SANS Institute

AI is reshaping cybersecurity, but human expertise still matters. A recent New York Times article covered a national cyber defense competition where AI agents and cyber professionals worked side-by-side. Among the participants was SANS Certified Instructor David Cowen, author of FOR509: Enterprise Cloud Forensics and Incident Response. The competition showed that while AI can accelerate operations, experienced practitioners remain critical for guidance and decision-making. → Read the full article: https://lnkd.in/eX9jbRH7 #AI #DFIR #Cybersecurity

52% of U.S. school districts reported a cybersecurity incident in 2025, up from 31% in 2023, according to Clever's Cybersecure 2026 Report. That trajectory reflects what SANS President Ed Skoudis has been arguing for years: schools are treating training as a calendar event when it needs to function as an operational habit. Ed recommends building recurring, role-based training directly into school operations. The format differences matter. What a district administrator needs to understand about a breach response differs from what a classroom teacher needs, which differs from what a student needs. One annual training session cannot cover all three. Administrators: Quarterly tabletop exercises covering ransomware response, business email compromise, and decision-making under pressure. Faculty: Short micro-modules of a few minutes covering cloud document security, phishing recognition, and multifactor authentication. Students: Security reminders embedded into the environments they already use, from login portals to common gathering areas. Nathan Eddy has the full breakdown in EdTech Magazine here: https://lnkd.in/eqr_kVXB

Time to register for the webcast and access to the 2026 SANS Institute SOC Survey! Great information in the report on year-over-year trends, a discussion of the contrast in responses between executives and SOC Staff, and many other highlights discussed in the webcast about the report! Register now! https://lnkd.in/gJ8HKgbX

At this month's National Collegiate Cyber Defense Competition, red teamers deployed AI agents to attack student-defended networks in real time. The bots moved fast, worked in parallel, and never took a lunch break. They also installed malware on their own machines and reported network activity that never happened. David Cowen, SANS instructor and red team member, and his teammate Evan Anderson founder of Offensive Context kept their agents narrowly scoped, verifying outputs and catching missteps before they compounded. Dave was direct about what actually drove the results: the bots are only as good as the people using them. Learn more via Cade Metz in The New York Times here: https://lnkd.in/eX9jbRH7

Bad translation used to filter out lower-sophistication attacks automatically. Cloud environments, SaaS platforms, multilingual orgs: if the phishing email was broken English, most staff caught it. Simon Vernon, Head of R&D in EMEA at SANS, explains why that passive filter is gone. AI gives attackers seamless translation at scale, in any language your workforce uses, across every region you operate in. If you've expanded your cloud footprint into new markets, that expansion now introduces an attack surface your previous threat model didn't account for. If you're responsible for security in a cloud environment, this one's worth your time. Full episode out now: https://go.sans.org/ryYJZv

AI governance frameworks can feel abstract until you pick something concrete to start with. Sounil Yu, Co-Founder and Chief AI Officer of Knostic and SANS Institute AI Cybersecurity Summit speaker, has a specific recommendation for organizations that are not sure where to begin. Start with coding agents. They are already in your environment, they carry significant permissions, and most organizations have not defined what they should and should not be doing. Work through the process of governing them properly and you will have a template for every other class of agent that follows. What are three things your organization is doing right now to improve its AI security posture? Drop them in the comments. #AISummit #AI #AISecurity

The fourth season of the SANS Cyber Leaders Podcast doesn't arrive in a quiet moment. Active conflict. AI-assisted attacks. A CISO role that has quietly become one of the hardest jobs in business. The guests this season are the people responsible for navigating all of it, not advising on it from the sidelines. Swipe through to see who's joining James Lyne and Professor Ciaran Martin this season. Read the full blog, then subscribe and listen 👉 https://go.sans.org/ug28qw #CybersecurityLeadership

Time to register for the webcast and access to the 2026 SANS Institute SOC Survey! Great information in the report on year-over-year trends, a discussion of the contrast in responses between executives and SOC Staff, and many other highlights discussed in the webcast about the report! Register now! https://lnkd.in/gJ8HKgbX

Heather Barnhart, SANS DFIR Curriculum Lead and Head of Faculty, presented at #RSAC and promised to share two frameworks publicly: one mapping safe AI integration points to SWGDE guidelines for Digital Forensics, and one mapped to NIST CSF 2.0 for Incident Response. She built them because the field is divided: practitioners who want nothing to do with AI, and those who fully support it. Grounded in frameworks the field already relies on, graded by risk at every step. Her message to both camps: "AI is your junior analyst. You must train it. You must understand what forensic artifacts are and how to handle incidents before you throw AI into the mix.” What every DFIR professional should know before integrating AI: ➡️ Validation is always human. AI cannot associate an artifact to a person to prove attribution. Legal and evidentiary conclusions require human accountability. AI involvement must be documented at every step. ➡️ Where AI earns its place: identification, triage, artifact parsing, timeline building, and anomaly detection at scale. ➡️ Where it does not: forensic conclusions, attribution, and driving investigative or legal action. Heather will be releasing detailed phase-by-phase documentation with usage examples per case type, alongside contributors Ovie Carroll, Josh H., Taz Wake, David Bianco, and Steve Anson. If you want to contribute, all voices are welcome! #DFIR #DigitalForensics #IncidentResponse #AI