One More Day for OnDemand Cybersecurity Training Special Offer - Your Choice, Learn More


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

ICS Active Defense Primer

  • Monday, June 10, 2019 at 2:00 PM EDT (2019-06-10 18:00:00 UTC)
  • Kai Thomsen

You can now attend the webcast using your mobile device!



As targeted threats against ICS environments are becoming more prevalent it has become more important than ever for organizations and companies responsible for critical infrastructure to increase their defensive posture.

In this Webcast Kai Thomsen will give a short introduction into the four different concepts that make up active defense

- Threat Intelligence

- Asset Identification and Network Security Monitoring

- Incident Response

- Threat and Environment Manipulation

and how they can be applied in ICS environments.

Speaker Bio

Kai Thomsen

Kai has been working in various IT Security roles for more than 15 years. Currently he is the DFIR lead at the premium automaker AUDI AG. Kai also designs and runs Red Team exercises at Audi that integrate IT, business, and physical aspects.

Before Audi he worked for more than 12 years at the engineering company SMS Group where he designed and implemented defensible LANs as well as running DFIR in traditional IT and ICS environments.

Kai holds an MA in Computer Science and English and American Literature.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.