SANS DFIR Summit & Training
SANS Institute · 2026
Access and status
Cost
Partly free
Part of it is free and part is not. The entry says which part; read that before you plan around it.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
SANS's annual practitioner summit, with the 2026 edition running 15-16 October 2026 at the Hilton Arlington Rosslyn in Arlington, Virginia, followed by SANS courses 17-22 October. Both the summit and the courses can be attended in person or virtually.
Who it is for, and when
This is where working DFIR analysts and consultants go for the year's new artefact research and tooling — talks tend to be "here is the artefact, here is the parser, here is the repository" rather than strategy. Summit-only registration is free, in person or virtual, and includes the talks, presentations and workshops, with networking, an evening reception and the exhibit hall for in-person attendees; the free virtual tier gives select talks plus a Slack channel. The paid element is the attached training: the site lists course-plus-summit registration at $995 USD for both in-person and virtual.
What it does not cover
It is a practitioner and vendor-adjacent event, not a research conference: talks are not peer reviewed and should not be cited as if they were. It also assumes you already do the work — there is no beginner track in the summit itself, and the legal and expert-testimony side is barely represented.
Go to the source
Open at sans.org (opens in a new tab)https://www.sans.org/cyber-security-training-events/digital-forensics-summit-2026/
Details
- Type
- Conference
- Written for
- New to the fieldWorking examinerAdvancedNew to the field, Working examiner, Advanced
- Publisher
- SANS Institute
- Year
- 2026
- Topics
- conferences, incident-response, training, community, threat-hunting
- Checked at source
Related entries
FIRST Conference
PaidThe annual conference of FIRST, the global forum of incident response and security teams, which comprises over 800 member teams in more than 100 countries. The 2026 edition ran 14-19 June 2026 in Denver, Colorado.
Blue Team Labs Online
Partly freeA gamified platform, run by Centri, of "security investigations and challenges covering; Incident Response, Digital Forensics, Security Operations, Reverse Engineering, and Threat Hunting". Challenges are downloadable artefacts — memory dumps, phishing emails, packet captures, logs — while investigations run in hosted lab instances.
CyberDefenders
Partly freeA blue-team lab platform hosting scenario-based investigations grouped as endpoint forensics, network forensics, malware analysis, cloud forensics, threat hunting, detection engineering and threat intelligence. Challenges are question-and-answer over supplied evidence, with a scoreboard.
HTCIA, founded in 1986 and describing itself as "the oldest association exclusively dedicated to advancing high technology and cyber investigations", runs a calendar of chapter meetings and regional training events. The flagship event currently listed is the Ohio HTCIA Salt Fork Conference, whose 2026 edition — its 25th — ran 20-22 May 2026 at Salt Fork State Park Lodge, Kimbolton, Ohio, offering 20 hours of training credit.
Magnet Forensics' online DFIR conference, delivered over several weeks of sessions. The 2026 edition has taken place and its recordings are published as a free replay library, searchable by speaker, theme, language and week, covering mobile forensics, cloud investigations, video analysis and corporate investigations.