Training is the deep-end of SAINTCON. While the main conference floor runs talks, contests, and communities, the training rooms host multi-hour, hands-on classes from instructors across the industry.
Trainings can be purchased during registration. Add any class below to your order when you register, or add one to an existing registration (see below).
2026 catalog
Seven hands-on classes this year. Full day (8 hours) unless noted, with a lunch break from 12:00 to 12:30 PM. Prices are per seat. Ham In A Day is free and has its own sign-up.
AI SOAR and Security Engineering with Elastic #
Taught by Dale Rowe and Ross Woodside
Your mission begins here. Stop waiting on tickets, vendors, and “someday” roadmaps. In this full-day, hands-on workshop, you’re the security crew of a starship about to launch, and an attacker has already slipped into its systems. You’ll team up with AI coding assistants to turn raw telemetry into working security tools, live in Elastic Cloud, while you track down a phished crew member, a planted payload, and rogue transmissions. Before liftoff, you’ll build a tool of your own and demo it to the room.
You will learn to:
- Explore unfamiliar security data fast, with AI helping you write the queries
- Bring new data sources online, like threat-intel feeds and cloud audit logs, using Elastic’s built-in integrations
- Turn detections into automated response, with alerts that enrich themselves and take action
- Build and ship a small security tool, such as a dashboard, a triage bot, or an enrichment API, without starting from a blank page
- Direct, review, and check AI-written code so it’s safe to run, with no leaked secrets or made-up logic
Every lab has step-by-step guidance and a checkpoint, so nobody gets left on the launchpad. You’ll leave with working tools, reusable playbooks, and a repeatable way to become the force multiplier on your team. The patterns carry over to any SIEM, SOAR, or language.
Who it’s for: Blue teamers, red teamers, and anyone in security who would rather build than wait. You should know basic security concepts like logs and alerts. No coding or Elastic experience is needed, because the AI writes the code and you learn to direct and check it.
What to bring: A laptop with a modern browser and admin rights to install software, plus a free GitHub account. The Elastic Cloud environment is provided, and we’ll send setup details before class.
Beat the Breach: Incident Response Bootcamp #
Taught by McKay Hardy
While the Beat the Breach experience immerses participants in a live cyber incident, Incident Response Bootcamp takes a deeper dive into the skills, processes, and technologies that enable organizations to effectively detect, investigate, contain, and recover from real-world attacks.
Designed for SOC analysts, incident responders, detection engineers, threat hunters, security leaders, and IT professionals, this hands-on course combines practical instruction with real-world examples drawn from enterprise incident response operations. Participants will learn how modern security teams prepare for incidents, investigate malicious activity, coordinate response efforts, communicate with stakeholders, and make critical decisions under pressure.
The course is divided into two complementary sections. During the first half, participants receive instructor-led training covering incident response methodologies, investigation workflows, detection engineering, threat intelligence integration, log analysis, containment strategies, and recovery planning. The second half transitions from theory to practice as attendees participate in a Beat the Breach simulation, applying the concepts learned during training in a realistic, high-pressure incident response scenario.
Throughout the course, attendees will explore the tools, techniques, and processes used by mature security organizations to identify and respond to threats more effectively. Rather than simply discussing incident response concepts, participants will have the opportunity to put those concepts into action while working through realistic challenges that mirror the complexity of modern cyber incidents.
Whether you are looking to strengthen your incident response capabilities, improve your organization’s readiness, or gain practical insights from experienced practitioners, Beat the Breach: Incident Response Bootcamp provides the knowledge, experience, and confidence needed to respond effectively when a real incident occurs.
No slides-only theory. No canned examples. First learn the skills, then put them to the test in a live-fire Beat the Breach simulation.
Satellite Hacking: Going Beyond the Planet #
Taught by Michael Butler
Space, the final hacking frontier! Satellites are critical infrastructure, but are they critically vulnerable? In this hands-on class, you will use a compromised ground station terminal to compromise, control, and commandeer a virtualized satellite. We will cover the status of the industry, provide an understanding of the challenges inherent to cybersecurity in space, and cover the threats that our satellites face. You will execute attacks, exercise the unique kind of command and control required for satellite operations, and leverage data exfiltration techniques.
Complete Intro to Pentesting: Cloud, WebApp, Network and AD #
Delve into the mechanics of the full breadth of penetration testing. This intensive course will equip you with the knowledge and skills to perform both external and internal network testing, as well as master web application attacks using Burpsuite. Crafted for anyone with a passion for cybersecurity, this hands-on training promises a practical approach to explore the multifaceted aspects of penetration testing and its potential to detect security vulnerabilities in networks and web applications.
In this course you will learn:
- The ethical hacking process using the Penetration Testing Execution Standard (PTES) framework
- Techniques for internal and external network penetration testing
- Web application testing methodologies and tools
- Mastering Burpsuite for effective web application security assessments
- Utilizing additional tools like nuclei, nikto, openvas, and sqlmap
- Real-world exploitation techniques and post-exploitation strategies
Cyber Threat Intelligence 101 #
Taught by Andy Piazza
This workshop will present an introduction to the basic concepts of threat analysis, leveraging open-source tools, and processing threat intelligence reports in support of computer network defense and incident response. This is a workshop for blue teamers (current and future!) that are interested in threat analysis. It will include discussing publicly available tools along with covering processes that are actionable today without additional training or paid accounts.
We will start the workshop in an academic segment to build a baseline of key terms and the distinction between Cyber Intelligence and Cyber Threat Analysis. Once we have a common foundation, we will move into a hands-on portion exploring open-source reports to enrich and pivot within our dataset. I will demonstrate the process that I use to read through the content of a threat report, process the IOCs and TTPs, and correlate the activity to previous reporting. This section of the workshop will work through Symantec’s Waterbug reporting along with ESET’s Turla reporting, as examples of the same activity being reported under different names and from different perspectives. Attendees will conduct passive lookups (e.g. VirusTotal, ThreatMiner, and PassiveTotal) on the IOCs included in the report. In the final portion of the class, we will discuss bringing our analysis back together into an intelligence product. We will discuss the best methods for clustering threat activity, categorizing capabilities, and visualizing threat activity.
Protecting Your Privacy in the Digital Age #
Taught by LevBGN
This is a 4-hour training session covering various aspects of how to maintain your privacy during a time when businesses are financially driven to destroy it. In this training session, we will cover everything you need to know to slow and stop the leak of your personal information, from OS hardening and browser settings to masked payment cards and disinformation. And if we get extra time, we might even see what data your network traffic might be leaking about you! Prepare to take back the control of your personal data.
Ham In A Day: Get Your Amateur Radio License #
Every mission needs comms. Ham In A Day is a full-day prep course and exam session for the FCC Technician license. We’ll work through everything on the exam: radio fundamentals, rules and regulations, safety, and operating practice. Right after class, attendees can test on site with our volunteer examiners, free of charge. Come with a little preflight study under your belt, and you can walk out a licensed ham.
You will learn to:
- Understand how radio works: frequency, propagation, antennas, and power
- Operate legally and courteously under FCC Part 97
- Stay safe around RF and electrical hazards
- Get on the air with repeaters, simplex, and digital modes like APRS and SSTV
Before class (strongly recommended). Don’t launch cold. The class moves fast, so spend a few hours with the material first. Run through the Technician question pool on HamStudy.org (free flashcards and practice exams) and take a practice test or two. Make sure you’re studying the current 2026 to 2030 pool. Even a weekend of light review makes a big difference on exam day.
Who it’s for. Anyone, no prior license needed. Hackers who’ve poked at SDR, Meshtastic, or the RF side of security will feel right at home. Just do your preflight study first.
What to bring. Photo ID, your FCC Registration Number (FRN, free from FCC CORES, so get it before class), and a pen.
When and where. Monday, October 26, 8:00 AM to 4:00 PM. UVCC, 2nd floor lounge, north end. Class starts at 8:15 AM sharp, and the exam session follows the class.
Free, but seats are limited. The class is capped at about 40 people. Reserve your seat on Zeffy. This class is run by the Ham Radio Village (InkRF), discord.gg/hrv.
Format
- Duration. Classes run full-day (8 hours) or half-day (4 hours), all on Monday, October 26, the day before the conference.
- Location. Dedicated training rooms inside the UVCC, separate from the main conference floor. Ham In A Day is in the 2nd floor lounge.
- Class size. Capped so instructors can actually help each student. Seats are limited; popular classes sell out.
Who it’s for
Most classes assume working knowledge of security concepts. Some are introductory; some are squarely for practitioners with years of experience. Prerequisites are listed with each class in the catalog.
Add training to an existing registration
If you already registered for the main conference and want to add a training class, log into your account on the registration site and add the class if seats are still available. Log in with the email address you registered with: your receipt email lists a username and a password, and the username it shows is that email address. If something about your registration blocks that, email registration@saintcon.org.
Past years
Training catalogs from prior SAINTCONs are browsable in the archives. Good way to get a sense for the tone and depth before 2026 topics drop.
Want to teach?
The Call for Trainings for 2026 has closed and this year’s instructors are confirmed. Watch that page for the next call.
Questions
Drop into Discord and ping Zonifer, our trainings manager (find him on the Planning Committee page).
