SEC536: Adversarial AI - Penetration Testing AI Systems



Megan is a Senior Security Engineer at Datadog, SANS DFIR faculty, and co-author of FOR509. She holds two master’s degrees, serves as CFO of Mental Health Hackers, and is a strong advocate for hands-on cloud forensics training and mental wellness.
Virtual
CTI teams invest significant time collecting, analyzing, and producing threat intelligence, yet finished intelligence often fails to drive stakeholder action.
In this session, we'll explore how to close the gap between intelligence production and actionable outcomes by guiding you through different visualizations that help map raw data straight into enterprise capital risk.
You'll learn how to use visualization to strengthen your analysis, match visual formats to different stakeholders and requirements, and communicate complex threat intelligence as clear, actionable intelligence products. We'll also cover tools and AI-assisted workflows for effective GenAI adoption that speeds up everything from link analysis and hypothesis testing to attack flow visualization.
*Sponsored by Feedly
Virtual
Exploit windows are shrinking to hours. Learn how to operationalize threat intelligence at machine speed using verified agentic search, multistep flows, and rich operations data. In a live demo, we’ll showcase how this capability simplifies the entire process from triage to decisive action.
*Sponsored by Google
Virtual
Anonymization infrastructure has fundamentally changed how defenders investigate malicious activity. Residential proxy networks, commercial VPN services, cloud platforms, and autonomous AI agents all produce traffic that can appear legitimate while masking its true origin.
This session examines how threat intelligence teams can combine infrastructure intelligence with behavioral context to identify meaningful patterns, reduce investigative dead ends, and make more confident operational decisions in an increasingly anonymous internet.
*Sponsored by Spur Intelligence
Virtual
Virtual
Infrastructure-based threat hunting has a blind spot: attackers can swap domains and IPs faster than defenders can track them. This webinar shows a different approach.
By clustering malware on behavior instead of infrastructure, we uncovered a global Formbook campaign that used forged bank notices to target finance, maritime and Gulf public-sector organizations. Join us for a step-by-step look at the method and how to apply it in your own investigations.
*Sponsored by VMRay
Virtual
AI is compressing attacks from days into hours, and it can fake a name, a web page or a certificate in seconds. What it can't fake is the traffic: every attack still has to cross the network, and that leaves receipts. NetFlow is the post office's receipt for each delivery: which computers talked to each other, through which door, how much, and when, without ever opening the envelope.
Using one real case in Pure Signal Command, we'll show how to turn those receipts into what actually matters: the relationships between machines, and the attack hiding in them.
*Sponsored by Team Cymru
Virtual
When you’re threat hunting or investigating an alert, how often do you need to go back to OneNote, a wiki, a ticket, or a spreadsheet? Try to remember which of your 100 browser tabs has the thing you’re looking for? Need to ask Dave, but Dave’s at lunch?
In this session, join Threatlock Holmes as we work a case end to end the way a team would, using Pathfindr, the new AI investigation tracker from Dataminr. You’ll see how an investigation persists, captures what you look at, builds its own timeline and relationship graph, and shows the sources behind AI-suggested notes. You’ll leave with two things: a quick test of whether your investigations survive a handoff, and a way to turn each one into knowledge your team keeps.
*Sponsored by Dataminr
Virtual
Virtual
Large language models are fundamentally reshaping the threat landscape, acting simultaneously as an attacker's tool, a high-value target, and a new vector for insider risk. According to SANs, 81% of security professionals express deep concern over AI-powered threats, and traditional detection stacks were never built to catch them. Fortunately, adversaries leave behind an immutable footprint in the global DNS.
Join us for an exclusive session where we reveal how a comprehensive, multi-signal approach that combines global DNS intelligence enriched with web content, X.509 certificates, and IP telemetry, empowers security teams to spot and neutralize LLM-era threats before they strike. Moving beyond reactive incident cleanup, you'll learn how to track attacker infrastructure during the staging phase and shift your strategy to true prevention.
What You'll Learn:
Walk away with actionable detection patterns mapped to MITRE ATT&CK®, powerful pivot workflows, and a practical blueprint for integrating multi-source infrastructure intelligence into your SOC, fraud, and AI-governance programs, all measured in outcomes your board cares about: threats blocked and analyst hours saved.
*Sponsored by Domain Tools
Virtual
*Sponsored by Reversing Labs
Virtual
Impersonation domains targeting financial institutions and their customers appear faster than takedowns can keep up.
This talk demonstrates proactive, internet-scale hunting across new registrations, certificates, visual lures, and kit artifacts to find fraud infrastructure before it is used.
*Sponsored by Censys
Virtual
Virtual
Staying ahead of today’s threat landscape requires more than knowing what attackers are doing. It requires turning that intelligence into action. Matt Moss, Sales Engineer Manager at ESET North America, will explore how global threat research, adversary insights, and AI-assisted analysis can inform stronger detection and faster decision-making. See how those insights can extend into managed detection and response, where human expertise, AI, and continuous monitoring come together to identify and respond to threats, helping organizations strengthen resilience against evolving cyberattacks.
*Sponsored by ESET
Virtual
*Sponsored by Feedly and Google
Virtual
Virtual