FIRST Cyber Threat Intelligence Conference 2026
2026-04-21..2026-04-23
Munich, Germany
who it's for
threat intelligence analysts, incident response and DFIR teams, security operations center analysts, security automation engineers, CERT and CIRT teams, CTI platform and integration engineers, security researchers and open source contributors
topics
trust scoring for indicators; self-healing plugin pipelines; Telegram cybercrime collection; RAG security and injection mitigations; embeddings plus LLM pruning for logs; OpenCTI MISP STIX integration; detection as code pipelines; vulnerability sighting forecasting models; Poisson and logistic/DKI selector; community CTI feed vetting taxonomy; pushing high-confidence IOCs to CN and EDR
| title | author | length |
|---|---|---|
| Billions of Indicators, Zero Action: How We Fixed That | Daniel Lima, Gabriel Testoni | 28m |
Organizations start with billions of indicators and under 10% becoming action; the team builds a modular microservice CTI pipeline that enriches indicators… | ||
| Unlocking Insights: The Role of TI in Modern DFIR Operations | Efstratios Lontzetidis, Stef Collart (NVISO) | 32m |
Shows concrete DFIR+TI workflows that turn a few indicators into bigger breakouts: URLScan, VirusTotal and Malware Bazaar pivots attribute an Android sample to… | ||
| IC5 – Integrated CERT Cyber Communications, Collaboration & Coordination Framework | Rakesh Kumar Singh, Yudhishthira Sapru | 26m |
IC5 is a behavioral five-layer model that turns raw alerts into classified context (gauge), a prescribed tone (compass), audience-specific frames (prism)… | ||
| How NOT to be Your Adversary's Best Friend - Doing What Matters... | Brian Hein (CA), James Shank | 26m |
Argues that tactical “actionable” CTI is a crutch and instead pushes teams to measure business outcomes in dollars, not IOC counts, citing 50–100k IOCs… | ||
| Forecasting Vulnerability Sightings Under Data Scarcity: Modeling Sparse and Bursty Cyber Threat ... | Alexandre Dulaunoy, Cédric Bonhomme | 33m |
Built an open source pipeline called Vulnerability-Lookup ingesting ~70 sources and over 2 million vulnerability records, and a severity estimator called VLI… | ||
| Beyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence | Cydney Stude, Steve de Vera, Vamshi Krishna Edamadaka | 25m |
An AWS CIRT team builds a hybrid threat data extraction tool that combines deterministic DFS parallel processing over CloudTrail CSVs with an embeddings + LLM… | ||
| Operational Efficiency in CTI: A Blueprint for SME's Using Open-Source AI and Cognitive Automation | Omar Saenz, Raquel Guzman | 32m |
Blueprint promises a runnable CTI stack for cash-strapped SMEs built on OpenCTI, MISP, STIX plus cognitive automation that extracts IoCs and MITRE TTPs via RAG… | ||
| One Bad OSINT Can Ruin Everything: How Secure is Your CTI RAG System, and Can You Minimize the Risk? | Sian-Yao Eric Huang, Yen-Shan Chen | 29m |
Demonstrates a practical exploit where inserting a single malicious OSINT report into a CTI corpus plus targeted retriever+generator optimization (discrete… | ||
| Hunting Cyber Threat Intelligence on Telegram | Emmanuele Zambon, Luca Allodi, Roy Ricaldi, Victor Asanache | 32m |
TeleHUNT automated framework systematically discovers Telegram cybercrime communities using 28 discovery configurations (links, handles, forwards; Open Web vs… | ||
| OpenTide: From Raw Intelligence to Structured Threat-Informed Detections | Amine Besson, Remi Séguy | 25m |
OpenTide turns raw CTI into validated detection assets by modeling atomic threat vectors, bundling them into detection objectives, and rendering concrete… | ||
| Filtering the Noise: Crafting an Actionable Threat Feed from Community-Shared Intelligence | JJ Josing | 31m |
Community MISP pipeline uses PyOTI enrichment modules to run dozens of API lookups (Circle Hash Lookup, VirusTotal, Greynoise Riot, Cisco Umbrella), tags… | ||
| CTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard Ecosystem | Alexandre Dulaunoy, Christian Studer | 30m |
CTI-Transmute is an open-source conversion layer that reliably maps between the MISP Standard and STIX by building on the misp-stix/MiSTIC library, exposing a… | ||
| Dealing With Uncertainty: Scenario Planning for Cybersecurity Decision-Making | Gert-Jan Bruggink | 33m |
Distills decades of theory into a usable 7-step practical framework with templates and facilitator guidance tested in real Venation engagements and workshops… | ||
| Evaluating Threat Intelligence Through Velocity | Joe Slowik | 26m |
Claim: cyber threat intelligence is decision support and its operational value collapses if it arrives too late, so measure CTI by delivery velocity. Argues an… | ||
| nothing matches | ||