SANS ICS Europe Summit 2026

Tue, Nov 3 - Wed, Nov 4, 2026
English

Motorworld, Munich

Motorworld, Am Ausbesserungswerk 8, 80939 Munich, Germany

Jump to:

Sponsors
Schedule
Location

Hands-On Cybersecurity Training in Munich

The systems keeping the lights on, processes moving, and factories running impact millions of lives—and the ICS Summit is where these kinds of practitioners get together to talk. This summit brings together the people who work in the trenches every day to share real cases, hard-won lessons, and techniques that are tested.

Regardless of if you're fresh in the industry or a seasoned expert hunting for advanced techniques, you'll walk away with material you can immediately take back to the office.

Plus, Day 1 includes all practical workshops. A compact version of SANS usually course offering in one day of intense applied sessions, ahead of the summit on Day 2.

Who Should Be There

Cybersecurity Risk Analysts (OT/ICS Focus)
Industrial Automation Specialists
Infrastructure Security Departments
Those working around Maintenance or Power
Process Control Technicians
Logistics and Power Cybersecurity Professionals
Manufacturing IT Directors

The Story Behind the SANS ICS Security Summit

Students Say

Slide 1 of 4
The course is packed with useful information and gives you a lot of tools.
FOR578 StudentSANS Copenhagen September
Slide 2 of 4
Jonathan is a great instructor and has tremendous knowledge and is willing to teach and share.
LDR516 StudentSANS Copenhagen January
Slide 3 of 4
The Instructor always uses great examples and breaks down the topics for easy understanding.
LDR414 StudentSANS Oslo April
Slide 4 of 4
This course is invaluable for providing me with information to return to my job and provide direct input to the work I am delivering. This involves considering Incident Response for Critical Infrastructure for a city-wide environment in the making.
ICS515 StudentSANS Stockholm May

Register

€600 EUR

€600 EUR*Prices exclude applicable local taxes

In personIncludes

Talks, Break Out Sessions, and Hands-On Workshops
Unmatched Networking
Access to the exhibition hall and venue
Lunch and light refreshments will be provided during the event and scheduled breaks
First Access to Approved Recordings and Decks

Thank You To Our Sponsors

Schedule

Course Training

Daily required course training hours throughout the week.

Bonus Sessions

Engage in extra learning and activities during SANS events.

NetWars Tournaments

Hands-on competitions to test and sharpen your cybersecurity skills.

Not attending a course? Standalone registration is also available. See the Schedule section below for details.

Showing 4 of 17

Filter by:

Select day:

Registration & lunch

12:00PM - 01:00PM CET

Operationalising MITRE ATT&CK for ICS

The session opens the summit by connecting industrial defenders to a unified framework for threat understanding. It explores how the MITRE ATT&CK for ICS matrix can be transformed from documentation into a daily defensive tool. Attendees will walk through mapping attacker behaviours to real network telemetry, building detections around them, and shaping incident response plans that align to ATT&CK techniques. The session focuses on translating theory into practice, enabling teams to identify, classify, and respond to adversaries with greater precision and speed.

Kai Thomsen, Director of Global Incident Response Services - Dragos Inc

Track 1

01:00PM - 03:00PM CET

Networking break

Track 1

03:00PM - 03:30PM CET

Detecting anomalies in OT networks with passive monitoring

Industrial networks demand visibility that doesn’t interrupt operations. The session focuses on passive monitoring approaches that provide deep insight into control system traffic while maintaining safety. Delegates will learn the technical fundamentals of parsing common ICS protocols (Modbus, DNP3, S7Comm, and CIP), developing traffic baselines, and distinguishing normal process changes from true indicators of compromise. Using real examples, the session demonstrates how anomaly detection enhances situational awareness and supports faster, safer incident response in operational environments.

Michael Hoffman, Field CTO, Oil & Gas – Dragos Inc

Track 1

03:30PM - 05:30PM CET

Registration and networking

09:30AM - 10:00AM CET

Chair opening remarks

Tim Conway, Technical Director of ICS & SCADA Programs – SANS Institute

10:00AM - 10:55AM CET

Moderated by

Tim Conway

SANS ICS Curriculum Lead at SANS Institute

Only visible from altitude: What scale reveals that no single program can

Every asset owner believes their environment is unique: their plants, their constraints, their threats. After running OT security programs across hundreds of clients, thousands of sites, dozens of countries and every critical-infrastructure sector, I've reached an uncomfortable conclusion: they're nearly identical where it counts. The differences are the surface. The patterns underneath are the structure, and most of them are invisible from inside a single engagement. This session shares what only becomes visible from altitude: the universal truths about how the industry measures the wrong things, buys the wrong capabilities, and overlooks the same scope, every time. We'll trace why maturity is a vanity metric, why the AI era widens OT's exposure precisely where it hurts most, and why the job of cyber has quietly changed: from managing risk to creating operational resilience. You'll leave knowing which of your "unique" problems are actually everyone’s, and what to do about them.

Samuel Linares, Global OT Cybersecurity Lead - Accenture

10:10AM - 10:55AM CET

Zero Trust in OT - Comparing CISA's new playbook against real-world practice

In April 2026, CISA and federal partners published the first joint guidance explicitly adapting zero trust to OT, organised around six functions – Govern, Identify, Protect, Detect, Respond, Recover – and aligned to NIST CSF 2.0, the CISA Zero Trust Maturity Model, NIST SP 800-82 Rev.3 and IEC 62443. Crucially, the guide itself concedes that IT-centric zero trust cannot be applied wholesale to OT: availability imperatives, decades-long asset lifecycles and legacy protocols with no concept of identity all demand adaptation. This session walks through each of the six functions, shows where current OT security architectures already deliver the intended outcome, and – just as importantly – is candid about where the guidance runs into real operational limits: continuous re-authentication on a serial RTU, identity-based policy on Modbus/TCP, or re-architecting a 25-year-old DCS. Two real-world, phased zero trust adoption examples close the session.

Daniel Buhmann, Senior Consulting Systems Engineer - Fortinet

10:55AM - 11:25AM CET

Networking break

11:25AM - 11:55AM CET

Now what? From design to daily operation: Governance, monitoring and improvement

Many organisations invest significant effort in creating a network zoning plan, defining zones and conduits, and documenting an access matrix. At that point, it can feel as if the segmentation work is finished. But in reality, this is where the real challenge starts. Assets are added, moved or removed. Vendors request remote access. Temporary exceptions appear. Legacy systems remain in place. Engineers need practical solutions. Business processes change. Over time, small unmanaged decisions can slowly break the intended zoning model. This session explains what needs to happen after the network segmentation design is ready. It focuses on how to embed segmentation into daily operations through governance, change management, risk-based access decisions, verification, monitoring, exception handling and continuous improvement. The session also links these operational practices to expectations from NIS2 and IEC 62443, showing how segmentation becomes more than a technical architecture: it becomes a managed cybersecurity control that must be governed, tested, evidenced and maintained.

Dieter Sarrazyn, Industrial Security Advisor & Founder - Secudea

11:55AM - 12:25PM CET

From cyber risk to operational risk: Making better security decisions in OT

Cybersecurity decisions in operational technology have real-world consequences for safety, reliability, and operational continuity. As IT and OT environments become increasingly connected, security engineers and practitioners must balance cyber risk with the realities of industrial operations. Drawing on real-world experience, Saltanat Mashirova explores practical approaches to cyber-physical risk assessment, identifying critical assets, prioritising security controls, and applying frameworks such as ISA/IEC 62443 to support informed decision-making. Join us to gain actionable guidance for assessing risk, communicating priorities, and making security decisions that strengthen resilience without disrupting operations.

Saltanat Mashirova, Global Cybersecurity Services Product Manager - Eaton

12:25PM - 12:55PM CET

Lunch

12:55PM - 01:55PM CET

Technical session

01:55PM - 02:25PM CET

Technical session

02:25PM - 02:55PM CET

Session title TBC

Brad Wilkerson, Director, Decision Science Products – The Walt Disney Company

02:55PM - 03:25PM CET

Chair closing remarks

Tim Conway, Technical Director of ICS & SCADA Programs – SANS Institute

03:25PM - 03:30PM CET

Summit close

03:30PM - 03:30PM CET

Munich, Germany

Motorworld

SANS is pleased to return to Motorworld for SANS ICS Europe Summit 2026.

Located in a thoughtfully restored historic train yard, Motorworld offers a distinctive setting that blends industrial heritage with modern amenities. The venue features an extensive collection of cars and motorized vehicles from across history and around the world, creating an engaging environment that extends beyond the classroom.

The spacious layout and open design support both focused learning and informal networking, while expanded tours and behind-the-scenes experiences will be available to complement the summit.

View On Google Maps Hotel Info

3 Reasons To Stay At The Event Venue

Ultimate Convenience
Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities - all in one centralized, convenient location.
Seamless Networking Opportunities
Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders - from impromptu conversations in the lobby to exclusive after-hours events.
All Day, All Event Access
SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.

Business People Shaking Hands and Smiling

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS ICS Europe Summit 2026

Share

Hands-On Cybersecurity Training in Munich

Who Should Be There

Students Say

Register

Register

Thank You To Our Sponsors

Schedule

Course Training

Bonus Sessions