#blueteamcon — Public Fediverse posts

I had an amazing time at #BlueTeamCon 2026. I wrote up some of my notes and learnings (with a little help from AI).

https://dwayne-mcdaniel.com/blog/BlueTeamCon2026.html

#BlueTeamCon 2026
LLMs - How to Trust When We Can’t Verify
Stephanie Losi

#BlueTeamCon 2026
Why Incident Response Plans Fail Under Pressure
Ron Dilley

Glad to see this callout from Bansal at #BlueTeamCon - this has been true for awhile

#BlueTeamCon 2026
From Hours to Minutes With StealerLens: LLM-Accelerated Infostealer IR for Overwhelmed SOCs
Olivier Bilodeau

#BlueTeamCon 2026
Containers Don't Lie. But Your Security Tooling Might Be Missing What They're Saying
Advait Patel

Good general note for detection from Patel at #BlueTeamCon

Evidence & Provenance or GTFO. AI hallucinates like it’s at burning man, you need to make it show its work. - Justin Borland at #BlueTeamCon

GitHub is used by threat actors because it’s almost ideal for malware hosting - nearly universally allowed and easy for code to blend in - Justin Borland at #BlueTeamCon

Day 2 of #BlueTeamCon 2026 kicks off with:
The Malware Is Coming from Inside the Repo
from Justin Borland

#BlueTeamCon 2026

Building the Human Firewall: Why Security Awareness Must Precede the Workplace

Nousheen Begum

#BlueTeamCon 2026
Defending the Credential Reset Process
Tom Cross

#BlueTeamCon 2026
Zero Trust After the Breach: Lessons from Real-World Incident Response
Andrea Ibiassi

#BlueTeamCon 2026
The End is Just the Beginning of Better Security: Enhancing Vulnerability Management with OpenEoX
Justin Murphy from CISA

#BlueTeamCon 2026
Paving the Road for AI-Driven Security Teams
Britton Hayes
and
Joakim Pedersen

#BlueTeamCon 2026

It Started with an Employee. It Ended Inside Your AI: The Exposure Chain You Need to Understand

Derick Johnson

#BlueTeamCon 2026
Proactive Malware Hunting
Megan Carney

#BlueTeamCon 2026

The Second Front: Detecting LOTL Off the Endpoint
Mark Orlando

Write your documentation so AI can scrape documentation you trust - Johnathon Rhoades at #BlueTeamCon (I hate this is where we’re at but this is prolly true)

#BlueTeamCon 2026
Make the Governed Path the Apparent One
Johnathon Rhoades

#BlueTeamCon 2026
Game of Cones: Why Your Crisis Plan Shouldn't Melt Under Pressure
Richard Suls

Your User, Their Rules: Rethinking the OS trust model for the AI-era
Ofir Balassiano and Golan Myers
#BlueTeamCon 2026

Fast, cheap, or good: pick two - @jfslowik at #BlueTeamCon

The purpose of CTI is to reduce uncertainty in decision-making. You need to know your stakeholders. - @jfslowik at #BlueTeamCon

Too Big to Review: Scaling AppSec to Zero at Fortune #1
Adam Schaal
#BlueTeamCon 2026

Find the choke point (where multiple attack points converge) and fix that first - Irina Dimitrov (Loktionova) at #BlueTeamCon

Mobilization in CTEM is the most important step: assign ownership for fixes - Irina Dimitrov (Loktionova) at #BlueTeamCon (see also: people are the hardest problem in infosec)

Golden rule of threat hunting:90% of what you find is IoT devices and admins doing something weird - Matthew Gracie at #BlueTeamCon https://github.com/InfosecGoon/StandardForPlaybooks

HCIP (human centered investigative playbooks) are both human and machine readable - Matthew Gracie at #BlueTeamCon https://github.com/InfosecGoon/StandardForPlaybooks

#BlueTeamCon 2026
Vulnerability Management: The Leadership Playbook
Lenny Zeltser