SO-CON 2027 Conference & Training

SO-CON 2027 brings practitioners and security leaders together around one question: how are adversary tradecraft and AI reshaping Attack Path Management, and what does that mean for the way we test, defend, and lead? 

Whether your work happens in the lab, with clients, or at the program level, join a community connecting technical discovery with better-informed decisions. 

Attendees will get to: 

• Take a closer look at adversary tradecraft: Explore how adversary techniques challenge existing assumptions and how a deeper understanding of those techniques can inform your next move.

• Experience a clearer view of attack paths: Connect individual techniques to the broader paths adversaries can take through an environment. Consider what those connections mean for security priorities, testing, and defense.

• Connect with industry peers: Connect in-person on the latest in the industry. Immerse yourself in interactive sessions, gain practical insights, and build lasting relationships. 

• Find perspective beyond your own role: Bring operational questions into a broader conversation. Exchange perspectives with people approaching security from different disciplines, responsibilities, and levels of experience.  

SO-CON 2027 Schedule 

SO-CON 2027 consists of a two-day conference followed by four days of training, beginning on Monday, April 26, 2027. Stay tuned for the full schedule and details! 

Conference 

Join us for our two-day, in-person conference featuring over 40 informative sessions across three tracks, educational activities, and opportunities to connect with the security community.  

The conference is an in-person-only event and will not be livestreamed or otherwise support remote attendance. To get a feel for the full experience, explore SO-CON 2026.

Training 

After the conference, take your skills further with SpecterOps Tradecraft Academy courses. Choose an in-person or virtual learning experience designed to help you apply new techniques through practical instruction, hands-on labs, and direct engagement with experienced frontline practitioners. 

Training Benefits 

• Receive a complimentary SO-CON 2027 conference pass: Every training registration includes access to the 2027 SO-CON conference (in-person only). 

• Practice with hands-on labs: Reinforce key concepts through practical exercises and lab work throughout the course. 

• Learn directly from frontline practitioners: Engage with SpecterOps experts who bring current field experience and real-world context to the classroom. 

• Enjoy breakfast and lunch each day: In-person attendees receive catered breakfast and lunch during training (in-person only). 

• Connect beyond the classroom: Join evening social activities with fellow students and instructors, including events such as Bring Your Own Research Night (in-person only). 

• Save as a SpecterOps training alumnus: Eligible SpecterOps training alumni may receive 25% off tuition. To request the discount, email training-sales@specterops.io with a link to your digital credential from a prior SpecterOps Tradecraft Academy offering.

• Choose the format that works for you: Attend an in-person course or join virtually, with options designed to support different learning preferences and schedules.

  Note: Virtual training tickets do not include the in-person benefits of the event.  

Adversary Intelligence: LLM Tradecraft 

Agentic systems are already embedded in the environments that security practitioners are responsible for securing. Understanding how they work, where they fail, and how they can be exploited is no longer optional.  

This 3-day LLM Tradecraft course teaches participants how modern LLMs process input and generate output, how prompting strategies affect model behavior, and why the architectural properties of these systems create security implications that don’t map cleanly onto traditional network security thinking. From there, the focus shifts to agentic systems: how they orchestrate tools and memory, where those patterns create exploitable gaps, and how attackers abuse them through prompt injection, jailbreaks, and insecure AI infrastructure. Labs run throughout every module, giving participants hands-on experience with leading AI tooling across LLM system security, threat modeling, reverse engineering, and defensive security workflows. 

Full course details here. 

Adversary Tactics: Identity-driven Offensive Tradecraft

Modern ecosystems rely on Identity Providers (IdP) and Identity and Access Management (IAM) systems to authenticate users and govern access. Threat actors and red teams increasingly use “identity-driven” tradecraft to navigate modern environments and attack paths. But what turns a path into an attack path? How do attackers discover new paths, abuse IAM platforms, and execute high-impact attacks?  

The Identity-Driven Offensive Tradecraft course is a follow-on course to our Red Team Operations course and equips students with methods to discover attack paths in complex environments, including both known techniques and new attack primitives in common technology stacks and bespoke systems. In this follow-on course to our Students will learn to identify and execute elaborate attacks against on-premises and cloud technologies. They’ll practice through hands-on labs that simulate real-world environments and a variety of technologies and attack paths, including cross-tenant and supply chain attacks. 

Full course details here. 

Adversary Tactics: Red Team Operations

Upgrade your red team tradecraft with tactics, techniques, and procedures (TTPs) commonly used by attackers in real-world breaches.  

The Red Team Operations course teaches students how to design resilient command and control infrastructure and covertly operate in target networks to simulate advanced adversaries. Students learn to apply data-driven approaches to tradecraft decisions, execute advanced Active Directory attacks, perform sophisticated post-exploitation actions beyond “Domain Admin,” and practice “offense-in-depth” by adapting techniques in response to defenders. Participants will use the skillsets taught in this course to go up against live defenders in an elaborate lab environment mimicking an enterprise network, learning to adapt and overcome active response operations through collaborative feedback. 

Full course details here.  

Adversary Perspectives: Azure

Before you can emulate or defend against the tactics of an adversary operating in Azure and Entra ID, first you must understand their perspective. How do premiere security operators view Azure’s infrastructure components, common architecture designs, security controls, and agent architectures?  

Through hands-on labs, this course teaches participants how to identify misconfigurations in Azure and Entra ID that are commonly leveraged by attackers. Participants should expect to walk away from the Adversary Perspectives: Azure course with a strong foundation of Azure and Entra ID security knowledge and having taken their first step in attacking or defending corporate Azure and Entra ID environments. 

Full course details here.