Galactic's Security Stack Workshop

Build a security program you can explain, defend, and keep running.

A free, half-day virtual workshop for the IT engineers, security teams, and technology leaders responsible for keeping their organization's data and people safe from attackers

December 9, 2026 · 10:00 AM ET · Half Day · Virtual · Free

Three layers of protective rings surrounding a central data server

The State of the Security Stack in 2026

For the first time in the history of Verizon's Data Breach Investigations Report, exploiting a vulnerability was the most common way attackers got in, ahead of stolen credentials. At the same time, organizations are fully fixing a smaller share of known exploited vulnerabilities, and taking longer to do it.

An effectively-built security program that maps to a control set, stays patched, and does the job it was built to do reduces risk and keeps critical assets safe. This workshop is designed to help you achieve those goals.

Verizon DBIR coverage · Vulnerability remediation coverage · SANS AI Survey

31%

Of breaches began with vulnerability exploitation, now the top initial access vector, ahead of credential abuse at 13%.

Source: Verizon 2026 Data Breach Investigations Report

26%

Of known exploited vulnerabilities were fully remediated, down from 38%, as the median time to fix rose to 43 days.

Source: Verizon 2026 Data Breach Investigations Report

27%

Of practitioners describe their AI deployments as mature, even as 78% now use AI in their security strategy.

Source: SANS 2026 AI Survey

Architecture Before Tools

December 9 is when you work through the right way to build a stack: what it has to prove, what belongs in it, how to keep it working once it's deployed, and where AI can help.

You'll be able to:

Turn frameworks and obligations into a control baseline you can defend.
Map every tool in your stack to the capability it provides, and see where the gaps and redundancies are.
Keep the stack patched and working without letting it become the way in.
Put AI to work in your defenses, and secure the AI you already use.

The Sessions

Wednesday, December 9, 2026 · 10:00 AM to 2:45 PM ET (7:00 AM to 11:30 AM PT)

01 Building the Map Before the Stack

10:00 AM ET

Before any decisions are made about tools, a stack needs a map. Four things are critical in informing what that map looks like: obligations, program frameworks, control catalogs, and threat-informed models. This session demonstrates how to combine those into one defensible baseline that you can build your stack around.

02 From Controls to Capabilities

10:35 AM ET

The full stack walkthrough. Each capability category, from identity and endpoint to detection, response, and recovery, is covered by what it does, which controls it satisfies, and how it differs from the categories it overlaps with, with example vendors and products for each. Leave with a clear way to spot sprawl, redundancy, and gaps in any stack.

03 Keeping the Stack Working Without Making It the Way In

12:30 PM ET

Deploying the stack is the start, not the finish. This session covers building a patching process that holds up under real pressure, the traps that allow coverage to erode, and how to harden your management and security tools so they don't become an attacker's entry point.

04 AI in the Architecture

1:15 PM ET

Where AI genuinely strengthens defenses today, from alert triage to investigation and detection writing, and how to evaluate the AI claims in security products. The session also covers controls the AI you already use needs, and how AI frameworks fit alongside the ones from the morning.

05 Wrap-Up and Q&A

Full Panel · 2:00 PM ET

The presenters come together to recap the day, walk through the leave-behind resources, and take your questions.

The Presenters

Cody Kretsinger

Director of Security Research

Cody Kretsinger got his start in security as a hacker, and he now uses what he learned to help organizations stop the kinds of attacks he once carried out. As Director of Security Research at Galactic, he studies how attackers operate and turns what he finds into practical guidance for the teams defending against them.

Aidan Brown

Security Analyst

Aidan Brown tracks the threats that matter and turns them into guidance that engineers and executives can both act on. His work spans threat intelligence, security research, and security awareness, and it starts from hands-on analysis.

Collin Page, CISSP

Security Advisor

Collin Page has spent more than ten years in cybersecurity, much of it in healthcare and finance. He turns penetration test findings into a plain-English list of what to fix first and what to have ready if one of those gaps gets used against you.

The Resources

Every attendee walks away with resources built to apply what they learned to their own environments.

The Security Stack Blueprint

A vendor-neutral guide that recaps the full workshop: the frameworks and how they fit together, security models, capability categories with example options, practices for keeping the stack working, and AI controls and defensive use cases.

The Stack Gap Analysis Skill

An AI skill built on the Blueprint. Load it into your model of choice, give it your stack inventory, existing statement of work, or a report export, and it walks through your stack element by element to find the gaps.