FIRSTCON26 — 38th Annual FIRST Conference
The 38th Annual FIRST Conference ("Peak Defense: Building Adaptive Systems for Modern Threats") brought the global incident response community to Denver: talks on AI-assisted IR and triage, CTI sharing, vulnerability identity and EPSS, supply-chain attacks, tabletop exercises, CSIRT building and the EU CRA.
→ See editor’s top picks at FIRSTCON26 — 38th Annual FIRST Conference
- Indicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing — Brian DeWyngaert
In the dynamic landscape of cybersecurity, the rapid and accurate sharing of Cyber Threat Intelligence (CTI) is paramount for effective defense. However, a persistent challenge has been bridging the…
- Protecting Customers Through Smarter OSS Management — Lisa Bradley, Patricia Tarro
In an era defined by escalating software supply chain attacks and increasing regulatory scrutiny, Lisa Bradley and Patricia Tarro from Dell Technologies delivered a compelling talk at FIRSTCON…
- The Vulnerability Identity Crisis — Art Manion, Jay Jacobs
In "The Vulnerability Identity Crisis," Art Manion and Jay Jacobs present their ongoing work to establish a robust, structural, and foundational definition of a vulnerability. Their research…
- Can a General-Purpose LLM Do Tier-1 Triage? — Romulo Rocha
In an era where Security Operations Centers (SOCs) grapple with an overwhelming deluge of alerts and persistent analyst burnout, the promise of Artificial Intelligence (AI) for enhanced threat…
- One Poisoned Artifact Can Steer Your AI: How Robust Are Your LLM-Assisted Security Workflows? — Cheng-Lin Yang, Yen-Shan (Lily) Chen
In an era where Artificial Intelligence is rapidly integrating into critical enterprise functions, particularly in cybersecurity, the robustness and reliability of these systems are paramount. This…
- Attack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners — Yukiko Endo, Masato Jingu, Masaki Kubo
The proliferation of internet-wide scanning has become a significant challenge for security operations centers (SOCs) and incident responders. While many scans are conducted for legitimate purposes…
- Fighting Back Without Hacking Back: Why “Risk Management” Isn’t Enough In The Era of Cyber War — Tom Millar
In an era marked by a profound shift in the cyber threat landscape, Tom Millar of the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with Adam Shostack, delivered a…
- From Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF — Dr. Stephen Coston, William Rodriguez
In the rapidly evolving landscape of cybersecurity, incident response teams face an escalating barrage of challenges, from the proliferation of new attack surfaces in hybrid cloud environments to…
- Cyber Deception 2.0: Adaptive Honeynets and Canary Intelligence in Production — Peter Morin
In a landscape increasingly challenged by sophisticated cyber threats and persistent SOC overload, Peter Morin, Leader of PwC Canada's OT Cyber Security Practice, presented a compelling vision for…
- Leveraging AI to Review and Strengthen Your Incident Response Plan: A Proof of Concept — John Hollenberger
In an era where cyber attackers evolve at an unprecedented pace, often leveraging artificial intelligence themselves, traditional methods for reviewing and updating Incident Response Plans (IRPs)…
- Proactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware — Hiroaki Toyota
In an era where artificial intelligence is rapidly integrating into everyday software and infrastructure, the cybersecurity landscape faces an unprecedented challenge: agentic malware. This talk…
- Fighting Back Against Large-Scale Phishing Campaigns Targeting Swedish Municipalities, Regions ... — Mathias Persson
This talk, presented by Mathias Persson, a Cybersecurity Specialist at CERT-SE (the Swedish national coordinating CERT), delves into the anatomy and mitigation strategies for large-scale…
- How Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack Surfaces — Andreanne Bergeron
In an era of relentless data breaches, the sheer volume of exposed personal information has led to widespread fatigue among the general public, often resulting in a perceived loss of control over…
- My CERT PL – Free Security Tools for Everyone (in Poland) — Krzysztof Zając
In a compelling presentation at FIRSTCON, Krzysztof Zając from CERT PL unveiled mycert.pl, a groundbreaking national security portal designed to provide free cybersecurity tools and services to the…
- The EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ... — Mars Cheng
The European Union's Cyber Resilience Act (CRA) represents a pivotal shift in global cybersecurity regulation, moving beyond data privacy to mandate comprehensive security requirements for all…
- Chaos Stack: Designing Layered Tabletop Exercises for Complex Crisis Simulation — John Hollenberger
In the realm of cybersecurity, traditional tabletop exercises often fall short in preparing organizations for the chaotic reality of a real-world incident. John Hollenberger's talk, "Chaos Stack…
- The PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas — Vishal Thakur
In an era where cyber threats evolve at an unprecedented pace, the security community often finds itself in a reactive posture, responding to attacks only after they have been observed and reported…
- "Malice in the Modules" - How NPM Became a Supply-Chain Battleground? — Harish Shankar
In his FIRSTCON talk, "Malice in the Modules," Harish Shankar from Schneider Electric dissects the escalating threat landscape surrounding NPM (Node Package Manager) packages. The presentation…
- Panel: Peak Performance Under Pressure: Building Cross-Functional Resilience in Incident Response — Merisa Lee, Brooke Pearson, Melanie Ensign
This panel discussion, "Peak Performance Under Pressure: Building Cross-Functional Resilience in Incident Response," delivered at FIRSTCON, brought together seasoned incident response (IR)…
- Technical Recovery Plan (TRP) Exercise in a Cloud-Native Environment: Practical Lessons ... — Masanori Morino
In an era where ransomware attacks are increasingly sophisticated and impactful, organizations are compelled to rigorously test their recovery capabilities. Masanori Morino from KINTO Technologies…
- You Need Some Neurosparkle In Your SOC — Carson Zimmerman, Megan Roddie-Fonesca
In their compelling FIRSTCON talk, "You Need Some Neurosparkle In Your SOC," Carson Zimmerman of Microsoft and Megan Roddie-Fonesca, a Security Engineer at Datadog, champion the invaluable role of…
- From Planning to Impact: Lessons from Poland’s National Cybersecurity Exercises with a Dedicated ... — Marcin Fronczak, Miroslaw Maj
In this insightful FIRSTCON talk, Marcin Fronczak and Miroslaw Maj shared the extensive experience and lessons learned from over a decade of organizing national-scale cybersecurity exercises in…
- Monday Keynote: Perseverance, Growth and Success. The Sunburst Story from the CISO perspective. — Tim Brown
Tim Brown, currently the CISO at Team8 and formerly the Chief Information Security Officer for SolarWinds, delivers a poignant and remarkably candid keynote address at FIRSTCON, recounting the…
- Panel: From Takedown to Touchpoint: An Inside Look at the Data-sharing Pipeline in the Victim ... — Tod Eberle, Adam Diament, Stu W, Stewart Garrick, Chris Butera
This panel discussion, "From Takedown to Touchpoint," delves into the often-unseen mechanisms by which data from law enforcement disruption operations is shared to facilitate victim notification…
- Battle-Tested Incident Recovery: Lessons from the Front Lines — Jack Hughes
In his compelling FIRSTCON presentation, "Battle-Tested Incident Recovery: Lessons from the Front Lines," Jack Hughes, Senior Director of Digital Forensics and Incident Response for Unit 42 by Palo…
- Tabletop Lessons from 3 Decades and 2 Continents — Kenneth Van Wyk
In "Tabletop Lessons from 3 Decades and 2 Continents," Kenneth Van Wyk of KRvW Associates, LLC, presents a compelling analysis of the most common and egregious mistakes observed in incident response…
- Beyond Manual Hunting: OSINT Copilot with LLMs & Evidence-Based Collection, Enrichment ... — Matheus Bezerra, Victor Fabre
In an era defined by an ever-expanding digital attack surface and increasingly sophisticated threat actors, the traditional approach to cybersecurity threat hunting often falls short. Analysts are…
- The AI Assistant’s Betrayal: One-Click for AI to Turn into the Perfect Insider — Dolev Taler, Mark Vaitsman
In an era where Artificial Intelligence (AI) assistants are rapidly integrating into daily personal and organizational workflows, a critical gap has emerged between their burgeoning usability and…
- How EPSS Is Wrong and Useful at the Same Time — Jay Jacobs
In this compelling FIRSTCON talk, Jay Jacobs, a chief data scientist and one of the original creators of the Exploit Prediction Scoring System (EPSS), delves into the paradox inherent in EPSS: how…
- Seeing Through the Fog: Interpreting Entra ID Signals During AiTM Attacks — Pierre Audonnet
In this insightful FIRSTCON presentation, Pierre Audonnet, a Solution Engineer at Microsoft, delves into the escalating threat of Adversary-in-the-Middle (AiTM) attacks targeting Microsoft Entra ID…
- Dark Silicon: Unmasking GPU Threats in the Age of AI — Sneha Rangari
In an era where artificial intelligence is rapidly becoming the backbone of critical operations, the security of the underlying hardware, particularly Graphics Processing Units (GPUs), remains a…
- Critical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks — Julie Agnes Sparks, Greg Foss
In the rapidly evolving landscape of cybersecurity, Software-as-a-Service (SaaS) applications have become indispensable, yet they frequently represent critical blind spots for security teams. In…
- Panel: Tips and Tricks to Run a CSIRT in Low-income and Fragile Contexts — Ghislain de Salins, Palakiyem Assih, Sergio Guivala, Thank-You Hauwanga, Lawrence Muchilwa, Anat Lewin
This compelling panel discussion at FIRSTCON, expertly moderated by Ghislain de Salins of the World Bank, delved into the formidable challenges and inspiring success stories of establishing and…
- Climbing Toward the Summit of Defense: Practical Methods for Strengthening CSIRT Organizations — Aya Ohara, Kaori Fukuda, Ikuya Hayashi
In an era where cyber threats evolve at an unprecedented pace, the effectiveness of CSIRT (Computer Security Incident Response Team) organizations hinges not just on technical prowess, but…
- Eiffel: A Tool to Oversee Incident Response From the Heights — Óscar Salvador, Juan Gonzalez
In an era of rapidly evolving cyber threats and increasingly complex digital infrastructures, the Cybersecurity Agency of Catalonia (ACSC) has developed "Eiffel," a sophisticated platform designed…
- nx Compromise - AI as an Attack Vector — Olivia Brown
On August 26, 2025, the software supply chain was rattled by a sophisticated attack targeting nx, a widely adopted JavaScript build tool and monorepo framework. This talk, delivered by Olivia Brown…
- Threat From The Inside: Investigate eBPF Malware — Geri Revay
In this compelling talk at FIRSTCON, Geri Revay, a seasoned Malware Researcher and Threat Intelligence Analyst at Fortinet, delved into the escalating threat landscape surrounding eBPF (extended…
- Defeating Node.js Malware through API Tracing — Sven Rath
In an insightful talk at FIRSTCON, Sven Rath, a Security Researcher at Check Point Research, delved into the escalating threat of Node.js malware and introduced a powerful dynamic analysis…
- Bringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics — Junya Hiwatari
Digital forensics and incident response (DFIR) are critical yet often time-consuming processes, particularly when dealing with the vast amounts of log and artifact data generated in modern IT…
- Understanding Scammer Threats: Detection Strategies Aligned with Thailand’s Cybersecurity Act 2562 — Teerawut Wittayakorn, Saichon Saelee
This talk, presented by Major General Teerawut Wittayakorn and Saichon Saelee from Thailand's National Cybersecurity Agency (NCSA) at FIRSTCON, addresses the rapidly escalating problem of…