SEC536: Adversarial AI - Penetration Testing AI Systems



Kick off your SANS Virginia Beach 2026 experience at the Welcome Reception. Join fellow cybersecurity professionals, instructors, and students for a relaxed breakfast gathering designed to help you connect, share experiences, and make the most of your week in Virginia Beach. Start your morning building new relationships, exchanging insights, and preparing for an engaging week of training. Breakfast will be provided at both hotels on Tuesday, August 25th.
In-Person
Start your day with the SANS Virginia Beach 2026 5K Walk/Run on the Boardwalk. Join fellow attendees, instructors, and staff for a fun and energizing morning along the beautiful Virginia Beach coastline. Whether you prefer to run, jog, or walk, this special event is a great opportunity to connect with the community, enjoy the ocean views, and kick off your day before training begins. All fitness levels are welcome.
In-Person
Kick off your SANS Virginia Beach 2026 experience at the Welcome Reception. Join fellow cybersecurity professionals, instructors, and students for a relaxed breakfast gathering designed to help you connect, share experiences, and make the most of your week in Virginia Beach. Start your morning building new relationships, exchanging insights, and preparing for an engaging week of training. Breakfast will be provided.
In-Person
Most security teams I’ve worked with and helped have a handful of people defending thousands. Yet we expect them to cover everything, watch everything, and control everything, like they have an army’s headcount to do it.
Special Forces solved this problem seventy years ago. A twelve man ODA does not win by force. It wins by training the local population to fight, by learning the language before the mission, and by operating on intent instead of scripts.
This talk translates that doctrine for defenders. I will share what I have seen and used in the field: building an indigenous force of security champions, killing the jargon that costs you the business, and rewriting policy as commander’s intent.
No silver bullets, no promises. Just ideas that have worked for teams with your actual headcount, plus a look at AI as a partner force you train rather than a replacement you trust blindly.
In-Person & Virtual
In 2001, SANS created a "Top 10 Security Mistakes Individuals Make" list. I was one of the co-authors of this list. In 2026, 9 of those 10 items have not been "fixed". For more than 25 years, cybersecurity has promised that the next technology, framework, or tool would finally make us safer. And yet breaches keep getting worse.
This session argues that modern cyber incidents are not the result of novel or sophisticated threats, but of the industry’s repeated failure to fix problems we have understood since the 1990s. Weak authentication, excessive trust, misconfiguration, and social engineering powered early viruses and intrusions—and today they still sit at the heart of ransomware, cloud breaches, and identity compromise. By tracing a straight line from the early internet to today’s “advanced” attacks, this talk exposes how attackers have barely changed their techniques while defenders have built increasingly complex systems on the same fragile assumptions. The result is an arms race that looks innovative on the surface but keeps collapsing for the same reasons.
This is not a talk about the next threat. It’s a challenge to the cybersecurity community to confront why decades of warnings, lessons learned, and best practices have failed to change outcomes—and what must be done differently if we actually want security to improve.
In-Person & Virtual
Start your day with the SANS Virginia Beach 2026 5K Walk/Run on the Boardwalk. Join fellow attendees, instructors, and staff for a fun and energizing morning along the beautiful Virginia Beach coastline. Whether you prefer to run, jog, or walk, this special event is a great opportunity to connect with the community, enjoy the ocean views, and kick off your day before training begins. All fitness levels are welcome.
In-Person