Find Evil! Hackathon for autonomous AI incident response

Find Evil! is the first hackathon for autonomous AI incident response. Built by the community, for the community.

Quick 90-second video on the Find Evil Hackathon from RSAC stage:

The latest! Submissions are closed! 4,368 builders registered, 129 expert judges are scoring now, and winners are still to be announced. Winning code goes back to the community through Protocol SIFT. findevil.devpost.com

The name comes from a real command. I typed “find evil” into an autonomous IR agent I built on the SIFT Workstation, the beat to shreds, open-source incident response platform the DFIR community has been building for 19 years.

Fourteen minutes later I had a complete C drive forensic analysis. Claude Code reasoning through 200+ tools via Model Context Protocol. The [un]prompted con and RSAC audiences watched the whole thing in real time.

Find Evil! is the first hackathon dedicated to building exactly that: autonomous AI agents for incident response. Hosted by SANS Institute.

The goal: Make Protocol SIFT, the framework connecting AI agents to the SIFT Workstation’s full toolset, into a fully autonomous incident response agent.

An AI-powered adversary can go from initial access to full domain control in under 8 minutes. CrowdStrike’s fastest observed breakout time: 7 minutes. Horizon3’s autonomous agent: 60 seconds to full privilege escalation. MIT’s 2024 research: AI-driven attack workflows running 47 times faster than human operators.

Meanwhile, a human incident responder is still pulling up their toolkit.

That gap is the most dangerous problem in cybersecurity. And it’s getting worse. (I’ve been saying that for three years. It keeps being true.)

Find Evil! challenges you to build an AI defender that keeps pace with a 7-minute attack.

The build platform is the SIFT Workstation: 200+ incident response tools, 19 years of community development, 60K+ downloads anually (the most downloaded open source DFIR tool). The framework is Protocol SIFT, which connects AI agents to those tools through Model Context Protocol.

Protocol SIFT works. It also hallucinates more than we’d like. (That’s exactly why this hackathon exists.) Unlike offensive teams that operate with three or four people in secret, we’re putting the entire practitioner community on this problem simultaneously. Your job: teach an AI agent to think like a senior analyst, how to sequence its approach, recognize when something doesn’t add up, and self-correct when it gets it wrong.

In November 2025, Anthropic’s security team published findings on GTG-1002, a Chinese state-sponsored operation where attackers used Claude Code to run autonomous reconnaissance, exploitation, and lateral movement at 80 to 90% autonomy. The AI handled everything at request rates Anthropic described as “physically impossible” for human operators. (I spent months building Protocol SIFT thinking I was ahead of the curve. Chinese intelligence got their press release out first, through Anthropic’s security team who caught them. Make of that what you will.)

GTG-1002 used the same architecture Protocol SIFT is built on: Claude Code, MCP, and security tools. The difference is which direction it’s pointed. Protocol SIFT demonstrated what’s possible on the defense side. This hackathon is how the community makes it real.

The DFIR community built the SIFT Workstation 19 years ago because defenders shouldn’t have to go without the tools to do the job. Find Evil! is the same argument, applied to AI.

You don’t need to be an incident response expert. The SIFT Workstation handles the domain tooling. You need curiosity and building skills.

• IR/Security professionals: You’ve been finding evil manually for years. Build the AI partner you wish you had at 3 AM during an active incident.

• AI/ML engineers: Apply your skills to a domain where speed determines whether attackers win. Real case data, real tools, no toy datasets.

• Students and early-career builders: No IR background required. The SIFT Workstation is your on-ramp to the most in-demand intersection in tech.

• Open-source contributors: Every submission lives on as a community tool. Build something thousands of responders will use.

• Federal agencies, military units, and academic institutions welcome. (Pseudonymous entries permitted for teams that need them. You know who you are.)

• New to AI? Good. Get your hands on the tools and learn with us.

First place: $10,000 plus SANS Summit pass, hotel, and OnDemand course per team member, plus a SANS Webcast broadcast to the full SANS community.

Second place: $7,500 plus Summit pass, hotel, and OnDemand course per member, plus SANS Webcast.

Third place: $4,500 plus OnDemand course per member.

Teams of 1 to 5. Solo permitted.

Open worldwide, age 18+.

Sponsored by SANS Institute.

Registration, rules, resources: findevil.devpost.com

Send this out and let’s build.

Rob T. Lee is Chief AI Officer & Chief of Research, SANS Institute