANS Holiday Hack Challenge and hands-on security innovations continue to elevate the industry, advancing defenses worldwide.

Learn more

Schedule

Summit Dates

Tuesday, 28 October - Wednesday, 29 October

Training Dates

Thursday, 30 October - Tuesday, 4 November

Showing 14 of 35

Filter by:

Select day:

Welcome and Opening Remarks

Summit Day 108:45AM - 09:00AM CDT

In-Person & Virtual

Keynote | The Augmented Era: Disrupt or be Disrupted

We're living through the most fundamental shift in cybersecurity since the advent of the Internet itself. AI isn't replacing security practitioners (yet), but it's creating augmented adversaries who operate at unprecedented scale. A single attacker can now use AI to force multiply themself as if they were an entire team. Nation-state actors are leveraging AI to maintain fraudulent positions at Fortune 500 companies. Non-technical criminals are deploying sophisticated ransomware. The question isn't whether AI will disrupt security, it's whether you'll be the disruptor or the disrupted.

Summit Day 109:00AM - 09:45AM CDT

Presented by

Pedram Amini

Chief Scientist

In-Person & Virtual

Social Hacktics

Social engineering remains one of the most effective and widely used attack vectors in modern cybersecurity operations. John McAfee once stated, “Social engineering has become 75% of an average hacker’s toolkit, and for the most successful hackers, it reaches 90% or more.” Despite its overwhelming real-world application, providing a hands-on, safe, and realistic environment to learn and test these techniques has remained elusive. Until now. Introducing Social Hacktics, a next-generation social engineering CTF that merges AI innovation with an immersive strategy to create one of the most authentic human exploitation experiences to date.

Summit Day 109:00AM - 09:00PM CDT

Facilitated by

Foster Nethercott

Certified Instructor Candidate

In-Person

Break

Summit Day 109:45AM - 10:00AM CDT

In-Person & Virtual

Blue Team | High-Fidelity Threat Hunting: Unveiling Insider Threats Beyond the Logs...The Dual-Identity Evasion Technique

Traditionally, security monitoring assumes that SIEM technologies will be accurate and provide a comprehensive picture of network activity, but what happens when we find that the events recorded by these technologies are insufficient, and we don't have the proper telemetry?

Summit Day 110:00AM - 10:35AM CDT

Presented by

Oscar Cárcamo

Threat Management Sr Specialist

In-Person & Virtual

Red Team Workshop | Hacking Humans with AI

Artificial Intelligence has taken the world by storm. From leveraging AI for cancer detection to powering the latest fully autonomous smart toaster, this technology is finding its way into every industry and every walk of life.

Summit Day 110:00AM - 12:00PM CDT

Presented by

Foster Nethercott

Certified Instructor Candidate

In-Person

Blue Team | Outside the Debugger: Effective Malware Analysis for Everyday Defenders

The misconception: Malware analysis requires deep assembly knowledge and reversing skills. The reality: Many practical insights can be gained through simple, freely available tools/frameworks. Target audience: Blue teamers who need actionable intel without becoming RE experts.

Summit Day 110:40AM - 11:15AM CDT

Presented by

Abdul Mhanni

DFIR Analyst

In-Person & Virtual

Blue Team | The Hunt for Silent Compromise: Detecting Cloud-Native Persistence Without Malware or Alerts

As attackers evolve beyond malware and implants, defenders must learn to hunt compromise that never triggers an alert.

Summit Day 111:20AM - 11:55AM CDT

Presented by

Ankit Gupta

Senior Security Engineer

Shilpi Mittal

Lead IT Security Engineer

In-Person & Virtual

Lunch

Summit Day 112:00PM - 01:15PM CDT

In-Person & Virtual

Red Team | Breaking Entra: Real-World Cloud Identity Attacks You Can Recreate

Identity has become the new perimeter and in Microsoft Entra ID (formerly Azure Active Directory), it's also the easiest one to break. Misconfigured apps, over-scoped permissions, and weak conditional access open the door to attackers who know where to look.

Summit Day 101:15PM - 01:50PM CDT

Presented by

Tomer Nahum

Security Research Team Lead

Jonathan Elkabas

Security Researcher

In-Person & Virtual

Blue Team Workshop | Evolving SOC Workflows: Techniques For More Efficient Investigations

Tasks in the SOC are critical for detecting malicious activity and driving the appropriate response. However, some workflows are not optimized, resulting in SOC analysts having to conduct tasks that are highly repetitive or that involve significant manual effort. This workshop will provide a model for optimizing common tasks in the SOC, showing an evolution of manual processes to more efficient approaches then to automation to free up the analysis for high-value tasks.

Summit Day 101:15PM - 03:15PM CDT

Presented by

David Mashburn

Certified Instructor

In-Person

Red Team | The Evolution of Syscalls: A Winding Path to Untraceable Execution

This presentation provides a step-by-step, technical exploration of the evolution of syscalls. It begins with the fundamental role of Win32 & NT Windows APIs in executing syscalls within kernel space.

Summit Day 101:55PM - 02:30PM CDT

Presented by

Thomas Xuan Meng

UK-Based Security Researcher

In-Person & Virtual

Red Team | Living Off the Crash: Weaponizing System-Generated Crash Dumps

Endpoint protection systems regularly identify credential harvesting and session hijacking attacks, but crash dumps represent an unmonitored attack surface with the potential to contain the same valuable information. Windows crash dumps routinely preserve domain credentials, browser authentication tokens, and sensitive documents from multiple applications and sessions, yet organizations rarely consider their exploitation potential. This presentation demonstrates how offline analysis of these naturally occurring artifacts can lead to intelligence extraction using chained memory analysis tools after initial acquisition without ongoing endpoint interaction or detection.

Summit Day 102:35PM - 03:15PM CDT

Presented by

Jason Mull

Team Lead, Security Operations

In-Person & Virtual