Talk With an Expert

Hack & Defend Summit & Training 2025

  • Tue, Oct 28 - Tue, Nov 4, 2025
  • 9 Courses
  • 12 CPEs (Summit Only)
  • 1 Tournament
  • English
Omni Austin Hotel Downtown & Virtual (CT)
700 San Jacinto at 8th Street, Austin, TX 78701
Hack & Defend Summit & Training

Offense Informs Defense. Defense Informs Offense.

Organizations face a critical disconnect between offensive security experts who identify vulnerabilities and defensive teams tasked with protecting systems. The Hack & Defend Summit brings these different security professionals together to learn from each other and build better protection strategies. By working together instead of separately, we can create stronger defenses against real threats.

Join us this October in Austin, TX for practical workshops, presentations from experts, and network with other security professionals. Whether you're interested in finding vulnerabilities, defending systems, or managing security teams, the Hack & Defend Summit will help you learn new skills and protect against cyber-attacks.

Register

Summit and Course Registration

from $8,780 USD
In personIncludes
  • Course: Live Instructor Training with Hands-on Exercises
  • Summit: Talks, Presentations and Workshops
  • Core Netwars Tournament
Live onlineIncludes
  • Course: Virtual Live Instructor Training with Hands-on Exercises
  • Summit: Select Talks and Content
  • Summit: Interactive Chat on Slack

Summit Registration Only

from Free
$645 USD*Prices exclude applicable local taxes
In personIncludes
  • Free Lunch and Snacks
Attend In PersonLogin to register
Free
Live onlineIncludes
  • Interactive Chat on Slack
  • Talks and Sessions
Important Dates
Refund Deadline:
Hotel Group Discount Deadline:

Courses

Looking for Group Purchasing? Contact Us

Showing 9 of 9
Filter by:

SEC503: Network Monitoring and Threat Detection In-Depth

Intermediate
SEC503Cyber Defense
SEC503: Network Monitoring and Threat Detection In-Depth
  • GIAC Certified Intrusion Analyst
  • 6 Days
  • 46 CPEs
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

SEC504: Hacker Tools, Techniques, and Incident Handling

Essentials
SEC504Offensive Operations
SEC504: Hacker Tools, Techniques, and Incident Handling
  • GIAC Certified Incident Handler
  • 6 Days
  • 38 CPEs
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

SEC542: Web App Penetration Testing and Ethical Hacking

Intermediate
SEC542Offensive Operations
SEC542: Web App Penetration Testing and Ethical Hacking
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:Virtual

SEC560: Enterprise Penetration Testing

Intermediate
SEC560Offensive Operations
SEC560: Enterprise Penetration Testing
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring

Intermediate
SEC511Cyber Defense
SEC511: Continuous Monitoring and Security Operations
  • GIAC Continuous Monitoring Certification
  • 6 Days
  • 46 CPEs
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses

Major UpdatesIntermediate
SEC599Offensive Operations
SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses
  • GIAC Defending Advanced Threats
  • 6 Days
  • 36 CPEs
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

Intermediate
SEC530Cyber Defense
SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise
  • GIAC Defensible Security Architecture
  • 6 Days
  • 36 CPEs
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations

Major UpdatesIntermediate
SEC450Cyber Defense
SEC450: Blue Team Fundamentals: Security Operations and Analysis
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

SEC588: Cloud Penetration Testing

Intermediate
SEC588Offensive Operations
SEC588: Cloud Penetration Testing
  • GIAC Cloud Penetration Tester
  • 6 Days
  • 36 CPEs
  • Starts 30 Oct 2025 at 8:30 AM CT
  • $8,780 USD (Course)
  • $999 USD (Certification)
  • *Prices exclude applicable local taxes

View course details
Log in to register:In-PersonVirtual

Advisory Board

Schedule

Summit Dates

Tuesday, 28 October - Wednesday, 29 October

Training Dates

Thursday, 30 October - Tuesday, 4 November

Showing 15 of 35
Filter by:

Welcome and Opening Remarks

Summit Day 108:45AM - 09:00AM CDT
In-Person & Virtual

Keynote | To Be Announced

Summit Day 109:00AM - 09:45AM CDT
In-Person & Virtual

Break

Summit Day 109:45AM - 10:00AM CDT
In-Person & Virtual

Blue Team | High-Fidelity Threat Hunting: Unveiling Insider Threats Beyond the Logs...The Dual-Identity Evasion Technique

Traditionally, security monitoring assumes that SIEM technologies will be accurate and provide a comprehensive picture of network activity, but what happens when we find that the events recorded by these technologies are insufficient, and we don't have the proper telemetry?

Summit Day 110:00AM - 10:35AM CDT
In-Person & Virtual

Red Team Workshop | To Be Announced

Summit Day 110:00AM - 12:00PM CDT
In-Person

Red Team Workshop | To Be Announced

Summit Day 110:00AM - 12:00PM CDT
In-Person

Blue Team | Outside the Debugger: Effective Malware Analysis for Everyday Defenders

The misconception: Malware analysis requires deep assembly knowledge and reversing skills. The reality: Many practical insights can be gained through simple, freely available tools/frameworks. Target audience: Blue teamers who need actionable intel without becoming RE experts.

Summit Day 110:40AM - 11:15AM CDT
In-Person & Virtual

Blue Team | The Hunt for Silent Compromise: Detecting Cloud-Native Persistence Without Malware or Alerts

As attackers evolve beyond malware and implants, defenders must learn to hunt compromise that never triggers an alert.

Summit Day 111:20AM - 11:55AM CDT
In-Person & Virtual

Lunch

Summit Day 112:00PM - 01:30PM CDT
In-Person & Virtual

Red Team | Breaking Entra: Real-World Cloud Identity Attacks You Can Recreate

Identity has become the new perimeter and in Microsoft Entra ID (formerly Azure Active Directory), it's also the easiest one to break. Misconfigured apps, over-scoped permissions, and weak conditional access open the door to attackers who know where to look.

Summit Day 101:30PM - 02:05PM CDT
In-Person & Virtual

Blue Team Workshop | To Be Announced

Summit Day 101:30PM - 03:30PM CDT
In-Person

Blue Team Workshop | To Be Announced

Summit Day 101:30PM - 03:30PM CDT
In-Person

Red Team | The Evolution of Syscalls: A Winding Path to Untraceable Execution

This presentation provides a step-by-step, technical exploration of the evolution of syscalls. It begins with the fundamental role of Win32 & NT Windows APIs in executing syscalls within kernel space.

Summit Day 102:10PM - 02:45PM CDT
In-Person & Virtual

Red Team | To Be Announced

Summit Day 102:50PM - 03:25PM CDT
In-Person & Virtual

Wrap-Up

Summit Day 103:30PM - 04:00PM CDT
In-Person & Virtual

Welcome and Opening Remarks

Summit Day 208:45AM - 09:00AM CDT
In-Person & Virtual

Break

Summit Day 209:00AM - 09:15AM CDT
In-Person & Virtual

Keynote: Red Team | To Be Announced

Summit Day 209:15AM - 10:00AM CDT
In-Person & Virtual

Blue Team Workshop | To Be Announced

Summit Day 209:15AM - 12:30PM CDT

Red Team | Subverting macOS Applications and Security Controls through 0-Day Vulnerabilities

macOS combines a layered security model with a variety of enforcement mechanisms, including consent-based controls, code integrity validation, sandboxing, and runtime protections.

Summit Day 210:00AM - 10:35AM CDT
In-Person & Virtual

Red Team | When Attackers Tune In: Weaponizing LLM Fine-Tuning for Stealthy C2 and Exfiltration

Large Language Models (LLMs) like ChatGPT, Claude and Gemini are increasingly being integrated into enterprise environments for the purposes of automation, analytics, and decision-making.

Summit Day 210:35AM - 11:05AM CDT
In-Person & Virtual

Break

Summit Day 211:05AM - 11:20AM CDT
In-Person & Virtual

Red Team | MEDSHIELD: Proactive Threat Modeling Framework for Connected IoT Care

Adversarial exploitation of medical devices, robotics, and smart hospital systems has emerged as a critical challenge as healthcare environments embrace interconnected, IoT enabled equipment.

Summit Day 211:20AM - 11:55AM CDT
In-Person & Virtual

Red Team | To Be Announced

Summit Day 211:55AM - 12:30PM CDT
In-Person & Virtual

Lunch

Summit Day 212:30PM - 01:30PM CDT
In-Person & Virtual

Keynote: Blue Team | To Be Announced

Summit Day 201:30PM - 02:05PM CDT
In-Person & Virtual

Red Team Workshop | To Be Announced

Summit Day 201:30PM - 04:30PM CDT
In-Person

Blue Team | Ambiguous Techniques: Determining Malice through Context

In the evolving landscape of cybersecurity, defenders face the challenge of distinguishing malicious activities from benign ones, particularly when dealing with ambiguous techniques--those whose observables lack sufficient clarity to determine intent with certainty.

Summit Day 202:05PM - 02:40PM CDT
In-Person & Virtual

Blue Team | Detecting the Undetectable: Post-Exploitation Threats in Kubernetes and Containerized Workloads

Kubernetes and container platforms have transformed deployment speed-but they also obscure post-exploitation activity behind abstraction layers.

Summit Day 202:40PM - 03:15PM CDT
In-Person & Virtual

Break

Summit Day 203:15PM - 03:30PM CDT
In-Person & Virtual

Blue Team | Hidden in Plain Sight: SaaS AI Risks Blue Teams Miss

As enterprise platforms quietly integrate AI features into productivity suites, CRMs, and collaboration tools, Blue Teams are left blind to where data is flowing, what models are learning, and how risk is propagating.

Summit Day 203:30PM - 04:05PM CDT
In-Person & Virtual

Blue Team | From Exploit to Enterprise Risk: Scaling Purple Team Insights to Protect the Mission

Technical findings alone don't drive change-risk-informed insights do. In this talk, we'll explore how red and purple team activities can evolve from isolated exercises into enterprise-level enablers that directly inform mission resilience, operational risk decisions, and business prioritization.

Summit Day 204:05PM - 04:40PM CDT
In-Person & Virtual

Wrap-Up

Summit Day 204:55PM - 05:00PM CDT
In-Person & Virtual

Tournament: Core NetWars

Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.

Training Event (Sunday)06:30PM - 09:30PM CST
In-Person

Tournament: Core NetWars

Registration: All students who register for a 4–6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.

Training Event (Monday)06:30PM - 09:30PM CST
In-Person

Omni Austin Hotel

Hotel Special Rates and Reservations

A special discounted rate of $299.00 S/D plus applicable taxes will be honored based on space availability.

A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID.

All rates include the resort fee for a savings of $22 per day. The resort fee provides deluxe WiFi for unlimited devices, two bottles of water upon arrival (additional upon request), in-room coffee and tea offerings, complimentary local and 1-800 calls, 24/7 access to the fitness center with Peloton bikes, exclusive access to the heated rooftop pool and priority and discounted cabana & daybed rentals (subject to availability), priority reservations at Capital A Restaurant, daily digital edition of The Wall Street Journal, $2 off admission to the Bob Bullock Texas State History Museum, and $5 off a 2-hr rental at the Texas Rowing Center (paddleboard, canoe, kayak).

These items are subject to change.

These rates are only available through Friday, October 3, 2025.

Austin, Skyline

3 Reasons To Stay At The Event Venue

  • Ultimate Convenience

    Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need—from your training to dining and amenities - all in one centralized, convenient location.

  • Seamless Networking Opportunities

    Stay where the action is! Maximize your chances to connect with fellow cybersecurity professionals and industry leaders - from impromptu conversations in the lobby to exclusive after-hours events.

  • All Day, All Event Access

    SANS live training events include bonus sessions exclusively at the venue. Staying on-site ensures you won’t miss these opportunities to grow your network and engage with peers beyond the conference agenda.

People Shaking Hands

More Information