Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

SEC501 Live Online February

  • Mon, Feb 8 - Sat, Feb 13, 2027
  • 1 Course
  • English
Virtual (ET)
SEC501 Live Online February
  • 6-Day Course: February 8 – 13, 2027

    Earn 38 CPEs.

  • GIAC Certified Enterprise Defender

    (GCED)

    Learn about certification.

  • Intermediate Skill Level

    Course material is geared for cybersecurity professionals with hands-on experience.

  • 26 Hands-On Labs

    Apply what you learn with hands-on exercises and labs.

Jump to:

SEC501: Applied Cyber Defense - Live Online

The hardest part of enterprise defense is rarely the analysis. It is deciding what to do when the record you need sits with a SaaS provider, an MSSP, or a cloud platform, and it will not arrive before you have to act.

SEC501 trains that decision over six days of live, virtual instruction, built around a single persistent anomaly you follow all week. Each section adds evidence and none of it hands you a tidy conclusion. The recurring question is the one the job actually asks: does this justify escalation, containment, or collecting more, and what is still missing when you make the call?

During the week, you'll work through:

  • 25+ integrated hands-on labs
  • A Capture the Flag capstone with independent challenges
  • Packet analysis, network reconstruction, and Suricata rule testing
  • Asset discovery, vulnerability validation, and credential exposure exercises
  • Deleted-file recovery, Windows artifact analysis, and ransomware timeline work
  • Static, host behavior, network behavior, and manual code analysis of a malware specimen

Verifying AI-Assisted Analysis

SEC501 treats AI-assisted analysis and agent actions as evidence to be verified, not accepted. You compare automated interpretations against primary records, confirm what authority an agent was granted, and identify which system change it actually made. 38 CPE credits, aligned to the GIAC Certified Enterprise Defender (GCED) certification.

Who Should Take This Course?

Experienced technologists whose defensive work crosses systems and teams: SOC analysts moving into incident handling, security engineers responsible for detection and hardening, network and system administrators taking on defense duties, DFIR practitioners, and CSIRT members. SEC401-level knowledge or equivalent experience is the right starting point.

Students Say

I would absolutely say this made me a much better analyst and broadened my horizons on concepts I thought I had a good grasp on, but this course showed me more tools that I can utilize.
Andrea M.U.S. Federal Agency

Download the Course Syllabus or Letter to Justify this Training to Your Manager

To learn more about SEC501, business takeaways, laptop requirements and more, please visit the course page.

Courses

Looking for Group Purchasing? Contact Sales

GIAC Certification Exam Attempt

2 Free practice tests when you add a certification exam attempt to your course. Available for select courses below.

Extra 120 Days of Course Access

Add OnDemand Extended Access for 120 days to help you prepare for your GIAC exam. Available for select courses below.

Featured Speaker

Ross Bergman
Ross Bergman

Ross Bergman

SANS Principal Instructor Ross Bergman brings nearly four decades of hands-on and leadership experience. SANS Senior Instructor Dave Shackleford has advised hundreds of organizations on cloud, network, and security architecture.

Read more about Ross Bergman

Three Reasons to Train Virtually

  • Ultimate Convenience

    Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need right from your home.

  • Personalization

    Hands-on learning with the opportunity to ask questions and receive instant feedback from world-renowned experts. Afterward, reinforce your skills with 4-months of access to daily course lecture archives.

  • Hands-On Labs

    Learn cutting-edge cybersecurity knowledge with hands-on labs that provide you with techniques you can immediately use in your organization.

Woman at Laptop

Frequently Asked Questions

SEC501 Live Online February is taught live in Eastern Time from February 8-13, 2027. Seven days before class, download your digital materials and run the Test Connection check under SANS Live Online in your SANS Account; printed books ship to your registration address about 14 days ahead. Class chat and help run through your course Slack channel.

Other questions are answered in the SANS Live Training FAQ.

Yes. Ross Bergman teaches SEC501 live online February 8-13, 2027, in Eastern Time: six days and 38 CPEs, aligned with GIAC Certified Enterprise Defender (GCED).

SOC analysts moving into incident handling, security engineers, sysadmins taking on defense, and DFIR and CSIRT staff. SEC401-level knowledge is the expected starting point.

One persistent anomaly runs through all six days, and each section adds evidence, so students practice deciding when to escalate, contain, or keep gathering. The week ends with a Capture the Flag.

An Intel or AMD x64 laptop from 2020 or later with at least 16 GB of memory and virtualization enabled. Apple M-series and other ARM laptops won't run the course's virtual appliances.

SEC501 Live Online February | Cybersecurity Training