Andy Laman pairs decades of real-world leadership with technical expertise to author SANS SEC503TM: Network Monitoring and Threat Detection In-DepthTM, a cornerstone course that has trained thousands of defenders worldwide. As a Senior Instructor at the SANS Institute, he teaches defenders how to capture, analyze, and act on network evidence, blending advanced technical depth with lessons drawn from experience in enterprise, government, and consulting sectors. He also leads A4 InfoSec, the firm he founded to help organizations strengthen monitoring, detection, and response programs.
Andy’s career reflects the evolution of modern network defense. Over his career of 30+ years working internationally, Andy has served in most roles within IT and cybersecurity, from support desk services and network/system administration to leadership roles, such as assistant vice president and chief information security officer. Today, through A4 InfoSec, Andy helps organizations design detection programs tailored to their operational realities. These experiences directly inform the labs in SEC503, where not only do students learn how systems communicate, they learn how to think critically under pressure.
He holds the prestigious GIAC Security Expert (GSE #142) certification, one of the rarest in the industry. He also maintains 21 advanced GIAC certifications including GIAC Penetration Tester (GPEN), GIAC Network Forensic Analyst (GNFA), GIAC Continuous Monitoring (GMON), and GIAC Response and Industrial Defense (GRID), as well as the CISSP credential. He also serves on the GIAC Advisory Board, and is a faculty member of the SANS Technology Institute, which has been designated an NSA Center of Academic Excellence in Cyber Defense and is a multi-year winner of the National Cyber League competition.
In the classroom, Andy is known for making complex detection concepts accessible and engaging. Students consistently praise his teaching style: “Andy is hands down the best instructor I have had so far,” and “his real-world experience brings the labs to life.” Many call SEC503 a “game changer” in how they understand network defense, crediting Andy’s lab design with transforming their detection skills. By the end of SEC503, students not only understand detection theory but leave with workflows they can immediately apply in their organizations. Away from the classroom, Andy enjoys outdoor exploration and jokes that his greatest challenge is keeping his spouse from getting lost in the mountains — a reminder that, like cybersecurity, success often depends on persistence, navigation, and teamwork.
Qualification Summary
Senior Instructor and Course Author, SEC503: Network Monitoring and Threat Detection In-Depth
Andy is very knowledgeable and can express multiple concepts in various manners for all to fully understand/grasp. Very good at communication!
Slide 2 of 3
Andy is fantastic. His presentation is fun, informational, and on topic.
Slide 3 of 3
Andy is hands down the best instructor I [have] had so far. I don't know what he puts in his coffee in the morning, but the energy and enthusiasm he still has after a full day of teaching is fantastic.
Slide 1 of 0
(1/0)
Upcoming Training Courses
Here are upcoming opportunities to train with this expert instructor.
