Nation-State Cyber Threats, Critical Infrastructure Attacks and AI Risks to Dominate SANS CyberThreat 2026

London, UK, 13 October 2026 – From Russian espionage operations and attacks targeting critical infrastructure to emerging risks posed by AI systems, some of cybersecurity's most pressing challenges will take centre stage at SANS CyberThreat 2026 on 16-17 November at the Roundhouse London. With the SANS 2026 AI Survey finding that 78% of organisations reported confirmed or suspected AI-enabled attacks in the past year, understanding how AI is reshaping the nature of cyber threats is crucial. Designed for threat hunters, incident responders, security researchers and intelligence professionals, the two-day event will explore the latest threat intelligence, attack techniques and lessons learned from the front lines of cyber defence.

The programme combines keynote presentations, technical sessions, hands-on challenges and peer networking opportunities. Highlights include:

• From AI assistants to AI attackers – Sessions will examine how AI is changing both cyber offence and defence, from SANS Institute CEO, James Lyne's opening keynote on The Great Rewrite: AI, geopolitics, and the new rules of cyber defence to discussions on remediating vulnerabilities as AI accelerates discovery.
• Inside Russian, Chinese and North Korean cyber operations – Researchers from BAE Systems, Microsoft and Check Point Software will present new investigations into some of today's most active threat actors, including Sandworm's use of trojanised software installers in Ukraine, Chinese espionage infrastructure linked to Ink Dragon, and the evolving tactics of North Korea's Famous Chollima group.
• "We asked our AI Red Teaming agent to shut down a wind farm...so it did" – This headlining session will explore what happens when agentic AI is deployed in a live operational technology environment, examining how an AI red teamer approached a real-world critical infrastructure target while operating within strict safety constraints.
• How insider threats became a primary security challenge – Drawing on incident response data, dark web research, HUMINT and honeypot engagements, Lab-1's Thomas Mannie Wilkan will explore why malicious insiders have moved from edge case to mainstream concern and how AI may be accelerating the risk.
• Making sense of cybersecurity's most complex challenges – IBM's Anne Leslie, Head of Cloud Risk, will explore how organisations can navigate emerging challenges including AI governance, post-quantum readiness, supply chain risk and increasingly complex technology ecosystems.
• Ukraine's cyber war playbook – In the closing keynote, Illia Vitiuk, Adviser to the Chairman - Security Service of Ukraine, will share lessons learned from defending against more than 16,000 cyberattacks and incidents since Russia's full-scale invasion, and what organisations can learn from operating under sustained cyber aggression.

CyberThreat 2026 will also continue SANS Institute’s ongoing collaboration with the UK’s National Cyber Security Centre (NCSC) to strengthen cyber resilience and practitioner capability. This shared focus on practical, intelligence-led defence will run throughout discussions on nation-state threats, operational technology and the evolving threat landscape.

"Threat intelligence only delivers real value when it leads to action. Understanding the threat is important, but insight alone does not improve security. NCSC turns raw intelligence into clear, actionable guidance that network defenders can implement. It is the application of that guidance that ultimately improves resilience," said Paul Chichester, Director Operations at the NCSC.

Alongside the conference programme, attendees will have the opportunity to participate in SANS CyberThreat’s flagship Capture the Flag challenge and connect with fellow practitioners from across Europe and beyond.

“The cyber threats facing the UK, from nation-state activity and critical infrastructure attacks to AI, are increasingly interconnected. Addressing them requires collaboration across government, industry and the practitioner community. Our work with the NCSC helps build the skills and capabilities needed to strengthen cyber resilience, while CyberThreat brings that community together to share practical knowledge and experience,” said Simon Vernon, Head of R&D at SANS Institute.

“What an extraordinary year it's been for the cyber security profession. Alongside the multiple incidents and many threat actors, AI has begun to change the way we talk and think about cyber security in both good and bad ways. It's been a whirlwind and it's time to take stock and learn from each other. More than anything else, that's what SANS CyberThreat is about. It's never been more important,” said Ciaran Martin, Director of the Cyber Leaders Network at SANS Institute.

For agenda details, speaker information and registration, visit the SANS CyberThreat Summit 2026.

Event Details

• Event: SANS CyberThreat 2026
• Date: 16-17 November 2026
• Location: The Roundhouse, London, UK, Chalk Farm Rd, Chalk Farm, London NW1 8EH
• Audience: Threat hunters, incident responders, SOC analysts, threat intelligence professionals, security researchers, red and blue teams
• Registration

About SANS Institute

The SANS Institute is the global leader in cybersecurity training and certifications, trusted by governments, enterprises, and security professionals worldwide. For over three decades, SANS has set the industry standard for technical excellence, equipping practitioners with the real-world skills needed to defend today’s most complex digital environments. As cybersecurity evolves, SANS continues to lead the way, defining best practices and establishing the global benchmark for AI security and emerging technologies.