SEC536: Adversarial AI - Penetration Testing AI Systems



Kick off your SANS Dallas 2026 experience at the Welcome Reception. Be part of this kickoff event and join the industry’s most powerful gathering of cybersecurity professionals. Share stories, make connections, and learn how to make the most of your week in Dallas, TX. Come join your instructors and fellow students for a fun, relaxed evening. Beverages (adult and otherwise) and small bites will be included.
In-Person
Join us for an exciting, hands-on exploration where we transform a humble chat completion script into a sophisticated, fully agentic AI system, all through a series of live, iterative demonstrations. We will demystify how they work by building an agentic system from the ground up.
We'll kick off with a memory-less agent that does well with single questions but stumbles on conversational follow-ups. Watch as we add persistent message history, enabling coherent multi-turn dialogues. Next, we'll hit the wall of context limits when tackling file operations and large data, revealing why raw tool access isn't enough. Through additions of tool-calling capabilities, we'll differentiate between built-in tools and configurable MCP services.
Our agent will gain "hands" to act on the world, "eyes" to inspect complex data structures (databases, logs, packets, registries), and advanced memory architectures to manage its cognitive load. Culminating in a blueprint for agentic memory management, including adaptive system prompts, modular skill loading, planning modes, and compressible context, we'll demonstrate how these elements combine to create truly autonomous, efficient AI agents.
In-Person & Virtual
The classic way to make a massive difference with technology, or “Dent in The Universe,” is via a startup. We can define a startup as a company with high growth possibilities that is innovative and potentially disruptive. This describes most startups in the infosec space. Also, essentially every startup has a strong technology component today and infosec concerns. This translates to lots of startup opportunities for infosec professionals, whether as a founder, early-stage employee, rank and file employee, or even investor.
In this talk we’ll discuss startups, including how important having a “great idea” may or may not be, funding options, as well as “exit” strategies. Funding options include bootstrapping, which means using existing resources, starting a business without external help or capital. Angel investors, affluent individuals who provide capital for a startup, are another option, as are venture capitalists, and crowd sourcing.
An exit strategy is how illiquid assets like company ownership and stock are changed into liquid assets like cash. Even if you do not plan on exiting the company, you may want to convert some assets to cash. And of course any investors will want their money back with profits at some point. If you are focused on outcomes instead of inputs, a startup can be absolutely fantastic.
If you are happy hacking more than just technology, but also happy to figure out and execute business concerns, such as hacking procedures and whatever it takes to make things work, a startup is an option to consider.
In-Person & Virtual