Training
Featured CourseView All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
Cloud Security Training, Courses, and Resources
Can't find what you are looking for?

Let us help.

Contact us
Community Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely.

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk With an Expert
Talk With an Expert

Keynote | How to Save Your SOC from Stagnation

Download File
Keynote | How to Save Your SOC from Stagnation (PDF, 0.78MB)Last updated: 13 Jun, 2023
Presented by:
Carson Zimmerman
Carson Zimmerman
  • Blue Team Summit 2023

Blue Team Summit 2023

Presenters

Carson Zimmerman
Carson Zimmerman

Carson Zimmerman

Carson Zimmerman is the Chief Architect of Microsoft’s Security Operations Center (SOC), where he leads strategic initiatives to advance global threat detection and response.

Read more about Carson Zimmerman

Related Resources

Keynote | DFIR AI-ze Your Workflow

Summit PresentationDigital Forensics and Incident Response
  • 24 Jul 2025
  • Mari DeGrazia
  • SANS DFIR Summit 2025

Training a TAIGR to Protect Our Power

Summit Presentation
  • 17 Jun 2025
  • Andy Bochman
  • SANS ICS Security Summit 2025

Sustaining Your ICS Cyber Program - Gaining Support Communicating Risk and Ensuring Long-Term Success

Summit PresentationIndustrial Control Systems Security
  • 17 Jun 2025
  • Blake Gilson
  • SANS ICS Security Summit 2025

Asset Management or - How I Learned to Stop Kicking the Can Down the Road

Summit PresentationIndustrial Control Systems Security
  • 17 Jun 2025
  • Nikolas Upanavage
  • SANS ICS Security Summit 2025

SANS ICS 5 Critical Controls Goes to the Board - Jemenas 5 Critical Controls Journey

Summit PresentationIndustrial Control Systems Security
  • 17 Jun 2025
  • David Worthington
  • SANS ICS Security Summit 2025

Evolving a Definition of ICS Malware - Capability Intent and Adverse Effects

Summit PresentationIndustrial Control Systems Security
  • 17 Jun 2025
  • Jimmy Wylie
  • SANS ICS Security Summit 2025

Related Courses

  • Slide 1 of 21

    AIS247: AI Security Essentials for Business Leaders

    Essentials
    AIS247Cybersecurity Leadership
    LDR414: SANS Training Program for CISSP® Certification
    • 2 CPEs / 2 Hours (Self-Paced)

    View course detailsRegister
  • Slide 2 of 21

    SEC535: Offensive AI - Attack Tools and Techniques

    newAI-FOCUSEDIntermediate
    SEC535Offensive Operations, Artificial Intelligence
    SEC535: Offensive AI - Attack Tools and Techniques
    • 3 Days (Instructor-Led)
    • 18 CPEs / 18 Hours (Self-Paced)
    • Labs: 14 Hands-On Labs

    View course detailsRegister
  • Slide 3 of 21

    SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

    Advanced
    SEC595Cyber Defense
    SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
    • GIAC Machine Learning Engineer (GMLE)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 30 Hands-On Labs

    View course detailsRegister
  • Slide 4 of 21

    SEC275: Foundations: Computers, Technology, & Security

    Beginner
    SEC275Cyber Defense
    SEC406: Linux Security for InfoSec Professionals
    • GIAC Foundational Cybersecurity Technologies (GFACT)
    • 38 CPEs / 38 Hours (Self-Paced)
    • Labs: 80 Hands-On Labs

    View course detailsRegister
  • Slide 5 of 21

    SEC503: Network Monitoring and Threat Detection In-Depth

    Intermediate
    SEC503Cyber Defense
    SEC503: Network Monitoring and Threat Detection In-Depth
    • GIAC Certified Intrusion Analyst (GCIA)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours (Self-Paced)
    • Labs: 37 Hands-On Labs

    View course detailsRegister
  • Slide 6 of 21

    SEC501: Advanced Security Essentials - Enterprise Defender

    Intermediate
    SEC501Cyber Defense
    SEC501: Advanced Security Essentials - Enterprise Defender
    • GIAC Certified Enterprise Defender (GCED)
    • 6 Days (Instructor-Led)
    • 38 CPEs / 38 Hours (Self-Paced)
    • Labs: 25 Hands-On Labs

    View course detailsRegister
  • Slide 7 of 21

    SEC573: Automating Information Security with Python

    Advanced
    SEC573Cyber Defense
    SEC573: Automating Information Security with Python
    • GIAC Python Coder (GPYC)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 128 Hands-On Labs

    View course detailsRegister
  • Slide 8 of 21

    SEC497: Practical Open-Source Intelligence (OSINT)

    Intermediate
    SEC497Cyber Defense
    SEC497: Practical Open-Source Intelligence (OSINT)
    • GIAC Open Source Intelligence (GOSI)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 29 Hands-On Labs

    View course detailsRegister
  • Slide 9 of 21

    SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

    Major UpdatesIntermediate
    SEC450Cyber Defense
    SEC450: Blue Team Fundamentals: Security Operations and Analysis
    • GIAC Security Operations Certified (GSOC)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 22 Hands-On Labs

    View course detailsRegister
  • Slide 10 of 21

    SEC401J: Security Essentials - Network, Endpoint, and Cloud (Japanese)

    Essentials
    SEC401JCyber Defense
    SEC401: Security Essentials - Network, Endpoint, and Cloud
    • GIAC Security Essentials (GSEC)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    View course detailsRegister
  • Slide 11 of 21

    SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis

    Advanced
    SEC587Cyber Defense
    SEC587
    • GIAC Strategic OSINT Analyst (GSOA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 28 Hands-On Labs

    View course detailsRegister
  • Slide 12 of 21

    SEC411: AI Security Principles and Practices: GenAI and LLM Defense

    newAI-FOCUSEDIntermediate
    SEC411Cyber Defense, Artificial Intelligence
    SEC406: Linux Security for InfoSec Professionals
    • 14 CPEs / 14 Hours (Self-Paced)
    • Labs: 3 Hands-On Labs

    View course detailsRegister
  • Slide 13 of 21

    SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

    Intermediate
    SEC511Cyber Defense
    SEC511: Continuous Monitoring and Security Operations
    • GIAC Continuous Monitoring Certification (GMON)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours (Self-Paced)
    • Labs: 18 Hands-On Labs

    View course detailsRegister
  • Slide 14 of 21

    SEC555: Detection Engineering and SIEM Analytics

    Intermediate
    SEC555Cyber Defense
    SEC555: SIEM with Tactical Analytics
    • GIAC Certified Detection Analyst (GCDA)
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 18 Hands-On Labs

    View course detailsRegister
  • Slide 15 of 21

    SEC406: Linux Security for InfoSec Professionals

    Essentials
    SEC406Cyber Defense
    SEC406: Linux Security for InfoSec Professionals
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 30 Hands-On Labs

    View course detailsRegister
  • Slide 16 of 21

    SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG

    AI-FOCUSEDEssentials
    SEC495Cyber Defense, Artificial Intelligence
    SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG
    • 7 CPEs / 7 Hours (Self-Paced)

    View course detailsRegister
  • Slide 17 of 21

    SEC401: Security Essentials - Network, Endpoint, and Cloud

    Essentials
    SEC401Cyber Defense
    SEC401: Security Essentials - Network, Endpoint, and Cloud
    • GIAC Security Essentials (GSEC)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    View course detailsRegister
  • Slide 18 of 21

    SEC673: Advanced Information Security Automation with Python

    newAdvanced
    SEC673Cyber Defense
    SEC673: Advanced Information Security Automation with Python
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 27 Hands-On Labs

    View course detailsRegister
  • Slide 19 of 21

    SEC547: Defending Product Supply Chains

    newIntermediate
    SEC547Cyber Defense
    SEC547: Defending Product Supply Chains
    • 18 CPEs / 18 Hours (Self-Paced)
    • Labs: 13 Hands-On Labs

    View course detailsRegister
  • Slide 20 of 21

    SEC301: Introduction to Cyber Security

    Beginner
    SEC301Cyber Defense
    SEC673: Advanced Information Security Automation with Python
    • GIAC Information Security Fundamentals (GISF)
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 14 Hands-On Labs

    View course detailsRegister
  • Slide 21 of 21

    SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

    Intermediate
    SEC530Cyber Defense
    SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise
    • GIAC Defensible Security Architecture (GDSA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 24 Hands-On Labs

    View course detailsRegister