Trainer Bio: Billy R. Bennett is the founder and CEO of Pyramid ODI, an organization development consulting firm based in Augusta, Georgia. For more than three decades, he has helped technical specialists, leaders, and teams improve communication, collaboration, leadership, and performance in multinational, industrial, and high-pressure work environments. Billy specializes in translating complex behavioral information into practical actions people can use in their work, relationships, and careers. He is a certified workplace assessment professional and has served on international consultant advisory groups.

Learn more about Pyramid ODI at www.pyramidodi.com.

Full Course Description:
Cybersecurity professionals routinely work across technical, operational, and organizational boundaries. They must explain complex risks, challenge assumptions, resolve competing priorities, and make sound decisions under pressure. Yet many have received far more preparation for the technical demands of their work than for the interpersonal and career challenges that increasingly determine their effectiveness.

Before the course, participants complete an established workplace behavioral assessment. During the session, they receive a personalized Cybersecurity Professional Impact Profile showing how their natural style, motivational needs, interests, and possible stress responses can affect communication, collaboration, influence, leadership, and career development.

Participants apply their profiles to realistic cybersecurity workplace scenarios. They examine how they might explain risk to an executive, challenge a senior colleague, navigate disagreement between security and operations, and adapt their communication without becoming inauthentic. Each participant concludes by creating a practical 30-day Professional Impact Plan.

This is not a technical cybersecurity course or a test of cybersecurity aptitude. It is a structured professional-development experience for cybersecurity professionals who want their technical expertise to be better understood, trusted, and acted upon.

By the end of the course, participants will be able to:

• Explain how their behavioral style affects communication, collaboration, and professional relationships.
• Recognize the conditions that help them remain engaged and effective.
• Identify stress behaviors that may emerge during conflict, uncertainty, or heavy workloads.
• Adapt their approach for technical peers, operational leaders, and executives.
• Create a focused development plan for increasing their professional impact.

Knowledge/Experience/Prerequisites: Suitable for all levels. Participants must complete the assessment questionnaire before the workshop (the deadline will be provided—estimated two weeks before the workshop).

What attendees need to bring: Participants will complete an assessment before the session and must bring printouts with them.

Trainer Bio: Vulnerability Researcher by day, hacker trainer by night.

Full Course Description:
The first day is White Belt, which covers the basics of binary exploitation including a deep dive of the x86 32 bit architecture, how the stack operates, and how buffer overflows are identified and exploited. Each module ends in a stripe test that shows mastery of the concepts. At the end of the first day, players will be able to analyze simple x86 binaries, develop exploits for buffer overflows, and will be given a belt test, which consist of 9 vulnerable binaries.

Day two, “Blue Belt”, introduces students to the x86 64 bit architecture and discusses the differences in calling conventions and how it impacts exploitation. Students will also be introduced to the basics of shellcoding, restricted and encoded shellcode, and egg hunters. After lunch, students encounter their first binary protection mechanism: NX. Students will learn the basics of building ROP chains to bypass this mitigation. The afternoon will conclude with a belt test with 7 vulnerable binaries that cover simple buffer overflows, shellcode, and ROP challenges.

Day three, “Purple Belt”, builds more familiarity with ROP gadgets with examples such as ret2csu. New binary protection mechanisms are introduced: ASLR, stack canaries, and PIE, requiring the student find and utilize read primitives to leak addresses. The day ends with a ret2libc where the students must leak the libc address and ROP to system. A final belt test will be given. All course content stays live and is treated as a CTF for the remainder of the conference. Before closing ceremonies, the CTF will conclude and top students will receive placement medals.

A sample of the training curriculum can be found at www.binaryjiujitsu.com.

Knowledge/Experience/Prerequisites: Programming basics

What attendees need to bring: Laptop with a browser

Trainer Bio: David Formby is co-founder and CEO/CTO of Fortiphyd Logic, a cybersecurity company specializing in OT/ICS security training through realistic virtual industrial environments. He holds a PhD in Electrical and Computer Engineering from Georgia Tech, where his research focused on offensive and defensive security for industrial control systems, including demonstrating the first proof-of-concept ransomware attack on a PLC. He went on to create GRFICS, an open-source 3D ICS simulation now used by thousands of practitioners for hands-on training. David has presented research on securing PLCs and ICS security training at both industry and academic conferences including S4, RSA, and Black Hat. He currently leads Fortiphyd Logic in innovating cyberphysical ranges.

Full Course Description:
Using GRFICSv3, a free open-source ICS simulation, students deploy a working chemical plant environment on their own laptop at the start of the session. The rest of the day runs a single unified scenario from two perspectives.

In the morning, students work through a structured attack chain: network reconnaissance, protocol-level abuse, and lateral movement into the control network, culminating in causing the simulated reactor to explode in the 3D simulation.

In the afternoon, students switch sides. Using Suricata IDS, Wazuh SIEM/EDR, and router/firewall capabilities including DNS logging and ARP monitoring, they detect and mitigate the attack chain they just executed.

OT professionals will recognize the environments and the consequences. IT and general security professionals will find the tooling familiar and the industrial context new. Both groups leave with skills they can apply immediately.

The lab runs on Docker, costs nothing, and belongs to the student after the course.

Knowledge/Experience/Prerequisites: Some Linux experience is helpful but not necessary.

What attendees need to bring: Students are required to bring a laptop.

Trainer Bio: Travis Altman is a cybersecurity leader, educator, and researcher with more than 20 years of experience helping organizations defend against sophisticated cyber threats. Throughout his career, he has worked across offensive security, incident response, product security, detection engineering, secure software development, cloud security, and adversary emulation for organizations spanning financial services, manufacturing, healthcare, pharmaceuticals, higher education, and the federal government.

Full Course Description:
Throughout this course, students will build a strong foundation in adversary tactics, Microsoft Sentinel, Microsoft Defender, endpoint telemetry, Kusto Query Language (KQL), and detection engineering. Using a custom enterprise style cyber range, participants will execute common reconnaissance techniques, observe the resulting telemetry, investigate security alerts, and develop detections that identify attacker behavior using real security data.

Rather than relying on academic exercises or isolated demonstrations, this course emphasizes operational skills that can be directly applied in enterprise environments. Students will gain experience analyzing endpoint activity, validating detections, investigating alerts, and understanding how offensive techniques translate into defensive opportunities.

Whether you are a security analyst looking to strengthen your investigative skills, an engineer responsible for building detections, a threat hunter seeking a deeper understanding of attacker tradecraft, or an IT professional preparing to transition into cybersecurity, Purple Ops provides the knowledge and practical experience needed to better understand, detect, and defend against modern threats.

By the end of the course, students will not only understand how attacks are performed, but more importantly, how to identify, investigate, and detect those attacks using the same tools and techniques found in modern security operations centers.

Knowledge/Experience/Prerequisites: Basic IT skills.

What attendees need to bring: Students are required to bring a modern laptop with the ability to run modern virtualization software (e.g., 8 GB of ram and at least 25 GB of free storage.

Trainer Bio: Security Onion Solutions instructors have years of experience in threat hunting, enterprise security monitoring, and log management. They have worked in real-world operational security roles, engineered monitoring strategies and solutions, and handled real-world incidents. They bring their practical experience to the classroom, enabling students in both theory and hands-on application to hunt adversaries in environments large and small.

Full Course Description:

Students in this class will also receive a FREE voucher to take the Security Onion Certified Professional (SOCP) Exam!

The class will cover the following topics:

• Security Onion Console
• Security Onion System Architecture
• Security Onion Workflows
  • Alert Triage & Case Creation with SOC Alerts and Cases
  • Threat Hunting with SOC Hunt and Dashboards
  • Detection Engineering
• Grid Management
  • Users
  • Firewalls
  • Monitoring
  • Troubleshooting
• Tuning the Grid
  • Berkeley Packet Filters
  • Performance Tuning – Zeek and Suricata
  • Data Pipeline Tuning – Logstash and Elasticsearch
  • Alert Tuning
• Customizing Security Onion Console
• Integrating Endpoint Telemetry
• Capstone Capture the Flag Event
• Multiple Labs and Case Studies

Knowledge/Experience/Prerequisites:
Security Onion Essentials Training Course – Available Here (2 hours; free)
Students should also have a basic understanding of networks, TCP/IP, and standard protocols such as DNS, HTTP, SSL, etc. Knowledge/experience with Linux is recommended, but not required.

What attendees need to bring: Students may want to bring writing utensils to take notes in their provided course books. Security Onion Solutions will provide a training laptop to each student.