SANS Institute

All of DFIR. One Event.

Digital Forensics | Incident Response | Ransomware | Threat Hunting

The SANS DFIR Summit & Training is back—in a new city, a new season, and with our most in-depth program yet.

This year, the Summit has expanded to tackle today’s most challenging DFIR topics—from core digital forensics and incident response to focused deep dives in threat hunting and ransomware—through expert-led talks, open-source tool sessions, and more hands-on opportunities than ever before.

If staying sharp on the latest research, tools, and investigative tradecraft matters to you, this is where you need to be.

Summit: Oct 15-16 | Training: Oct 17-22

Cloud security is no longer optional—it's a moving target. As organizations accelerate multi-cloud adoption, they face growing complexity, evolving threats, and rising expectations around compliance, visibility, and control.

The 2026 SANS Cloud Security Research Survey brings together insights from security leaders and practitioners worldwide. This year’s study examines the current state of cloud security, highlighting key challenges, top threats, and the tools organizations are using—or wish they had—to secure cloud environments at scale.

Join us for this exclusive webcast to explore the survey findings, gain practical insights, and benchmark your organization’s approach to cloud security.

What You’ll Learn

• Top Cloud Threats in 2026: Credential theft, misconfigurations, ransomware, and more
• Tool Adoption Trends: CNAPP, SSE, IAM—who's using what, and how well it's working
• DevSecOps Integration: How teams are embedding security earlier in the cloud development cycle
• Compliance & Governance: Strategies to keep up with expanding regulatory demands
• AI in Cloud Security: Emerging use cases and buyer sentiment around AI-driven tools
• Gaps & Opportunities: What the industry still lacks—and where investment is headed next
  

Why Register? By registering, you’ll gain:

• Actionable benchmarks to measure your organization against industry peers.
• Practical strategies you can take back to your team immediately.
• 3 CPE credits for attending.
• Access to attend both live or the recorded session on your own time.
• Exclusive access to the full 2026 Cloud Survey Insights report

This partnership between SANS and RBC reflects a mutual commitment to investing in the expansion of Canada's cybersecurity workforce.

Before the competition begins, join SANS and RBC for a live orientation session. This is your chance to learn what to expect from Cyber Quest CTF and have your questions answered before you start the clock. By registering for this webinar, you will receive a prompt in your SANS account dashboard to register separately for the Cyber Quest CTF on the Ranges.io platform. Please use the same school-issued email address when registering on Ranges.io. 

Automation promised to free security teams from the alert treadmill, but for many organizations, it created a new one. Join Dave Shackleford, SANS Instructor, on November 4, 2026 at 10:30 AM EST where he will share survey data from practitioners across industries on what the transition from automation to genuine agency actually looks like in 2026.

Specifically, he will speak to how agentic threats are landing on the radar, the barriers stalling SOC autonomy, and how teams are weighing the tradeoffs of letting AI act independently in production environments. Beyond the technology questions, the data also dives into how organizations plan to reshape their teams as AI absorbs some of the work that currently fills an analyst's day.

As industrial environments become more connected and threats more advanced, the challenge of securing ICS and OT systems grows more urgent. How are asset owners responding—and where are the biggest gaps?

Join us to discuss insights from SANS 9th annual State of ICS/OT Security Survey. This trusted industry research captures how organizations across sectors are evolving their industrial cybersecurity strategies in response to regulatory pressures, emerging threats, and operational demands.

Building on key findings from 2025—like improvements in incident response and IT-OT alignment—this year’s survey dives deeper into visibility across the ICS cyber kill chain, the growing role of cyber-informed engineering (CIE), and the need for resilience-focused security controls.

Whether you manage industrial assets, influence cyber strategy, or lead incident response, this session delivers the benchmarks and insights you need to make informed decisions in 2026 and beyond.

What You’ll Learn

• How organizations are improving visibility across the ICS Cyber Kill Chain to detect and respond to threats earlier
• What cyber-informed engineering (CIE) looks like in practice—and how it’s being used to bridge safety, reliability, and cybersecurity
• Where key gaps and dependencies exist in OT-specific security controls and architectures
• How to maximize the ROI of cybersecurity investments in industrial settings
• Which areas saw progress in 2025, including response times, visibility, and IT-OT collaboration—and where critical misalignments remain how standards, regulations, and threat intelligence are shaping ICS/OT cyber programs moving forward
• Real-world safety and reliability impacts of modern ICS threats—and what your peers are doing to mitigate them
  

Why Register? By registering, you’ll gain:

• Actionable benchmarks to measure your organization against industry peers.
• Practical strategies you can take back to your team immediately.
• 3 CPE credits for attending.
• Access to attend both live or the recorded session on your own time.
• Exclusive first access to the full 2026 ICS/OT Survey Insights report

SANS Fall Cyber Solutions Fest 2026: Emerging Technologies Track explores the cutting edge of security innovation as organizations race to secure increasingly complex digital ecosystems. This track highlights breakthrough capabilities in AI-driven defense, autonomous security operations, quantum-resilient architectures, next-gen cloud and CNAPP frameworks, and advanced identity protection. Attendees will gain deep insights into how emerging tools, platforms, and methodologies are reshaping modern security strategies and accelerating detection, response, and resilience.

Designed for practitioners, leaders, and technology evaluators, this track delivers practical, vendor-agnostic guidance from top SANS experts and real-world case studies from the front lines. Sessions will showcase how emerging technologies can be operationalized at scale, reduce analyst workload, improve visibility across hybrid environments, and help organizations prepare for the next wave of threats. Join us to understand what’s coming, what matters, and how to build a future-ready security posture.

Why Register

• See what’s next first—gain early insight into the technologies shaping security in 2026 and beyond.
• Hear from top SANS and industry experts delivering practical, unbiased guidance you can apply immediately.
• Evaluate emerging solutions with real-world case studies that separate hype from reality.
• Strengthen your strategy with actionable frameworks for adopting AI, autonomous security, quantum-resilient design, and more.

The SANS Fall Cyber Solutions Fest 2026: Identity Security and Zero Trust Track delivers a deep technical examination of identity as the modern attack surface. As adversaries exploit misconfigured IdPs, weak federation trust, poisoned authentication flows, and over-permissioned service principals, this track analyzes the mechanics of identity compromise across multiple attack surfaces, and hybrid environments. Sessions will dissect novel identity threat vectors, including token replay and manipulation, MFA fatigue attacks, conditional access bypass techniques, and identity infrastructure persistence. Practitioners will gain prescriptive guidance on securing authentication pipelines, hardening federation architectures, and monitoring high-risk identity events with advanced telemetry.

Anchored in Zero Trust architecture, the track focuses on continuous policy enforcement, adaptive authentication, micro-segmentation, and automated privilege reduction across distributed systems. Experts will present reference architectures and implementation patterns for identity-centric Zero Trust deployments, covering identity threat detection and response (ITDR), identity-driven segmentation, policy decision point/orchestration design, and integration of identity context into SIEM, XDR, and SOAR workflows. Attendees will leave with actionable techniques for securing machine identities, enforcing least privilege at scale, validating trust signals in real time, and operationalizing Zero Trust across multi-cloud and SaaS ecosystems.

The SANS Fall Cyber Solutions Fest 2026 SOC Track brings together frontline defenders, analysts, engineers, and SOC leaders to dissect the evolving threat landscape and the technologies reshaping modern security operations. With adversaries advancing faster than ever, this track delivers deep technical sessions focused on detection engineering, advanced analytics, automation, AI-enhanced triage, and next-generation SOC architectures designed for hybrid and cloud-native environments. Attendees will learn practical methods to reduce alert fatigue, enhance threat visibility, and accelerate response—rooted in real-world case studies from industry experts.

Through hands-on demonstrations, expert-driven briefings, and collaborative discussions, participants will explore tools, frameworks, and operational best practices that drive measurable SOC maturity. Whether your team is improving existing workflows or architecting a future-state SOC, this track equips security professionals with actionable strategies to operationalize intelligence, leverage automation responsibly, and build a resilient, adaptive detection and response capability. Join us to strengthen your SOC’s effectiveness and prepare for the challenges of tomorrow’s cyber landscape.

Who Should Attend:

• SOC analysts, detection engineers, incident responders, and threat hunters seeking practical, real-world techniques to elevate their operational capabilities.
• SOC managers, CISOs, and security leaders focused on maturing their SOC programs, optimizing workflows, and integrating automation and AI.
• Organizations evaluating next-generation SOC tools, architectures, and strategies to strengthen resilience and accelerate threat detection and response.

The SANS Fall Cyber Solutions Fest 2026 AI Track explores how artificial intelligence is transforming cybersecurity—from accelerating threat detection and response to reshaping automation, analytics, and SOC workflows. This track brings together experts who will demystify AI’s real-world security applications, address emerging risks like model manipulation and data poisoning, and showcase how defenders can responsibly integrate AI to amplify decision-making, scale operations, and strengthen resilience against advanced threats.

What to Expect:

• Deep-dive sessions on practical AI use cases for detection engineering, triage automation, threat hunting, and response orchestration.
• Live demonstrations of AI-powered tools, workflows, and models used by today’s top-performing SOC and SecOps teams.
• Guidance on mitigating AI-related risks, including adversarial attacks, hallucinations, model governance, and secure data pipelines.
• Insights into how AI augments—not replaces—human analysts to improve speed, accuracy, and operational efficiency.
• Forward-looking discussions on the future of AI in cybersecurity, including emerging trends, architecture considerations, and organizational readiness.

The SANS Fall Cyber Solutions Fest 2026 Threat Intelligence Track explores how organizations can transform raw data into operational insight that drives faster, more precise decision-making across the enterprise. This track examines cutting-edge TI methodologies, automation strategies, adversary profiling, AI-assisted analysis, and how to integrate intelligence into SOC, IR, and executive workflows. Attendees will gain actionable techniques to enhance visibility, predict attacker behavior, and strengthen resilience against emerging threats.

What to Expect

• Practical demonstrations of modern threat intelligence tooling, automation pipelines, and AI-driven enrichment workflows.
• Expert-led sessions on adversary tracking, campaign analysis, and converting strategic, operational, and tactical intelligence into measurable security outcomes.
• Real-world case studies showing successful TI program design, stakeholder alignment, and integration into detection engineering and incident response.

Who Should Attend

• Threat intelligence analysts, CTI program leads, and cyber analysts advancing their intelligence capabilities.
• SOC and IR professionals looking to operationalize TI to improve detection accuracy and response agility.
• Security architects and engineers integrating intelligence feeds, enrichment, and automation into broader security ecosystems.
• CISOs and security leaders evaluating how TI can inform risk decisions, resource prioritization, and strategic planning.

The threat landscape isn’t slowing down—and neither are defenders. The 2026 SANS Detection & Response Survey provides a data-driven look at how security teams are evolving their detection, triage, and response strategies in an environment shaped by AI-driven threats, ransomware, supply chain attacks, and cloud complexity.

Now in its third year, this independent, vendor-neutral survey captures both a snapshot and a trendline—offering critical insights into what’s working, what’s lagging, and where the industry is heading.

Join us as we break down the results and uncover how real-world teams are cutting through noise to focus on signals that matter.

What You'll Learn

• The State of Detection and Response: Current practices, emerging trends, and persistent gaps
• AI and Automation: Real impact vs. hype in triage, investigation, and response workflows
• Cloud Detection: How teams are adapting to increasingly complex cloud environments
• Tackling Threats: How organizations are responding to ransomware, supply chain compromise, and advanced attacks
• Proactive Capabilities: Where threat hunting, deception, and intelligence sharing fit in today’s lifecycle
• Peer Benchmarks: How your program compares—what’s maturing, what’s stalling, and what’s next
  

Why Register? By registering, you’ll gain:

• Actionable benchmarks to measure your organization against industry peers.
• Practical strategies you can take back to your team immediately.
• 3 CPE credits for attending.
• Access to attend both live or the recorded session on your own time.
• Exclusive access to the full 2026 Detection & Response Survey Insights report

Security leaders have spent years hearing that employees are the weakest link. SANS and Sidekick partnered on a research project to test that assumption and map how organizations actually experience human-layer risk today:

• Where incidents originate
• How quickly teams detect risky user actions such as a risky click, login, or data paste
• Whether the tools accumulated over the years are reducing risk or adding complexity

The webcast also examines a question every security leader will recognize: whether concern about human-layer risk is translating into budget, board attention, and a change in approach, or settling into an accepted status quo.

The survey also probed the questions reshaping security roadmaps. We’ll be exploring topics such as:

• Is AI mostly making familiar threats faster and more convincing, or is it a fundamentally different kind of risk that calls for a different defense?
• How do practitioners view AI agents that assist users in the moment, and where does governing employee AI use rank against competing priorities?
• What actually moves human-layer risk from a recognized problem to a funded initiative, whether a security incident, a board mandate, regulatory pressure, or a breach at a peer?

Finally, we will also examine what security professionals say would most strengthen their defense of the human layer.

Why Attend CDI 2026:

• Courses are hands-on with lab practice each day, taught by instructors who are frontline experts in the field they teach.​
• Most courses pair with a GIAC certification, a credential that proves capability.​
• Classmates matter as much as the curriculum. You'll train alongside industry peers who are working to solve the same problems you are. Plus, evening keynotes and SANS@Night talks keep the conversation going after class ends. ​
• With four months of OnDemand Extended Access, included with every course purchase, you can revisit modules later once you'reback at work implementing the techniques.
• The event venue, Grand Hyatt Washington,  sits a few blocks from the National Mall, with a direct Metro Center connection underneath.​

AI adoption is accelerating—but are organizations’ security programs keeping pace? As AI becomes embedded across the enterprise, security leaders must not only protect AI systems but also establish the governance, skills, and operational capabilities needed to manage AI risk at scale.

Led by SANS Field CTO Chris Cochran, this virtual event brings together industry experts to explore findings from the 2026 SANS AI Security Maturity Benchmark, built on the SANS AI Security Maturity Model™. Go beyond the data as experts examine where organizations are making meaningful progress, where critical gaps remain, and what separates more mature AI security programs from the rest.

Why Join?

• Benchmark AI security maturity: See how organizations compare across critical AI security capabilities and how maturity varies by industry, size, region, and level of AI adoption.
• Challenge perceived readiness: Explore whether organizations are as mature as they believe they are—and where AI adoption may be outpacing the ability to secure it.
• Understand what drives maturity: Examine the impact of investment, skills, governance, and organizational barriers on AI security progress.
• Hear diverse perspectives: Join Chris Cochran and industry experts for thought leadership and panel discussions on AI-related incidents, operational challenges, and the capabilities proving hardest to put into practice.
• Identify your next move: Gain data-driven insights to evaluate your own program, prioritize improvements, and build a roadmap toward greater AI security maturity.
• Earn 3 CPE credits

Register now to explore the benchmark, hear expert perspectives, and discover what it takes to build a more mature, measurable, and operational AI security program.