Hack & Defend Summit & Training 2025

Tue, Oct 28 - Tue, Nov 4, 2025
8 Courses
12 CPEs (Summit Only)
1 NetWars Tournament
English

Omni Austin Hotel Downtown & Virtual (CT)

700 San Jacinto at 8th Street, Austin, TX 78701

Jump to:

Event Highlights
Courses
Speakers
Schedule
Location

Offense Informs Defense. Defense Informs Offense.

Organizations face a critical disconnect between offensive security experts who identify vulnerabilities and defensive teams tasked with protecting systems. The Hack & Defend Summit brings these different security professionals together to learn from each other and build better protection strategies. By working together instead of separately, we can create stronger defenses against real threats.

Slide 1 of 2
Slide 2 of 2

Join us this October in Austin, TX for practical workshops, presentations from experts, and network with other security professionals. Whether you're interested in finding vulnerabilities, defending systems, or managing security teams, the Hack & Defend Summit will help you learn new skills and protect against cyber-attacks.

What Attendees Say

Slide 1 of 4
An enriching experience that exceeded my expectations. The comprehensive range of expert-led sessions provided valuable insights into the latest cybersecurity trends and cutting-edge techniques.
Mahima Dharmasena
Slide 2 of 4
This is an amazing opportunity to learn from the best and to network with the most encouraging people.
Amanda D.
Slide 3 of 4
Overall, all the presenters were great. I not only learned a lot. I realized I have a lot to learn.
Richard B.
Slide 4 of 4
The Summit was relevant to what I do, the problems my company faces, our challenges, etc...The speakers are icons in this space.
Jonathan Heese

Summit Highlights

Highly Technical Talks and Sessions

Two simultaneous tracks — Defense and Offense — Choose your path.

DFIR Summit & Training 2025, Highly Technical Talks

Hands-On Workshops and Challenges

If you're joining us in Austin, you'll have the chance to gain real-world experience through both offensive and defensive hands-on workshops, interactive labs, and capture-the-flag (CTF) challenges.

Connect With Offensive and Defensive Legends in the Community

Numerous opportunities for deep-dive discussions, and casual chats over breaks, meals, and evening receptions.

Summit Night Out

The days will be filled with the latest in Red and Blue, but the fun goes up a notch at night for those joining us in Austin.

World-Class SANS Courses

Enhance your knowledge base and add to your toolkit by bundling your Summit experience with a hands-on, immersive course taught by top SANS instructors and course authors.

Register

Summit and Course Registration

from $8,780 USD

In personIncludes

Course: Live Instructor Training with Hands-on Exercises
Summit: Talks, Presentations and Workshops
Core Netwars Tournament

Select course to Enroll

Live onlineIncludes

Course: Virtual Live Instructor Training with Hands-on Exercises
Summit: Select Talks and Content
Summit: Interactive Chat on Slack

Select course to Enroll

Summit Registration Only

from Free

$525 USD*Prices exclude applicable local taxes

In personIncludes

Free Lunch and Snacks

Attend In PersonLogin to register

Free

Live onlineIncludes

Interactive Chat on Slack
Talks and Sessions

Important Dates

Refund Deadline:: October 13, 2025
Hotel Group Discount Deadline:: October 10, 2025

Courses

Looking for Group Purchasing? Contact Us

Showing 8 of 8

Filter by:

SEC503: Network Monitoring and Threat Detection In-Depth

SEC503Cyber Defense

GIAC Certified Intrusion Analyst
6 Days
46 CPEs
Andrew Laman

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC504: Hacker Tools, Techniques, and Incident Handling

SEC504Offensive Operations

GIAC Certified Incident Handler
6 Days
38 CPEs
Ron Hamann

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC542: Web App Penetration Testing and Ethical Hacking

SEC542Offensive Operations

GIAC Web Application Penetration Tester
6 Days
36 CPEs
Hassan El Hadary

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

SEC511Cyber Defense

SEC511: Continuous Monitoring and Security Operations

GIAC Continuous Monitoring Certification
6 Days
46 CPEs
Tim Garcia

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses

SEC599Offensive Operations

GIAC Defending Advanced Threats
6 Days
36 CPEs
Michel Coene

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

SEC530Cyber Defense

GIAC Defensible Security Architecture
6 Days
36 CPEs
Greg Scheidel

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

SEC450Cyber Defense

SEC450: Blue Team Fundamentals: Security Operations and Analysis

GIAC Security Operations Certified
6 Days
36 CPEs
David Mashburn

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC588: Cloud Penetration Testing

SEC588Offensive Operations

GIAC Cloud Penetration Tester
6 Days
36 CPEs
Moses Frost

Starts 30 Oct 2025 at 8:30 AM CT
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

Advisory Board

Stephen Sims

Research Fellow

Stephen Sims, an esteemed vulnerability researcher and exploit developer, has significantly advanced cybersecurity by authoring SANS's most advanced courses and co-authoring the "Gray Hat Hacking" series.

Learn more

John Hubbard

Consultant

John is a Senior SANS Instructor and SOC consultant, author of SEC450 and LDR551. With deep SOC leadership experience, GIAC certifications, and hands-on labs, he equips cyber defenders with the skills to hunt, detect, and lead resilient operations.

Learn more

Huáscar Tejeda

Huáscar Tejeda is a seasoned cybersecurity expert with 20+ years of notable achievements in IT and Telecommunications. Huáscar is co-author of the Gray Hat Hacking 6th edition.

Learn more

Ingrid Parker

Senior Manager of Threat Hunting

Ingrid is currently the Manger of Intelligence at Red Canary.

Learn more

Jason Ostrom

Founder and Principal Consultant

Jason Ostrom has revolutionized cybersecurity by developing open-source tools like PurpleCloud and Automated Emulation, enabling scalable adversary emulation in cloud environments.

Learn more

Jeff McJunkin

CEO

Jeff McJunkin, Rogue Valley InfoSec founder, has led Fortune 100 pen tests and shaped Core NetWars. His key role in SANS Holiday Hack Challenge and hands-on security innovations continue to elevate the industry, advancing defenses worldwide.

Learn more

Schedule

Summit Dates

Tuesday, 28 October - Wednesday, 29 October

Training Dates

Thursday, 30 October - Tuesday, 4 November

Showing 17 of 36

Filter by:

Select day:

Welcome and Opening Remarks

Summit Day 108:45AM - 09:00AM CDT

In-Person & Virtual

Keynote | The Augmented Era: Disrupt or be Disrupted

We're living through the most fundamental shift in cybersecurity since the advent of the Internet itself. AI isn't replacing security practitioners (yet), but it's creating augmented adversaries who operate at unprecedented scale. A single attacker can now use AI to force multiply themself as if they were an entire team. Nation-state actors are leveraging AI to maintain fraudulent positions at Fortune 500 companies. Non-technical criminals are deploying sophisticated ransomware. The question isn't whether AI will disrupt security, it's whether you'll be the disruptor or the disrupted.

Summit Day 109:00AM - 09:45AM CDT

Presented by

Pedram Amini

Chief Scientist

In-Person & Virtual

Social Hacktics

Social engineering remains one of the most effective and widely used attack vectors in modern cybersecurity operations. John McAfee once stated, “Social engineering has become 75% of an average hacker’s toolkit, and for the most successful hackers, it reaches 90% or more.” Despite its overwhelming real-world application, providing a hands-on, safe, and realistic environment to learn and test these techniques has remained elusive. Until now. Introducing Social Hacktics, a next-generation social engineering CTF that merges AI innovation with an immersive strategy to create one of the most authentic human exploitation experiences to date.

Summit Day 109:00AM - 09:00PM CDT

Facilitated by

Foster Nethercott

Certified Instructor Candidate

In-Person

Break

Summit Day 109:45AM - 10:00AM CDT

In-Person & Virtual

Blue Team | High-Fidelity Threat Hunting: Unveiling Insider Threats Beyond the Logs...The Dual-Identity Evasion Technique

Traditionally, security monitoring assumes that SIEM technologies will be accurate and provide a comprehensive picture of network activity, but what happens when we find that the events recorded by these technologies are insufficient, and we don't have the proper telemetry?

Summit Day 110:00AM - 10:35AM CDT

Presented by

Oscar Cárcamo

Senior Consultant

In-Person & Virtual

Red Team Workshop | Hacking Humans with AI

Artificial Intelligence has taken the world by storm. From leveraging AI for cancer detection to powering the latest fully autonomous smart toaster, this technology is finding its way into every industry and every walk of life.

Summit Day 110:00AM - 12:00PM CDT

Presented by

Foster Nethercott

Certified Instructor Candidate

In-Person

Blue Team | From Exploit to Enterprise Risk: Scaling Purple Team Insights to Protect the Mission

Technical findings alone don't drive change-risk-informed insights do. In this talk, we'll explore how red and purple team activities can evolve from isolated exercises into enterprise-level enablers that directly inform mission resilience, operational risk decisions, and business prioritization.

Summit Day 110:40AM - 11:15AM CDT

Presented by

Anthony Switzer

Cybersecurity Executive

In-Person & Virtual

Blue Team | The Hunt for Silent Compromise: Detecting Cloud-Native Persistence Without Malware or Alerts

As attackers evolve beyond malware and implants, defenders must learn to hunt compromise that never triggers an alert.

Summit Day 111:20AM - 11:55AM CDT

Presented by

Ankit Gupta

Senior Security Engineer

Shilpi Mittal

Lead IT Security Engineer

In-Person & Virtual

Lunch

Summit Day 112:00PM - 01:15PM CDT

In-Person & Virtual

Red Team | From DPAPI to AppBound: Looting Credentials on Modern Web Browsers

With technologies like Credential Guard and LSA Protection becoming defaults in new versions of Windows, red teamers need to find new ways to loot credentials on compromised Windows systems, and it just so happens that one of the most practical alternatives to tradional lsass.exe dumping for passwords is looting credentials stored in web browsers

Summit Day 101:15PM - 01:50PM CDT

Presented by

Melvin Mejia

Senior Red Team Operator

In-Person & Virtual

Blue Team Workshop | Evolving SOC Workflows: Techniques For More Efficient Investigations

Tasks in the SOC are critical for detecting malicious activity and driving the appropriate response. However, some workflows are not optimized, resulting in SOC analysts having to conduct tasks that are highly repetitive or that involve significant manual effort. This workshop will provide a model for optimizing common tasks in the SOC, showing an evolution of manual processes to more efficient approaches then to automation to free up the analysis for high-value tasks.

Summit Day 101:15PM - 03:15PM CDT

Presented by

David Mashburn

Certified Instructor

In-Person

Red Team | The Current State and Future of AI's Role in Vulnerability Research and Offensive

The speed at which AI security products are being released is unlike anything we've seen in the past. The opportunities to weaponize this technology for offensive operations are endless!

Summit Day 101:55PM - 02:30PM CDT

Presented by

Stephen Sims

Fellow

In-Person & Virtual

Red Team | Living Off the Crash: Weaponizing System-Generated Crash Dumps

Endpoint protection systems regularly identify credential harvesting and session hijacking attacks, but crash dumps represent an unmonitored attack surface with the potential to contain the same valuable information. Windows crash dumps routinely preserve domain credentials, browser authentication tokens, and sensitive documents from multiple applications and sessions, yet organizations rarely consider their exploitation potential. This presentation demonstrates how offline analysis of these naturally occurring artifacts can lead to intelligence extraction using chained memory analysis tools after initial acquisition without ongoing endpoint interaction or detection.

Summit Day 102:35PM - 03:10PM CDT

Presented by

Jason Mull

Team Lead, Security Operations

In-Person & Virtual

Break

Summit Day 103:15PM - 03:30PM CDT

In-Person

Wrap-Up

Summit Day 103:30PM - 03:45PM CDT

In-Person & Virtual

Hacker Feud

Get ready for the ultimate showdown at "Hacker Feud"—SANS' electrifying twist on Family Feud that's all about cybersecurity—offense, defense, and everything in between! Picture this: two fierce teams battling it out, buzzing in with answers to quirky topics like "Name the top vulnerability hackers exploit" or “The most annoying phishing scam tactic," all based on real surveys from 100 sharp-minded hackers and cybersecurity pros. With fast-paced rounds, hilarious wrong answers, and epic steals, this event promises non-stop laughter, brain-teasing fun, and insider insights into the cyber world. Whether you're a seasoned pro or a curious newbie, join the frenzy, cheer on your squad, and see if you can outwit the crowd. Hosted by Ed Skoudis, this event will be the highlight of your evening.

Summit Day 103:45PM - 05:00PM CDT

Presented by

Ed Skoudis

Fellow

In-Person