SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Reskill
This path is for individuals not currently working in cybersecurity who want to change their careers to get into the field. This track focuses on cyber aptitude rather than on formal education.
Upskill
Designed to help advance stalled careers in cybersecurity, this academy provides a path for individuals with IT experience or limited cybersecurity skills to upskill into an in-demand cybersecurity position in two to four months.
Available Courses for the AF COOL Program
- Slide 1 of 37
SEC275: Foundations: Computers, Technology, & Security
Beginner SEC275Cyber Defense
- GIAC Foundational Cybersecurity Technologies (GFACT)
- 38 CPEs / 38 Hours (Self-Paced)
- Labs: 90 Hands-On Labs
- Slide 2 of 37
SEC301: Introduction to Cyber Security
MAJOR UPDATESBeginner SEC301Cyber Defense
- GIAC Information Security Fundamentals (GISF)
- 5 Days (Instructor-Led)
- 30 CPEs / 30 Hours (Self-Paced)
- Labs: 14 Hands-On Labs
- Slide 3 of 37
SEC401: Security Essentials - Network, Endpoint, and Cloud
Essentials SEC401Cyber Defense
- GIAC Security Essentials (GSEC)
- 6 Days (Instructor-Led)
- 46 CPEs / 46 Hours (Self-Paced)
- Labs: 20 Hands-On Labs
- Slide 4 of 37
SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations
MAJOR UPDATESIntermediate SEC450Cyber Defense
- GIAC Security Operations Certified (GSOC)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 22 Hands-On Labs
- Slide 5 of 37
SEC501: Advanced Security Essentials - Enterprise Defender
Intermediate SEC501Cyber Defense
- GIAC Certified Enterprise Defender (GCED)
- 6 Days (Instructor-Led)
- 38 CPEs / 38 Hours (Self-Paced)
- Labs: 25 Hands-On Labs
- Slide 6 of 37
SEC503: Network Monitoring and Threat Detection In-Depth
Intermediate SEC503Cyber Defense
- GIAC Certified Intrusion Analyst (GCIA)
- 6 Days (Instructor-Led)
- 46 CPEs / 46 Hours (Self-Paced)
- Labs: 37 Hands-On Labs
- Slide 7 of 37
SEC504: Hacker Tools, Techniques, and Incident Handling
MAJOR UPDATESEssentials SEC504Offensive Operations
- GIAC Certified Incident Handler Certification (GCIH)
- 6 Days (Instructor-Led)
- 38 CPEs / 38 Hours (Self-Paced)
- Labs: 44 Hands-On Labs
- Slide 8 of 37
SEC510: Cloud Security Engineering and Controls
Advanced SEC510Cloud Security
- GIAC Public Cloud Security (GPCS)
- 5 Days (Instructor-Led)
- 38 CPEs / 38 Hours (Self-Paced)
- Labs: 52 Hands-On Labs
- Slide 9 of 37
SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring
Intermediate SEC511Cyber Defense
- GIAC Continuous Monitoring Certification (GMON)
- 6 Days (Instructor-Led)
- 46 CPEs / 46 Hours (Self-Paced)
- Labs: 18 Hands-On Labs
- Slide 10 of 37
SEC522: Application Security: Securing Web Applications, APIs, and Microservices
Advanced SEC522Cloud Security
- GIAC Certified Web Application Defender (GWEB)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 21 Hands-On Labs
- Slide 11 of 37
SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise
Intermediate SEC530Cyber Defense
- GIAC Defensible Security Architecture (GDSA)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 24 Hands-On Labs
- Slide 12 of 37
SEC540: Cloud Native Security and DevSecOps Automation
UPDATEDAdvanced SEC540Cloud Security
- GIAC Cloud Security Automation (GCSA)
- 5 Days (Instructor-Led)
- 38 CPEs / 38 Hours (Self-Paced)
- Labs: 19 Hands-On Labs
- Slide 13 of 37
SEC542: Web App Penetration Testing and Ethical Hacking
MAJOR UPDATESIntermediate SEC542Offensive Operations
- GIAC Web Application Penetration Tester (GWAPT)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 35 Hands-On Labs
- Slide 14 of 37
SEC555: Detection Engineering and SIEM Analytics
Intermediate SEC555Cyber Defense
- GIAC Certified Detection Analyst (GCDA)
- 5 Days (Instructor-Led)
- 30 CPEs / 30 Hours (Self-Paced)
- Labs: 18 Hands-On Labs
- Slide 15 of 37
SEC560: Enterprise Penetration Testing
UPDATEDIntermediate SEC560Offensive Operations
- GIAC Penetration Tester (GPEN)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 30 Hands-On Labs
- Slide 16 of 37
SEC566: Implementing and Auditing CIS Controls
MAJOR UPDATESIntermediate SEC566Cybersecurity Leadership
- GIAC Critical Controls Certification (GCCC)
- 5 Days (Instructor-Led)
- 30 CPEs / 30 Hours (Self-Paced)
- Labs: 23 Hands-On Labs
- Slide 17 of 37
SEC573: AI-Powered Security Automation: Building Tools with Python, LLMs, and MCP
MAJOR UPDATESAdvanced SEC573Cyber Defense, Artificial Intelligence
- GIAC Python Coder (GPYC)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 128 Hands-On Labs
- Slide 18 of 37
SEC575: iOS and Android Application Security Analysis and Penetration Testing
Intermediate SEC575Offensive Operations
- GIAC Mobile Device Security Analyst (GMOB)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hands-On Labs
- Slide 19 of 37
SEC588: Cloud Penetration Testing
MAJOR UPDATESIntermediate SEC588Offensive Operations
- GIAC Cloud Penetration Tester (GCPN)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 24 Hands-On Labs
- Slide 20 of 37
SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses
Intermediate SEC599Offensive Operations
- GIAC Defending Advanced Threats (GDAT)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 25 Hands-On Labs
- Slide 21 of 37
SEC617: Wireless Penetration Testing and Ethical Hacking
Advanced SEC617Offensive Operations
- GIAC Assessing and Auditing Wireless Networks (GAWN)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hands-On Labs
- Slide 22 of 37
SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking
Advanced SEC660Offensive Operations
- GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)
- 6 Days (Instructor-Led)
- 46 CPEs / 46 Hours (Self-Paced)
- Labs: 30 Hands-On Labs
- Slide 23 of 37
FOR498: Digital Acquisition and Rapid Triage
Essentials FOR498Digital Forensics and Incident Response
- GIAC Battlefield Forensics and Acquisition (GBFA)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hands-On Labs
- Slide 24 of 37
FOR500: Windows Forensic Analysis
UPDATEDEssentials FOR500Digital Forensics and Incident Response
- GIAC Certified Forensic Examiner (GCFE)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 22 Hands-On Labs
- Slide 25 of 37
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
UPDATEDIntermediate FOR508Digital Forensics and Incident Response
- GIAC Certified Forensic Analyst (GCFA)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 35 Hands-On Labs
- Slide 26 of 37
FOR518: Mac and iOS Forensic Analysis and Incident Response
UPDATEDIntermediate FOR518Digital Forensics and Incident Response
- GIAC iOS and macOS Examiner (GIME)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 23 Hands-On Labs
- Slide 27 of 37
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
Advanced FOR572Digital Forensics and Incident Response
- GIAC Network Forensic Analyst (GNFA)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hands-On Labs
- Slide 28 of 37
FOR578: Cyber Threat Intelligence
MAJOR UPDATESIntermediate FOR578Digital Forensics and Incident Response
- GIAC Cyber Threat Intelligence (GCTI)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 20 Hands-On Labs
- Slide 29 of 37
FOR585: Smartphone Forensic Analysis In-Depth
MAJOR UPDATESEssentials FOR585Digital Forensics and Incident Response
- GIAC Advanced Smartphone Forensics (GASF)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 22 Hands-On Labs
- Slide 30 of 37
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
Advanced FOR610Digital Forensics and Incident Response
- GIAC Reverse Engineering Malware (GREM)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 48 Hands-On Labs
- Slide 31 of 37
LDR414: SANS Training Program for CISSP® Certification
Intermediate LDR414Cybersecurity Leadership
- GIAC Information Security Professional (GISP)
- 6 Days (Instructor-Led)
- 51 CPEs / 51 Hours (Self-Paced)
- Slide 32 of 37
LDR512: Security Leadership Essentials for Managers
UPDATEDIntermediate LDR512Cybersecurity Leadership
- GIAC Security Leadership (GSLC)
- 5 Days (Instructor-Led)
- 30 CPEs / 30 Hours (Self-Paced)
- Labs: 25 Hands-On Labs
- Slide 33 of 37
LDR514: Security Strategic Planning, Policy, and Leadership
Advanced LDR514Cybersecurity Leadership
- GIAC Strategic Planning, Policy, and Leadership (GSTRT)
- 5 Days (Instructor-Led)
- 30 CPEs / 30 Hours (Self-Paced)
- Labs: 32 Hands-On Labs
- Slide 34 of 37
LDR551: Building and Leading Security Operations Centers
Advanced LDR551Cybersecurity Leadership
- GIAC Security Operations Manager (GSOM)
- 5 Days (Instructor-Led)
- 30 CPEs / 30 Hours (Self-Paced)
- Labs: 19 Hands-On Labs
- Slide 35 of 37
ICS410: ICS/SCADA Security Essentials
Essentials ICS410Industrial Control Systems Security
- GIAC Global Industrial Cyber Security Professional (GICSP)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 15 Hands-On Labs
- Slide 36 of 37
ICS456: Essentials for NERC Critical Infrastructure Protection
Essentials ICS456Industrial Control Systems Security
- GIAC Critical Infrastructure Protection (GCIP)
- 5 Days (Instructor-Led)
- 31 CPEs / 31 Hours (Self-Paced)
- Labs: 23 Hands-On Labs
- Slide 37 of 37
ICS515: ICS Visibility, Detection, and Response
Intermediate ICS515Industrial Control Systems Security
- GIAC Response and Industrial Defense (GRID)
- 6 Days (Instructor-Led)
- 36 CPEs / 36 Hours (Self-Paced)
- Labs: 22 Hands-On Labs
Upcoming Training Events for the SANS' AF COOL Program
- Slide 1 of 3
SANS AI Cybersecurity Summit 2026
Obtain hands-on, practical skills from the world's best instructors by taking a SANS course at SANS AI Cybersecurity Summit 2026.
Summit 
- Mon, Apr 20 - Mon, Apr 27, 2026 • ET
- Arlington, VA, US & Virtual (ET)
- 9 Courses
- Slide 2 of 3
SANS Security West 2026
Join world-renown cybersecurity professionals at one of our premier annual training events in San Diego. Gain hands-on experience from leading experts while enjoying the city’s coastal beauty, professional atmosphere, and exceptional hospitality.
Training Event 
- Mon, May 11 - Sat, May 16, 2026 • PT
- San Diego, CA, US & Virtual (PT)
- 34 Courses
- Slide 3 of 3
SANSFIRE 2026
Light the fuse on your cyber future in Washington, D.C., with SANSFIRE. World-class content, expert instructors, and a capital city rich with sights, stories, and significance.
Training Event 
- Mon, Jul 13 - Sat, Jul 18, 2026 • ET
- Washington, DC, US & Virtual (ET)
- 35 Courses
SEC275: Foundations: Computers, Technology, & Security
SANS Foundations is the most comprehensive, certified introductory cybersecurity course on the market. Developed by leading subject matter experts, SEC275 provides fundamental cybersecurity knowledge and skills, giving students with no prior technical or industry experience a level of proficiency that allows them to speak the same language as professionals. Learn foundational computer and security concepts and develop programming skills in an interactive learning environment, supported by world renowned instructors, video lectures, hands-on labs and exercises. SANS Foundations transforms learning into real-world, practical skills, going far beyond what all other foundational cybersecurity courses offer.
