Blue Team Con 2026

When a breach hits, the instinct is clear: shut everything down. But is that always necessary and what does it cost the business?
In the face of increasingly sophisticated attacks, perimeter-based defences often collapse once compromised. This session explores how Zero Trust changes that equation, not during the breach itself, but in how organisations recover and rebuild securely.
Drawing on real-world incident response in large enterprises, the talk shows how to turn reactive recovery into long-term resilience. It highlights what actually works in practice: reducing lateral movement, limiting blast radius, and maintaining essential services while addressing practical challenges.
This includes rapid onboarding of tens of thousands of users under crisis conditions, enabling secure third-party access for recovery teams, and implementing segmentation across workforce, datacentre, branch, and OT environments.
Breaches create a rare window to enforce least-privilege access and accelerate Zero Trust adoption.