SANS Cyber Defense Initiative 2026 — 41 hands-on cybersecurity courses, GIAC certifications, and a NetWars tournament, Dec 14–19 in Washington, D.C. and live online.
SANS Cyber Defense Initiative 2026 (CDI 2026) is one of the largest year-end cybersecurity training events on the calendar. From December 14–19, 2026, the SANS Institute brings 41 hands-on courses, a NetWars tournament, keynote sessions, and SANS@Night talks to the Grand Hyatt Washington — with a live-online option for remote participants.
What It Is
CDI is a six-day training intensive built around the SANS course catalog. Rather than a traditional conference, it pairs four-to-six-day instructor-led courses with conference-style evening programming — so a team can send people across different roles and have each of them find a relevant course the same week, from a first security certification through malware reverse engineering and ICS incident response.
Dates, Venue & Format
- Dates: Monday, December 14 – Saturday, December 19, 2026 (ET)
- Venue: Grand Hyatt Washington, 1000 H Street NW, Washington D.C. 20001 — a few blocks from the National Mall, with a direct Metro Center connection underneath
- Format: In-person and live online (ET)
- Evening keynotes & talks: December 17–18, 6:30–9:30 PM
Topics & Courses
The 41-course lineup spans defensive operations, digital forensics and incident response, threat intelligence, security leadership, cloud security, industrial control systems, and offensive disciplines. Course highlights include:
- FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics (GCFA)
- FOR578: Cyber Threat Intelligence (GCTI)
- FOR610: Reverse-Engineering Malware — Malware Analysis Tools and Techniques (GREM)
- SEC401: Security Essentials (GSEC) and SEC301: Introduction to Cyber Security (GISF)
- SEC450: Blue Team Fundamentals — Security Operations and Analysis
- SEC599: Defeating Advanced Adversaries — Purple Team Tactics & Kill Chain Defenses (GDAT)
- SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking
- ICS410: ICS/SCADA Security Essentials (GICSP) and ICS515: ICS Active Defense and Incident Response (GRID)
- SEC545: GenAI and LLM Application Security
- MGT512: Security Leadership Essentials for Managers (GSLC)
Benefits: GIAC Certifications
Most CDI courses pair with a GIAC certification — an ANSI-accredited (ISO/IEC 17024) credential that auditors, insurers, and contracting officers accept as evidence of capability. In-person attendees also get keynote access and a Core NetWars tournament free with any 4-to-6-day course, plus four months of OnDemand Extended Access included with every course purchase. A limited-time $2,000 package (120 days of OnDemand access + a GIAC certification attempt with two practice tests) is included for registrations completed between September 4 and November 15, 2026.
Who Should Attend
Cybersecurity practitioners at every level: SOC analysts, incident responders, threat hunters, digital forensic examiners, penetration testers, ICS/OT engineers, and security leaders. December timing lets organizations either open Q1 of the federal fiscal year or close out calendar-year training budgets, with government per-diem rooms available at the venue.
Registration & Practical Details
- Register: on the official event page (standalone registration for keynotes, workshops, and NetWars is also available for those not attending a course)
- Hotel rate: $242.00 S/D plus taxes through November 23, 2026 (subject to availability)
- Refund deadline: November 27, 2026
Official page: sans.org/cyber-security-training-events/cyber-defense-initiative-2026
