SANS Network Security 2027

Cybersecurity Training That Covers the Whole Attack Surface

SANS Network Security 2027 is a cybersecurity training event running September 27 - October 2 at Caesars Palace in Las Vegas, in-person and online. The course lineup is among the largest SANS runs in a year, spanning cyber defense, offensive operations, digital forensics, cloud security, ICS/OT, leadership, and AI security, with two NetWars tournaments included.

From Agentic AI to ICS, and Most Things In Between

Security teams are covering more ground than they were a year ago. AI agents are reaching production with real permissions, cloud estates change daily, and OT networks that were never designed to be reachable now are.

Why Attend Network Security 2027

• Every course is taught by someone who works every day in the field they teach, so the examples and stories shared in class come from their many years of experience.
• Most courses pair with a GIAC certification exam, giving you a way to prove new skills after the week ends.
• Classmates matter as much as the curriculum. You'll train alongside industry peers who are working to solve the same problems you are. Plus, evening keynotes and SANS@Night talks keep the conversation going after class ends. ​
• Caesars Palace connects directly to the Forum Shops, a multi-story mall with dining and retail, so getting between class, a meal, and your room never requires stepping outside.

Why Organizations Send Teams

• Regulatory expectations keep tightening. NIS2, DORA, PCI DSS 4.0, and incident-disclosure rules increasingly ask organizations to provide evidence of real capability. Trained, certified staff is that evidence.
• Lower the cost of the incident you haven't had yet. Detection and response times are a function of who is on shift. The teams that contain an intrusion quickly are the ones who have practiced the work before the alert fires.
• Close skill gaps that hiring hasn't solved. If the experience needed to take on your organization's cyber risk remains scarce in the talent market, training your team can fill that gap. Network Security courses cover LLM application security, cloud security engineering, and OT visibility and response in the same week.
• Gain credentials that hold up in an audit. GIAC is accredited by ANAB under ISO/IEC 17024, which is why auditors, insurers, and contracting officers accept the credential as evidence.

Course Highlights

• Defend autonomous AI agents in production, including guardrails and prompt-injection defense, in Securing Agentic AI.
• Hunt stealthy attackers across Linux estates in Linux Incident Response and Threat Hunting.
• Test industrial control environments without breaking them in ICS/OT Penetration Testing and Assessments.
• Catch attacker activity inside cloud accounts in Cloud Security Threat Detection.