# Where to Get AI Security Training at an Infosec Conference

By Charles Givre · 2026-08-21

> Conference training compresses AI security into two to four days. Which conferences run real labs, how to read a course abstract, and what to install first.

The conference training day is a constrained format. Four days at most, eight hours each, thirty people in a hotel ballroom sharing wifi that was never built for thirty simultaneous model downloads. No homework, no makeup session, no second attempt in week two. That constraint is the whole story: it determines which AI security topics can be taught well at a conference and which cannot, and it should determine which course you book.

Here is where the training actually happens, and how to tell a lab course from a slide deck with a lab section stapled on.

## The Conferences That Run Real AI Security Courses

[Black Hat](https://www.blackhat.com/us-26/training/schedule/index.html) carries the largest catalog. The USA edition runs four training days ahead of the briefings (August 1-4, 2026, Las Vegas), with courses sold in two-day and four-day blocks. The Asia, Europe, and Sector editions run smaller catalogs on the same structure. We teach four courses there this year, and we run the two-day Applied Data Science and AI for Cybersecurity twice, August 1-2 and again August 3-4, because one session does not absorb the demand.

[Hack In The Box](https://conference.hitb.org/) runs multi-day trainings alongside its conferences, including HITB CyberWeek. Smaller rooms than Black Hat, which usually means more instructor time per student.

[DEF CON](https://defcon.org/) is a different animal. Workshops run a few hours, cost little or nothing beyond admission, and fill within minutes of registration opening. The [AI Village](https://aivillage.org/) is where the adversarial ML content lives, and it operates closer to a CTF than a classroom. Excellent for exposure. Not a replacement for a course.

RSAC and most regional BSides events are briefing-driven. Some BSides chapters run a one-day workshop track that is worth the ticket price, but you are unlikely to find a four-day AI security lab there.

## Read the Abstract Like a Detection Rule

The signal in a course abstract is proper nouns. Named libraries, named datasets, named technique IDs. Vague abstracts describe outcomes; real ones describe artifacts.

Weak: "Students will get hands-on experience with prompt injection."

Strong: "Students run direct and indirect injection against a local Llama endpoint served by [Ollama](https://ollama.com/), map each payload to [MITRE ATLAS](https://atlas.mitre.org/) AML.T0051, and write a detection for the resulting output-handling failure (OWASP LLM02)."

Four things to look for before you spend the training budget:

- **The data.** Zeek `conn.log`, Sysmon Event ID 1, Windows Security Events 4624 and 4625, PhishTank URL feeds. If the datasets are the same ones used in a general [scikit-learn](https://scikit-learn.org/) tutorial, you are getting an ML course with security vocabulary applied afterward.
- **What runs locally.** A lab that depends on a hosted API and a key you supply is a lab that stops working when the room saturates the uplink.
- **What you leave with.** Notebooks, trained model artifacts, and a repo you can clone at work. A certificate is not an artifact.
- **What day one is.** If day one teaches Python syntax and you already write Python, you paid for three days, not four.

## Logistics Decide More Than the Curriculum

A conference class loses its first ninety minutes to environment setup unless the instructor ships an image. That is why we ship one: [Centaur](https://github.com/gtkcyber/centaur) is a pre-configured VirtualBox VM with the Python data science stack, published under Apache 2.0, so nobody spends a paid training day debugging a `pip install` against a corporate proxy.

Do the pre-flight at home, on your own network:

```bash
# The week before you travel, not in the hotel lobby.
python3 -m pip install --quiet scikit-learn pandas jupyterlab
ollama pull llama3.2:3b        # roughly 2 GB
ollama run llama3.2:3b "reply with OK"
```

Then confirm the laptop can host the VM at all: around 16 GB of RAM, 40 GB free, and virtualization enabled in BIOS (VT-x on Intel, AMD-V on AMD). A locked corporate build with virtualization disabled and no local admin will not run the lab, and the fix is a ticket to your IT team, not something an instructor can solve at 9am on day one.

## What Four Days Cannot Do

Conference training builds a foundation and hands you working code. It does not produce a production ML engineer. The parts that need months rather than days are the unglamorous ones: baseline drift as your network changes, retraining cadence, calibrating a model against a live alert queue, and detecting the slow adversary who is specifically shaped to look normal.

Two groups should skip it. If you cannot actually protect the days, out of Slack and off the on-call rotation, the format collapses and you will retain a fraction of it. And if Python is still a struggle, a course spent fighting syntax is a wasted seat. Learn the fundamentals first, then book the course. Security executives are the exception in the other direction: the one-day non-technical format exists because four days of labs is the wrong tool for someone who needs to evaluate AI risk, not build models.

If you are weighing formats rather than venues, we wrote separately about [what a hands-on AI bootcamp should contain](/blog/hands-on-ai-cybersecurity-bootcamps) and how to vet one. Our conference catalog and the rest of our [AI cybersecurity training](/lp/ai-cybersecurity-training) is built around the same constraint described here: labs that run locally, code you keep, and an honest scope for the number of days you actually have.

## FAQ

### Where can I get AI security training at a major infosec conference?

Black Hat carries the largest catalog: the USA edition runs four training days ahead of the briefings (August 1-4, 2026 in Las Vegas), with smaller catalogs at the Asia, Europe, and Sector editions. Hack In The Box runs multi-day trainings alongside its conferences, including HITB CyberWeek. DEF CON offers short workshops and the AI Village, which is closer to a CTF than a course. RSAC and most regional BSides events are briefing-driven, with occasional one-day workshops. GTK Cyber teaches four AI courses at Black Hat USA 2026 and trains at HITB.

### How much AI security material can you actually absorb in a conference course?

Enough to build a foundation and leave with working code, not enough to reach production competence. A two-day course covers one arc well: the data science lifecycle applied to security data, or adversarial testing of an LLM application. A four-day format can cover classical ML, generative AI, and adversarial techniques with labs between each. What does not fit in any conference block is the operational tail: baseline drift, retraining cadence, and tuning a detection against a live alert queue.

### What should I install before a conference AI security course?

Whatever the instructor ships, imported and booted at home first. That usually means VirtualBox or VMware plus the course VM image, which wants roughly 16 GB of RAM and 40 GB of free disk. Confirm virtualization is enabled in BIOS (VT-x or AMD-V) and that you have local admin on the machine. If the labs use a local LLM, pull the weights before you travel. Conference wifi will not download a multi-gigabyte model for thirty people at once.

### Is a conference workshop the same thing as a conference training course?

No. A workshop is typically two to four hours, free or cheap with conference admission, allocated first-come or by lottery, and taught to whoever fits in the room. A training course is a paid two-to-four-day block with a capped roster, a prepared lab environment, and a curriculum that assumes continuity across days. Workshops are good for exposure to a technique. Courses are where you build something you can run against your own data.


---

Canonical: https://gtkcyber.com/blog/ai-security-training-infosec-conferences/