Live sessions, workshops and conferences
Guardian Labs analysts, incident responders and product engineers run live sessions every fortnight — demonstrations on real telemetry, hands-on labs and unscripted question time. Everything is recorded, and every recording is free.
Live and upcoming
All times shown in your local timezone at registration. Sessions run 45 to 60 minutes unless marked as a workshop; every one ends with open Q&A that is not cut short for time.
Breakout time fell to 41 minutes and 79 percent of intrusions involved no malware at all. Two of the report's lead authors walk through the underlying casework, including the three findings that did not make the printed edition.
We run a real phishing proxy against a lab tenant, defeat push-based multi-factor authentication in under 90 seconds, then show exactly which signals give the replay away and how conditional access plus token binding breaks the chain.
A three-hour guided lab in a disposable cluster. You will execute container escape, privileged sidecar abuse and a malicious admission webhook, then build and tune the detections that catch each one. Bring a laptop and a terminal; we provide the cluster.
Written for financial entities and their critical ICT providers. We go control by control through operational resilience testing, incident classification and the 24-hour initial notification, and show the artefact set that survives scrutiny.
The hardest part of automation is not the automation — it is the approval model around it. We cover blast-radius limits, staged enablement, reversible actions, change-window awareness and the audit trail your risk committee will ask for.
A session designed to be watched jointly by engineering and security. Passive discovery on Purdue levels 0 to 3, safe protocol parsing, and why change-window-aware response is the only response model a safety instrumented system will tolerate.
Flagship conference
Three days in San Francisco, 12–14 October. Two thousand practitioners, forty sessions, and a detection engineering track that is deliberately too technical for a keynote stage. Customer-led content outnumbers vendor content two to one.
Twelve deep sessions on analytic design, coverage measurement and tuning at scale.
A full-scale breach exercise run in real time across the main hall on day two.
Book a 45-minute session with a Guardian architect on your actual deployment.
Two-day accelerated path to Sentinel Analyst certification, exam included.
Three-day structure
On-demand library
Every session we have run this year, indexed by chapter so you can skip straight to the demonstration. Slides and detection content are linked under each recording.
Tooling, timing and negotiation behaviour for nine active ransomware-as-a-service operations, with the detection logic for each.
Watch the recordingNorthbank Financial Group on running two detection stacks side by side for sixty days, and what the comparison revealed.
Watch the recordingBuilding analytics that survive adversary adaptation, and measuring coverage in a way that does not flatter your own tooling.
Watch the recordingHow OIDC trust misconfiguration becomes full account takeover, demonstrated live across two cloud providers.
Watch the recordingEverything shipped this quarter, including the new reasoning traces on autonomous decisions and expanded OT protocol coverage.
Watch the recordingTurning containment time into currency, with the cost model and the three objections finance will raise.
Watch the recordingFrom impossible-travel noise to behavioural baselines that catch session replay from a legitimate-looking network position.
Watch the recordingAn unrehearsed ransomware tabletop with a real executive team, including the decisions that went badly and why.
Watch the recordingOn the road
We staff booths with engineers rather than product marketing, so bring the awkward architecture question. Book a slot in advance and you will get a named person and a whiteboard for 45 minutes instead of a queue.
| Event | City | Dates | Our presence |
|---|---|---|---|
| Guardian Sentinel Summit | San Francisco | 12–14 Oct 2026 | Host · 40 sessions |
| Cyber Defence Europe | Amsterdam | 3–5 Nov 2026 | Booth D14 · keynote |
| SecOps Summit APAC | Singapore | 18–19 Nov 2026 | Two technical talks |
| Financial Sector Security Forum | London | 2 Dec 2026 | DORA panel |
| Healthcare Security Congress | Chicago | 21–22 Jan 2027 | Clinical device workshop |
| OT & ICS Defence Days | Frankfurt | 10–11 Feb 2027 | Hands-on lab · booth 22 |
Scroll the table sideways to see every column.
Recurring programmes
Subscribe to a series and every future session is added to your calendar automatically, with the recording delivered whether you attend or not.
Monthly, 30 minutes. What Guardian Labs saw in the last four weeks, which adversaries changed tradecraft, and what shipped in response.
First Thursday, monthly
Subscribe to the seriesFortnightly, 60 minutes. Practitioners present an analytic they built, and the room tries to evade it. Bring your own detection to workshop.
Alternate Wednesdays
Subscribe to the seriesQuarterly, 35 minutes. Everything shipped in Guardian Sentinel, why it was built, and what is deprecated — with migration notes.
Quarterly, week after release
Subscribe to the seriesQuarterly, 75 minutes. A live tabletop exercise run against a volunteer executive team, unrehearsed, with the incident response lead facilitating.
Quarterly, by invitation
Request an invitationRegistration
One form covers any session, workshop or series. Workshops are capped at 40 participants and confirmed by email within one working day; webinars confirm instantly.
Related
The written research behind most of these sessions, including the 2026 Global Threat Landscape Report referenced in the September webinar.
Read the researchThe customer stories our co-presenters tell on stage, with the full metric set and deployment detail written down.
See the outcomesStructured certification paths for analysts and awareness programmes for the wider workforce, delivered live or self-paced.
Explore trainingNew to a topic? Start with the security glossary, or check the datasheets for the specifications referenced in the product sessions.
A Guardian engineer will run a private walkthrough against your architecture, your constraints and your open questions. Sixty minutes, no slideware.