SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

In-Person
Evidence of USB device connection is littered all over a Windows system. Many tools try to parse this information & some even get it right… sometimes!
Hey, it depends!
I’ll talk about some of these artifacts and some of the available tools, including a script I wrote to try and pull a lot of this data together in a useful way, which has recently been updated, so this is also a chance to provide feedback.
In-Person
Artificial intelligence (AI) is making its way into security operations quickly, but many practitioners are still struggling to turn early experimentation into consistent operational value. This is because SOCs are adopting AI without an intentional approach to operational integration. Some teams treat it as a shortcut for broken processes. Others attempt to apply machine learning to problems that are not well defined. Findings from our 2025 SANS SOC Survey reinforce that disconnect.
A significant portion of organizations are already experimenting with AI, yet 40 percent of SOCs use AI or ML tools without making them a defined part of operations, and 42 percent rely on AI/ML tools “out of the box” with no customization at all. The result is a familiar pattern. AI is present inside the SOC but not operationalized. Analysts use it informally, often with mixed reliability, while leadership has not yet established a consistent model for where AI belongs, how its output should be validated, or which workflows are mature enough to benefit from augmentation. This session provides guidelines on operational implementation.
In-Person
In-Person