SANS FOR-series forensics courses
Six-day instructor-led forensics immersion courses — FOR500, FOR508, FOR572, FOR578, FOR610 — taught by working practitioners, each mapped to a GIAC certification.
Type: Bootcamp & intensiveWorking practitionersLaw enforcement & investigators
Offered by SANS Institute
The facts
- Cost
- $8,780 per course at list price, the same figure for live instructor-led and for OnDemand self-paced, with regional pricing in EUR, GBP, JPY, AUD and SGD. A GIAC certification attempt is an extra, bundled add-on at purchase.Figure read 2026-09-12 from www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training
- Prerequisites
- None enforced. Each course page states assumed knowledge; the advanced courses genuinely assume it.
- Format
- Six days instructor-led (in person or live online) or about 36 hours self-paced OnDemand with roughly four months of access. Hands-on labs throughout, with a virtual machine and datasets you keep.
- Length
- Six consecutive days for the live format; OnDemand is self-paced inside the access window.
- Renewal
- No renewal or recertification requirement is published for this entry.
- Accreditation
- SANS courses are not themselves accredited. The associated GIAC certifications are ANAB-accredited to ISO/IEC 17024, and that accreditation attaches to the exam, not to the course.
- Who it suits
- A practitioner with employer funding, or anyone for whom the fastest possible path to current, hands-on capability is worth the field's highest price.
- Audience
- Working practitioners · Law enforcement & investigators
- Official page
- www.sans.org/cyber-security-courses
Strengths
- The course material and instructors are, by broad consensus in the field, the best available — this is the benchmark everything else in the category is measured against.
- Labs and datasets are realistic and substantial, which is what separates it from lecture-only training.
- Courseware remains usable as a working reference for years, which is part of what the price buys.
- One price covers both live and OnDemand, so remote learners are not charged a premium.
Limitations
- $8,780 per course is the highest price in the field by a wide margin, and it buys one course — a working skill set is several of them.
- Effectively inaccessible without an employer training budget, a Work Study place, or a funded academy seat. That is a structural barrier, not a quibble.
- The certification attempt is a separate cost on top, and SANS does not publish the bundled add-on figure as static text on the course page.
- Six consecutive days is a hard scheduling ask for anyone with a live caseload or billable targets.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.
- www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training
- www.sans.org/cyber-security-courses/windows-forensic-analysis
- www.sans.org/cyber-security-courses/reverse-engineering-malware-malware-analysis-tools-techniques
- www.sans.org/cyber-security-courses/cyber-threat-intelligence