Four days in the AI Cyber Bootcamp at Black Hat USA 2026 produce a folder of working notebooks: trained detection models, an anomaly-hunting pipeline, an LLM triage workflow, and an AI agent that automates a SOC task. You write the code in labs on real security data, and it runs in your own environment after you leave. The point is not to watch a demo. It is to build the thing.
Black Hat USA 2026 runs August 1 to 4 at Mandalay Bay in Las Vegas. The bootcamp is the four-day AI Cyber Bootcamp and takes all four training days. Here is what each stretch of the course actually puts in your hands.
Foundations: data science on real security data
You start with the unglamorous part that everything else depends on: getting security data into a shape a model can use. Pandas and Python against real datasets (PCAP-derived features, EDR telemetry, phishing corpora, malware metadata), not toy CSVs. You do the preprocessing, feature engineering, and exploratory analysis that decide whether a model works or wastes a week.
By the end of the first stretch you have a clean feature pipeline you built yourself, and you understand why a model failed when the features were wrong. That skill transfers to every detection problem you will ever touch.
