Training
Featured CourseView All Courses
Get a free hour of SANS training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
Cloud Security Training
Can't find what you are looking for?

Let us help.

Contact us
Community Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Solutions for Emerging Risks

Discover tailored resources that translate emerging threats into actionable strategies

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk With an Expert
Talk With an Expert

SANS 2024 Detection and Response Survey

Login to download
SANS 2024 Detection and Response Survey (PDF, 2.05MB)Published: 19 Nov, 2024
Created by
Josh Lemon
Josh Lemon

Our 2024 Detection & Response Survey delved into how organizations address critical aspects of detection, response, and the integration of these vital functions within organizations. In this white paper, SANS Certified Instructor Josh Lemon provides insights into the prevalence of organizations maintaining separate detection and response teams, and how that affects their organizations’ overall security posture. 

Meet the expert

Josh Lemon
Josh Lemon

Josh Lemon

Principal Instructor

Josh leads global MDR at Uptycs, defending major international brands, while also serving as an independent DFIR expert advising legal, government, and commercial clients in Australia.

Read more about Josh Lemon

Additional resources

Trust But Verify: Evaluating the Accuracy of LLMs in Normalizing Threat Data Feeds

WhitepaperArtificial Intelligence
  • 16 Jul 2025

Do AI Coding Assistants Make Bad Coders Worse? A Security Evaluation of GitHub Copilot

WhitepaperArtificial Intelligence
  • 11 Jul 2025

Prioritized Industrial Cyber Defense in Oil and Gas

WhitepaperIndustrial Control Systems Security
  • 13 Jun 2025
  • Dean Parsons

Be a DLP Hero: How to Quickly Deliver Value from Your DLP Program and Set It Up for Future Success

WhitepaperSecurity Awareness
  • 3 Jun 2025
  • Kevin Garvey

Resiliency and Business Continuity in the Cloud Era

WhitepaperCloud Security, Security Awareness
  • 21 May 2025
  • Dave Shackleford

SANS 2025 CTI Survey Webcast & Forum: Navigating Uncertainty in Today’s Threat Landscape

WhitepaperDigital Forensics and Incident Response, Security Awareness, Cybersecurity and IT Essentials
  • 20 May 2025
  • Rebekah Brown, Andreas Sfakianakis

Related courses

  • Slide 1 of 7

    ICS515: ICS Visibility, Detection, and Response

    Intermediate
    ICS515Industrial Control Systems Security
    ICS515: ICS Visibility, Detection, and Response
    • GIAC Response and Industrial Defense (GRID)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 25 Hours of hands-on instruction

    View course detailsRegister
  • Slide 2 of 7

    ICS418: ICS Security Essentials for Leaders

    Essentials
    ICS418Industrial Control Systems Security
    ICS418: ICS Security Essentials for Leaders
    • 12 CPEs / 12 Hours (Self-Paced)
    • Labs: 12 Hours of hands-on instruction

    View course detailsRegister
  • Slide 3 of 7

    ICS613: ICS/OT Penetration Testing & Assessments

    betaAdvanced
    ICS613Industrial Control Systems Security
    ICS613: ICS/OT Penetration Testing & Assessments
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 27 Hours of hands-on instruction

    View course detailsRegister
  • Slide 4 of 7

    ICS456: Essentials for NERC Critical Infrastructure Protection

    Essentials
    ICS456Industrial Control Systems Security
    ICS456: Essentials for NERC Critical Infrastructure Protection
    • GIAC Critical Infrastructure Protection (GCIP)
    • 5 Days (Instructor-Led)
    • 31 CPEs / 31 Hours (Self-Paced)
    • Labs: 23 Hours of hands-on instruction

    View course detailsRegister
  • Slide 5 of 7

    ICS310: ICS Cybersecurity Foundations

    newBeginner
    ICS310Industrial Control Systems Security
    ICS310: ICS Cybersecurity Foundations
    • 6 CPEs / 6 Hours (Self-Paced)
    • Labs: 3 Hours of hands-on instruction

    View course detailsRegister
  • Slide 6 of 7

    ICS410: ICS/SCADA Security Essentials

    Essentials
    ICS410Industrial Control Systems Security
    ICS410: ICS/SCADA Security Essentials
    • GIAC Global Industrial Cyber Security Professional (GICSP)
    • 6 Days (Instructor-Led)
    • 36 CPEs / 36 Hours (Self-Paced)
    • Labs: 15 Hours of hands-on instruction

    View course detailsRegister
  • Slide 7 of 7

    ICS612: ICS Cybersecurity In-Depth

    Advanced
    ICS612Industrial Control Systems Security
    ICS612: ICS Cybersecurity In-Depth
    • 5 Days (Instructor-Led)
    • 30 CPEs / 30 Hours (Self-Paced)
    • Labs: 25 Hours of hands-on instruction

    View course detailsRegister