SANS 2027

Cybersecurity Training for Every Seat on the Security Team

SANS 2027 is a cybersecurity training event running April 12-17 at the Hyatt Regency Orlando, in-person and online. One of the largest course lineups SANS runs each year, it spans cyber defense, offensive operations, digital forensics, cloud and identity security, ICS/OT, leadership, and AI security, with Core NetWars included.

From Business Fluency to ICS/OT Penetration Testing in One Week

A security department is several different jobs. Analysts watch for intrusions, testers break in, examiners reconstruct what happened, engineers lock down cloud and identity, and managers answer for all of it. This spring flagship event offers a course for each of those roles, so a department can complete cybersecurity training together.

Some of the newest SANS courses are running here and cover identity security for cloud, hybrid, and agentic environments, GenAI and LLM application security, and adversarial AI. Core NetWars is included with course registration, and the game scenario starts at a local arcade before an AI pulls the players into a digital world.

The Hyatt Regency Orlando sits on International Drive, minutes from Universal Orlando Resort, Walt Disney World, and SeaWorld, and SANS offers attendees discounted Walt Disney World tickets for anyone bringing family.

Why Attend SANS 2027

• SANS instructors are still working practitioners, which is why labs resemble real client environments and why questions in class get answers drawn from experience.
• Most courses pair with a GIAC certification exam, giving you a credential that tests what you learned and travels with you to your next role.
• A flagship event crowd means the person beside you may work in a different specialty, and Core NetWars, SANS@Night talks, and the Welcome Reception give those conversations somewhere to happen.
• The SANS group rate at the Hyatt Regency Orlando includes the resort fee, which covers a daily food and beverage credit and two trolley tickets to the International Drive area.

Why Organizations Send Teams

• One trip covers the whole department. Analysts, testers, examiners, cloud and identity engineers, ICS staff, and managers can each find a course at this event, so one group booking and one hotel block replace several separate trips.
• April timing suits calendar-year budgets. For organizations on a calendar-year budget, mid-April falls after the plan is set and leaves most of the year to put the new skills to work.
• Close gaps that hiring hasn’t solved. Identity, cloud, ICS/OT, and AI security skills are hard to recruit for, and courses in all four run the same week. Training people already on the team is often the faster route.
• Credentials auditors recognize. GIAC certifications are accredited by ANAB under ISO/IEC 17024, which gives auditors, insurers, and vendor-assessment teams a standard they already know.

Course Highlights

• Secure identities across cloud, hybrid, and agentic environments in Identity Security for Cloud, Hybrid, and Agentic.
• Assess industrial control systems without disrupting operations in ICS/OT Penetration Testing & Assessments.
• Hunt attackers across an enterprise network and respond at scale in Enterprise-Class Incident Response & Threat Hunting.
• Bring AI into daily detection and investigation work in AI-Enabled Security Operations: Hands-on Investigation, Detection, and Automation.