SANS Demo Day 2026

Wed, Jun 24, 2026
9:00AM - 3:00PM EDT
English
Dave Shackleford
Solutions Forum

Thank You To Our Sponsors

SANS 2026 Demo Day showcases the latest innovations, tools, and techniques shaping the future of cybersecurity across defense, detection, automation, and cloud security. This highly interactive event gives attendees a front-row seat to live demonstrations from leading solutions providers and SANS experts, revealing how modern solutions solve real-world security challenges. From emerging AI-driven capabilities to advanced threat-hunting workflows, participants will see technologies in action—grounded in practical use cases that map directly to today’s most pressing security needs.

Designed to help organizations make informed, strategic technology decisions, Demo Day provides a unique opportunity to compare capabilities side-by-side, ask technical questions directly to solution architects, and understand how various tools integrate into existing security programs. Whether modernizing your SOC, maturing cloud defenses, or exploring new approaches to automation and resilience, attendees will walk away with clear insights to guide investments and strengthen their overall security posture.

Who Should Attend:

Security leaders, CISOs, and directors evaluating future security technology investments.
SOC analysts, detection engineers, and incident responders looking to see tools that improve visibility, efficiency, and response.
Cloud, DevSecOps, and infrastructure teams seeking solutions that enhance security across hybrid and multi-cloud environments.
IT and security architects responsible for selecting, testing, and deploying new security platforms.
Anyone interested in hands-on exposure to emerging cybersecurity technologies and how they perform in real-world scenarios.

Schedule

Showing 14 of 14

Filter by:

Select day:

Opening Remarks

09:00AM - 09:15AM EDT

Virtual

Presented by

Dave Shackleford

Founder at Voodoo Security

The Autonomous SOC: Stopping AI-Fueled Threats at Machine Speed

In 2026, the traditional SOC architecture reached a breaking point. As attackers leverage AI to drastically reduce exfiltration windows, the legacy model of "stitching" together disconnected SIEM, SOAR, and EDR tools creates a visibility and response gap that defenders can no longer afford. This session demonstrates a fundamental shift toward a unified security operations platform.

We will go under the hood to show how a centralized data lake natively integrates telemetry across endpoint, cloud, and identity to provide instant, actionable context. Witness a live demonstration of how the platform automatically correlates thousands of disparate alerts into a single, high-fidelity incident timeline to eliminate manual noise

Learn how to move beyond manual triage and swivel-chair analysis to achieve an autonomous SOC that resolves threats in seconds, not days.

*Sponsored by Palo Networks EMEA

09:15AM - 09:45AM EDT

Virtual

Presented by

Ciarán McHale

Senior Domain Consultant, Security Operations Transformation

Your workforce runs AI everywhere. Harmonic makes that possible, and secure.

The browser tab with ChatGPT was just the beginning. Today's workforce uses desktop AI applications that pull live data across systems, trigger autonomous agents, and make decisions no DLP policy was designed to see. Security teams need a control layer that works across all of it, without slowing anyone down. This session demonstrates how Harmonic Security assesses intent in milliseconds, giving organizations the ability to steer humans and agents towards secure AI use.

*Sponsored by Harmonic Security

09:45AM - 10:15AM EDT

Virtual

Presented by

Bryan Woolgar-O'Neil

CTO and Co-Founder

From Mythos to Mitigation: Zscaler’s Deception-Driven, Machine-Speed Response and Containment

AI-driven adversaries are always on, fast and attack multiple targets at once—compressing the time between exposure and exploitation and overwhelming SOC queues with higher event rates and less decision time. For Zscaler customers, the challenge shifts from “Can we alert and patch?” to “Can the Zscaler detect, respond and mitigate for us at machine speed with high confidence?” This session frames Mythos-like, semi-autonomous attack workflows as the new threat model, then explains why deception within Zscaler produces automation-safe signals: legitimate users almost never touch decoys, so interactions become high-fidelity escalation triggers suitable for immediate containment." Note for team: "The session includes a live demo: an LLM/MCP-based attacker simulation that triggers perimeter (ZIA DNS/HTTP), identity/AD, endpoint, cloud/SaaS, and GenAI-app decoys in real time—driving automated containment and end-to-end audit across the Zscaler Platform. IT will include a demo (won't do it live, but will run and talk through a pre-recorded version - so pseudo live).

*Sponsored by Zscaler

10:15AM - 10:45AM EDT

Virtual

Presented by

Cyrus Havewala

Transformation Architect

Beyond the AI Agent Hype: What's Actually Working in Security Operations

In 2026, you can't scroll LinkedIn without hitting "AI Agents" every third post. But strip away the marketing and ask a simple question: what problems are security teams actually solving with them today? This session will cover: - Real use cases with real numbers (EDR, identity, phishing – what's working now) - How to separate genuine capability from vaporware - A practical framework for evaluating whether AI agents for security ops can increase your capacity, speed, and overall security In this session, Jeff Lackey, AI Security Engineer at 7AI, shares how forward-leaning SOCs are adopting a People-Led, AI-Driven (PLAID) operating model, pioneered by 7AI, where autonomous AI agents absorb investigative toil while human analysts focus on strategic, higher-value work. You’ll see how agentic automation is reshaping SOC workflows, redefining analyst roles, and shifting success metrics from alert counts to real security outcomes like MTTD and MTTR. Attendees will leave with a clear framework for building a resilient, scalable SOC – without adding tools or burning out teams.

*Sponsored by 7ai

10:45AM - 11:15AM EDT

Virtual

Presented by

Jeff Lackey

AI Security Engineer at 7AI

BREAK

11:15AM - 11:30AM EDT

Virtual

Achieve Enterprise-Grade Security with Symantec CBX

Midmarket organizations with lean security teams are challenged by sophisticated, multi-vector threats, alert fatigue, and the pressure to consolidate tools. This 30-minute demonstration showcases how Symantec CBX, an integrated, cloud-based cybersecurity platform, delivers enterprise-grade security outcomes with consumer-grade simplicity. You will see Symantec CBX in action, correlating security signals across endpoint, network, and data, providing a single visualization of attacks for faster, more confident remediation. The demo will highlight how Symantec CBX delivers:

Real-time threat prevention to stop attacks before they execute
Unified visibility across endpoints, web, and data
Data security enrichment that protects sensitive information without friction
Accelerated detection and response through intelligent correlation and telemetry See how Symantec CBX delivers strong prevention, relentless detection, and automated response in one unified platform.

*Sponsored by Broadcom

11:30AM - 12:00PM EDT

Virtual

Presented by

Kirk Hasty

Technical Product Engineer / Manager

Paul Miller

Security Strategist

Prisma Browser in Action: Browser Built for the Agentic AI Era

With employees spending the vast majority of their workday within browsers, traditional web browsers have become significant points of vulnerability. During this session, you will see how Prisma Browser™ addresses these vulnerabilities by stopping threats and blocking data loss directly at the source. The browser has evolved into the new perimeter. Discover how Prisma Browser empowers organizations to leverage GenAI productivity maintaining a robust, future-proof security posture.

*Sponsored by Palo Alto EMEA

12:00PM - 12:30PM EDT

Virtual

Presented by

John Korber

Manager at Domain Consulting

A Modern Approach to Third-Party Risk with Vanta

The pace of AI adoption has outrun every traditional TPRM program. The gap between new vendors and real risk assessment is widening, and the consequences have never been higher. In this session, Vanta will explore the systemic vulnerabilities in legacy TPRM approaches and demonstrate how leading security teams are rebuilding their programs around continuous monitoring, AI-assisted assessments, and automated workflows. With Vanta’s TPRM solution, you can:

Cut risk assessment time by 50%
Increase vendor evidence collection time by 64%
Increase productivity gains by 54%

*Sponsored by Vanta

12:30PM - 01:00PM EDT

Virtual

Presented by

Matt Cooper

Staff GRC Program Manager

BREAK

01:00PM - 01:15PM EDT

Virtual

From Alert to Evidence: Event Driven Collections for Faster DFIR Investigations

Legacy DFIR stacks are slowing teams down with unreliable off network collections, brittle or bloated agents, and too many disconnected point products and scripts. This creates operational drag which shows up as increasing risk, costs, and investigation time. In this session, we’ll show how Magnet Forensics solutions give you a faster, more resilient path forward, replacing outdated remote collection approaches while simplifying deployment and day to day operations. You’ll see how investigative teams can preview live endpoint file systems to target exactly what matters before collecting, and how API driven triggers from your EDR/XDR kick off collections automatically the moment an alert fires, so evidence doesn’t disappear while the team is off the clock. We’ll connect the dots across an integrated, hybrid workflow from triage to automated collection, analysis, and collaboration, so you can reduce manual effort, shrink response times, and scale investigations without scaling headcount.

*Sponsored by Magnet Forensics

01:15PM - 01:45PM EDT

Virtual

Presented by

Jeff Rutherford

Forensic Consultant

XBow Session Details Pending

01:45PM - 02:15PM EDT

Session Details Pending

02:15PM - 02:45PM EDT

Virtual

Closing Remarks

02:45PM - 03:00PM EDT

Virtual

Presented by

Dave Shackleford

Founder at Voodoo Security

Meet Your Chairman

Dave Shackleford

Founder at Voodoo Security

Cybersecurity leader Dave Shackleford combines decades of enterprise defense, cloud security, and hands-on consulting experience to help students master real-world security operations and modern threat defense.

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

SANS Demo Day 2026

Share

Thank You To Our Sponsors

Who Should Attend: