Blue Team Con 2026

arrow_back View All Dates

10:30am CDT

A Standard For Investigative Playbooks Swissôtel Chicago - Track 2Matthew Gracie Vulnerability Management: The Leadership Playbook Swissôtel Chicago - Track 3Lenny Zeltser

11:00am CDT

How We've Gone Completely Phishing-resistant (And So Can You!) Swissotel Chicago - Track 1Eric Woodruff

11:30am CDT

The Demon Dog of Defense in Depth Swissôtel Chicago - Track 2Aria Langer Threat Intelligence at the Speed of Cyber Defense Swissôtel Chicago - Track 3Joe Slowik

12:00pm CDT

Secrets That Survive Everything: The Shift-Right Runtime Gap Left Unguarded Swissôtel Chicago - Track 2Hemanth Gorijala

12:30pm CDT

Your User, Their Rules: Rethinking the OS trust model for the AI-era Swissôtel Chicago - Track 2Golan Myers • Ofir Balassiano MDR: From Vendor Shortlist to Security Partnership Swissôtel Chicago - Track 3Alan Simpson

1:00pm CDT

AI Failures in IR: A Field Guide to Filling the Gaps Swissôtel Chicago - Track 2Alex Thomson Game of Cones: Why Your Crisis Plan Shouldnt Melt Under Pressure Swissôtel Chicago - Track 3Richard Suls Defending the Hypervisor: Using Offensive Tooling to Validate vSphere Security Swissotel Chicago - Track 1Darryl Baker (DFIRDeferred)

1:30pm CDT

Life After Tier 1: Rebuilding the SOC When Triage Is Outsourced Swissôtel Chicago - Track 2Stuart Fairchild Make the Governed Path the Apparent One Swissôtel Chicago - Track 3Johnathon Rhoades

2:00pm CDT

Learning How to Pop Champagne Bottles: How Leaders Should Reframe Cyber Wins and Losses Swissôtel Chicago - Track 2Anthony Hendricks Teaching AI to Analyze Malware: How to Encode Practitioner Expertise into an MCP Server Swissôtel Chicago - Track 3Lenny Zeltser The Second Front: Detecting LOTL Off the Endpoint Swissotel Chicago - Track 1Mark Orlando

2:30pm CDT

Vibe Check: Scaling AppSec in an AI-Driven World Swissôtel Chicago - Track 2Cory Roop CISA’s Menu for Vulnerability Management Swissôtel Chicago - Track 3Justin Murphy • Julia Turkevich

3:00pm CDT

It Started with an Employee. It Ended Inside Your AI: The Exposure Chain You Need to Understand Swissôtel Chicago - Track 2Derick Johnson Beyond The Auth Artifacts: Identifying Intrusions by Correlating Identity and EDR Telemetry Swissôtel Chicago - Track 3Shogo Hayashi • Teruki Yoshikawa Entra the Dragon: Entra ID Red vs Blue Swissotel Chicago - Track 1Sean Metcalf

3:30pm CDT

Paving the Road for AI-Driven Security Teams Swissôtel Chicago - Track 2Joakim Pedersen • Britton Hayes Beyond the SIEM: Critical Governance and Architecture Decisions for Modern SOCs Swissôtel Chicago - Track 3Bart Stump (Stumper) • Jeremy Croghan

4:00pm CDT

Finding SOCKS with ProxyWatch Swissôtel Chicago - Track 2Brian Reitz • John Wotton The End is Just the Beginning of Better Security: Enhancing Vulnerability Management with OpenEoX Swissôtel Chicago - Track 3Justin Murphy

4:30pm CDT

Zero Trust After the Breach: Lessons from Real-World Incident Response Swissôtel Chicago - Track 2Andrea Ibiassi It Wasn’t Spoofed: Investigating Authenticated Email Abuse in Real Environments Swissôtel Chicago - Track 3Kelsey O'Connell (w0mbat)

5:00pm CDT

Superposition, not Superstition Swissôtel Chicago - Track 2Johnny Xmas

5:30pm CDT

Building the Human Firewall: Why Security Awareness Must Precede the Workplace Swissôtel Chicago - Track 2Nousheen Begum