SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Kick off your SANS 2026 experience in style at the Welcome Reception!
This high-energy, can’t-miss event is your first opportunity to connect with fellow cybersecurity professionals, renowned SANS faculty, and industry peers from around the globe. Spark meaningful conversations about today’s most pressing cybersecurity trends, expand your professional network, and start shaping your training goals for the week ahead—or simply unwind and enjoy the moment.
Whether you’re here to collaborate, explore, or recharge, this reception sets the stage for a week of deep, immersive learning. Refreshing beverages (adult and otherwise) and delicious bites will be served.
You invested heavily in your SIEM. Now it's expensive, noisy, and you're not sure it's catching what matters. So you migrate to a new platform, rebuild your detections, and two years later find yourself in exactly the same place. Sound familiar? The uncomfortable truth is that your SIEM isn't the problem—your data is. SIEMs are wrappers around data and process. Switch the wrapper without fixing what's inside, and you've just bought yourself an expensive reset button. This talk reframes data collection as a first-class security operations problem. We'll show how leading teams design detection starting from threat scenarios, not from whatever logs happen to be available.
Attendees will learn:
We'll ground this in real-world case studies, including how missing Zoom authentication logs enabled North Korean operatives to remain undetected, and other examples where the data problem became visible only during incident response—when it was too late. You'll leave with a practical playbook for treating data collection as the strategic capability it is, not an afterthought to your next SIEM purchase.
*Sponsored by Beacon Security
This lunch & learn explains how Offensive Cyber Threat Intelligence (Off CTI) improves defender awareness by extending visibility beyond the firewall to identify adversary infrastructure, stolen credentials, vulnerabilities, and campaign indicators before they affect the enterprise—think of it as preventive incident response. By using reconnaissance, threat actor profiling, malware ecosystem analysis, and external attack surface discovery, Off CTI helps defenders anticipate attacks, prioritize vulnerabilities, and stop kill chains early.
Attendees will see how intelligence from deep and dark web sources—combined with offensive techniques—can improve detection, speed up incident response, and strengthen proactive defense across complex environments.
Presented by Shawn Loveland, COO
*Sponsored by Resecurity
Threat actors work hard to remain hidden, but much of their infrastructure and activity is exposed through DNS, often more than attackers realize. This session explores how DNS can be used to discover, track, and identify malicious infrastructure used in real-world attack campaigns. Drawing on years of DNS threat research, we'll examine tactics attackers use every day, including domain lookalikes, traffic distribution systems (TDS), domain hijacking, parked-domain abuse, and residential proxies. Attendees will gain practical insights into how DNS can help defenders detect and disrupt threats earlier in the attack lifecycle.
*Sponsored by Infoblox
Presented by Brent Eskridge, Staff Threat Researcher, Infoblox
There is an old American legend about a larger-than-life lumberjack, Paul Bunyan, whose mighty axe carved forests and shaped the frontier. As the story goes, Paul faced off against a steam-powered saw that threatened to outpace his manual brute force effort. With his trusty ox, Babe, by his side, he tackled the challenge head-on. He challenged the innovators to a contest, swinging his axe with all his might. Despite his heroic effort, the machine edged him out by a quarter-inch, and Paul walked away, humbled but not broken.
Step into the SANS Solutions Expo and experience innovation in action. This special event brings together leading cybersecurity vendors and solution providers to showcase the latest tools, technologies, and services designed to strengthen and modernize your security program. Whether you're evaluating new platforms, exploring emerging technologies, or looking for practical solutions you can implement right away, the Solutions Expo is your chance to connect directly with the experts behind today’s most impactful security innovations.
In this presentation: Jean-Francois Maes will take you on a journey of how LLMs work, why you are likely using it wrong if you're using it like Google search and how to implement patterns to get better results both in daily conversation as well as vibe coding.
The 2026 Cybersecurity Toolkit Refresh brings a major set of free, practical updates to two widely adopted resources in the community: the SANS Policy Templates and the Cybersecurity Risk Foundation (CRF) frameworks.
This session focuses on what’s new in the spring 2026 releases—updated SANS policies, refreshed CRF safeguards, expanded threat and governance models, and new supporting tools designed to help teams mature faster without adding complexity. Whether you're already using these resources or discovering them for the first time, the emphasis is simple: everything discussed in this talk is freely available, ready to download, and put into practice as soon as you get home from this event.
A relaxed evening reception designed to bring together OnDemand students, SANS instructors, course authors, and staff—for real conversation, shared stories, and new professional connections. It's where solo study becomes shared community.
Enjoy light bites, drinks, and open access to:
We can't wait to welcome you to SANS Unplugged.
In an era of rapid digital transformation like the use of AI and quantum computing, cybersecurity and risk has become a critical concern for organizations worldwide. As cyber threats grow in complexity and sophistication, leaders must not only stay informed about emerging trends but also proactively manage risks and influence organizational culture to build resilience.
Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About Core NetWars: The most comprehensive of the NetWars ranges, this ultimate multi-disciplinary cyber range powers up the most diverse cyber skills. This range is ideal for advancing your cybersecurity prowess in today's dynamic threat landscape. The winning team and the top five solo players from every Core NetWars tournament throughout the year are offered a chance to compete in the annual SANS Core NetWars Tournament of Champions.
Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About ICS NetWars: Focused on factory machinery operations, this experience brings players onto the factory floor, exposing them to the challenges of detecting and defending physical equipment and manufacturing components from cyberattacks.
Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About Core NetWars: The most comprehensive of the NetWars ranges, this ultimate multi-disciplinary cyber range powers up the most diverse cyber skills. This range is ideal for advancing your cybersecurity prowess in today's dynamic threat landscape. The winning team and the top five solo players from every Core NetWars tournament throughout the year are offered a chance to compete in the annual SANS Core NetWars Tournament of Champions.
Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About ICS NetWars: Focused on factory machinery operations, this experience brings players onto the factory floor, exposing them to the challenges of detecting and defending physical equipment and manufacturing components from cyberattacks.