SANS Cyber Threat Intelligence Summit 2027

A high-level summit focused on cyber threat intelligence, incident response, and advanced security operations, organized by the SANS Institute.

SANS Cyber Threat Intelligence Summit 2027

SANS Cyber Threat Intelligence Summit 2027 runs 1–2 February 2027 at The Westin Alexandria Old Town, Alexandria, Virginia.

What it is

The SANS Cyber Threat Intelligence Summit & Training is organised by the SANS Institute and is, in SANS's words, "devoted solely to the tradecraft of cyber threat analysis and intelligence". 2027 is its 15th annual meeting. It has two parts:

• the Summit, 1–2 February, in person only;
• Training, 3–8 February, in person at the same hotel or live online.

Who it's for

Threat intelligence analysts and the incident responders, threat hunters and security operations staff who use their work. The talks are practitioner-led; the call for presentations was open to first-time speakers.

The Summit

Two days of technical talks and keynotes on current CTI research, tools, case studies and techniques, plus hands-on workshops on CTI tooling and tradecraft. Talks run as 25-minute sessions and 10-minute lightning talks, and workshops as 90–120-minute sessions. The schedule also carries bonus sessions, an exhibit hall and a Summit Social evening reception.

NetWars

DFIR NetWars runs in the evenings, in person and virtually: a tournament covering digital forensics, incident response, threat hunting and malware analysis. Students on four- to six-day courses can play at no extra charge.

Training

Ten SANS courses run during the training days, most of them six days and each tied to a GIAC certification:

• FOR578 Cyber Threat Intelligence, and the two-day FOR478 Cyber Threat Intelligence Foundations (online);
• FOR508 Advanced Incident Response, Threat Hunting, and Digital Forensics;
• FOR500 Windows Forensic Analysis;
• FOR572 Advanced Network Forensics;
• FOR577 Linux Incident Response and Threat Hunting;
• FOR608 Enterprise-Class Incident Response & Threat Hunting;
• SEC503 Network Monitoring and Threat Detection In-Depth;
• SEC504 Hacker Tools, Techniques, and Incident Handling;
• SEC511 Cybersecurity Engineering: Advanced Threat Detection and Monitoring.

Summit-only and summit-plus-course registrations are offered; see the SANS event page for current options.