SANS Institute

The SANS Government Forum 2026, presented in partnership with Carahsoft, brings together Federal, State and Local cybersecurity leaders to address today’s most pressing security challenges. This forum is designed to help agencies strengthen mission readiness, modernize infrastructure, and improve cyber resilience through expert-led insights and real-world strategies.

Key Focus Areas

• AI and Agentic AI
• Explore how AI-driven and autonomous systems are transforming threat detection, response and decision-making
• Learn how agencies can safely operationalize AI to enhance security outcomes
• Critical Infrastructure: IT/OT
• Address the convergence of IT and operational technology environments
• Gain strategies to defend essential services against ransomware and nation-state threats
• Zero Trust and Identity Security
• Understand identity-first security architectures for hybrid and cloud environments
• Learn how to enforce least privilege and reduce identity-based risk
• Exposure Management: Threat and Attack Surface
• Discover approaches to continuously identify, prioritize and reduce cyber risk
• Improve visibility across expanding attack surfaces and complex ecosystems

Why Attend

• Gain actionable, practitioner-led insights from SANS experts and industry leaders
• Engage in real-world discussions around current government cybersecurity challenges
• Identify proven solutions to accelerate secure adoption of emerging technologies
• Walk away with strategies to defend today’s missions and prepare for evolving threats

Unleash Elite Potential. Transform Your Career.

This is where high-impact training meets high-value connections. Learn alongside peers who are driven to lead, and take advantage of in-person extras like expert-led workshops, intimate networking receptions, and interactive problem-solving sessions. The energy is contagious—and the opportunity, unmatched. 

Innovative Courses, Industry-Leading Instructors

Whether you're refining your cybersecurity skill set or exploring cutting-edge solutions, you'll find the right course here. Explore tracks on:

• Cybersecurity Tactics & Strategy
• Advanced Control Implementation
• Building a Secure Organizational Mindset
• Translating Policy Into Practice
  …and more.

This is more than an event—it’s a deep dive into a supportive, distraction-free space built for growth and collaboration.

This event creates an intimate, community-focused atmosphere allowing you to focus on learning in a distraction-free setting with your like-minded industry peers. Enjoy bonus after-class extras like hands-on workshops, and networking sessions that extend value far beyond the classroom.

Your evolution begins here. Join SANS and transform your future.

Elevate Your Skills. Redefine the Cyber Game.

Dive into an immersive cyber security training experience at SANS New York 2026. Led by world-renowned instructors boasting extensive industry experience, this event offers live access to top experts in the field.

SANS New York 2026 is equipped with industry-leading hands-on labs, simulations, and exercises that you can immediately apply upon your return to work.

Innovative Courses, Industry-Leading Instructors

Choose from our menu of courses tailored for cybersecurity-seeking practitioners, from foundational skills to cutting-edge innovations, that dive deep into topics like:

• Hacker Tools, Techniques, and Incident Handling
• Security Leadership Essentials for Managers
• Cloud Penetration Testing
• ICS Visibility, Detection, and Response
  and many more!

This event creates an intimate, community-focused atmosphere allowing you to focus on learning in a distraction-free setting with your like-minded industry peers. Enjoy bonus after-class extras like hands-on workshops, and networking sessions that extend value far beyond the classroom.

Your evolution begins here. Join SANS and transform your future.

Join the 5th annual SANS Cloud Security Exchange on August 17—a one-of-a-kind virtual event where cloud and cybersecurity experts from SANS Institute, Amazon Web Services, Google Cloud, and Microsoft will come together live, in person on the same stage, sharing thought leadership and technical insights. Registrants can watch the event virtually from anywhere, experiencing world-class presentations, live Q&A, and actionable strategies from the leaders shaping today’s cloud security landscape.

This rare collaboration offers a full day of deep dives into cloud security, the benefits and challenges of AI, and practical guidance for securing modern environments. If you work with cloud platforms or are responsible for protecting them, this free, one-day virtual event is designed to equip you with the knowledge and strategies you need.

Expect world-class technical presentations, live Q&A with industry experts, and actionable guidance on securing modern environments—including multi-cloud architecture, Zero Trust strategies, and AI-driven defense. Participants will also receive a complimentary cloud security eBook with exclusive insights from SANS and the participating cloud providers and can earn CPE credits.

This global online event is completely free and offers a rare opportunity to learn directly from the teams building and securing today’s leading cloud platforms.

What You’ll Learn

• Hear real-world strategies and lessons learned from AWS, Google Cloud, Microsoft, and SANS experts to help you stay ahead of evolving cloud threats and security challenges.

Why Register

• Earn CPE Credits: Receive 4 CPEs to support your professional development.
• Exclusive eBook: Get a complimentary Cloud Security eBook co-authored by SANS, AWS, Google Cloud, and Microsoft.
• Flexible Viewing: Register even if you can’t attend live—all sessions will be available on demand.
• Engage with the Community: Connect with speakers and peers through the SANS Slack community during the event.

Don’t miss this opportunity to learn from the organizations shaping the future of cloud security—all in one place. Register now to secure your spot.

• Course: Live Instructor Training with Hands-on Exercises
• Summit: Talks, Presentations and Workshops
• Summit: Unmatched Networking
• Summit: Evening Reception
• Summit: Access to Exhibit Hall
• Summit: Light Breakfast, Lunch, and Breaks with Snacks and Beverages

Organizations can no longer rely on tool count as a measure of security maturity. As ransomware-as-a-service operators, identity-focused attackers, and supply chain adversaries increasingly target mid-market and resource-constrained organizations, security teams are being asked to defend against enterprise-grade threats without enterprise-scale resources. At the same time, cyber insurance requirements, customer security assessments, and regulatory expectations continue to raise the bar for demonstrable detection and response capabilities.

This webcast explores why the traditional tool-first approach to security operations is failing resource-constrained teams and what modern detection and response programs must do instead. SANS Senior Instructor Rich Greene will examine how organizations can shift from fragmented security tooling toward a telemetry-driven operating model centered on visibility, correlation, automation, and continuous validation. Rather than focusing on individual products, this approach emphasizes the disciplines required to detect and respond to real-world adversary behavior across interconnected environments.

What You Will Learn

• Why ransomware affiliates and supply chain attackers increasingly target resource-constrained organizations
• How security teams can move beyond disconnected tools to achieve meaningful telemetry fusion across endpoint, identity, network, SaaS, and cloud environments
• Why ATT&CK-based detection coverage provides a more effective measure of defensive capability than alert volume or vendor signature counts
• How to implement a practical four-phase operating model built around audit, consolidation, automation, and validation
• What low-regret automation looks like and how organizations can safely pre-authorize response actions for high-confidence threats

Modern detection and response requires more than additional tools—it requires the ability to correlate telemetry, detect adversary behavior, automate appropriate response actions, and continuously validate effectiveness against evolving threats. By understanding how these disciplines work together, security leaders can improve resilience, strengthen operational efficiency, and build a more defensible security program even with limited resources. 

Unlock Your Cybersecurity Potential in Virginia Beach

Join an energizing and focused event that blends deep technical learning with meaningful connections. Whether you're new to cybersecurity or leveling up your expertise, this event gives you face time with top-tier instructors and peers from across the industry. Add hands-on labs, interactive receptions, and bonus networking opportunities, and you have a transformative week that goes far beyond the classroom.

Innovative Courses, Industry-Leading Instructors
Craft your own learning journey from a diverse menu of courses that span everything from cyber essentials to advanced strategy. Explore topics like:

• Security Culture 
• CIS Controls Implementation And Audit Readiness
• Strategic Security Decision-Making
• Policy Frameworks And Team Enablement
  …and many more.

In this focused and welcoming environment, you’ll find real connections, actionable insights, and a chance to truly invest in your career.

Your evolution begins here. Join SANS and transform your future.

Data flows continue to increase in complexity as enterprise architectures continue to change and mature. Data flows have expanded across cloud platforms, on-premises systems, collaboration tools, and increasingly, AI/ML pipelines. Yet the security controls designed to protect it haven’t evolved at the same pace—leading to fragmented data loss prevention (DLP) coverage, increased operational complexity, and growing risk.

Join us on September 10, 2026 at 10:30 AM EDT for a SANS Security Lab featuring Certified SANS Instructor Kevin Garvey and Broadcom’s Security Strategist, Alejandro Loza. Together, they will examine where traditional DLP approaches fall short and explore practical strategies for protecting data across today’s hybrid and AI-driven environments.

Through expert discussion and live demonstration, they’ll break down key challenges facing security teams, including data sprawl, tool fragmentation, and protecting sensitive information at the application layer and within emerging AI workflows.

Attendees will learn how to:

• Evaluate modern approaches to DLP across distributed environments
• Reduce operational overhead while improving visibility
• Address evolving risks in SaaS applications and AI pipelines
• Communicate data protection priorities effectively to stakeholders

The session will include brief; illustrative examples of how these concepts can be applied in practice.

Sensitive data is already flowing into AI systems across your organization—often without security teams knowing what data is being shared, where it's going, or how it's being used.

Employees are adopting AI tools at an unprecedented pace, while AI copilots, embedded AI features, and autonomous systems are gaining access to business data in ways that traditional security controls were never designed to monitor. From intellectual property and source code to customer and regulated data, organizations are facing new challenges in maintaining visibility and control.

In this webinar, we'll explore where AI is creating new data exposure risks, how shadow AI is expanding the attack surface, and what security teams can do to identify, monitor, and reduce AI-related risk across the enterprise.

You'll gain practical guidance for improving visibility into AI-driven data activity, evaluating AI-enabled applications and vendors, and implementing controls that support AI adoption without sacrificing security.

What You'll Learn

• Where AI tools, copilots, and agents are creating new security blind spots
• How shadow AI is expanding the enterprise attack surface
• Why visibility into AI-driven data access is becoming critical
• How to reduce sensitive data exposure across AI systems and workflows
• What security teams should evaluate in AI vendors, platforms, and embedded AI capabilities
• Practical approaches for balancing AI innovation with security and governance requirements

Threat hunting is no longer just a niche skill—it’s a critical pillar of modern defense. Now in its second decade, the 2026 SANS Threat Hunting Survey delivers a comprehensive, vendor-neutral look at how organizations around the world are adapting their hunting strategies to match the speed, complexity, and stealth of today’s threats. This year’s report explores the maturation of threat hunting in the face of faster, stealthier adversaries. From credential abuse and malware-free intrusions to the hunt for lateral movement in cloud environments, defenders are evolving—and this survey shows how. Join us for an exclusive look at the key findings from the latest research, and discover how threat hunters are staying proactive, practical, and one step ahead.

What You’ll Learn

• Top Threats: How teams are detecting malware-free intrusions, credential abuse, and lateral movement 
• Cloud Hunting: Progress and pain points in multi-cloud environments 
• AI in Hunting: Where AI helps, where it doesn’t, and what’s actually working 
• Hunt Maturity: Benchmarks on tools, training, and metrics 
• Lessons Learned: What works, what doesn’t, and how to stay ahead 

Why Register? By registering, you’ll gain:

• Actionable benchmarks to measure your organization against industry peers. 
• Practical strategies you can take back to your team immediately. 
• 3 CPE credits for attending. 
• Access to attend both live or the recorded session on your own time. 
• Exclusive access to the full 2026 Threat Hunting Survey Insights report

Elevate your cybersecurity skillset at SANS Network Security 2026! Dive into an exhilarating week of intensive, top-tier training designed to sharpen your skills, whether you're just starting out or advancing your expertise. Engage directly with leading minds in the field through hands-on labs and real-world techniques, and gain insights that only face-to-face interactions can offer.

Connect with SANS faculty, participate in workshops exclusively offered in-person, and join a community of peers who are just as passionate as you are. From networking events to community-building activities, you’ll enjoy all-access, in-person only benefits that foster memorable and lasting connections.

This talk begins with a brief examination of recent breach data and the growing ecosystem of attacker tooling available through Dark Web marketplaces and Telegram channels, highlighting where OSINT and cyber threat intelligence teams should focus their monitoring efforts. We will then explore why multi-factor authentication (MFA) bypass attacks continue to succeed despite widespread adoption, examining both the technical and operational factors that make these attacks so effective.

The majority of the presentation will focus on Artificial Intelligence (AI) and its rapidly expanding role in modern offensive security. We will analyze how attackers are leveraging AI to dramatically increase the speed, scale, and sophistication of attacks, while also examining AI systems themselves as an emerging attack surface.

The session will demonstrate how AI can be applied as both a SAST and DAST capability for discovering and exploiting zero-day vulnerabilities in web applications, as well as its growing role in binary exploitation. Offensive innovation has historically outpaced defensive adaptation, and the adoption of AI is accelerating this imbalance. This talk provides practical insight into how the threat landscape is evolving and what security professionals must understand to keep pace.

If your next step is capability-building, SEC543: AI-Assisted Source Code Analysis and Exploitation for Penetration Testers teaches you how to map codebases faster, find what scanners miss, and generate validated exploit tooling with AI assistance.

Threat hunting is no longer just a niche skill—it’s a critical pillar of modern defense. Now in its second decade, the 2026 SANS Threat Hunting Survey delivers a comprehensive, vendor-neutral look at how organizations around the world are adapting their hunting strategies to match the speed, complexity, and stealth of today’s threats. This year’s report explores the maturation of threat hunting in the face of faster, stealthier adversaries. From credential abuse and malware-free intrusions to the hunt for lateral movement in cloud environments, defenders are evolving—and this survey shows how. Join us for an exclusive look at the key findings from the latest research, and discover how threat hunters are staying proactive, practical, and one step ahead.

What You’ll Learn

• Top Threats: How teams are detecting malware-free intrusions, credential abuse, and lateral movement
• Cloud Hunting: Progress and pain points in multi-cloud environments
• AI in Hunting: Where AI helps, where it doesn’t, and what’s actually working
• Hunt Maturity: Benchmarks on tools, training, and metrics
• Lessons Learned: What works, what doesn’t, and how to stay ahead

Why Register? By registering, you’ll gain:

• Actionable benchmarks to measure your organization against industry peers.
• Practical strategies you can take back to your team immediately.
• 3 CPE credits for attending.
• Access to attend both live or the recorded session on your own time.
• Exclusive access to the full 2026 Threat Hunting Survey Insights report