FIRST Conference 2026 (FIRSTCON26)
2026-06-14..2026-06-19
Denver, United States
who it's for
incident responders, soc analysts, cert and csirt staff, threat intelligence analysts, security engineers, vulnerability managers, security researchers, product security engineers
topics
STIX 2.x packages; TAXII and MISP integration; IMX guided mode; LLM retriever baiting; RAG and vector retrievers; EDR for agentic malware; eBPF malware investigation; GPU threats to AI systems; CRA compliance and SBOMs; adaptive honeynets and deception; OCSF log normalization and timelines; malicious code signing at scale
| title | author | length |
|---|---|---|
| Indicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing | Brian DeWyngaert | 27m |
CISA’s IMX is an open‑source, containerized platform that turns analyst narratives into validated STIX 2.x packages in minutes, deployable via Docker. A… | ||
| Protecting Customers Through Smarter OSS Management | Lisa Bradley, Patricia Tarro | 44m |
Dell shows how it built a central dependency management platform (DMP), ingests SCA outputs, scores components with an OpenSSF‑derived trustworthiness score… | ||
| The Vulnerability Identity Crisis | Art Manion, Jay Jacobs | 37m |
Current vulnerability records lack consistent identity, so the talk proposes a structural working definition and a rearchitecture: a vulnerability is a… | ||
| Can a General-Purpose LLM Do Tier-1 Triage? | Romulo Rocha | 34m |
Controlled experiment evaluates 600 synthetic alerts (three rounds of 100 alerts each, 30% true positives, two hidden campaigns of 15 alerts each) using an… | ||
| One Poisoned Artifact Can Steer Your AI: How Robust Are Your LLM-Assisted Security Workflows? | Cheng-Lin Yang, Yen-Shan (Lily) Chen | 43m |
Researchers build a RAG pipeline with BC embedding base as retriever and qwen 34B as generator and show a single attacker‑crafted document containing a… | ||
| Attack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners | Yukiko Endo, Masato Jingu, Masaki Kubo | 43m |
A darknet of ~300,000 unused IPv4 addresses collects packets and a real‑time methodology classifies survey‑scanner traffic, links it to organizations, and… | ||
| Fighting Back Without Hacking Back: Why “Risk Management” Isn’t Enough In The Era of Cyber War | Tom Millar | 29m |
Claim: nation-state and criminal actors move from espionage to deliberate disruption, hitting healthcare and utilities (examples: Sandworm, Vault Typhoon… | ||
| From Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF | Stephen Coston, William Rodriguez | 32m |
Claims a reproducible, schema-first pipeline (Ingest → Normalize → AI Assist → Validate → Timeline → Export) that converts fragmented AWS/Azure/SaaS/endpoint… | ||
| Cyber Deception 2.0: Adaptive Honeynets and Canary Intelligence in Production | Peter Morin | 35m |
Claims an open source, Python single‑process adaptive grid that turns distributed honeypots into an intelligence layer, using modules for SSH/HTTP, TCP‑stack… | ||
| Leveraging AI to Review and Strengthen Your Incident Response Plan: A Proof of Concept | John Hollenberger | 30m |
A proof of concept uses free Google Gemini, Microsoft Copilot, and ChatGPT to evaluate an incident response plan against NIST 800‑61 R3 mapped to CSF 2.0… | ||
| Proactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware | Hiroaki Toyota | 33m |
A safe, containerized adversary rig demonstrates an observe–plan–act agent that generates Python code in memory, performs seven sequential goals (recon… | ||
| Fighting Back Against Large-Scale Phishing Campaigns Targeting Swedish Municipalities, Regions ... | Mathias Persson | 25m |
Between June 2024 and May 2025 attackers compromise Microsoft 365 accounts across Swedish municipalities and regions, abuse SharePoint/OneNote to host a… | ||
| How Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack Surfaces | Andréanne Bergeron | 41m |
Proposes a four-branch Identity Exposure Metric built from a 216B+ record corpus, a 348‑row market dataset and a 29‑law sentencing corpus, using an iterative… | ||
| My CERT PL – Free Security Tools for Everyone (in Poland) | Krzysztof Zając | 36m |
A free portal provides automated vulnerability scanning (Artameis uses Nuclei, SQLmap and other OSS), password-leak ingestion and notification, enriched… | ||
| The EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ... | Mars Cheng | 30m |
The EU CRA applies to any product with a digital element sold in the EU and imposes Sep 11, 2026 reporting start plus full manufacturer obligations by Dec 11… | ||
| Chaos Stack: Designing Layered Tabletop Exercises for Complex Crisis Simulation | John Hollenberger | 39m |
Chaos Stack is a layered, time‑sequenced tabletop method that injects injects every 5–10 minutes across cyber, legal, operations and PR so teams face competing… | ||
| The PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas | Vishal Thakur, David Wearing, Niels Heijmans | 39m |
An open‑source framework called PR3TACK catalogs plausible but unobserved adversary TTPs and already publishes directly to GitHub with over 40 techniques and a… | ||
| "Malice in the Modules" - How NPM Became a Supply-Chain Battleground? | Harish Shankar | 39m |
Detailed case studies show attackers using npmjs.help spoofing, infostealer malware to harvest CI/CD access tokens and TruffleHog to find secrets, then pushing… | ||
| Panel: Peak Performance Under Pressure: Building Cross-Functional Resilience in Incident Response | Merisa Lee, Brooke Pearson, Melanie Ensign | 44m |
Panel argues incident response works when day‑to‑day ops mirror incident workflows, so teams run weekly Slack drills, use dedicated incident command separate… | ||
| Technical Recovery Plan (TRP) Exercise in a Cloud-Native Environment: Practical Lessons ... | Masanori Morino | 26m |
Practical case study of a ransomware Technical Recovery Plan exercise triggered by a 2023 Toyota Financial Services incident, focused on Amazon Aurora MySQL… | ||
| You Need Some Neurosparkle In Your SOC | Carson Zimmerman, Megan Roddie-Fonesca | 43m |
Argues that neurodivergent staff deliver measurable SOC wins: faster pattern matching, deeper threat hunting, and persistent follow‑through, while also… | ||
| From Planning to Impact: Lessons from Poland’s National Cybersecurity Exercises with a Dedicated ... | Marcin Fronczak, Miroslaw Maj | 43m |
Three national KSC‑EXE editions validate an NIS‑based approach using a dedicated CyberBastion TTX platform that runs realistic multi‑sector scenarios with… | ||
| Monday Keynote: Perseverance, Growth and Success. The Sunburst Story from the CISO perspective. | Tim Brown | 01h 01m |
Timeline starts with a Dec 12 notification that tainted Orion builds shipped in three releases, 18,000 downloads but under 100 fully compromised; attackers… | ||
| Panel: From Takedown to Touchpoint: An Inside Look at the Data-sharing Pipeline in the Victim ... | Tod Eberle, Adam Diament, Stu W, Stewart Garrick, Chris Butera | 42m |
Describes how law enforcement seizes domains and redirects traffic to sinkhole redirection run on Shadowserver name servers to enumerate live victims, how… | ||
| Battle-Tested Incident Recovery: Lessons from the Front Lines | Jack Hughes | 39m |
Unit 42 reports that 86% of incidents cause business impact and offers a tested recovery path that chooses between remediating the estate or rebuilding it… | ||
| Tabletop Lessons from 3 Decades and 2 Continents | Kenneth R. van Wyk | 45m |
Dataset covers 150+ exercises across two continents and shows recurring operational failures: bloated 250‑page IRPs nobody uses, missed chain‑of‑custody and… | ||
| Beyond Manual Hunting: OSINT Copilot with LLMs & Evidence-Based Collection, Enrichment ... | Matheus Bezerra, Victor Fabre | 34m |
A pipeline turns chaotic forum and marketplace scraping into searchable intelligence: HTTP clients and browser automation handle scale and bot defenses… | ||
| The AI Assistant’s Betrayal: One-Click for AI to Turn into the Perfect Insider | Dolev Taler, Mark Vaitsman | 43m |
Researchers disclose two one‑click flaws in Microsoft Copilot: RePrompt abuses a Q URL parameter in Copilot Personal to auto‑execute injected prompts that… | ||
| How EPSS Is Wrong and Useful at the Same Time | Jay Jacobs | 40m |
EPSS outputs a daily probability (0–100%) that a CVE sees observed exploitation in the next 30 days, trained on a matrix of roughly 2,800 features and ~110… | ||
| Seeing Through the Fog: Interpreting Entra ID Signals During AiTM Attacks | Pierre Audonnet | 42m |
Shows a recorded demo where an adversary proxies Entra ID sign‑ins with an Evil Jinx variant, harvests session cookies, uploads them to Azure storage and… | ||
| Dark Silicon: Unmasking GPU Threats in the Age of AI | Sneha Rangari | 28m |
GPUs are silently abused for crypto‑mining and model theft: VRAM‑resident malware (eg. Jellyfish) and side‑channel snooping leave no OS logs, while a… | ||
| Critical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks | Julie Agnes Sparks, Greg Foss | 46m |
Covers concrete SaaS attack patterns and detections: Salesforce and Clue breaches via OAUTH tokens abused to pull CRM tables, Snowflake exfiltration from dev… | ||
| Panel: Tips and Tricks to Run a CSIRT in Low-income and Fragile Contexts | Ghislain de Salins, Palakiyem Assih, Sergio Guivala, Thank-You Hauwanga, Lawrence Muchilwa, Anat Lewin | 39m |
Multiple countries show concrete wins: Mozambique secures a cybersecurity and cybercrime law and creates a national cyber fund in law, Namibia runs incident… | ||
| Climbing Toward the Summit of Defense: Practical Methods for Strengthening CSIRT Organizations | Aya Ohara, Kaori Fukuda, Ikuya Hayashi | 42m |
Five‑year community program runs 57 continuous sessions with 508 organizations and 534 practitioners, meeting monthly and averaging about 5–15 attendees per… | ||
| Eiffel: A Tool to Oversee Incident Response From the Heights | Oscar Salvador, Juan Gonzalez | 30m |
Eiffel ingests KAPE outputs and Velociraptor JSON into a normalized data lake, runs SIGMA-based alerts (about 3,000 community rules plus 65 lab-created rules)… | ||
| nx Compromise - AI as an Attack Vector | Olivia Brown | 26m |
A supply‑chain compromise of nx on Aug 26, 2025 publishes 19 malicious versions over eight hours and weaponizes Claude, Gemini, Q CLI to have developers’ local… | ||
| Threat From The Inside: Investigate eBPF Malware | Geri Revay | 40m |
eBPF is kernel‑hook code that threat actors use to pseudoadd privilege escalation and to text‑replace hiding cronjob outputs; most real‑world malware still… | ||
| Defeating Node.js Malware through API Tracing | Sven Rath | 33m |
A purpose-built Node.js Tracer instruments the runtime by hooking module APIs (installed via the preload require flag), spoofs API returns to defeat… | ||
| Bringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics | Junya Hiwatari | 31m |
A tool called Attack Flow Finder (AFF) uses an explicit Ordered-Sigma rule file to require event sequences across disparate artifacts (MFT, USN, Browser… | ||
| Understanding Scammer Threats: Detection Strategies Aligned with Thailand’s Cybersecurity Act 2562 | Teerawut Wittayakorn, Saichon Saelee | 43m |
Thailand documents over 400,000 scam cases and builds a national response around a central AOC with hotline 1441 and a 10-minute rule to ID cases and contact… | ||
| Itinerary to Defeat Yet Another Beacon Implementation | Naoki Takayama | 30m |
Three reimplementations of Cobalt Strike beacon in Rust and Go get deep analysis: one Rust project is simple with config in plain text, another Rust project… | ||
| AI Interpretability as a Security Control: Introducing the CIRCUIT Framework | Eric Zielinski | 31m |
CIRCUIT is an open standard that turns interpretability into a reproducible security control: a numeric CRS computed as risk tier × (6 − IMS) ×… | ||
| From Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response | Tom Millar, Rina Rakipi | 36m |
An analyst finds a threat actor’s engineering workstation revealing novel TTPs used in three separate incidents, which enables seizure of infrastructure and… | ||
| Introducing StealerLens: An LLM-Powered Forensics Microscope to Accelerate InfoStealer ... | Olivier Bilodeau | 42m |
StealerLens is an LLM‑powered forensics microscope that ingests single infection stealer logs (average 2.3 MB, ~30 files) and returns a ranked infection… | ||
| Sysmon Deep Dive: Real Detection Scenarios You Can Reproduce | Peter Morin | 32m |
Sysmon versioned as a low-overhead kernel driver logs hashed process creations, DNS and network connections, DLL injection and session GUIDs, demonstrated with… | ||
| Building a Regional ISAC for West Africa that Works: Governance, Tools and Community Maturity | Don Stikvoort, Miroslaw Maj | 39m |
A two‑year project builds a regional ISAC across 12 ECOWAS countries (Nigeria to Cabo Verde) using SIM3 maturity roadmap and the FIRST CSIRT Services Framework… | ||
| Malicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses | Aaron Walton | 30m |
Research-backed dataset shows ~2.5k abused code‑signing certificates tracked and about 70 new malicious certs per month, mostly obtained by impersonation and… | ||
| Who Did It? Getting Started with Threat Actor Profiling | Marthe Råheim Rogndokken | 28m |
Introduces PACT as a stepwise profiling workflow: detect the incident, collect and label evidence with an admiralty code, then analyze in three concurrent… | ||
| The Clock is Ticking: CRA Compliance at Scale | Lisa Bradley, Sarah Evans | 36m |
Shows a large vendor mapping CRA deadlines into concrete workstreams: September 11 notifications and December 11 full compliance, with operational… | ||
| Arcana: A Unified Framework for Incident Response Documentation and Knowledge Management | Vishal Thakur, Jayden Vo | 38m |
A practical IR documentation framework released publicly on Atlassian’s GitHub at FIRSTCON26, Arcana provides 19 playbooks, ~90 runbooks and SOP templates… | ||
| The SOC Of The Future… The Future Is Now | Carson Zimmerman | 32m |
Argues the SOC must be engineered for scale, complexity, and burnout with four focus dimensions: MITRE ATT&CK coverage, business constituency, IT surface… | ||
| Hack Your Board's Mindset: Closing the Strategy-Operations Gap via Board Game Simulations | Yi-Hsien Chen | 34m |
Claims that encoding CDM and CTEM into game-based simulations builds shared mental models and speeds alignment by months. Two tabletop programs — CyberKen… | ||
| Benchmarking Your Constituency: A Practical Framework for CERTs with Results from Academic Sector | Juha Haaga | 43m |
Methodology uses official registries (NCES, ETER), certificate‑transparency and IP→org databases, Shodan scans and CT‑based subdomain discovery, plus AI… | ||
| From Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation | Mor Weinberger | 39m |
Analysis of 10,000 open‑source projects and 10 million findings shows long MTTR: 90% of CVEs already have fixes yet about 40% remain in containers for over 6… | ||
| Everything Everywhere All at Once…in 2038 | Pedro Umbelino | 39m |
Explains that the 2036–2038 rollovers are a systemic vulnerability rooted in the 32‑bit 2038 Unix time_t pattern, not just a single bug, and shows empirical… | ||
| A Researcher Centric Approach to Coordinated Vulnerability Disclosure | Patrick Garrity | 44m |
Proposes a researcher‑centric CVD model where a dedicated coordination team validates findings, identifies the correct supplier, opens communication channels… | ||
| From CVD to Secure Releases: Automating Security from Source to Releases | Vijay Sarvepalli, Christopher Cullen | 39m |
Asserts that Coordinated Vulnerability Disclosure must move from notification to active fixes by integrating with GitHub/GitLab and registries (npm, PyPI)… | ||
| OROCHIFY - An Assist to Product Developers in Manufacturing Industry to Find Vulnerabilities | Yuki Osawa, Chih-Hsiang Chang | 34m |
OROCHIFY is a Docker-based orchestration framework that runs third‑party scanners and proprietary scripts to give product teams fast pre-test checks during… | ||
| CSIRTeaming: Forging Resilient Incident Management Teams with Psychological Safety | Yoshiki Sugiura | 32m |
Proposes CSIRTeaming: a concrete model that combines High Reliability Organization practices and psychological safety to stop repeat incidents by fixing team… | ||
| Disparate Data, Distorted Decisions: Vendor Data Bias in CTI | Eli Woodward | 25m |
Empirical comparison of annual IR/TI reports shows structural bias: Unit 42, Mandiant, CrowdStrike and Verizon disagree on top initial access — some list… | ||
| Mind Over Malware: Reducing Decision Fatigue in Incident Response Teams | John Hollenberger, Jennifer Trujillo Hollenberger | 27m |
Claims that the brain is the incident-response bottleneck: stress triggers fight/flight/freeze/fawn, raising cognitive load and causing decision fatigue that… | ||
| nothing matches | ||