Four days in the AI Cyber Bootcamp at Black Hat USA 2026 produce a folder of working notebooks: trained detection models, an anomaly-hunting pipeline, an LLM triage workflow, and an AI agent that automates a SOC task. You write the code in labs on real security data, and it runs in your own environment after you leave. The point is not to watch a demo. It is to build the thing.
Black Hat USA 2026 runs August 1 to 4 at Mandalay Bay in Las Vegas. The bootcamp is the four-day AI Cyber Bootcamp and takes all four training days. Here is what each stretch of the course actually puts in your hands.
Foundations: data science on real security data
You start with the unglamorous part that everything else depends on: getting security data into a shape a model can use. Pandas and Python against real datasets (PCAP-derived features, EDR telemetry, phishing corpora, malware metadata), not toy CSVs. You do the preprocessing, feature engineering, and exploratory analysis that decide whether a model works or wastes a week.
By the end of the first stretch you have a clean feature pipeline you built yourself, and you understand why a model failed when the features were wrong. That skill transfers to every detection problem you will ever touch.
Classical ML for detection you can defend
Next you train supervised models on problems analysts actually see: malware family classification, phishing detection, intrusion classification, SOC alert triage. You work through Random Forest, Naive Bayes, KNN, and SVM, and more importantly you learn when to reach for which one and how to read the evaluation honestly.
This is where the FAQ question everyone asks gets answered in code: Random Forest handles mixed features, non-linear interactions, and gives you feature importance, which makes it a strong default for malware and intrusion work. Naive Bayes trains fast on sparse text features for spam. You do not take that on faith. You train both, compare the confusion matrices, and see it.
The output is a set of trained, evaluated classifiers with metrics you can explain to a skeptical senior analyst. That is the difference between a model you deploy and a model you hope works.
Unsupervised learning for threat hunting
Detection assumes you know what you are looking for. Hunting does not. So the course moves into unsupervised methods: KMeans and hierarchical clustering to group similar users, hosts, and processes; DBSCAN and IsolationForest for anomaly detection; PCA and t-SNE to explore high-dimensional data you cannot eyeball.
The labs run these against authentication logs, network flow, and EDR telemetry, so what you build is a hunting pipeline that surfaces the odd account, the anomalous host, the process that does not fit. You leave with a notebook that turns a pile of logs into a ranked list of things worth investigating.
Generative AI and agents that do real work
The back half turns to LLMs and agents. You use a language model for the tasks it is genuinely good at: summarizing threat intel, drafting log analysis, triaging alerts. You practice prompt engineering as an evaluated skill, not a party trick, measuring whether a prompt actually improves the output on a security task.
Then you build an AI agent that automates a SOC workflow end to end. This is the piece students most often tell us changed how they think about their job: an agent that reads, decides, and calls tools, doing the repetitive analysis a human was burning hours on. You walk out with the agent code and a clear sense of where agents help and where they quietly go wrong.
Adversarial AI: attack the models you just built
The course does not let you deploy AI without understanding how it breaks. The final labs are red and blue team exercises against ML and LLM systems: model evasion, data poisoning, prompt injection, and RAG poisoning, the attack that matters most now that nearly every enterprise LLM deployment grounds answers in a retrieval corpus.
You attack models like the ones you trained earlier in the week, then defend them. That loop is the whole reason to learn AI and security together instead of separately. You leave able to reason about the attack surface of an AI system, not just its accuracy.
What you take home
Add it up and the four days produce a working portfolio, not a certificate to frame: trained classifiers with honest evaluation, a clustering and anomaly-detection hunting pipeline, an LLM triage workflow, a SOC-automation agent, and a set of adversarial exercises you have run from both sides. All of it lab-built on the Centaur VM and real security data, all of it runnable in your own environment on the flight home. Most students are using at least one of those notebooks in production within a month. That is the test of training that worked: code you keep and use, not notes you never open again.
Who should take it, and who should not
The bootcamp is built for security professionals who can read code and want to apply AI, ML, and data science to operations. Analysts, detection engineers, and threat hunters are the sweet spot. If you have never written a script, the pace will hurt.
If you are a security leader who needs to govern AI rather than build it, the four-day technical course is the wrong seat. The one-day executive course covers risk, governance, and vendor evaluation for that audience instead. Not sure which fits your team? The course decision guide matches each GTK Black Hat course to role and time. For a group or a custom on-site version, contact us.
Full details and registration are on the Black Hat 2026 training page. The seats that matter fill early; the folder of working code is worth booking one.