SANS ICS Security Summit & Training 2026

Mon, Jun 8 - Tue, Jun 16, 2026
8 Courses
18 CPEs (Summit Only)
1 NetWars Tournament
English

Disney’s Contemporary Resort & Virtual (ET)

4600 North World Drive, Lake Buena Vista, FL 32830

Jump to:

Event Highlights
Courses
Speakers
Sponsors
Schedule
Location

Summit: June 8-10 - In-Person Only | Training: June 11-16 - In-Person & Live Online | Summit Co-Chairs: Tim Conway and Robert M. Lee | In-Person CPE Credits: 18

Get up-to-speed on the latest methods and techniques for safeguarding industrial systems and operational technology.

Slide 1 of 2
Slide 2 of 2

The SANS ICS Security Summit offers something for everyone—from introductory learning for those new to ICS/OT security to advanced insights and techniques for seasoned practitioners and leaders. Join us at Disney in Orlando to experience immersive workshops, in-depth talks, and practical takeaways led by the industry’s top experts.

Create core memories with your peers in the ICS/OT community and your family during a magical getaway. Extend the experience with world-class training courses immediately after the Summit to further build your expertise. Don’t miss this one-of-a-kind opportunity in Orlando!

*Exclusive Offer: All SANS ICS Security Summit 2026 registrants will receive ICS310: ICS Cybersecurity Foundations course OnDemand for Free (a $499 USD value.) — Access granted prior to the Summit.

"A great way to get a wide variety of ICS Security content and meet others fighting the same fight." - Justin Opatrny, General Mills, Inc.

Where the ICS/OT Community Comes Together

The ICS Security Summit was founded by Michael J. Assante, alongside SANS Founder Alan Paller, to unite those protecting the technologies that power industry and sustain our modern way of life. What began as a bold idea has become the global gathering place for ICS defenders—a community bound by shared purpose, real-world experience, and a relentless drive to secure critical infrastructure and the essential systems that keep operations running everywhere. Each year, when we come together, we don’t just continue Mike’s legacy—we strengthen it, forging new connections and advancing the mission of safeguarding civilization for generations to come.

What Attendees Say

Slide 1 of 4
Great speakers, great content, and fantastic opportunities to talk with others in the industry about issues we're all facing!
John Fruge
Slide 2 of 4
Anyone responsible for U.S. ICS Security needs to attend this event every year. It's beneficial because it identifies and educates on current and real threats. The SANS Summit informs and educates at multiple levels—strategic, operational, tactical, etc.
Bill Peterson
Slide 3 of 4
As my first ICS Summit it truly felt like being at a family reunion with a wonderful family I didn’t know I had — warm, collaborative, and passionate about the same mission. As a remote worker, I made more meaningful connections in that one week than I would have in years otherwise. My first thought upon wrap-up was: Time to start working on funding to get back there in 2026! Truly well done!
Bill ProvostThe Hershey Company
Slide 4 of 4
The Summit was fantastic. The accessibility of the speakers before and after the event makes this so much better. This experience is invaluable and cannot be replicated anywhere else. I have every intention of attending next year.
Harold Fisher

Summit Highlights

SANS Instructor-Led Workshops

Workshops include talks, live demonstrations, and select hands-on labs leveraging Operational Technology (OT) devices and applications, giving attendees practical exposure to the tools and environments used to secure critical infrastructure.

SANS ICS Security Summit 2026: Men Standing Together In Summit Room

In-Depth ICS/OT Security Talks

The industry's top ICS/OT practitioners will share their latest research, solutions, tools, and case studies.

SANS ICS Security Summit 2026: Men Giving a Presentation on Stage

Unmatched Networking with the Top Minds in ICS/OT Security

You’ll have the chance to engage with Summit Chairs, speakers, and your peers in the community for deep-dive discussions, and casual chats over breaks, meals, and evening receptions.

Solutions Expo Hall

Explore the latest tools and solutions in ICS/OT security.

SANS ICS Security Summit 2026: Two People Collaborating On a Project

World-Class SANS ICS Security Courses

Enhance your knowledge base and add to your toolkit by bundling your Summit experience with a hands-on, immersive course taught by top SANS instructors and course authors.

Register

Summit and Course Registration

from $3,505 USD

In personIncludes

Course: Live Instructor Training with Hands-On Exercises
Course: Students taking a 4-6 day course will be able to participate in ICS-focused NetWars
Summit: Talks, Presentations and Workshops
Summit: Unmatched Networking
Summit: Evening Reception
Summit: Access to Summit Exhibit Hall
Summit: Lunch and light refreshments will be provided during the event and scheduled breaks
Summit: Exclusive Offer - Receive ICS310: ICS Cybersecurity Foundations course OnDemand for free

Select course to Enroll

Live onlineIncludes

Course: Virtual Live Instructor Training with Hands-On Exercises

Select course to Enroll

Summit Registration Only

from $925 USD

$925 USD*Prices exclude applicable local taxes

In personIncludes

Talks, Presentations and Workshops
Unmatched Networking
Evening Reception
Access to Summit Exhibit Hall
Lunch and light refreshments will be provided during the event and scheduled breaks
First Access to Approved Recordings and Decks
Summit: Exclusive Offer - Receive ICS310: ICS Cybersecurity Foundations course OnDemand for free

Attend In PersonLogin to register

Important Dates

Refund Deadline:: May 22, 2026
Hotel Group Discount Deadline:: May 11, 2026

Courses

Looking for Group Purchasing? Contact Us

Showing 8 of 8

Filter by:

SEC504: Hacker Tools, Techniques, and Incident Handling

SEC504Offensive Operations

GIAC Certified Incident Handler
6 Days
38 CPEs
James Leyte-Vidal

Starts 11 Jun 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

ICS410: ICS/SCADA Security Essentials

ICS410Industrial Control Systems Security

Global Industrial Cyber Security Professional
6 Days
36 CPEs
Justin Searle

Starts 11 Jun 2026 at 8:30 AM ET
$9,230 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

ICS515: ICS Visibility, Detection, and Response

ICS515Industrial Control Systems Security

GIAC Response and Industrial Defense
6 Days
36 CPEs
Robert M. Lee

Starts 11 Jun 2026 at 8:30 AM ET
$9,230 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

ICS456: Essentials for NERC Critical Infrastructure Protection

ICS456Industrial Control Systems Security

GIAC Critical Infrastructure Protection
5 Days
31 CPEs
Tim Conway

Starts 11 Jun 2026 at 8:30 AM ET
$7,650 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

ICS612: ICS Cybersecurity In-Depth

ICS612Industrial Control Systems Security

5 Days
30 CPEs
Jeffrey Shearer

Starts 11 Jun 2026 at 8:30 AM ET
$9,230 USD (Course)
*Prices exclude applicable local taxes

View course details

ICS418: ICS Security Essentials for Leaders

ICS418Industrial Control Systems Security

2 Days
12 CPEs
Dean Parsons

Starts 11 Jun 2026 at 8:30 AM ET
$3,505 USD (Course)
*Prices exclude applicable local taxes

View course details

ICS613: ICS/OT Penetration Testing & Assessments

ICS613Industrial Control Systems Security

5 Days
30 CPEs
Don C. Weber & Tyler Webb

Starts 11 Jun 2026 at 8:30 AM ET
$9,230 USD (Course)
*Prices exclude applicable local taxes

View course details

SEC502: Cloud Security Tactical Defense

SEC502Cloud Security

GIAC Cloud Security Essentials
5 Days
36 CPEs
Kenneth G. Hartman

Starts 11 Jun 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

Summit Chairs

Tim Conway

SANS ICS Curriculum Lead at SANS Institute

SANS Fellow Tim Conway, co-author of ICS456, ICS310, and ICS612, blends decades of hands-on ICS/OT security and compliance expertise with ongoing frontline consulting, helping students turn complex industrial challenges into practical skills.

Learn more

Robert M. Lee

CEO at Dragos, Inc

SANS Fellow and Dragos CEO Robert M. Lee, author of ICS515 and FOR578 and co-author of ICS310, teaches from landmark industrial cyber investigations, turning real adversary tradecraft into visibility, detection, and response skills in OT.

Learn more

Thank You To Our Sponsors

Schedule

Showing 17 of 55

Filter by:

Select day:

Breakfast & Credential Pick-Up

08:00AM - 09:00AM EDT

In-Person

Opening Remarks

09:00AM - 09:10AM EDT

In-Person

Presented by

Tim Conway

SANS ICS Curriculum Lead at SANS Institute

Robert M. Lee

CEO at Dragos, Inc

Keynote | Fragile Lifelines: Navigating a World of Continuous Cyber Warfare

This keynote will explore the high-stakes intersection of geopolitics and critical infrastructure protection in an era where cyber conflict is no longer an occasional event, but a constant state of global competition. Participants will hear how nation-states leverage "low and slow" stealth tactics to pre-position themselves within vital networks—such as energy, water, and transportation—transforming essential services into instruments of geopolitical leverage.

09:10AM - 09:50AM EDT

In-Person

Presented by

Brian Harrell

VP and Chief Security Officer at FirstEnergy

When AI Crossed the Air Gap: Shadow AI as an ICS Safety Risk

Industrial environments are not being compromised by deployed AI models, but by uncontrolled AI use by engineers, analysts, and vendors interacting with OT data. This session presents a real world case study where shadow AI introduced new risks to safety, availability, and integrity in an ICS adjacent environment.

09:50AM - 10:20AM EDT

In-Person

Presented by

Teri Green

Vice President of Technology at Elevate Energy

Break

10:20AM - 10:40AM EDT

In-Person

Designing a Defensible ICS Network: How to Achieve Context-Aware Microsegmentation

Network segmentation is a core requirement of a defensible ICS architecture, yet many OT networks remain flat or rely on segmentation approaches that are difficult to deploy and sustain. This session focuses on SANS Critical Control 2 (Defensible Architecture) and Critical Control 3 (ICS Network Visibility and Monitoring), presenting a practical crawl, walk, run approach to segmentation in industrial environments.

10:40AM - 11:10AM EDT

In-Person

Presented by

Jose Avila Gomez

Solutions Engineer: Industrial Networking and Cybersecurity at Cisco

Architecture That Leaves PowerPoint: Practical Purdue in Real Factories

Many industrial architectures never move beyond diagrams, often dismissed as too complex, too expensive, or too risky for production environments. This session explores the practical, iterative deployment of the Purdue Model in brownfield factories,

11:10AM - 11:40AM EDT

In-Person

Presented by

Nick Ford

Associate Director, Connected Factory at Raytheon

Consequence-Driven Cyber-Informed Engineering (CCE) in ICS Environments

This talk will focus on introducing a novel idea on Consequence-driven Cyber-informed Engineering championed by Idaho National Labs in USA.

11:40AM - 12:10PM EDT

In-Person

Presented by

Prashant

Senior Cybersecurity Advisor at Enbridge Inc.

Lunch

12:10PM - 01:20PM EDT

In-Person

From C2 Dead-End to Covert Access: SSH Tunneling Through DNP3 Virtual Terminal Objects

We built command-and-control over DNP3. Then we realized we'd solved the wrong problem.

01:20PM - 01:50PM EDT

In-Person

Presented by

Tyler Webb

Principal Penetration Tester at Dragos, Inc.

Bringing the Fight to the Edge: What 61,000 OT Firewalls Telemetries Reveal About Early and Predictable ICS Attack Behavior

Defenders of industrial control systems are often focused to respond late in the attack lifecycle, after adversaries have already reached sensitive operational environments. This session presents findings from Palo Alto Networks’ OT Threat Research Lab based on large-scale analysis of 2023/2024/2025 security telemetry collected from more than 61,000 firewalls inspecting industrial application traffic.

01:50PM - 02:20PM EDT

In-Person

Presented by

Adam Robbie

Head of OT Threat Research at Palo Alto Networks

When Governance Fails on the Plant Floor: Deconstructing Real ICS Incidents and Rebuilding Security that Actually Works

Industrial Control Systems rarely fail because of “advanced hackers.” They fail because governance, engineering, and security do not meet where real work happens.

02:20PM - 02:50PM EDT

In-Person

Presented by

Elena Bobkova

Senior Lead Auditor at Det Norske Veritas

Rehearsing the End of the World: A MITRE Led TTX on Protracted Cyber Conflict

MITRE recently hosted the Critical Infrastructure Cybersecurity Tabletop Exercise (CICS TTX), bringing together approximately 200 participants from 70 organizations—including federal, state, and local governments, emergency managers, and industry representatives from pipelines, electricity, IT, communications, and rail—across five metropolitan areas.

02:50PM - 03:20PM EDT

In-Person

Presented by

Mark Bristow

09:00AM - 09:10AM EDT

In-Person

Presented by

Tim Conway

SANS ICS Curriculum Lead at SANS Institute

Robert M. Lee

CEO at Dragos, Inc

Keynote To Be Announced

09:10AM - 09:50AM EDT

In-Person

Out of Control II: Abusing MQTT and Sparkplug B for Distributed Kinetic Attacks

This presentation pulls back the curtain on how a protocol meant to simplify industrial data can instead become a powerful weapon in the wrong hands.

09:50AM - 10:30AM EDT

In-Person

Presented by

Marco Ayala

National Sector Chief - Energy at InfraGard

Eric Forner

CTO at Armexa

Break

10:30AM - 10:50AM EDT

In-Person

Post-Incident Actions in OT (72h): Technical Stabilization for Industrial Environments

The first 72 hours after an OT-ICS incident are dominated by operational constraints: safety, uptime, vendor dependencies, and limited maintenance windows.

10:50AM - 11:20AM EDT

In-Person

Presented by

Jarek Sordyl

CISO at CISO4U

Design Your Defense: Using D3FEND for OT to Uncover Gaps in Your Architecture

Much like MITRE ATT&CK has done for collating attacker methods, D3FEND was built to fundamentally describe the assets and subsequent countermeasures vital for defense.

11:20AM - 11:50AM EDT

In-Person

Presented by

Emma Holt

Operational Technology Systems Security and Safety Engineer at The MITRE Corporation

From Dwell Time to Dollars: Quantifying the Financial Value of Faster OT Incident Recovery

Over the last several years, the SANS State of ICS/OT Security surveys show a consistent pattern: detection and containment timelines are improving, but remediation/recovery remains the long pole—sometimes stretching into weeks or longer.

11:50AM - 12:20PM EDT

In-Person

Presented by

Donovan Tindill

Director, OT Cybersecurity at DeNexus

Lunch

12:20PM - 01:30PM EDT

In-Person

New Kind of Critical Infrastructure—Uncovering Vulnerabilities in AI Data Center Equipment

AI is the latest craze that makes the world go round, and to satisfy the demand we are witnessing a desperate gold rush of compute. This has transformed data centers from boring server farms into the critical infrastructure of the modern era, diverting supply chains and packing as much compute to feed the LLM machine.

01:30PM - 02:00PM EDT

In-Person

Presented by

Amir Zaltzman

Senior Vulnerability Researcher at Claroty Team82

Managing the AI Hunger for OT Data: Secure Approaches for Industrial Integration

As businesses accelerate AI adoption, the demand for real-time OT data is skyrocketing. This creates a unique challenge: how do we enable AI-driven insights without compromising operational integrity or cybersecurity?

02:00PM - 02:30PM EDT

In-Person

Presented by

Blake Gilson

IT Strategy Manager at ExxonMobil

Making the Switch - How to Build an OT Cyber Program Around the Five Critical Controls

Based on my experience supporting and later leading an OT cybersecurity program, this talk explores the evolution from a NIST Cybersecurity Framework–aligned strategy to a more operations-driven approach built on the SANS Five Critical Controls for OT Cybersecurity.

02:30PM - 03:00PM EDT

In-Person

Presented by

Christopher Cotter

09:30AM - 09:40AM EDT

In-Person

Presented by

Robert M. Lee

CEO at Dragos, Inc

Tim Conway

SANS ICS Curriculum Lead at SANS Institute

Keynote to be Announced

09:40AM - 10:10AM EDT

In-Person

From Fire Drills to Fusion: How Cyber Fusion Centers Transform Security Operations

Modern security teams are overwhelmed—drowning in alerts, disconnected tools, and reactive “fire drill” responses. Cyber Fusion Centers (CFCs) offer a path out of this chaos,

10:10AM - 10:40AM EDT

In-Person

Presented by

Terry McCorkle

Founder and CEO at PhishCloud, Inc.

Modernizing Operational Technology Security in the Field

Speaker: Steven Green

As industrial environments become more connected, OT security must evolve without disrupting safety, reliability, or uptime.

Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.

About ICS NetWars: Focused on factory machinery operations, this experience brings players onto the factory floor, exposing them to the challenges of detecting and defending physical equipment and manufacturing components from cyberattacks.

06:30PM - 09:30PM EDT

In-Person & Virtual

Tournament: ICS NetWars

06:30PM - 09:30PM EDT

In-Person & Virtual

Disney’s Contemporary Resort

Hotel Special Rates and Reservations

A special discounted rate of $379.00 S/D plus applicable taxes will be honored based on space availability.

These rates are only available through Monday, May 11, 2026.

A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID at Disney's Port Orleans Resort - French Quarter.

Book Your Reservation and Buy Discounted Park Tickets

3 Reasons To Stay At The Event Venue

Ultimate Convenience
Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities - all in one centralized, convenient location.
Seamless Networking Opportunities
Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders - from impromptu conversations in the lobby to exclusive after-hours events.
All Day, All Event Access
SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.

More Information

Retreat to this ultra-modern Disney Resort hotel and discover award-winning dining, spectacular views and dazzling pools. Whether you’re staying in the iconic A-frame Contemporary tower or the nearby Garden Wing, you can walk to Magic Kingdom main gate or catch the Resort Monorail as it breezes through the tower. Inside, a 90-foot-tall mural by Disney Legend Mary Blair—responsible for the distinct look and feel of the “it’s a small world” attraction—celebrates the Grand Canyon and the American Southwest.

Dragos and SANS partnered to offer 8 scholarships supporting professionals and aspiring practitioners who are looking to deepen their ICS cybersecurity knowledge and connect with the community. These scholarships are designed to help offset costs for individuals committed to advancing their skills and contributing to the field. The application window for this scholarship is now closed. Applications were accepted through 5:00 p.m. EDT on Friday, March 27, 2026. We appreciate the strong interest in this opportunity. Recipients will be notified by Monday, April 13, 2026. The scholarship includes: - Summit registration fee (includes breakfast, lunch, and afternoon snacks during Summit days) - Three (3) nights at the Walt Disney World Contemporary Resort - Airfare up to $600 (must be booked through the SANS travel agent)

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

SANS ICS Security Summit & Training 2026

Share

Get up-to-speed on the latest methods and techniques for safeguarding industrial systems and operational technology.

Where the ICS/OT Community Comes Together

What Attendees Say

Summit Highlights

SANS Instructor-Led Workshops

In-Depth ICS/OT Security Talks

Unmatched Networking with the Top Minds in ICS/OT Security

Solutions Expo Hall

World-Class SANS ICS Security Courses

Register

Summit and Course Registration

Summit Registration Only

Courses

GIAC Certifications

Extra 4 Months of Course Access

SEC504: Hacker Tools, Techniques, and Incident Handling

Quick view

ICS410: ICS/SCADA Security Essentials

Quick view

ICS515: ICS Visibility, Detection, and Response

Quick view

ICS456: Essentials for NERC Critical Infrastructure Protection

Quick view

ICS612: ICS Cybersecurity In-Depth

Quick view

ICS418: ICS Security Essentials for Leaders

Quick view

ICS613: ICS/OT Penetration Testing & Assessments

Quick view

SEC502: Cloud Security Tactical Defense

Quick view

Summit Chairs

Tim Conway

Robert M. Lee

Thank You To Our Sponsors

Schedule

Breakfast & Credential Pick-Up

Opening Remarks

Keynote | Fragile Lifelines: Navigating a World of Continuous Cyber Warfare

When AI Crossed the Air Gap: Shadow AI as an ICS Safety Risk

Break

Designing a Defensible ICS Network: How to Achieve Context-Aware Microsegmentation

Architecture That Leaves PowerPoint: Practical Purdue in Real Factories

Consequence-Driven Cyber-Informed Engineering (CCE) in ICS Environments

Lunch

From C2 Dead-End to Covert Access: SSH Tunneling Through DNP3 Virtual Terminal Objects

Bringing the Fight to the Edge: What 61,000 OT Firewalls Telemetries Reveal About Early and Predictable ICS Attack Behavior

When Governance Fails on the Plant Floor: Deconstructing Real ICS Incidents and Rebuilding Security that Actually Works

Rehearsing the End of the World: A MITRE Led TTX on Protracted Cyber Conflict

Break

Workshop Track 1—New to ICS/OT

Workshop Track 2—Practitioner

Workshop Track 3—Leadership

Breakfast

Opening Remarks

Keynote To Be Announced

Out of Control II: Abusing MQTT and Sparkplug B for Distributed Kinetic Attacks

Break

Post-Incident Actions in OT (72h): Technical Stabilization for Industrial Environments

Design Your Defense: Using D3FEND for OT to Uncover Gaps in Your Architecture

From Dwell Time to Dollars: Quantifying the Financial Value of Faster OT Incident Recovery

Lunch

New Kind of Critical Infrastructure—Uncovering Vulnerabilities in AI Data Center Equipment

Managing the AI Hunger for OT Data: Secure Approaches for Industrial Integration

Making the Switch - How to Build an OT Cyber Program Around the Five Critical Controls

Workshop Track 1—New to ICS/OT

Workshop Track 1—New to ICS/OT

Workshop Track 2—Practitioner

Workshop Track 2—Practitioner

Workshop Track 3—Leadership

Workshop Track 3—Leadership: Executive Cyber Exercise

Summit Social—Family Luau

Breakfast

Awards

Opening Remarks

Keynote to be Announced

From Fire Drills to Fusion: How Cyber Fusion Centers Transform Security Operations