SANS Security West 2027

Cybersecurity Training Where AI Is Both Target and Tool

SANS Security West 2027 is a cybersecurity training event running May 10-15 at the Hilton San Diego Bayfront, in-person and online on Pacific Time. Courses cover offensive and adversarial AI, AI-driven security automation, digital forensics, cloud security, and security leadership, and most lead to a GIAC certification exam.

AI Attack, Defense, and Automation, Alongside Core SANS Courses

AI now shows up on both sides of an incident. Attackers use it to build and speed up their tooling, defenders are folding it into detection and response, and the AI systems organizations deploy have become targets in their own right. Training at Security West follows all three: offensive AI techniques, penetration testing of AI systems, AI for offensive security, and AI-driven automation for red, blue, and purple teams, plus Python tooling built around LLMs.

Offensive AI and adversarial AI are three-day courses, one running Monday to Wednesday and the other Thursday to Saturday, so a student can take both in the same week. Around them sit some of SANS’ most popular courses: network monitoring, incident handling, Windows, Mac and iOS, and smartphone forensics, ICS, cloud, and leadership.

The Hilton San Diego Bayfront sits on San Diego Bay about three miles from San Diego International Airport, with the Gaslamp Quarter and Petco Park close by.

Why Attend Security West 2027

• SANS instructors are working practitioners, so the AI courses draw on how attackers and defenders are using these tools in current environments.
• Most courses pair with a GIAC certification exam, and the AI lineup has its own: GIAC Offensive AI Analyst, GIAC AI Penetration Tester, and GIAC AI Security Automation Engineer.
• After-class workshops, expert-led talks, and the Welcome Reception put you in a room with instructors and practitioners working through the same problems at their own organizations.
• Booking through SANS makes the hotel’s daily destination charge optional, and anyone who opts in gets a one-hour bike or kayak rental and transportation to Coronado Island and its beach.

Why Organizations Send Teams

• Test the AI before an attacker does. Organizations putting AI into production need people who can attack those systems on their own terms, and courses on offensive AI, adversarial AI, and AI for offensive security run the same week.
• West Coast teams skip the cross-country trip. The event runs on Pacific Time, whether students attend in San Diego or join live online.
• Build capability the hiring market can’t supply quickly. AI security, cloud, and forensics skills are hard to recruit for, and training people already on the team is the faster route.
• A credential built to a recognized standard. GIAC certifications are accredited under ISO/IEC 17024, the international standard for certifying individuals, which gives managers a consistent way to compare skills across a team.

Course Highlights

• Test the AI systems your organization deploys for exploitable weaknesses in Adversarial AI - Penetration Testing AI Systems.
• Learn how attackers use AI to build and speed up their tooling in Offensive AI - Attack Tools and Techniques.
• Automate repetitive security work with Python and LLMs in AI-Powered Security Automation: Building Tools with Python, LLMs, and MCP.
• Reconstruct activity on Apple devices after an incident in Mac and iOS Forensic Analysis and Incident Response.