@SANSInstitute

SANS is the most trusted and by far the largest source for information & cyber security training, certification and research in the world.

 Worldwide
sans.org
Joined February 2009
  • Tweets43K
  • Following415
  • Followers195K
16.5KMedia
The way attackers get in has shifted, and credential theft is no longer leading the pack. Phishing and exploited vulnerabilities are closing the gap fast, and most defensive strategies haven’t caught up yet. What’s the #1 way in today?
10%Stolen credentials
49%Phishing
38%Exploited vulnerabilities
3%Other
39 votes • 4 days
2
3
4
1,755
See #SEC665, built for exactly this shift, at #SANSCDI: go.sans.org/usHyyV #SANSLiveTraining
370
The six-step IR process has no instruction for the moment your scope breaks. @joswr1ght rebuilt it. The result is Dynamic Incident Response, a book introducing the Dynamic Approach to Incident Response (DAIR) model. Currently $0 on Kindle: amazon.com/dp/B0HK2V88SX
The image features a book titled "Dynamic Incident Response: A Framework for Security Teams" by Joshua Wright, with an endorsement from SANS. Next to the book is a person smiling, framed in a circular cutout. The text highlights the book’s focus on modern incident response, authored by SANS faculty, and promotes that it's free to download, share, and adapt.

ALT The image features a book titled "Dynamic Incident Response: A Framework for Security Teams" by Joshua Wright, with an endorsement from SANS. Next to the book is a person smiling, framed in a circular cutout. The text highlights the book’s focus on modern incident response, authored by SANS faculty, and promotes that it's free to download, share, and adapt.

3
7
1,067
SANS Institute retweeted
Rob T. Lee
@robtleeOct 20
Come train alongside your security peers at the SANS Institute AI Cybersecurity Summit. Our registrants are from banks, hospitals, utilities, manufacturers, technology companies and government agencies, and we're all back in boot camp! These are people you can learn with, talk through a problem with, and call after the conference. We’ve set aside two afternoons for six hands-on workshops. Pick two: AI incident response: Practice responding to compromised AI workloads with Steve de Vera (AWS) and Kyle Shields, CISM, GCIH, GCPN (AWS). AI swarms: Investigate intrusions involving multiple AI agents with @joswr1ght (CounterHack). Offensive AI: Use AI to exploit vulnerable applications with Andy Dennis and and William Reyor (@Xbow) Delegating to agents: Practice assigning security work to agents while retaining control with @lennyzeltser (SANS Institute). AI pentesting: Practice AI-assisted penetration testing with @pedramamini (OPSWAT) and Adrian Wood (Dropbox / BT6). Autonomous DFIR: Work with Caleb Evans (Airbyte) and Mulder, his winning Find Evil! incident-response agent. Registration closes SOON for @SANSInstitute AI Cybersecurity Summit See you in Arlington, VA (Select Summit talks are also available live online.) Registration includes virtual access to @unpromptedconf II go.sans.org/YjGCXr
2
10
1,334
Security teams protect and defend from the frontlines all year. SANS wants to send them into 2027 better equipped.
1
3
8
2,560
more replies
That gives your team more time to reinforce what they learned and apply it back at work. Plus a path to validate those new skills through GIAC certification.
1
351
CDI 2026 runs Dec 14-19 in Washington, D.C. and online. See the full course lineup and what sending your team to CDI actually delivers: go.sans.org/coWeIu #SANSLiveTraining
349
LIVE NOW: the PHP vulnerabilities in plain terms, with @mosesrenegade and @secgreene of SANS. What is confirmed, what to patch first, what to do on EOL versions. go.sans.org/MpvmG6 #PHP
The image is a promotional graphic for a livestream event titled "PHP Vulnerabilities: What You Need to Know Today and Do Right Now." It features Rich Greene and Moses Frost as the speakers, with their titles listed. The logos for the SANS Institute and Neuvik are displayed, and the graphic has a blue color scheme.

ALT The image is a promotional graphic for a livestream event titled "PHP Vulnerabilities: What You Need to Know Today and Do Right Now." It features Rich Greene and Moses Frost as the speakers, with their titles listed. The logos for the SANS Institute and Neuvik are displayed, and the graphic has a blue color scheme.

5
1
5
1,743
The hard part of this PHP patch is finding every place you run PHP. SANS Critical Advisory at 12 PM ET today with @mosesrenegade and @secgreene. go.sans.org/MpvmG6 #PHP #infosec
Slide displaying information about a livestream titled "PHP Vulnerabilities: What You Need to Know Today and Do Right Now." Featured are Rich Greene and Moses Frost, who are instructors at SANS Institute and Neuvik. The design includes emergency and today's date tags with a blue abstract background and the SANS logo.

ALT Slide displaying information about a livestream titled "PHP Vulnerabilities: What You Need to Know Today and Do Right Now." Featured are Rich Greene and Moses Frost, who are instructors at SANS Institute and Neuvik. The design includes emergency and today's date tags with a blue abstract background and the SANS logo.

2
1,196
Two critical PHP RCEs (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) leaked ahead of embargo. Fix drops Wed 10 AM ET. SANS goes live Wed 12 PM ET with @mosesrenegade and @secgreene on what to do now. youtube.com/watch?v=OrfwyFVk… #PHP

Urgent Livestream - PHP Vulnerabilities: What You Need to Know Today and Do Right Now

Two critical vulnerabilities have been discovered in PHP, the techn...

youtube.com
2
14
16
4,216
Get the full details here: go.sans.org/MpvmG6

Emergency Livestream: PHP Vulnerabilities: What You Need to Know Today and Do Right Now | SANS...

According to Anthropic, their new Claude Mythos model discovered thousands of zero-day vulnerabilities across every major operating system and web browser.

sans.org
372
One week until our executive roundtable on critical infrastructure preparedness.
1
2
1,514
The real test for any response plan is whether it holds up against a single incident, or several at once, hitting different systems, in different places, at the same time.
1
1
419
Tim Conway, @RobertMLee, Mark Bristow, and Brian Harrell break down what that means for leaders on October 27 at 2pm EDT. Register now. go.sans.org/KWNZrC #CriticalInfrastructure
2
2
600
“Don’t start with content, start with the people.” James Mountford, Security Awareness & Culture Lead at AVEVA, on the 2026 SANS Security Awareness Report. Read the full report → go.sans.org/imaYcs #SecurityAwareness #SecurityCulture
1
5
959
Voting for the 2026 SANS Difference Makers Awards is now open through Nov 9. Your vote picks the community's choice in each of eight categories. Whose work made security better for us all? Vote to thank them.
The image is an announcement for the DMA Difference Makers Awards 2026, with "Voting Now Open" prominently displayed. It encourages voting for finalists who enhance cybersecurity. The image includes logos for SANS, RSA Conference, Fortinet, and Knoscti.

ALT The image is an announcement for the DMA Difference Makers Awards 2026, with "Voting Now Open" prominently displayed. It encourages voting for finalists who enhance cybersecurity. The image includes logos for SANS, RSA Conference, Fortinet, and Knoscti.

1
2
1,120
Cast your vote: feedback.sans.org/733559
404
Small U.S. water, power and gas utilities: free OT security tech, deployment help and SANS training for up to 500 of you. dragos.com/resources/press-r… #ICS | @Accenture | @DragosInc
1
7
2
17
3,329
Read in full: go.sans.org/8zOVU6

Accenture, Dragos, and SANS Institute Launch Foundation to Strengthen Cyber Defenses for Under-Re...

Accenture, Dragos, and SANS Institute launch the Community Cyber Resilience Foundation, providing no-cost OT cybersecurity to up to 500 under-resourced U.S. utilities.

sans.org
1
519
Load more