SANSFIRE 2027

Summer Cybersecurity Training for Investigators and Defenders

SANSFIRE 2027 is a cybersecurity training event running July 12-17 at the Grand Hyatt Washington in Washington, D.C., in-person and online. Courses cover digital forensics from endpoint to cloud, cyber defense, offensive operations, ICS security, leadership, and AI security, and most lead to a GIAC certification exam.

Windows, Network, Smartphone, and Cloud Forensics in the Same Week

Most serious intrusions end with someone reconstructing what happened, and the evidence lives in places that need different methods: Windows endpoints, network traffic, phones, and cloud tenants. SANSFIRE runs a course for each of those, along with ransomware response and cybercrime investigation, so a forensics team can cover its whole evidence picture in one week of cybersecurity training.

The defensive and offensive courses run alongside that core: detection and monitoring, penetration testing and exploit development, ICS, leadership, and AI security. Offensive AI and adversarial AI are three-day courses that run back-to-back, Monday to Wednesday and Thursday to Saturday.

The Grand Hyatt Washington connects directly to the Metro Center station and sits a few blocks from Capital One Arena.

Why Attend SANSFIRE 2027

SANS instructors are working practitioners, so the forensics and incident response courses are taught by people who run investigations and engagements outside the classroom.

Most courses have a matching GIAC certification exam, so what you learned can be tested and verified afterward.

Core NetWars is included with course registration, and its topics include threat hunting with ELK Stack and Windows, web server, and network forensics, so the tournament lines up with the week’s forensics courses. SANS@Night talks round out the evenings.

Why Organizations Send Teams

• July falls in the last quarter of the federal fiscal year. Agencies with funds to commit before September 30 can use them at this event along with government per diem rooms at the Grand Hyatt.
• Cover the whole evidence picture. Intrusions leave evidence on endpoints, networks, phones, and cloud tenants, and sending team members to different forensics courses the same week builds a response team that can work all four.
• Meet directive requirements. SANS courses and GIAC certifications help organizations satisfy the requirements of directives and frameworks such as DoD 8140, CMMC, and the NICE Framework.
• Credentials that stand up to review. GIAC certifications are independently accredited, which gives contracting officers, auditors, and security leadership a consistent measure of capability.

Course Highlights

• Recover evidence and build a timeline from compromised endpoints in Windows Forensic Analysis.
• Trace attacker movement through network evidence in Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response.
• Collect and analyze evidence from cloud environments after a breach in Enterprise Cloud Forensics and Incident Response.
• Work an extortion intrusion from first access through recovery in Ransomware and Cyber Extortion.