SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Virtual
The ransomware threat landscape has fundamentally shifted. Attackers are now leveraging artificial intelligence to generate polymorphic malware that evades traditional detection, accelerates attack timelines, and lowers the barrier to entry for threat actors at every skill level. In this session, we'll examine how AI-crafted ransomware differs from conventional variants, explore the evolving attack chain from initial access to detonation, and identify the early warning signs — from anomalous authentication patterns to suspicious file system activity — that indicate an attack is underway in your environment. The session concludes with a live demonstration of a ransomware attack and a walkthrough of how Netwrix Threat Prevention detects and disrupts the kill chain before encryption begins.
*Sponsored by Netwrix
Virtual
Attackers increasingly “live off the web,” abusing trusted services and standard browser workflows as the delivery surface. Using Fake Captcha at internet scale, this talk provides an internet-wide view of modern lures and why the most familiar pages can hide multiple, distinct delivery paths.
*Sponsored by Censys
Virtual
Virtual
88% of practitioners know that the first days after a new package release are the highest-risk window, but most still don't enforce a cooldown period. This is a critical mistake, because software supply chains have changed what was once an infrequent threat has exploded. Malware advisories in the OSS Vulnerability (OSV) database jumped over 1,267% between late 2023 and 2025, with the vast majority of all advisories ever filed arriving in 2025 alone. And the attack surface is expanding fast: adversaries are now deliberately targeting the emerging AI software supply chain, seeding malicious packages into the tools and ecosystems that AI coding agents consume. The economics have shifted too: attackers can now weaponize a working exploit in hours for less than $5, and with account takeover campaigns like Shai-Hulud hitting npm at scale, they don't even need to write new malware. They hijack trusted maintainer accounts, publish a malicious version of a legitimate package, and let your CI/CD pipeline do the rest. In this session, we'll break down how modern OSS malware campaigns actually work, and why traditional scanners that rely on public disclosures leave organizations exposed for days or weeks after infection. You'll leave with a practical framework for shifting from reactive detection to proactive prevention.
*Sponsored by Endor Labs
Virtual
This SANS First Look exposes a fast-growing ransomware blind spot: the hypervisor. As attackers shift to the virtualization layer—where traditional EDR has no visibility—organizations are facing a new class of high-impact attacks that can cripple entire environments in minutes. Join us to see how Vali Cyber’s ZeroLock brings a preemptive approach to this challenge—stopping ransomware before it takes hold, detecting what others miss, and rapidly restoring operations with minimal disruption.
*Sponsored by Vali Cyber
Virtual
Details coming soon
Virtual
Virtual