Blue Team Con 2026

arrow_back View All Dates

12:00am CDT

[Last Minute] Capture The Flag Swissôtel Chicago Unconference Swissôtel Chicago

8:00am CDT

Mental Health Hackers' 2nd Annual 9 Bridge Challenge [Run] Swissôtel Chicago

8:30am CDT

Coffee & Tea Break Swissôtel Chicago

9:00am CDT

General Conference Registration Swissôtel Chicago Swag Booth Open Swissôtel Chicago

10:00am CDT

How to Do Just About Anything (Including Security): Turning Curiosity and Creativity into a Career Swissôtel Chicago - Track 2Dan Browder The Malware Is Coming from Inside the Repo Swissôtel ChicagoJustin Borland Active Directory Post-Mortem: Assumptions vs Reality Swissôtel ChicagoDavid Horak CTF Village Swissôtel Chicago Cyber Polyglots Village Swissôtel Chicago IoT Village Swissôtel Chicago Labs Village Swissôtel Chicago Linux Village Swissôtel Chicago Wellness Village Swissôtel Chicago Massages in The Wellness Village Swissôtel Chicago

10:30am CDT

From Logs to Logic: Building Detections That Don’t Suck Swissôtel Chicago - Track 2Kyle Barboza

11:00am CDT

Containers Don't Lie. But Your Security Tooling Might Be Missing What They're Saying Swissôtel Chicago - Track 2Advait Patel Fortress in a Box: Enterprise-Grade Kubernetes Security for the Organizations That Can't Afford It Swissotel Chicago - Track 1José Lorenzana Slaying the Sprawl: A Hero’s Guide to Building (or Re-Forging) a Cloud Security Program Without a 20-Person Guild Swissôtel Chicago - Track 3Steve Turner El Azteca - Mexican Food Truck Swissôtel Chicago Nick's Pizza Truck Swissôtel Chicago

11:30am CDT

Deception strategy for securing cloud workloads Swissôtel Chicago - Track 2Suril Desai

12:00pm CDT

When the Package Is the Weapon: Detecting and Responding to npm Supply Chain Intrusions Swissôtel Chicago - Track 2Mohit Bansal Trusted, But Dangerous: Identity Abuse Through First-Party Apps in Entra Swissotel Chicago - Track 1Joe Morrissey • Jon Haas From Hours to Minutes With StealerLens: LLM-Accelerated Infostealer IR for Overwhelmed SOCs Swissôtel Chicago - Track 3Olivier Bilodeau

12:30pm CDT

Models and More: using data to inform decision making Swissôtel Chicago - Track 2Amanda Draeger

1:00pm CDT

Using Pentest Findings to Improve Detections Swissôtel Chicago - Track 2Ashley Knowles I Want to Tell You Two Stories: A Practice for Protecting Your Mental Health Swissôtel Chicago The Only Way to Win Is by Learning: Deception Design, Read Through a Comedy Game Show Swissotel Chicago - Track 1Dylan Shroll Why Incident Response Plans Fail Under Pressure Swissôtel Chicago - Track 3Ron Dilley

1:30pm CDT

From Compliance to Covert Ops: Demystifying the Offensive Security Landscape Swissôtel Chicago - Track 2Sandun Bambarandage

2:00pm CDT

The Contextualization Gap: Why Your SOC Has the Data But Not the Story Swissôtel Chicago - Track 2Cyrus Walker Strength in Diversity: Building an Inclusive Cybersecurity Workforce Swissotel Chicago - Track 1Rick Hudson LLMs - How to Trust When We Can’t Verify Swissôtel Chicago - Track 3Stephanie Losi Girl Scout Cookies Swissôtel Chicago

2:30pm CDT

AI-Assisted IR Without the Lies: A Browser Forensics Case Study Swissôtel Chicago - Track 2Kyle Henson • Aaron Hau

3:30pm CDT

Closing Ceremonies Swissôtel ChicagoPhoenix Fier • Frank McGovern • Alyssa Miller • Becky Selzer • Tillery • Stel Valavanis