SANS ICS Command Briefing 2026: Preparing for What Comes Next in Industrial Cybersecurity

Grounded in current SANS research and frontline operational experience, this one-hour session brings together Tim Conway, Robert M. Lee, Jason D. Christopher, and Dean Parsons to deliver leadership-level guidance for practitioners and executives. They will discuss what to prioritize for the year ahead, how to prepare without disrupting operations, and how to build programs that detect fast and restore right.

They will discuss:

• Securing ICS-aware remote access at scale — Enforcing approved, recorded sessions through controlled gateways (jump host or access broker) with device and user verification, including vendor access and assurance.
• Extending visibility to controllers and remote sites — Identifying what and where to monitor with detections that provide meaningful insights without overwhelming operations.
• Restoring to a safe operating state — Maintaining known-good device configurations and firmware images, practicing full device restores with field technicians, and defining safe-state transitions to reduce recovery time
• Using current threat information to improve defenses — Selecting the most relevant adversary behaviors, updating detection rules and network segmentation, verifying changes on real equipment, and measuring how quickly improvements are deployed.
• Leading with priorities, governance, and clear ownership — Including field technicians and contractors in exercises, and translating regulatory requirements into daily practices (access evidence, logging, change control) that strengthen reliability and speed investigations.