Blueprint: Build the Best in Cyber Defense
Hosted by John Hubbard
SANS's blue team show: long, teaching-first conversations on running a SOC, from metrics to ransomware negotiation.
- Level
- Practitioner, assumes you work in or study security
- Status
- Slowing, last episode
- Who's behind it
- Vendor-run, SANS Institute source
- Last verified
Listed underSOC and blue team
Editorial take
The closest thing to a SANS defense course in podcast form. John Hubbard, who leads SANS's cyber defense curriculum, hosts long interviews, often 50 to 90 minutes, that explain how a defensive practice actually works rather than chasing news. The season built around MITRE's book 11 Strategies of a World-Class Cybersecurity Operations Center is a free SOC management course in 13 episodes. Recent episodes on catching fake IT employees and ransomware negotiation are practical and specific. The catch is cadence: it runs in irregular seasons, with long gaps, and only two episodes have appeared since February 2026.
Last hand-checked 2026-09-30, Cadence slowed: last episode 2026-07-02.
Listen if you …
- work in a SOC or are training for one and want structured, evergreen material
- manage a security operations team and want the 11 Strategies season as a curriculum
- prefer long explanatory episodes over news
Skip if you …
- you want a regular schedule, episodes arrive in irregular seasons
- you only have 20 minutes, many episodes run past an hour
Start with these 3 episodes
- 01
11 Strategies of a World-Class Security Operations Center: Fundamentals
· 55 min · Beginner
Opens the show's best season and explains what a SOC is for before any tooling talk.
- 02
Strategy 5: Prioritize Incident Response
· 85 min · Practitioner
The book's authors on preparing, planning, and executing IR, the most exam-relevant chapter of the season.
- 03
How Phishing Resistant Credentials Work with Mark Morowczynski and Tarek Dawoud
· 54 min · Practitioner
Two Microsoft identity experts explain why passkeys and FIDO2 resist phishing, at a level defenders can repeat to leadership.
About the show
Blueprint is produced by the SANS Institute and hosted by John Hubbard, SANS's cyber defense curriculum lead and an instructor on SOC courses. It launched in June 2020.
Episodes are interviews with blue team practitioners and SANS instructors on security operations, detection, threat intelligence, identity, and incident response. Season 4 (2023) walked through MITRE's 11 Strategies of a World-Class Cybersecurity Operations Center chapter by chapter with the book's authors.
Notable guests
- Anton Chuvakin
- Rob Lee
- Katie Nickels
- Heather Mahalik
- Seth Misenar
- Mark Morowczynski
- Jamie Williams
- Dean Parsons
- David Hoelzer
Pairs with
If Blueprint: Build the Best in Cyber Defense works for you, these likely will too.
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
Johannes B. Ullrich
Five to eight minutes every weekday morning on what the SANS honeypots and handlers saw overnight.
Listen if you work in a SOC or run infrastructure and need to know what to patch today.
solodaily<30mDetection at Scale
Jack Naglieri
Detection and response leaders from Google, Block, and Snowflake on running a modern SOC on cloud-scale data.
Listen if you are a detection engineer or SOC lead building a detection-as-code practice.
interviewirregular30–60mDaily Cyber Threat Brief
Gerald Auger
A live weekday news stream that explains why each story matters, with a career community attached.
Listen if you are a student or junior analyst who wants news explained, not just reported.
mixeddaily60m+The Defender's Advantage Podcast
Luke McNamara
Mandiant and Google Threat Intelligence Group analysts on the intrusions they responded to, in 30 tight minutes.
Listen if you do incident response or threat hunting and want lessons from Mandiant engagements.
interviewirregular30–60m