Matt Edmondson
Senior InstructorFounder at Argelius Labs
Specialities
Open-Source Intelligence, Cyber Defense, Offensive Operations

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsOpen-Source Intelligence, Cyber Defense, Offensive Operations

Matt Edmondson is a Senior Instructor and course author at the SANS Institute, where he equips students with the skills to operationalize open-source intelligence (OSINT) against modern threats. He authored and teaches SANS SEC497: Practical Open-Source Intelligence (OSINT) and SANS SEC587: Advanced Open-Source Intelligence Gathering and Analysis, and is also the Founder of Argelius Labs, a boutique cybersecurity firm specializing in OSINT, persistent threat monitoring, and tailored intelligence solutions.
Matt spent two decades conducting investigations and advancing the use of OSINT and digital forensics in support of national security and law enforcement operations. His work included leading complex investigations into cybercrime and dark-web activity. Techniques he pioneered during this time are now embedded into the labs for SEC497 and SEC587, giving students the chance to practice the same methods used in real investigations. This foundation, combined with his consulting work through Argelius Labs, gives students a practical, scalable perspective on operationalizing OSINT.
He holds 12 GIAC certifications spanning forensics, incident response, penetration testing, and OSINT, including the GIAC Certified Forensic Analyst (GCFA), GIAC Open Source Intelligence (GOSI), and GIAC Certified Incident Handler (GCIH), as well as the Offensive Security Certified Professional (OSCP) credential. Matt is also a faculty member of the SANS Technology Institute, which has been designated an NSA Center of Academic Excellence in Cyber Defense and is a multi-year winner of the National Cyber League competition. In addition to authoring SEC497 and SEC587, he has spoken at leading conferences including Black Hat, the SANS OSINT Summit (which he chairs), and the SANS AI Summit, while also contributing widely to the community through open-source OSINT tools and resources.
In the classroom, Matt is known for his clarity and ability to make complex topics approachable. His teaching philosophy emphasizes deep technical understanding, enabling him to translate advanced OSINT and forensics concepts into practical, actionable skills. Students consistently praise his ability to connect theory with real-world investigations, and learners leave class empowered to apply what they’ve learned immediately. Outside of work, Matt enjoys classic video games and baseball—he often recalls chasing foul balls as a kid to trade them for snacks at local games. His blend of expertise, curiosity, and approachability makes him not only a respected leader in the OSINT community but also a trusted mentor to the next generation of defenders.
Matt has a talent for distilling topics and presenting them in everyman vocabulary and context. I found myself recalling several instances in the past in which Linux would have saved time and added value.
Matt does a great job of sprinkling in real world examples of his professional experience into the course. That type of real world application really reinforces the content being taught.
I especially enjoyed how Matt included his personal experiences to reinforce the course content.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
We've all got two things in common. First, we know AI is powerful. Second, we all have investments, and every one of us would like them to do a little better.

In this session, SANS instructors Matt Edmondson and Ngô Minh Hiếu (Hiếu PC), CEO of ChongLuaDao, will demonstrate how modern OSINT techniques and AI-powered workflows are transforming cyber investigations.

In this fast-paced, fun talk, we'll cover the top ways that I've improved my efficiency and productivity by changing the way I interact with AI in 2025 and into 2026.

I've been a heavy user of AI since the beginning, but the way that I use AI has recently shifted. In this fast-paced, fun talk, we'll cover the top ways that I've improved my efficiency and productivity by changing the way I interact with AI so far in 2025.

In this fast-paced, fun talk, we'll cover the top ways that I've improved my efficiency and productivity by changing the way I interact with Al so far in 2025.

Join us for SANS Secure Your Fortress: Building Robust and Resilient Defenses for 2025, where cutting-edge techniques meet hands-on practicality. Designed for cybersecurity professionals at all levels, this event equips you with the tools, strategies, and insights needed to overcome today’s toughest challenges and prepare for tomorrow’s emerging threats.

I've been a heavy user of Al since the beginning, but the way that I use Al has recently shifted. In this fast-paced, fun talk, we'll cover the top ways that I've improved my efficiency and productivity by changing the way I interact with Al so far in 2025.

Get ready to deep dive into the all-new SANS SEC587 Advanced Open-Source Intelligence course, where 20 new labs and enhanced content redefine the landscape of OSINT training. This overhaul includes content on Russian and Chinese OSINT, cutting-edge audio analysis powered by AI, and timely new sections on cryptocurrency and drone detection, among others.

Hear the stories from top SANS faculty of how they became the cybersecurity experts they are today and how their stories can be applied to your career journey. Learn how they build their skills to become one of the top practitioners within cybersecurity.

Join us for an exclusive webcast as we reveal the brand-new SANS OSINT Poster, hosted by SANS Senior Instructor and OSINT expert Matt Edmondson.

This survey will enable a comprehensive look into how AI is reshaping the cybersecurity landscape. Delving deep into real-world applications, challenges, and the evolution of AI-based threat actors, the survey aims to provide an understanding of where we stand and where we are headed.

The internet doesn't sit still. In this constantly changing environment, those using AI can gain a tremendous advantage in efficiency in every phase of the intelligence cycle. In this talk we'll cover how OSINT practitioners can benefit from recent developments in the AI space and what changes are coming to the SANS SEC587 Advanced OSINT Course.

インターネットは常に変化をし続けています。そういった環境において、AIを活用することで、OSINTサイクルのあらゆる段階においても、効率性において圧倒的なアドバンテージを得られます。 このWebcastでは、OSINT技術を利用している方がAIの活用によってどのような業務改善を行えるのかを共有し、SANSトレーニングの高度なOSINTコースであるSEC587の最近の更新情報について共有します。

Step into a world where cutting-edge defense meets practicality in cybersecurity! "SANS Secure Your Fortress" will teach you how to master the latest and most effective defense techniques. Whether you're a seasoned expert or just beginning your cyber journey, this event is for you.

X may have given it to the free Twitter API but there are still A LOT of data sources out there that we can monitor for free and fire alerts when things meet our criteria.

Have you ever stumbled across a file that you wanted to access but couldn’t due to the fact that it was password protected? Password cracking is a topic covered in depth in penetration testing courses but rarely in digital forensics or OSINT, even though it’s extremely applicable.

Over the course of his career, SEC497: Practical Open-Source Intelligence (OSINT) Course Author Matt Edmondson has started up multiple OSINT teams within the U.S. government and worked with private sector cyber threat intelligence teams ranging from Fortune 100 businesses to small startups. In this talk, Matt will explain how the OSINT landscape is changing and most importantly, he’ll discuss some crucial decisions that organizations can make which can severely hinder the effectiveness of their OSINT operations. He’ll also talk about what really matters with operational security (OPSEC) and how we can improve our OPSEC with minimal cost.

The intelligence cycle is a six-step process to gather, analyze, and disseminate intelligence information. During the webinar, we will discuss how ChatGPT, an AI-based language model, can assist in each phase of this process.We’ll provide real-world examples of ChatGPT being used to drastically reduce the time it takes to go from concept to functionality and to help us learn while we’re using it.

Metadata is a vital part of digital forensics work but is often glanced over for OSINT. In this workshop, we'll discuss why metadata is far more useful than most analysts give it credit for. We'll cover why many people miss metadata and how it could potentially reveal hidden information. We'll even set up some hands-on exercises so you can practice your skills.

Throughout his career, Matt Edmondson has started up several OSINT teams within the U.S. government and worked with private sector cyber threat intelligence teams ranging from Fortune 100 businesses to small startups.

Review relevant educational resources made with contribution from this instructor.