Beyond the Checkbox: What Breaks When You Actually Stress-Test Cloud Incident Response
M Harvey
fwd:cloudsec North America 2026 · Day 1
In the realm of cloud security, the true test of an organization's incident response (IR) capabilities often comes not from theoretical discussions but from real-world chaos. Matthew Harvey, a founding member of AWS's customer incident response team, presented a compelling talk at fwd:cloudsec on the critical disconnect between how organizations *think* their IR processes work and how they *actually* perform under pressure. His presentation, "Beyond the Checkbox: What Breaks When You Actually Stress-Test Cloud Incident Response," delves into the shortcomings of traditional tabletop exercises and introduces a more rigorous, Dungeons & Dragons-inspired approach to simulation.
AI review
Competent practitioner talk from someone who's clearly done the work — 50+ SERS engagements gives Harvey real pattern-recognition on where IR programs rot. The observations are valid and the methodology is sensible, but none of this is surprising to anyone who's run tabletops seriously. Fills a slot well for an audience that hasn't already internalized these lessons.