Ryan Thompson
Certified InstructorSenior Cloud Security Researcher at CrowdStrike
Specialities
Cloud Security

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsCloud Security

Ryan Thompson is a Certified Instructor at SANS Institute and Senior Cloud Security Researcher at CrowdStrike. His role involves researching and emulating adversary activity across AWS and Azure, building proof-of-concept solutions for threat hunting, and developing innovative detection capabilities within the cloud control plane. With a strong foundation in cybersecurity, marked by a long list of GIAC certifications, Ryan’s expertise and educational approach make him exceptionally qualified to teach and mentor the current and next generation of cybersecurity professionals.
With a slew of professional certifications, including GCIA, GCIH, GNFA, GCFA, GCFE, GCFR, and GCTD, Ryan's commitment to the cybersecurity domain is unmistakable. His entry into cybersecurity was kindled by an insightful talk on insider threats, which transformed his casual interest into a profound professional pursuit. Today, Ryan is recognized for his exceptional ability to translate complex technical challenges into teachable moments, making him a valuable asset both in the field and the classroom.
Ryan's professional journey is distinguished by his role at CrowdStrike, where he has been instrumental in advancing cloud security measures that protect extensive customer bases from sophisticated threats. His work not only involves deep technical expertise but also creative problem-solving, as he builds systems that preemptively counteract potential security breaches in cloud infrastructures.
As an instructor, Ryan believes in the power of education to transform and empower. He approaches teaching with the philosophy that learning should be accessible to all students, regardless of their prior knowledge. He relishes the opportunity to share his knowledge and enthusiasm for cloud security, emphasizing the practical relevance of each topic he covers. His unique blend of field experience and instructional skills makes him particularly adept at guiding students through the complexities of cloud security.
Outside of his professional and teaching roles, Ryan actively contributes to the cybersecurity community. He organizes events for BSides Boulder and NOCO Hackers, fostering a spirit of collaboration and continuous learning among cybersecurity enthusiasts. His personal interests include woodworking, bicycle riding and repair, and hydroponic gardening, which allow him to balance his screen time with engaging physical activities.
Ryan also maintains a cybersecurity blog, where he shares his professional insights, research findings, and practical advice. His commitment to advancing cybersecurity education and practice is evident in every aspect of his career, making him a trusted and respected figure in the field.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
In this hands-on workshop, you'll investigate cloud breach cases using command-line tools and telemetry data to uncover attacker activity, reconstruct timelines, and sharpen your cloud threat detection skills.

This talk will walk through real-world defense impairment techniques across AWS and Azure. We'll dig into what it looks like when attackers suppress their own IPs in GuardDuty, redirect CloudTrail logs to buckets they control, tamper with Azure diagnostic settings, or disable Defender entirely.

This talk will cover persistence mechanisms specific to the AWS ecosystem. The audience will learn about well established persistence techniques but also about creative new mechanisms that rely on newer cloud services.

Review relevant educational resources made with contribution from this instructor.