Frequently Asked Questions

While the SANS Institute is not an accredited college and does not award transferable academic credit, many of its courses and GIAC certifications may be waived into the degree and certificate programs at the SANS Technology Institute ― a regionally accredited college focused exclusively on cybersecurity for working professionals.

Some other colleges may also consider awarding credit for SANS training as part of prior learning assessments or life experience credit. We recommend checking with individual institutions to determine their specific transfer and credit recognition policies.

For students that have paid for their course, you can expect to receive your printed books, the PDF copies of your books, and lab material as noted below:

OnDemand Course

• PDF copies of your books and lab material will be available for download in your SANS Account within 72 hours of full payment
• Printed books will be shipped to the address provided during course registration approximately 72 hours after full payment. Shipment arrival will vary depending upon your location and standard shipping times.

Live Online Course

• PDF copies of your books and lab material will be available for download in your SANS Account 7 days before the first day of your course.  If you purchased the course within 7 days of the course start date, you will be able to access and download the books and lab materials within 24 hours of purchase.
• Printed books will be shipped to the address provided during course registration approximately 14 days days before the first day of your course. Shipment arrival will vary depending upon your location and standard shipping times.

In-Person Course

• PDF copies of your books and lab material will be available in your SANS Account 7 days before the first day of your course.  If you purchased the course within 7 days of the course start date, you will be able to access and download the books and lab materials within 24 hours of purchase.
• Printed books will be delivered to the venue hosting the course. You will pick up your books during course check-in. 

The SANS Technology Institute (SANS.edu) is a regionally accredited college and independent, legal subsidiary of the SANS Institute offering world-class undergraduate and graduate degree and certificate programs in cybersecurity designed for working professionals.  Designated by the NSA as a Center of Academic Excellence in Cyber Defense and a multi-year winner of the National Cyber League Competition, the college is recognized for its career-focused cybersecurity curriculum built on proven SANS courses and industry-recognized GIAC certifications.

The college also houses the Internet Storm Center, the world's leading global cyber threat detection network.

SANS Technology Institute’s programs include:

• Cybersecurity Fundamentals Certificate
• Applied Cybersecurity Certificate
• Bachelor’s Degree in Applied Cybersecurity
• Graduate Certificates in Cybersecurity
• Cybersecurity Master’s Degree

SANS.edu programs are accredited and eligible for various funding options including VA education benefits and corporate tuition assistance.

To learn more about college programs and admissions details, visit www.sans.edu, sign up for a free online info session, or email info@sans.edu.

No, SANS courseware cannot be purchased without enrolling in Live Training or OnDemand SANS Course.

SANS cares about the success of every student in our in person or online training. To ensure that every student has the equal opportunity to learn, we will provide the following to students who require aide at in person events, at no additional cost: an additional seat in the classroom and an additional set of course materials for Auxiliary Aides and/or the course notes in computer-readable format, as requested by the student.

SANS is not responsible for any other costs associated with the arrangement for or accommodations of the Auxiliary Aide. Call (301) 654-7267 or email registration@sans.org to discuss these options.

All SANS courseware and sans.org website content is protected by copyright and is not to be reproduced without permission. If you wish to seek permission from SANS to reference our courseware or content, write to us at info@sans.org.

You can watch free excerpts of more than 55 SANS courses here - www.sans.org/course-preview.

There are no official prerequisites for SANS courses, however, students should be aware that our courses progress in technical complexity or specialization as the course numbers rise from 300- to 400- to 500-, 600- and ultimately 700-level courses. Also, SANS has organized many of its courses into "tracks" that align with the key career pathways related to cybersecurity. Explore our training roadmap to learn more about the training we offer that aligns with the most common career pathways.

Bootcamp sessions are evening hands-on sessions that allow students to utilize the knowledge gained throughout the course in an instructor-led environment. Laptops are required. Bootcamp sessions are optional, but highly recommended, especially for students who are attempting certification. These hands on sessions reiterate what students learn during the day sessions.

No. SANS training is the best preparation available for GIAC Certification exams, and SANS training and GIAC Certifications can be purchased together here at sans.org, but you are not required to purchase training and certification together. SANS courses teach students practical, in-depth cybersecurity skills, tools, and knowledge they can apply to their work immediately.

GIAC Certifications are designed to provide an objective "benchmark", demonstrating that an individual meets a minimum standard of skill and knowledge, for people who want to prove this to themselves, or to a current or prospective employer.

No, the training that you purchase from SANS, including the course materials, test questions, and other courseware, is exclusively for your individual use and is not to be shared or sold without express written permission from the SANS Institute.

You are not allowed to use any part of the material for teaching others or incorporate it, or allow it to be incorporated, in any other training materials or publications, electronic or print, without prior specific written consent of the SANS Institute. Please refer to your purchase documentation or contact us for more information.

On your SANS Account dashboard, click the "My Orders" link and then click on the "Certificate of Completion" to download your certificate.

Yes, students earn CPE credits in every SANS course. 1 CPE is earned per course hour. To have SANS submit proof of CPE credits earned to ISC(2), CISSP members should include their CISSP ID# when they register for SANS training.

If you completed SANS training via our OnDemand, Mentor or Live Online training formats, you can login to your SANS Account and download a copy of your certificate of completion from your dashboard. CPEs are not awarded for re-certification.

Yes, please call the SANS Global Customer Care at (301) 654-SANS (7267), Mon-Fri 9:00 AM-8:00 PM EST, or send an e-mail to support@sans.org for assistance with merging your accounts.

1. Delete all cookies and cache in your browser settings.
2. Use Chrome or Firefox instead of Internet Explorer or Microsoft Edge.
3. Go to https://login.sans.org/ and then click forgot password
4. Enter you email address and then the screen will prompt you for a validation number which will be emailed to you.
5. Once you enter the validation code, you will be prompted to change your password.

Note: Your password must be at least 10 characters long and contain 5 unique characters.

If the above instructions do not work, please try the following:

1. Use a different browser such as Firefox or Google Chrome. Browser security settings sometimes interfere with logins.
2. Delete all cookies from SANS and try again.
3. Try manually typing your username and password instead of using a password keeper. This will help to ensure that the most recent username and password is used while logging in.

1. Log in and go to your Account Profile page.
2. Click on the hyperlink "Change" next to the email address on the Account Profile Details page
3. Enter your new email address in the Email field.
4. Scroll to the bottom of the screen and click the Save button.
5. Click the Save button.

To unsubscribe from SANS marketing email or physical mailing lists, log into your SANS Account and click the “Communication Preferences" link on your dashboard. Then, you will need to check or uncheck the boxes within email preferences and/or postal mail preferences to set your new communication preferences. Be sure to click “Save”.

Customers have the option to add SANS cyber ranges products during the course purchase process.

If you want to add a cyber range after registering for your course, contact SANS Global Customer Care at (301) 654-SANS (7267), Mon-Fri 9:00 AM-8:00 PM EST, or send an e-mail to support@sans.org.

For Live Online courses, payment must be received at least 15 days prior to your event start date. If payment is received after this time, shipment of physical course books may be delayed.

For In-Person courses, payment must be received before the first day of the event. Access to the classroom and course materials will not be granted until payment is received.

OnDemand access will be granted within 72 business hours after your payment is processed. Your 4-month access will begin when you click the Start Course button on the course card on the OnDemand Course Library Page. Your 4-month access period will begin 14 days after your course is available if you do not click the Start Course button before that time.

We accept credit cards (American Express, MasterCard, Visa and Discover Card), checks, wire transfers, and US & Canadian Federal government purchase orders.

• Regular check payments: SANS Lockbox, PO Box 419108, Boston, MA 02241-9108
• Overnight check payments: Bank of America Services, Lockbox 419108, Escal Institute of Advanced Technology, Inc., 2 Morrisey Blvd., Dorchester, MA 02125
• Wire Transfers:

Bank Name: Bank of America, 100 West 33rd St., New York, NY10001, Swift Code: BOFAUS3N

Bank Account Title: ESCAL Institute of Advanced Technologies, Inc., 11200 Rockville Pike, Suite 200, North Bethesda, MD 20852

Tel: 301-951-0102 x106

ABA Routing Number:

• ACH: 052001633
• Wires: 026009593

Bank Account Number: 4460-1165-9211

You can request a refund before the refund deadline, before accessing the online course and receiving the shipment of course materials. Submit your refund request to support@sans.org, and the registration fee will be returned, minus a $300.00 refund processing fee, to the same payment method. SANS OnDemand Courses are non-refundable and non-transferable once payment has been received and courseware has been shipped.

Yes, students can add a GIAC Certification exam attempt to their SANS course purchase either during the registration process, or through their SANS Account dashboard up until thirty days after the completion of their in person, Simulcast, or Live Online course. For OnDemand orders, students have until ninety days after the registration date to add the GIAC Certification exam attempt bundle.

To add a GIAC Certification exam attempt bundle after registering, login to your SANS Account, click the "My Orders" link in your dashboard, click the "Add Available Bundled Items to Your Order", and submit your payment information to complete your purchase.

Place your order and then email support@sans.org and ask to have the tax removed. Be sure to include the invoice order number in your request and submit it promptly after placing the order.

To use a credit memo to pay for a SANS training course, please follow the instructions below:

1. Register for a SANS training course and select "Credit Memo" as the method of payment
2. Enter the credit memo serial number
3. Complete the order to generate an unpaid invoice
4. Send a copy of the unpaid invoice and credit memo to tuition@sans.org

You can transfer to a different course before you've accessed your online course or received shipment of your course materials, or at the end of your first day at an in person training event. There are no exceptions to these limitations, and there is a $150.00 transfer processing fee.

Also note that transfers at in person events are not possible if the desired course is already filled to capacity. Submit your transfer request to support@sans.org as early as you can.

You can substitute another person in your place prior to accessing your course, with no exceptions. No new course materials will be provided or shipped. Submit your substitution request to support@sans.org. There is a $150.00 transfer fee for any substitution.

Yes, SANS has a “Local Law 50” program, which applies a 50% discount to the list price of all Digital Forensics and Incident Response (DFIR) courses with a special discount code. This discount applies only to the course, not the certification or other bundled products. To learn more about this partnership program, visit www.sans.org/state-local-LE-program.

SANS does have group purchase programs available for various critical constituencies involved in global, national, and local education, defense, and security.

Group training packages are also available to other organizations and allow them to monitor student progress, schedule private training, and receive cybersecurity workforce development consultation from our team of advisors. Contact us at info@sans.org or call 301-654-SANS(7267) for more information.

No, please call the SANS Global Customer Care office at (301) 654-SANS (7267), Mon-Fri 9:00 AM-8:00 PM EST, or send an e-mail to support@sans.org, for assistance with updating your account information.

Students must register for SANS training online at sans.org. Registrations by phone are not accepted. If you prefer to submit payment information offline, select "Check" as your payment type during online registration, and then contact us with your invoice number and payment information.

If you need any assistance with your online registration, contact our Global Customer Care team at registration@sans.org or (301) 654-SANS (7267). Please note that SANS requires payment in advance for all training.

Yes, by calling SANS Global Customer Care at (301) 654-SANS (7267), Mon-Fri 9:00 AM-8:00 PM EST. Note: Online payment submission must be a single transaction.

To download your invoice/receipt for upcoming training, login to your SANS Account using the email address you provided when you registered for this course. Click on the "My Orders" link to view your invoice/receipt.

To obtain a copy of your invoice at a later date, click on "Attendance History" in your SANS Account dashboard.

You will need to contact your banking institution to resolve the issue. SANS will not provide any information other than the payment was accepted or denied.

Online payments are processed immediately. Check payments can take up to 14 days to process.

Yes, by registering for a course online, adding any bundles you expect to purchase, and selecting "Check" as your payment option, you will automatically receive a quote via email.

You have until seven days after the completion of your in person, Simulcast or Live Online course to add a four-month OnDemand bundle to your purchase. From your SANS Account dashboard, click the "My Orders" link, then find your course and click "Add Available Bundled Items to Order." Select the OnDemand bundle, provide your payment information, and you will then receive email confirmation and instructions for accessing your course in the OnDemand platform.

If your credit memo expires you can no longer use it towards payment of a course. Credit memos must be used by their expiration date.

The SANS Institute requires payment in advance for all courses. If you are an employee of the United States federal government, you are permitted to submit a valid purchase order or federal training authorization form in advance as your prepayment.

SANS does not accept state, provincial, corporate, or university purchase orders as prepayment for training. Your tuition fee must be paid in advance by check, bank transfer, or credit card. We realize that your organization may still need to use a purchase order internally as part of the payment process. To obtain an invoice for your accounts payable department, please take the following steps:

• Register for your training online. At the end of the registration process, you will be prompted to print your own invoice. Please do this.
• Take the unpaid invoice to your accounts payable department so that they can match the purchase order with this invoice and generate payment to SANS by check, credit card, or bank transfer.

Please remember that SANS must receive your tuition payment prior to the start of your course.

SANS does not send visa letters of invitations to the United States; however, our EMEA regional office does provide visa letters of invitations for students traveling to European countries.

No, Gl Bill® funds cannot be applied to single SANS courses. However, SANS does accept Chapter 31 VR&E veteran benefits.

Gl Bill® funding and VA education and training benefits (including tuition payments and housing/book stipends, when applicable) are available to students enrolled in the degree or certificate programs of the SANS Technology Institute (SANS.edu), the regionally-accredited, independent, college subsidiary of SANS. SANS.edu programs feature many of SANS' most popular courses, and the costs for many GIAC Certification exams are also eligible for reimbursement. Learn more about using VA Education Benefits at the SANS Technology Institute.

DFIR NetWars Continuous: If you are interested in renewing your DFIR NetWars Continuous subscription, you may purchase up to two DFIR NetWars Continuous 4-month renewals for the discounted price of $939 each. You may also purchase one or more 1-month extensions for only $239 each. Either option will extend access to your existing account, allowing you to pick up right where you left off.

• SANS Skills Quest by NetWars: users can receive up to 12 CPEs per month. No Certificate of Completion is available.
• DFIR NetWars Continuous: users can receive up to 12 CPEs. No Certificate of Completion is available. 
• NetWars Tournament: students receive 6 CPEs for actively participating in a NetWars tournament. No Certificate of Completion is available. 

Yes. All our cyber ranges are available globally.

If you bundled a NetWars tournament at your course checkout, your subscription link will be provided by email and will be active 7 days or so before the training event starts.

SANS Skills Quest by NetWars

Your time starts from the day you activate your subscription by logging in for the first time.

After purchasing SANS Skills Quest by NetWars for the first time, log in to your SANS Portal. Under My Training, click on the Cyber Ranges link. Your invitation should appear there—click View to accept it.

IMPORTANT: You must activate your access within 30 days of receiving the invite email. If your invitation expires, simply contact SANS Support to have it reissued.

Your subscription lasts for either 6 months or 12 months (depending on your selected plan) after you log in for the first time.

If you purchased an extension or subscription after having already participated in SANS Skills Quest by NetWars, allow 48 hours for you to receive an invitation link via email, or to be available in your account at https://ranges.io.

DFIR NetWars Continuous

After purchasing DFIR NetWars Continuous, you will receive an email from “ranges.io” within 48 hours. This email includes instructions to access your training.

Your DFIR NetWars Continuous subscription is valid for 4 months after you log in for the first time.

SANS Skills Quest by NetWars and DFIR NetWars Continuous are self-paced cyber ranges with 24/7 access for a period of calendar time, covering a wide range of cybersecurity topics designed with challenges and hints that support continuous knowledge and skill development, helping participants master the latest skills and technologies in the industry.

It provides convenient access for those needing flexibility to practice their cyber skills at their own pace, supporting in-depth learning, practice, and assessment.

Students can explore topics thoroughly in a pressure-free environment, fostering critical thinking and problem-solving skills. This platform offers hands-on challenges with helpful hints when you're stuck, promoting continuous skill development.

• SANS Skills Quest by Netwars provides a run time of six months. Topics vary across areas.
• DFIR NetWars Continuous provides a run time of four months. Topics are focused on digital forensics & incident response.

NetWars tournament is a competitive and engaging event to be experienced with any NetWars range, either in a private environment of the customer’s choice or publicly at a SANS training event.

The delivery formats for tournaments include in-person, online, or hybrid, with the flexibility to be divided into two 3-hour sessions on separate days or combined into a consecutive 6-hour session.

Tournament events generally feature opening and closing ceremonies and award prizes to the top five solo players and the winning team. Prizes, such as challenge coins and trophies, vary per event or at the customer’s request.

The winning team and the top five solo players from every Core NetWars tournament during the year, from private runs and SANS training events, are invited to compete for their chance to claim victory in the annual SANS Core NetWars Tournament of Champions, held at the SANS Cyber Defense Initiative in Washington, DC.

Customers have the option to add SANS cyber ranges products during the course purchase process.

If you want to add a cyber range after registering for your course, contact SANS Global Customer Care at (301) 654-SANS (7267), Mon-Fri 9:00 AM-8:00 PM EST, or send an e-mail to support@sans.org.

DFIR NetWars Continuous is available to NetWars Tournament participants or as a bundle option for those who purchase any 5- or 6-day SANS course. A discount code will be sent to NetWars Tournament participants after the event that can be used to register for DFIR NetWars Continuous at the discounted rate.

If DFIR NetWars Continuous is being added to a registration as a bundle option with a long course it must be added within the following time frames consistent with the addition of other products:

• In-Person Event - before the end of the event
• OnDemand - within the first 30 days of access

Please send an email to registration@sans.org for information on adding NWC bundle to an existing registration.

Currently, no discounts are offered.

For NetWars Continuous, a zip file containing the LiveCD ISO image and a VMX file for opening in VMWare can be downloaded from the Game Details page on the CHC Portal (www.counterhackchallenges.com) by clicking the link for the game under "My Games". For NetWars Tournament, a CD containing these two files will be handed out at the event.

Core NetWars covers all aspects of IT Security, while DFIR NetWars concentrates on Digital Forensics, Incident Response, and Threat Hunting. Core NetWars includes topics on Vulnerability Assessment, Penetration Testing, Incident Response, and System Hardening. DFIR NetWars covers Incident Response, Endpoint/Host Forensics, Network Forensics, and Malware & Memory Analysis.

We designed NetWars so that entry-level players can hone their skills.

The environment includes five levels that progressively increase in difficulty. No matter your skill level, anyone can jump right in and begin answering questions at Level 1.

We designed NetWars so grand masters of InfoSec can quickly advance through earlier levels and find more complex scenarios and target infrastructures to analyze and attack. The in-depth challenges of Levels 3 and beyond will let you demonstrate your awesome abilities and possibly even challenge you to take your skills to the next level.

Getting stumped is no big deal. If NetWars was only about solving easy challenges, it wouldn't be very valuable. When you reach a problem you can't solve, NetWars becomes a learning environment for you to pick up new techniques and get exposed to new tools in an environment optimally set up for you to do so.

Not at all. NetWars consists of both offensive and defensive challenges in a wide variety of information security disciplines, including system hardening, packet analysis, digital forensics, malware analysis, vulnerability assessment, and penetration testing. Also, the best way to hone your skills as a defender is to understand the attacker, so everyone (both defense specialists and offensive-minded people) can benefit from NetWars.

NetWars Continuous trial accounts are granted on a case-by-case basis. The trial cost is $20 and will give access to a small subset of questions from the first three levels of NetWars for one week. If you are interested in a trial account please send us a request along with the following information: your name, company name, title, department, and phone number.

NetWars covers a broad range of topics, so almost every class offered by SANS will help you succeed in NetWars. The classes that will best help you get started are as follows:

• SEC401: Security Essentials Bootcamp Style
• SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling
• SEC560: Network Penetration Testing and Ethical Hacking
• SEC542: Web App Penetration Testing and Ethical Hacking
• FOR500: Windows Forensic Analysis
• FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
• FOR526: Advanced Memory Forensics & Threat Detection
• FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
• FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Although VMWare is heavily preferred, any virtualization software capable of booting from an ISO of a Linux LiveCD image will be sufficient. Any computer capable of running a virtual machine in said virtualization sofware will be sufficient.

Students who register and pay for any long course at a SANS event that includes a NetWars Tournament may participate in the tournament at that event free of charge.

You can submit as few or as many answers at a time as you wish. Any question left blank will be ignored and you will not lose points *or lose your mulligan* on that question.

Yes! The use of outside resources is encouraged to help you learn any material necessary to solve the challenges. NetWars was created to encourage self-guided learning.

The scoring server password is randomly generated and different from the password you chose for your Counter Hack Challenges Portal account. To log into the scoring server, first log into the CHC Portal (www.counterhackchallenges.com) using the credentials you chose upon registering. Go to "My Games" and click on the game details link in the list for the game you are currently participating in. On the game details page, click on "Log In to Scoring Server" which will automatically log you in.

No. The version of Linux used in NetWars is not compatible with VMWare tools and will not allow it to install correctly. For copying, pasting, and resizing the screen, please refer to the next set of FAQ questions.

The README file on the desktop of the VM and in your home folder contains the complete command syntax for changing your resolution. To do so, first run:

$ xrandr

This gives you a list of valid resolutions which can then be changed to using:

$ xrandr -s [width]x[height]

Inside of the VM, different programs have different key combinations for copy/paste. When inside the terminal, Ctrl+Shift+C/V are used to copy/paste. Anywhere else Ctrl+C/V works. In both cases you can use right-click -> copy/paste. *** Copying between your host and the VM will not work because VMWare Tools is not installed. Instead, open Firefox inside of the VM and log into the scoring server there to copy/paste your answers. ***

No. The VM is a LiveCD image and therefore does not store any files created or edits made to existing files. All changes are lost when you reboot or shut down the VM. If you accidentally delete an artifact or other system file necessary to complete a challenge, a reboot will restore the system to its original state.

Please make sure that you are using the original VMX file that we distributed with the LiveCD, which contains the proper settings for the VM to work as expected. Do not upgrade the virtual hardware version. To ensure that networking works as expected, make sure that the VM is configured with the OS type set to "Other Linux 2.6.x kernel", and the virtual hardware version set to 7.

If you are playing NetWars Continuous, the README file on the desktop of the VM and in your home folder contains complete command syntax for SSH to connect to the SSH gateway. If you are playing NetWars Tournament, a similar guide is available in Appendix B at the end of the provided handout. The basic command to connect is:

Tournament:

$ ssh -i [path_to_private_key] -p [sshd_listening_port] [lowercase_username]@netwars-ng.counterhackchallenges.com

Continuous:

$ ssh -i [path_to_private_key] -p [sshd_listening_port] [lowercase_username]@netwars-ngc.counterhackchallenges.com

A README file can be found in your home folder on the SSH gateway with a list of provided tools.

Using Firefox to browse the websites on the target boxes requires you to first set up a SOCKS5 Proxy connection through the SSH gateway. The command for doing this can be found in the same section referred to by the previous question "How do I access the SSH gateway?". Once your SOCKS5 proxy is configured, simply change the Firefox proxy settings to "Manual". They have already been filled in for you and do not need to be changed after being set to manual. It is not necessary to fill anything into the HTTP or HTTPS Proxy settings in Firefox.

You will receive access your OnDemand Course within 72 business hours after your payment is processed. Your 120-Day access will begin when you click the Start Course button on the course card on the OnDemand Course Library Page. Your 120-Day access period will begin 14 days after your course is available if you do not click the Start Course button before that time.

If you would like to purchase an OnDemand course now and delay the start of your access period for up to 12 months, you must contact support@sans.org to complete a SANS OnDemand Course Pre-Paid Agreement prior to registering.

You can access your SANS OnDemand course Certificate of Completion from the course card on the OnDemand Course Library page, from the Progress tab in the OnDemand Web player, and by clicking My Orders under the Account Details heading on the SANS account dashboard.

You can view your progress the course card on the OnDemand Course Library page and from the Progress tab in the OnDemand Web player.

You will earn your Certificate of completion after you view 80% of the video slides or pass 80% of the quizzes in the course with a score of 80% or better. You can access your SANS OnDemand course Certificate of Completion from the course card on the OnDemand Course Library page, from the Progress tab in the OnDemand Web player, and by clicking My Orders under the Account Details heading on the SANS account dashboard.

Live Online courses include 120 days of access to lecture audio and video recordings of your course.

OnDemand includes 120 days of access to your course audio and video in the OnDemand platform and the OnDemand mobile app with quizzes, labs, and subject matter expert support.

OnDemand course bundles become available 7 days after your live (Live Online or In-Person) course ends. They can be accessed from the SANS OnDemand link beneath the My Training heading on your SANS Account dashboard.

The GIAC Certification practice test bundle access is granted 7-10 business days after the last day of an in-person training event, or approximately 1 hour after GIAC confirms receipt of payment for online training bundles. To find your practice tests, log in to your SANS account, and click the Practice Test link under the My GIAC Certification heading on the SANS account dashboard.

SANS OnDemand courses include support from GIAC-certified subject matter experts. (SMES) To ask questions about course or lab content, you can chat with or email our SMEs via the Help & Support widget in the OnDemand Web player. You can also email them directly at online-sme@sans.org. Our SMEs will respond to emails within 2 hours during scheduled business hours. Our SME team is available Monday-Thursday from 9 am to 10 pm Eastern Time and Friday from 9 am to 5 pm Eastern Time.

If you have questions about your account or are having trouble accessing your course, you can contact SANS Global Customer Care at 301-654-SANS (7267) or support@sans.org Monday-Friday from 9 am to 8 pm Eastern Time. To help us better serve you, please include the following information in your message:

• Detailed description of what you are experiencing
• Screenshot of your course interface if there is anything that may help us understand your issue
• Operating system name and version
• Browser name and version
• If on a tablet, the tablet's make and model
• Where in the course you are experiencing the issue (Include pertinent details: course, section, learning object, slide) For example: SEC401.1.2, Slide 13: OSI Protocol Stack)

Yes. Your access can be extended beyond your original 120 days of access by purchasing an extension. You can purchase 45-day extensions to your course by calling (301) 654-7267, Monday - Friday from 9am to 8pm EST, or by emailing support@sans.org.

Please note that course access cannot be extended longer than one year from the original activation date.

OnDemand extensions will be available for up to 45 days after your expiration date. The option to extend your course will no longer be available after the 45-day grace period.

After logging in to your SANS account with the email address on your registration, click the SANS OnDemand link under the My Training heading on the SANS account dashboard.

For live training, Slack access is available form 1 hour before the first course session until 7 days after the end of class. Zoom access (when used) is available 30 minutes before each course session.

OnDemand access will be granted within 72 business hours after your payment is processed. Your 4-month access will begin when you click the Start Course button on the course card on the OnDemand Course Library Page. Your 4-month access period will begin 14 days after your course is available if you do not click the Start Course button before that time.

You will receive access your OnDemand Course within 72 business hours after your payment is processed. Your 4-month access will begin when you click the Start Course button on the course card on the OnDemand Course Library Page. Your 4-month access period will begin 14 days after your course is available if you do not click the Start Course button before that time.

To access your course, click the SANS OnDemand link under the My Training heading on the SANS account dashboard.

No, we are unable to provide copies of the videos used in your course.

If possible, try clearing the cookies from your default browser on your device and open the app and login again. If the issue persists, you can contact our support team for assistance at support@sans.org.

If you have not yet started your course online, you need to log in to your SANS account and start the course. After you have started your course, you can access the course in the SANS OnDemand mobile app.

Yes! You can use the SANS OnDemand mobile app to download course content and study on the go when you do not have access to a reliable internet connection.

Note: You must use the SANS OnDemand mobile app to work offline.

To change accounts, log out of the app (Settings > Log out). After you log out, tap Log in. You will then be able to log in with a different account.

It is possible you may experience issues if you are working over a VPN or behind a Web proxy server or firewall for personal or professional reasons. If you experience connection problems while working over a VPN or behind a Web proxy server or firewall, we recommend that you try to access the OnDemand course from another connection. If you still have issues, you can contact our support team.

The Confidence Meter helps you determine how well you are absorbing material in your OnDemand course. The Confidence Meter appears at the end of each learning module and asks you how confident you feel about what you just learned. After you answer the question, you will see your response in the Outline pane when you click on that module.

SANS OnDemand supports the most recent versions of the following browsers on computers running the most recent versions of the Windows, Mac, and iOS (iPad) operating systems:

Windows: Chrome, Firefox, and Edge Mac: Chrome, Firefox, and Safari iPad: Safari

Tablets with a screen size of at least 7" are supported provided they meet the other system requirements. Phone browsers are not generally recommended and are not currently supported devices. Please use our OnDemand Mobile Application if you want to view the content on a mobile device. The SANS OnDemand mobile app supports most iOS and Android phones.

We highly recommend that you test the computer you'll use for training by first accessing the corresponding course demo. SANS course demos are delivered in the OnDemand player, and should expose any compatibility issues that can be fixed before you begin your course.

We do not recommend having your course open in both the browser version and the mobile app version at the same time. If you do have them both open, we recommend you close your browser and log out of the web OnDemand player first to ensure your new progress is captured correctly on the mobile app. Using both web and mobile versions at the same time may result in course progress syncing issues or delays.

The mp3 files can be found on your SANS Account Dashboard, under My Online Training, by clicking SANS MP3s. SANS online course mp3 files can be downloaded before the displayed expiration date. You may download individual sections or a zip file containing all sections.

We recommend a 4 Mbps connection for best results.

Yes, the app is available for all OnDemand courses currently offered for sale. The app does not support demo courses.

You log in using your SANS portal account username and password.

Yes, if you are enrolled in multiple courses at the same time you will have access to all courses in the app.

You can click the Reset Password option from the app or reset your password from your SANS Portal account.

No, once a course has expired you will no longer have access to the app or any of the content you downloaded.

The mobile app is available on phones and tablets running the latest version of iOS or Android operating system.

No, the app is only supported on devices with iOS or Android operating systems.

Yes, both modes are supported but for optimal performance we suggest using the app in portrait mode.

You must be currently registered in a SANS OnDemand course to access the mobile app. If you are registered for a course, using the correct SANS portal account and still receive this message please contact support at ondemand@sans.org.

No, if you see your course has expired you will receive a message stating that you don’t have access to the mobile app if you try to login.

The app version can be found under settings.

Yes, quizzes are available when the device is online and in portrait/vertical mode. At this time, you cannot take a quiz if your device is offline or horizontal/landscape mode.

No, once a course has expired you will no longer have access to the course or course content in the mobile app. Any content downloaded to your device is not accessible once the course expires.

At this time the mobile app does not include the following features:

• Search
• Bookmarks
• Direct SME support
• Course evaluations
• Access to Labs

Check that your mobile device is online and that you have the latest version of the mobile app. Your course progress will only sync when your mobile device is online.

If your mobile device is online, you have the latest version of the mobile app, and your progress, is still not syncing, open one of your courses and then tap Settings in the lower right. From the Settings menu, tap Sync Progress. Tap the name of your course, and then tap the sync button to push your progress in the app to the player.

Check to make sure your courses have not expired. Expired courses are not displayed in the app.

The mp3 files can be found on your SANS Account Dashboard, under the My Training heading, by clicking SANS MP3s. SANS online course mp3 files can be downloaded before the displayed expiration date. You may download individual sections or a zip file containing all sections.

OnDemand course bundles become available 7 days after your live (Live Online or In-Person) course ends. They can be accessed from the SANS OnDemand link beneath the My Training heading on your SANS Account dashboard.

The GIAC Certification practice test bundle access is granted 7-10 business days after the last day of an in-person training event, or approximately 1 hour after GIAC confirms receipt of payment for online training bundles. To find your practice tests, log in to your SANS account, and click the Practice Test link under the My GIAC Certification heading on the SANS account dashboard.

Yes. SANS will continue to offer courses in the Live Online training format. You can learn more about this training format and see available opportunities here.

f a version of a NetWars Tournament is scheduled at your event, it is free to all students taking a course at that event. To determine whether one or more versions of NetWars Tournaments are scheduled to take place at your event, please visit the event home page. If it has been scheduled, it will be listed on the event home page below the courses associated with that event.

Occasionally, if a NetWars Tournament is not scheduled at your live event, you maybe eligible to partake in a later tournament.  In all cases, if you are eligible to register for a NetWars Tournament, you will see a notification in your SANS Account Dashboard.

To participate, you will receive an invitation the week of the event detailing how to confirm your spot through your SANS Account Dashboard and join the NetWars Tournament online.

At all events where SANS is providing In-Person Live-Stream classes and the instructor is streamed into the classroom, you will have live In-Person support from our professional Teaching Assistants.

In-Person (IP): means the instructor will be present at the event in a dedicated class for your course. 

In- Person Live Stream (IPLS): There are two versions of this: 

1. IPLS - Dedicated Classroom: Where you can train in a classroom with other students from you specific course, and the instructor is live-streamed into the room, with a dedicated Teaching Assistant for your support.
2. IPLS - Study Hall: Take your Live Online class at an In-Person event within a Study Hall room for optimum and undisturbed concentration. Multiple classes will be in the same room, with various Teaching Assistants available to assist. You can find more information on this training modality here.

An attendee may request to transfer to another SANS training at any time prior to the start of the originally registered event by submitting a transfer request in writing to registration@sans.org. Difference in tuition fees, if applicable, and processing fees will apply.

If an attendee cannot substitute their registration or transfer to other SANS training, the registered attendee may submit a refund request in writing to registration@sans.org. If the refund request is submitted prior to the start of the originally registered event, payments received will be refunded, less a processing fee, in the same manner they were paid. If an attendee has already accessed online course material, no refund or substitution will be made.

SANS makes every effort to ensure the scheduled delivery format (In-Person, In-Person Live Stream, & Live Online) & Instructor advertised on our event pages, will indeed be the case at the event start date. Should circumstances arise that require a change to either the format (I.E., changing from In-Person to Live Online) or Instructor, SANS reserves the right to make those changes at any time. We will contact you if changes arise however, we do not reimburse students for travel or other fees incurred due to a delivery format or Instructor change.

You will have access to both the broadcast platform chat function as well as a course specific Slack channel. These communication channels will be monitored to address any support requests. 

In addition, SANS Global Customer Care is available via the following:

Americas (Monday - Friday from 9:00am to 8:00pm EST)   

• 301-654-SANS (7267) or support@sans.org

Europe, Middle East, Africa (Monday - Friday from 9am to 8:00pm GMT) 

• +44-203-384-3470 or emea@sans.org

Asia Pacific

• Singapore: +65-8612-5278
• Australia: +61-2-6174-4581
• All: asiapacific@sans.org

To help us better serve you, please include the following information in your message

• Detailed description of what you are experiencing
• Screenshot of your course interface if there is anything that may help us understand your issue
• Operating system name and version
• Browser name and version
• If on a tablet, the tablet's make and model
• Specifically, where in the course you are experiencing the issue (Include pertinent details: course, section, learning object, slide) For example: SEC401.1.2, Slide 13: OSI Protocol Stack)

All SANS In-Person and Summit registrants can attend all bonus sessions and networking events held the night prior to and during the event. Some events, like NetWars, may require attendees to register, so that we can ensure space and materials are available.

Summit attendees not registered for a course, but interested in participating in a bonus session held during class nights, should submit a request to attend by contacting summit@sans.org.

Both SANS In-Person and Live Online courses will use the Slack chat application to facilitate interaction between the class as well as provide announcements from SANS staff.

Access to the SANS Training Slack workspace utilizes SSO (Single Sign-On) through your SANS Account. To join the workspace, click on either ‘SANS In-Person’ or ‘SANS Live Online’ under SANS Training from your account dashboard. You will be programmatically added to your course specific class channel as well as an announcements channel.

You can access your course Certificate of Completion by logging into your SANS Account and clicking on ‘My Orders’ under Account Details from your dashboard.

You can access your course Certificate of Completion by logging into your SANS Account and clicking on ‘My Orders’ under Account Details from your dashboard.

We recommend a network connection with at least a stable 4 Mbps connection for best results.

SANS Live Online courses may use one of two broadcast applications, Go-To-Training or Zoom. To determine which platform your course will use, login to your SANS Account using the email used to register for the course and click on ‘SANS Live Online’ under SANS Training. This link will become available in your account 7-days before the start of your course. From that page, click on the ‘Test Connection’ button. This will open up a test session of the primary platform that will be used to broadcast your course. 

In the event of a 3rd party platform outage, SANS may transition your course to an alternate platform.

System Requirements for Go-To-Training.

System Requirements for Zoom.

Yes. You will have access to a course specific Slack channel that will allow you to share and interact with both your instructor(s) and your classmates.

Login to your SANS Account using the email address on your registration and click on the SANS Live Online link under My Training. The ‘Test Connection’ button will become a ‘Join Live Broadcast’ button approximately 1-hour before the start of the course each day.

No. Due to copyright protections these files are available to be streamed online only.

Audio-video recordings of your course will be available in your SANS Account for 4 months and can be viewed online at any time before the stated expiration date.

All courses taught with a Live Online component will include the audio-video recordings from your actual course in the form of mp4 files. These recordings will not be available for courses taught only In-Person.

Digital course materials will be available to download in your SANS Account for 4 months. Once you have downloaded the course materials you will have ongoing access to those materials stored locally. Course book PDFs are password protected and you will have ongoing access to them as long as you have the password. We recommend storing the SANS provided password in a password manager. This password is provided on the course materials download page of your SANS Account.

Live Online Attendees: Physical course books will be shipped to the attendee address provided during registration. Shipments will begin being sent out 14 days prior to the start of an event to students who have completed payment. If you register, or complete payment on a pre-existing registration, after the 14 day out mark, course books will be shipped on the following business day. Shipments may take up to 7-days to reach attendees depending on geographical location. Digital course book PDFs, handouts and, if applicable, course media files will be available for download in the attendees SANS Account 7-days before the start of the course. Course media file downloads, due to their size, must be completed prior to the start of training.

In-Person Attendees: Physical course books will be available for pickup at event check-in. Additional details regarding event check-in, including dates, times, and location will be provided in the weeks leading up to your course. Digital course book PDFs, handouts and, if applicable, course media/lab files will be available for download in the attendees SANS Account 7-days before the start of the course. Course media/lab file downloads, due to their size, must be completed prior to the start of travel. Hotel networks are notoriously unreliable.

Maybe. SANS courses may be taught Live Online, In-Person, or both In-Person AND Live Online. SANS utilizes a live broadcast platform and the Slack chat application to bring students together across all formats.

Yes. Across all of SANS Live formats the course lectures, course books, & hands-on lab environments will be consistent.

When you click on the register button for a specific course from an event home page, you will be presented with the available formats. You can also search for training and filter by format, In-Person or Live Online, on our course list.

Summit presentations are uploaded at the conclusion of a Summit and can be accessed here.

Summits are training events that focus on a single topic of interest to the information security community. Over two days, attendees learn about new tools, techniques, and industry trends from prominent security practitioners through a series of in-depth presentations and panel discussions. Summits also provide a forum for sharing information and building relationships within the community at community-building networking events.

As with a SANS conference, multiple hands-on, immersion-style courses are offered at Summit events. The courses are offered prior to, or following the Summit, to give attendees a convenient way to complement their Summit experience with in-depth training.

E-mail alerts will be sent to you before the conference with registration details, including check-in times and locations, and laptop requirements (if applicable). Upon your arrival all you will need to do is check in at the SANS registration desk. To check in you will need to present a government-issued photo ID. At the registration desk you will receive your SANS badge, applicable course materials, and information you will need while you are at the conference.

For information about SANS In-Person training and Summit event sponsorship opportunities, please review our Sponsorship programs.

Hotel booking information can be found by accessing the location page within each in-person training event web page. We recommend attendees place their reservation prior to the booking deadline to ensure they receive the SANS discounted rate.

The Summit is not included with a course registration; however, students taking a course and attending the Summit receive a discounted fee for their Summit registration.

Prior to a Summit, registrants will receive a "Welcome Information" email with Summit check-in details, locations, times, and dates. If you are signed up for a course, the email will include additional course information.

Please note: Event emails are sent to the address in the registrant's SANS Account. Registrants should use a valid email address to ensure they receive all event information.

No, once you login and start your assessment, you cannot stop and restart. The assessment will not be accessible after you logout.

All assessments except the CTE are one-hour long. Time will not be added if you do not complete the assessment in the one-hour timeframe. For the CTE, you have two hours to complete the assessment.

To access an assessment, you will need to have a SANS Account. You will use your SANS Account password to access your CyberTalent Assessment.

Purchased assessments are available online for 12 months.

SANS CyberTalent Assessments have not been validated under section 703(h) of the EEOC Act.

Assessments are delivered online through the GIAC Certification exam engine.

Only assessment managers, usually the employer who purchased the assessments, have access to individual results. If the assessment is used during interview and hiring process, job candidates do not see the results.

CyberTalent assessment questions are written by GIAC subject matter experts and are derived from the skills required to pass GIAC exams. While these questions are not the same as those used on GIAC exams, they assess the same skills.

The SANS Work Study program provides a means for students to attend SANS In Person training at a much reduced rate in exchange for working at the event and assisting with written technical work. Students selected to participate in the SANS Work Study program are responsible for any costs associated with food, lodging, and transportation while attending the event. Learn more.

SysAdmin, Audit, Network, Security

The SANS PGP key is available from https://isc.sans.edu/PGPKEYS.txt.

On your SANS Account dashboard, click the "My Orders" link and then click on the "Click for CEU Certificate" to download your certificate.

There are many pathways to becoming a SANS Instructor, but the most common elements associated with journeys towards certification include SANS training and GIAC Certifications, speaking at SANS Summits, co-teaching and small classroom instruction, and then a bit of coaching, brand development, and a lot of hands-on, classroom practice. You can start the process by visiting our "Becoming a SANS Instructor" page here.

Certificates of attendance for webcasts can be found by clicking on "My Webcasts" under "Account Details" on your SANS Account dashboard.