CURRICULUM: Cloud Security FEATURED CNEW OURSE 5 Day Program You Will Be Able To ▐ Detect OAuth consent abuse, token theft, and service principal compromise ▐ Analyze Entra ID sign-in, audit, and Graph activity logs for identity anomalies ▐ Map hybrid attack paths across Active Directory and Entra ID using BloodHound ▐ Detect hybrid identity attacks including sync abuse, federation manipulation, and Kerberos escalation ▐ Uncover governance and lifecycle weaknesses that enable long-term attacker persistence ▐ Execute safe remediation by revoking sessions, rotating credentials, and restoring trust Who Should Attend ▐ IAM engineers and architects ▐ Cloud security engineers ▐ SOC analysts and incident responders ▐ Microsoft 365 and Entra ID administrators with security responsibility ▐ Cybersecurity consultants focused on Microsoft or hybrid identity ▐ IT administrators moving into security or identity-focused roles SEC559: Identity Security for Cloud, Hybrid, and Agentic™ 30 CPEs 16+ Labs Guard the Cockpit—Secure Your Identity Control Plane SEC559 is the only SANS course dedicated entirely to cloud and hybrid identity security. Attackers aren’t kicking down doors— they’re slipping through misconfigured applications, leaked secrets, rogue certificates, and quietly abused OAuth flows. SEC559 gives practitioners the attacker knowledge and hands-on experience to detect, govern, and respond to identity-based attacks across human, workload, and AI agent identities before trusted access becomes full compromise. Identity is now the primary attack vector. Common challenges include: ▐ ▐ AI agents and automated workloads operating with unreviewed, overprivileged application permissions ▐ Hybrid attack paths from on-premises Active Directory to full cloud tenant compromise ▐ Federation abuse—rogue SAML certificates granting persistent backdoor access ▐ Privilege sprawl, orphaned access, and ungoverned identity lifecycle Business Takeaways ▐ Reduce risk from identity attacks that bypass traditional perimeter defenses “ Over the years, I’ve seen identity incidents where defenders did everything right—but attackers still kept access. Tokens, application identities, federation trust. This course teaches defenders how to investigate when identity authority is under threat.” —Maxim Deweerdt, Course Author ▐ Detect attackers using legitimate credentials, tokens, and trusted access ▐ Prevent tenant-wide compromise with structured IR workflows ▐ Extend identity governance to cover AI agents and automated workloads ▐ Strengthen Zero Trust, identity governance, and compliance programs Syllabus Summary SECTION 1: Identity as the Control Plane SECTION 2: Authentication, Tokens and Session Security SECTION 3: Hybrid Identity and Active Directory Security SECTION 4: Identity Governance, External Trust and Lifecycle Security SECTION 5: Hybrid Identity Threat Detection, Prevention and Response OAuth token abuse and consent phishing that bypass standard detection ▐ Service principal compromise and CI/CD credential leakage Maxim Deweerdt Course Author For detailed course description, visit SANS.ORG/SEC559 WAYS TO TAKE SEC559 In-Person Live Online