SEC536: Adversarial AI - Penetration Testing AI Systems
SEC536Offensive Operations, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
When cybersecurity matters most, you shouldn't have to choose between career growth and everything else.
SANS OnDemand gives individuals and organizations the freedom to train without disruption.
Busy professionals can stay ahead of evolving threats without missing personal milestones. Teams can sharpen their skills without losing valuable time on the job. With flexible, self-paced learning, real-world labs, and expert instructors, SANS OnDemand helps you stay prepared — on your schedule.
As the global leader in cybersecurity training, certifications, and degrees, SANS Institute equips practitioners and teams with the skills needed to safeguard organizations and advance careers.
Our mission is simple: deliver practical knowledge you can use immediately to protect what matters most.
Whether you're new to information security or a seasoned expert with a specialized focus, SEC401 provides the essential skills and techniques needed to secure critical information and technology assets, whether on-premises or in the cloud. The course teaches you how to apply these concepts directly into a winning defensive strategy, all framed in terms of combating today's adversaries. This is how we fight, and this is how we win! With 20 hands-on labs, SEC401 empowers you to implement these skills effectively in real-world scenarios.
FOR500 builds in-depth and comprehensive digital forensics knowledge of Microsoft Windows operating systems by analyzing and authenticating forensic data as well as track detailed user activity and organize findings. It teaches students to apply digital forensic methodologies to a variety of case types and situations, allowing them to apply in the real world the right methodology to achieve the best outcome. Course Demo
Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems. The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done worse damage to the organization. For the incident responder, this process is known as "threat hunting".FOR508 teaches advanced skills to hunt, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivists.
Transform your incident response skills and get into the mindset of attackers with SEC504™ training. Through 30+ hands-on labs, you'll learn to investigate cybersecurity incidents, develop threat intelligence, and apply defense strategies against real-world threats. From password attacks to MFA bypass techniques on cloud services, this course takes you deep into the latest hacker tactics. Engage with cutting-edge tools and simulate live attacks to sharpen your defensive capabilities, all while preparing for the GIAC GCIH certification. You'll leave ready to defend both cloud and on-premises environments against evolving cyber threats.
Cyber threat intelligence represents a force multiplier for organizations looking to update their response and detection programs to deal with increasingly sophisticated advanced persistent threats. Malware is an adversary's tool but the real threat is the human one, and cyber threat intelligence focuses on countering those flexible and persistent human threats with empowered and trained human defenders. During a targeted attack, an organization needs a top-notch and cutting-edge threat hunting or incident response team armed with the threat intelligence necessary to understand how adversaries operate and to counter the threat. FOR578: Cyber Threat Intelligence will train you and your team in the tactical, operational, and strategic level cyber threat intelligence skills and tradecraft required to make security teams better, threat hunting more accurate, incident response more effective, and organizations more aware of the evolving threat landscape.
SEC503: Network Monitoring and Threat Detection In-Depth training delivers the technical knowledge, insight, and hands-on training you need to confidently defend your network, whether traditional or cloud-based. You will learn about the underlying theory of TCP/IP and the most used application protocols so that you can intelligently examine network traffic to identify emerging threats, perform large-scale correlation for threat hunting, and reconstruct network attacks. 37 Hands-on Labs + Capstone Challenge
Security leaders need both technical knowledge and leadership skills to gain the respect of technical team members, understand what technical staff are actually doing, and appropriately plan and manage security projects and initiatives. This security managers training course will teach leaders about the key elements of any modern security program. Learn to quickly grasp critical cybersecurity issues and terminology, with a focus on security frameworks, security architecture, security engineering, computer/network security, vulnerability management, cryptography, data protection, security awareness, application security, DevSecOps, cloud security, and security operations. This is more than security training. You will learn how to lead security teams and manage programs by playing through twenty-three Cyber42 activities throughout the class, approximately 60-80 minutes daily.
The next generation of security leadership must bridge the gap between security staff and senior leadership by strategically planning how to build and run effective security programs. Yet, creating a security strategy, executing a plan that includes sound policy coupled with top-notch leadership is hard for IT and security professionals because we spend so much time responding and reacting. We almost never do strategic planning until we get promoted to a senior position, and then we are not equipped with the skills we need to run with the pack. This information security course will provide you with the tools to build a cybersecurity strategic plan, an entire IT security policy, and lead your teams in the execution of your plan and policy. By the end of class you will have prepared an executive presentation, read 3 business case studies, responded to issues faced by 4 fictional companies, analyzed 15 case scenarios, and responded to 15 Cyber42 events.
More businesses than ever are moving sensitive data and shifting mission-critical workloads to the cloud, and not just to one cloud service provider (CSP). Organizations are responsible for securing their data and mission-critical applications in the cloud. The benefits in terms of cost and speed of leveraging a multicloud platform to develop and accelerate delivery of business applications and analyze customer data can quickly be reversed if security professionals are not properly trained to secure the organization's cloud environment and investigate and respond to the inevitable security breaches. New technologies introduce new risks. Help your organization successfully navigate both the security challenges and opportunities presented by cloud services. 20 Hands-on Labs + CloudWars CTF
SEC560 prepares you to conduct successful penetration testing for entire modern enterprises, including on-prem systems, Azure, and Entra ID. The course doesn't just focus on network devices, Windows, Linux, macOS, identity systems, etc. - instead, it focuses on the combined business risk of the entire enterprise. You will learn the methodology and techniques used by real-world penetration testers in large organizations to identify and exploit vulnerabilities at scale and show real business risk to your organization. The course material is complemented with 30+ practical lab exercises concluding with an intensive, hands-on Capture-the-Flag exercise in which you will conduct a penetration test against a target organization and demonstrate what you've learned.
SEC595 provides students with a crash-course introduction to practical data science, statistics, probability, machine learning, and AI. The course is structured as a series of short discussions with extensive hands-on labs that help students to develop useful intuitive understandings of how these concepts relate and can be used to solve real-world problems. The best analogy is that we are using an apprenticeship approach to bring you from beginner to journeyman in AI and related fields. If you've never done anything with data science or machine learning but want to use these AI techniques, this is definitely the course for you! 30 Hands-on Labs