LDR550: Leading Agentic Security Teams - Live Online
Most security teams have added AI around the edges of the work. An assistant here, a review tool there. The returns stay small because the way the team operates never changed.
LDR550 is about changing it. Two days of live, virtual instruction on a single question asked workflow by workflow: what may AI do on its own, and who answers for the outcome? You decide each grant of autonomy against the damage a wrong action would cause and how hard it would be to reverse, then record those decisions in one table you can take back to work. The capstone starts that table for your own organization, built from the budget, team, and tools you have now.
During The Two Days, You'll Work Through:
- 8 hands-on labs
- Cyber42 simulation rounds set at a fictional organization
- Baselining a security team's current autonomy and mapping its workflows
- Setting governance and oversight tiers, and naming who is accountable
- A tool-selection rubric built on capability rather than product
- A capstone: your own Security Autonomy Matrix and a 90-day roadmap
A Framework That Outlives Your Tool Stack
Course author and SANS Fellow Lenny Zeltser built LDR550 around decisions rather than products, so what you decide in class still works after your AI tools change. The course also covers the second-order problems: automation bias, analyst skill atrophy, and what the team falls back to when the AI is wrong or unavailable. You’ll get 12 CPE credits for this course.
Who Should Take This Course?
CISOs and senior security leaders who own strategy, budget, and the operating model, plus security directors and team leads who have to make the transition real inside their teams. The course expects no hands-on work with the tools. Security leadership experience or the equivalent of LDR512 is the right starting point.
