Get a Free GIAC Certification Attempt or $350 Off with OnDemand and vLive Training!

Confidential DFIR Security Training

Take DFIR training confidentially behind closed doors. Benefits include operational and budget efficiency, and expert training from a SANS Instructor who can provide a consistent approach to training security teams.

SANS' Digital Forensics and Incident Response Private Training programme is ideal for organisations with over 25 students who require DFIR cyber security training.

Private Training sees a SANS Instructor deliver our DFIR courses directly to employees in a HQ, training space or offices.

Please email for more information about Private DFIR Training.

For organisations with fewer than 25 students, please see our Training Events & Online Training options.

Hands On DFIR Learning

SANS DFIR Security Training is, by design, a hands on learning experience. Students are immersed in practical forensic and incident response work across systems ranging from Windows to Apple.

Our DFIR Courses are built around lab exercises, live code samples and test systems. Students don't just learn theory they work with key technologies.

The work is challenging, enlightening, rewarding and all designed to make students a tougher DFIR practitioner.

DFIR Private Training Benefits

SANS knows that security is paramount. By delivering SANS training behind closed doors we can ensure the maximum level of discretion.

SANS Training offers employers and managers efficiencies including:

  • Cost - Budget holders can avoid paying for a whole team's travel, accommodation and subsistence expenses.
  • Time - Team members remain in their HQ, on hand and able to participate in project work if needed.
  • Standardisation - By all following SANS Training, a DFIR team will share a common language, approach and philosophy.
  • Focus - With a SANS Instructor embedded in an organisation, training can be steered toward challenges and scenarios that are unique to an organisation.
  • Consistency - SANS' Private Training is one of the many ways in which SANS Training can be taken. Whichever mode of training is chosen, students receive the same quality of instruction, courseware, lab exercises and resources.

Built To Be Remembered

SANS Instructors are the DFIR discipline's leading practitioners and proponents. Many spend more time working in the field than they do teaching. DFIR Instructors are intimately acquainted with Forensics' latest trends, and Indecent Responses' newest tactics.

Many SANS Instructors are DFIR consultants who are in high demand from government bodies, military agencies and leading businesses.

They bring this wealth of real-world experience into the classroom.

SANS Private Training equips students with a library of learning resources and courseware.

This includes:

  • Expertly written textbooks - Each student will receive a collection of textbooks that relates directly to the course they're studying. Like the courses they support, the textbooks are updated regularly.
  • Lab exercises -During Private Training students will be presented with multiple lab exercises. Each student is given a copy of the virtual machines so they can recreate the exercises.
  • Toolkits - DFIR experts know which tools to use and how to get the best from them. We make sure every student leaves class with copies of the tools explored.

Read what previous students taking DFIR security training have to say about their course on our Testimonials page.

DFIR Security Certification

GIAC Information Assurance Certification (GIAC) is a widely respected provider of cyber security certification all over the world.

GAIC and SANS share a common belief in the importance of hands-on skills. GIAC Certification examinations test a professional's technical abilities and not just their factual knowledge.

SANS offers several DFIR courses that align with GIAC Certifications:

GIAC Certification Attempts are taken in a proctored test centre - an accredited, external establishment nominated by GIAC.

For any questions relating to training, read our FAQs or email

DFIR Curriculum
Course Certification
Level 1 SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling GCIH
FOR500: Windows Forensic Analysis GCFE
Level 2 FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics GCFA
FOR518: Mac and iOS Forensic Analysis and Incident Response
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response GNFA
FOR578: Cyber Threat Intelligence GCTI
FOR585: Smartphone Forensic Analysis In-Depth GASF
Level 3 FOR526: Advanced Memory Forensics & Threat Detection
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques GREM

Request More Information

Please enter the text you see in the image into the following text field.