Training
Featured CourseView All Courses

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

SEC595Cyber Defense, Artificial Intelligence
SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
View course detailsRegister
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Contact Sales
Contact Sales

A SANS 2021 Survey: Security Operations Center (SOC)

Download File
A SANS 2021 Survey: Security Operations Center (SOC) (PDF, 2.51MB)Published: 27 Oct, 2021
Created by:
Christopher CrowleyJohn Pescatore
Christopher Crowley & John Pescatore

This year's survey explored the explosion of both remote work and the use of cloud-based systems on critical SOC functions and team operations, as well as shifting budgets

Meet the experts

Christopher Crowley

Christopher Crowley

Senior Instructor

Chris Crowley, SANS Senior Instructor and SOC consultant, combines 25 years of cyber operations leadership and AI expertise to train defenders to detect, analyze, and respond to modern threats with clarity, confidence, and hands-on precision.

Learn more
John Pescatore

John Pescatore

John Pescatore has been the Director of Emerging Security Trends at SANS Institute since 2013. Before that, he worked in computer and network security for organizations like the NSA, U.S. Secret Service, and Gartner, Inc.

Learn more

Additional resources

Cyber Risk Intelligence and Security Posture (CRISP): From Compliance to Threat-Informed Intelligence

WhitepaperCyber Defense
  • 7 Apr 2026

Operationalizing CTEM within the SOC: A Proactive Approach to Threat Detection and Response

WhitepaperCyber Defense
  • 1 Apr 2026

Focused vs Dump-Everything Ingestion for GCP and Kubernetes SIEM Pipelines

WhitepaperCyber Defense
  • 26 Mar 2026

Enhancing Linux Threat Detection: A Sysmon - Based Approach to Identifying Sandworm TTPs

WhitepaperCyber Defense
  • 20 Mar 2026

Open-Source National Security Infrastructure for Sweden’s National Security Apparatus

WhitepaperCyber Defense
  • 18 Mar 2026

Using MITRE ATT&CK® as an Operational Framework: Prioritizing, Testing, and Sustaining Defense

WhitepaperCyber Defense
  • 18 Mar 2026
  • Christopher Crowley

Related courses

  • Slide 1 of 18

    SEC275: Foundations: Computers, Technology, & Security

    Beginner
    SEC275Cyber Defense
    SEC406: Linux Security for InfoSec Professionals
    • GIAC Foundational Cybersecurity Technologies (GFACT)
    • 38 CPEs / 38 Hours (Self-Paced)
    • Labs: 90 Hands-On Labs

    View course detailsRegister
  • Slide 2 of 18

    SEC503: Network Monitoring and Threat Detection In-Depth

    Intermediate
    SEC503Cyber Defense
    SEC503: Network Monitoring and Threat Detection In-Depth
    • GIAC Certified Intrusion Analyst (GCIA)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours (Self-Paced)
    • Labs: 37 Hands-On Labs

    View course detailsRegister
  • Slide 3 of 18

    SEC501: Advanced Security Essentials - Enterprise Defender

    Intermediate
    SEC501Cyber Defense
    SEC501: Advanced Security Essentials - Enterprise Defender
    • GIAC Certified Enterprise Defender (GCED)
    • 6 Days (Instructor-Led)
    • 38 CPEs / 38 Hours (Self-Paced)
    • Labs: 25 Hands-On Labs

    View course detailsRegister
  • Slide 4 of 18

    SEC573: AI-Powered Security Automation: Building Tools with Python, LLMs, and MCP

    MAJOR UPDATES
    AI-FOCUSED
    Advanced
    SEC573Cyber Defense, Artificial Intelligence
    SEC573: Automating Information Security with Python
    • GIAC Python Coder (GPYC)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 128 Hands-On Labs

    View course detailsRegister
  • Slide 5 of 18

    SEC497: Practical Open-Source Intelligence (OSINT)

    Intermediate
    SEC497Cyber Defense
    SEC497: Practical Open-Source Intelligence (OSINT)
    • GIAC Open Source Intelligence (GOSI)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 29 Hands-On Labs

    View course detailsRegister
  • Slide 6 of 18

    SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

    MAJOR UPDATES
    AI SKILLS
    Intermediate
    SEC450Cyber Defense
    SEC450: Blue Team Fundamentals: Security Operations and Analysis
    • GIAC Security Operations Certified (GSOC)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 22 Hands-On Labs

    View course detailsRegister
  • Slide 7 of 18

    SEC401J: Security Essentials - Network, Endpoint, and Cloud (Japanese)

    Essentials
    SEC401JCyber Defense
    SEC401: Security Essentials - Network, Endpoint, and Cloud
    • GIAC Security Essentials (GSEC)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours
    • Labs: 20 Hands-On Labs

    View course detailsRegister
  • Slide 8 of 18

    SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis

    AI SKILLS
    Advanced
    SEC587Cyber Defense
    SEC587
    • GIAC Strategic OSINT Analyst (GSOA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 28 Hands-On Labs

    View course detailsRegister
  • Slide 9 of 18

    SEC411: AI Security Principles and Practices: GenAI and LLM Defense

    NEW
    AI-FOCUSED
    Intermediate
    SEC411Cyber Defense, Artificial Intelligence
    SEC411
    • 18 CPEs / 18 Hours (Self-Paced)
    • Labs: 5 Hands-On Labs

    View course detailsRegister
  • Slide 10 of 18

    SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

    Intermediate
    SEC511Cyber Defense
    SEC511: Continuous Monitoring and Security Operations
    • GIAC Continuous Monitoring Certification (GMON)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours (Self-Paced)
    • Labs: 18 Hands-On Labs

    View course detailsRegister
  • Slide 11 of 18

    SEC555: Detection Engineering and SIEM Analytics

    Intermediate
    SEC555Cyber Defense
    SEC555: SIEM with Tactical Analytics
    • GIAC Certified Detection Analyst (GCDA)
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 18 Hands-On Labs

    View course detailsRegister
  • Slide 12 of 18

    SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG

    AI-FOCUSED
    Essentials
    SEC495Cyber Defense, Artificial Intelligence
    SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG
    • 7 CPEs / 7 Hours (Self-Paced)

    View course detailsRegister
  • Slide 13 of 18

    SEC401: Security Essentials - Network, Endpoint, and Cloud

    Essentials
    SEC401Cyber Defense
    SEC401: Security Essentials - Network, Endpoint, and Cloud
    • GIAC Security Essentials (GSEC)
    • 6 Days (Instructor-Led)
    • 46 CPEs / 46 Hours (Self-Paced)
    • Labs: 20 Hands-On Labs

    View course detailsRegister
  • Slide 14 of 18

    SEC673: Advanced Information Security Automation with Python

    Advanced
    SEC673Cyber Defense
    SEC673: Advanced Information Security Automation with Python
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 27 Hands-On Labs

    View course detailsRegister
  • Slide 15 of 18

    SEC301: Introduction to Cyber Security

    MAJOR UPDATES
    AI SKILLS
    Beginner
    SEC301Cyber Defense
    SEC673: Advanced Information Security Automation with Python
    • GIAC Information Security Fundamentals (GISF)
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 14 Hands-On Labs

    View course detailsRegister
  • Slide 16 of 18

    SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

    Intermediate
    SEC530Cyber Defense
    SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise
    • GIAC Defensible Security Architecture (GDSA)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 24 Hands-On Labs

    View course detailsRegister
  • Slide 17 of 18

    SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

    AI-FOCUSED
    Advanced
    SEC595Cyber Defense, Artificial Intelligence
    SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
    • GIAC Machine Learning Engineer (GMLE)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 30 Hands-On Labs

    View course detailsRegister
  • Slide 18 of 18

    SEC529: Quantum Security Readiness for Executives

    BETA
    Intermediate
    SEC529Cyber Defense
    SEC529: Quantum Security Readiness for Executives
    • 1 Day (Instructor-Led)
    • 6 CPEs / 6 Hours
    • Labs: 3 Hands-On Labs

    View course detailsRegister