Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

SEC522 Live Online February

  • Mon, Feb 8 - Fri, Feb 12, 2027
  • 1 Course
  • English
Virtual (ET)
SEC522 Live Online February
  • 5-Day Course: February 8 – 12, 2027

    Earn 30 CPEs.

  • GIAC Certified Web Application Defender

    (GWEB)

    Learn about certification.

  • Advanced Skill Level

    Course material is geared for cybersecurity professionals with hands-on experience.

  • 17 Hands-On Labs

    Apply what you learn with hands-on exercises and labs.

Jump to:

SEC522: Application Security: Securing Web Applications, APIs, and Microservices - Live Online

HTTP stopped being a website protocol a long time ago. It is now the connective tissue between cloud services, microservices, API gateways, and AI inference endpoints, and a flaw in one of those paths rarely stays contained to one application.

SEC522 teaches defense across that whole surface, virtually in real-time, with your questions answered as they come up. The lab environment is a running application rather than a slide deck: you attack it, defend it, then see what your control blocked. The course is programming-language agnostic, so the patterns hold whether your stack is Java, Python, .NET, or something newer.

During the Week, You'll Work Through

  • 17 hands-on labs
  • A competitive Defend the Flag capstone
  • SQL injection, XSS, CSRF, Unicode, and file upload handling
  • OAuth and access control, session fixation, and TLS traffic inspection
  • Content Security Policy, clickjacking, and cross-domain request defenses
  • GraphQL, API gateway, and JSON security exercises
  • Securing AI Endpoints and APIs

Securing AI Endpoints and APIs

The course closes its API and microservices section with securing AI components inside modern applications, including how AI inference endpoints inherit the same weaknesses as anything else built on HTTP. You’ll get 30 CPE credits for this course, and it’s aligned to the GIAC Certified Web Application Defender (GWEB) certification.

Who Should Take This Course?

Application security analysts and managers, application architects, technical leads of development teams, auditors who need to evaluate web defenses rather than just check for them, penetration testers who want the defensive side, and teams working under PCI DSS requirements. A basic working knowledge of HTML, JavaScript, and SQL is assumed.

Students Say

  • Slide 1 of 2
    [SEC522] is my first SANS training, and it has been far and away the best professional development training I have ever taken.
    Jesse S.Ascendium Education Group
  • Slide 2 of 2
    This class is essential for cybersecurity knowledge in the modern digital world.
    Artie S.US Federal Agency
Slide 1 of 0

Download the Course Syllabus or Letter to Justify this Training to Your Manager

To learn more about SEC522, business takeaways, laptop requirements and more, please visit the course page.

Early Bird Offer

Save $500 USD using the code "EarlyBirdNA" and pay for any 4-6 day course (excluding Beta Courses and 300 Level Courses) by December 24, 2026.

Courses

Looking for Group Purchasing? Contact Sales

GIAC Certification Exam Attempt

2 Free practice tests when you add a certification exam attempt to your course. Available for select courses below.

Extra 120 Days of Course Access

Add OnDemand Extended Access for 120 days to help you prepare for your GIAC exam. Available for select courses below.

Featured Speaker

Dr. Johannes Ullrich
Dr. Johannes Ullrich

Dr. Johannes Ullrich

Dean of Research at SANS Technology Institute

Dr. Johannes Ullrich is the Dean of Research for SANS Technology Institute, a SANS Faculty Fellow, and founder of the Internet Storm Center (DShield.org) which provides a free analysis and warning service to thousands of Internet users and organizations.

Read more about Dr. Johannes Ullrich

Three Reasons to Train Virtually

  • Ultimate Convenience

    Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need right from your home.

  • Personalization

    Hands-on learning with the opportunity to ask questions and receive instant feedback from world-renowned experts. Afterward, reinforce your skills with 4-months of access to daily course lecture archives.

  • Hands-On Labs

    Learn cutting-edge cybersecurity knowledge with hands-on labs that provide you with techniques you can immediately use in your organization.

Woman at Laptop

Frequently Asked Questions

SEC522 Live Online February is taught live in Eastern Time from February 8-12, 2027. Seven days before class, download your digital materials and run the Test Connection check under SANS Live Online in your SANS Account; printed books ship to your registration address about 14 days ahead. Class chat and help run through your course Slack channel.

Other questions are answered in the SANS Live Training FAQ.

Yes. Dr. Johannes Ullrich, founder of the Internet Storm Center, teaches SEC522 live online February 8-12, 2027, in Eastern Time: five days and 30 CPEs, aligned with GIAC Certified Web Application Defender (GWEB).

No. The course is language-agnostic, so the defenses apply to Java, Python, .NET, or anything newer. Basic working knowledge of HTML, JavaScript, and SQL is assumed.

Yes. The API and microservices section closes with securing AI inference endpoints, which share the same HTTP weaknesses as other application components.

Labs run against a live application you attack and then defend, covering injection, OAuth, GraphQL, and API gateways, and the week ends with a competitive Defend the Flag capstone.