FIRST

Improving Security Across Nations with FIRST: Maarten Van Horenbeeck, FIRST Liaison Member

🌐 In this week's "Improving Security Across Nations with FIRST" video series, we spotlight Maarten Van Horenbeeck, FIRST Liaison Member and Cybersecurity Fellow at Adobe.

He shares how openness and community ...

[+] Show More

Now Playing

Improving Security Across Nations with FIRST: Maarten Van Horenbeeck, FIRST Liaison Member

🌐 In this week's "Improving Security Across Nations with FIRST"...

Now Playing

Improving Security Across Nations with FIRST: Dr. Lisa Bradley, FIRST PSIRT SIG Member

🌐 In this week's "Improving Security Across Nations with FIRST"...

Now Playing

Improving Security Across Nations with FIRST: Sneha Rangari, FIRSTCON26 Speaker

🌐 In this week's "Improving Security Across Nations with FIRST"...

Now Playing

Improving Security Across Nations with FIRST: Ken van Wyk, FIRST Member

🌐 In this week's "Improving Security Across Nations with FIRST"...

Now Playing

Indicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing

Brian DeWyngaert (CISA, US) Threat intelligence is only as valuable as...

Now Playing

Protecting Customers Through Smarter OSS Management

Lisa Bradley (Dell Technologies, US), Patricia Tarro (Dell...

Lisa Bradley (Dell Technologies, US), Patricia Tarro (Dell Technologies, US)

As organizations increasingly rely on Open Source Software (OSS) to drive innovation, strong security practices are critical to safeguarding customers. This ...session provides a practical roadmap for building a mature OSS security strategy — from defining trusted OSS and maintaining secure repositories to generating Software Bills of Materials (SBOMs) for visibility, dependency tracking, incident response, and end‑of‑life planning.

Drawing on real‑world lessons from Dell Technologies’ OSS security journey, we’ll share challenges faced, strategies implemented, and actionable insights for creating a scalable, resilient framework. Attendees will learn how to select trustworthy OSS, proactively address vulnerabilities, and stay current with secure versions — transforming OSS management from a compliance task into a strategic advantage.

Whether you’re starting your OSS program or looking to strengthen it, this talk equips you with the tools to protect customers and secure your open‑source future.

---

Dr. Lisa Bradley is a distinguished cybersecurity expert and visionary leader, currently serving as the Senior Director of Product & Application Security at Dell Technologies. With over two decades of experience in enterprise-class engineering, including 13 years in product security leadership, Dr. Bradley has established herself as a trailblazer in the field of cybersecurity and vulnerability management.

In her current role, she leads Dell’s Product Security Remediation efforts, driving initiatives such as Vulnerability Response/PSIRT, post-GA security findings remediation, the Bug Bounty Program, Product 360 Risk, and Dependency Management. She also plays a pivotal role in supporting Dell’s Software Bill of Materials (SBOM) initiative, ensuring transparency and security across the product lifecycle.

Her commitment to advancing the cybersecurity industry extends beyond her corporate responsibilities. She is a frequent speaker at industry events and podcasts, and a proud co-author of the FIRST PSIRT Services Framework, contributing to global standards in incident response. Outside of her professional endeavors, Dr. Bradley enjoys spending quality time with her three children and friends. Her unwavering dedication to cybersecurity, combined with her leadership and advocacy, continues to inspire innovation and build trust in the ever-evolving landscape of technology and cyber defense.

Patricia Tarro is the Product Manager for Dependency Management at Dell Technologies. In this role, she is responsible for building and maintaining a platform that modernizes and adds efficiency to existing Dell processes related to the assessment of internal and external component security risk in product releases. Tricia has over 30 years of Information Technology experience, having spent the most recent years in Dell’s Product and Applications Security team.

In 2020, she earned a master’s degree in Administration of Justice and Homeland Security with a concentration in Cybersecurity and Intelligence. Currently she is pursuing a doctoral degree in Homeland Security at St. John’s University in Queens, NY. Her research focus is software supply chain security. Tricia is the Branch Assistant for Supply Chain Risk Management in the U.S. Coast Guard Auxiliary Cybersecurity Directorate.

[+] Show More

Now Playing

Attack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners

Yukiko Endo (NICT, JP), Masato Jingu (NICT, JP), Masaki Kubo (NICT,...

Yukiko Endo (NICT, JP), Masato Jingu (NICT, JP), Masaki Kubo (NICT, JP)

Security teams routinely waste time investigating benign scans from services such as Censys, Shodan, ZoomEye, and other survey‑scanners. However, ...there has been no comprehensive, openly available source that identifies which organizations are scanning the global IPv4 space and from which IP addresses.

We operate a large darknet monitoring network and developed a real‑time methodology to classify survey‑scanner traffic and distinguish it from malicious activity. Using this approach, we have identified more than 75 active scanning organizations worldwide.

Our team publishes a quarterly, publicly accessible list of survey‑scanner IP addresses and organizations on GitHub, enabling SOC analysts, incident responders, and network defenders to reduce false investigations and focus on actual threats. We also demonstrate how we integrate this list into our own security operations and quantify its operational impact.

Because many survey‑scanners provide ASM‑related commercial services based on their scanning activity, we additionally highlight behavioral differences among scanners to help practitioners better interpret and validate ASM outputs. Drawing on years of large‑scale darknet monitoring and continuous IP intelligence publishing, we provide practical insights that the community can immediately use to improve alert triage and threat‑hunting accuracy.

---

Yukiko Endo is a Senior Technical Researcher at the Cyber Threat Analysis Office, National Institute of Information and Communications Technology (NICT) in Japan, where she actively works on darknet monitoring, internet-wide scanning analysis, and threat intelligence research. Before joining NICT, she worked in both Japan and Germany on research and product development in the field of Identity and Access Management. Her broader interests include IoT security, Internet-wide measurement, and the collection and analysis of threat intelligence data.

Masato Jingu is an analyst at the Cyber Threat Analysis Office of the National Institute of Information and Communications Technology (NICT). He also serves as a member of NICT-CSIRT, where he is primarily responsible for the analysis of a livenet. Prior to joining NICT, he held positions in the private sector, where he was engaged in cybersecurity incident response as well as research and development activities.

Masaki Kubo serves as Director of the Cyber Threat Analysis Office at NICT. His responsibilities extend to both the internal security operation and a darknet monitoring research project known as 'NICTER'. Prior to joining NICT, He was a manager of JPCERT coordination center, focusing on the analysis and coordination of vulnerabilities and advocating for a secure coding initiative.

[+] Show More

Now Playing

One Poisoned Artifact Can Steer Your AI: How Robust Are Your LLM-Assisted Security Workflows?

Cheng-Lin Yang (CyCraft AI Lab, Taiwan, TW), Yen-Shan (Lily) Chen...

Cheng-Lin Yang (CyCraft AI Lab, Taiwan, TW), Yen-Shan (Lily) Chen (CyCraft AI Lab, TW)

As SOCs, CSIRTs, and incident‑response teams adopt LLM and RAG systems for alert triage, investigation, and automation, ...

[+] Show More

Now Playing

The Vulnerability Identity Crisis

Art Manion (Tharros Labs, US), Jay Jacobs (Empirical Security,...

Art Manion (Tharros Labs, US), Jay Jacobs (Empirical Security, US)

Current vulnerability management programs struggle with identity. Anyone working in defensive vulnerability management will recognize the challenges in associating a vulnerability ...with the variety of products used in or by any technology estate. We struggle not only with product identification but also vulnerability identification. This double challenge of poor product and poor vulnerability identity creates a collection of vulnerability records that provide sub‑optimal coverage, cannot be de‑duplicated within and across vulnerability data sources, and require significant human resources to manage.

These records are often overly complicated or overly simplistic and difficult to associate with other critical information. This work is based on two long‑time vulnerability veterans spending the better part of a year discussing and debating the state of vulnerability‑information management and focusing on underlying first principles. The result is Minimum Viable Vulnerability Enumeration (MVVE) for every vulnerability record and a detailed ontology for defining and assessing the importance of other vulnerability‑information elements.

---

Art Manion spends a lot of time working on various aspects of technical cybersecurity vulnerabilities including coordinated disclosure, measurement, management, information systems, risk assessment, and public policy. Art has led and contributed to vulnerability-related efforts the Forum of Incident Response and Security Teams (FIRST), the CVE Program, ISO/IEC JTC 1/SC 27, the Open Source Security Foundation (OpenSSF), and the National Telecommunications and Information Administration (NTIA, US). Art is the Deputy Director of ANALYGENCE Labs and previously managed vulnerability analysis at the CERT Coordination Center (CERT/CC).

Jay Jacobs is a Co-founder and Data Scientist at Empirical Security and Data Scientist Emeritus at Cyentia Institute. Jay is also the lead data scientist for the Exploit Prediction Scoring System (EPSS), a co-chair of the EPSS special interest group at FIRST and chair of the Consumer Working Group within the CVE program. He is also a co-founder of the Society for Information Risk Analysts (SIRA), a not-for-profit association dedicated to advancing risk management practices where he served on the board of directors for several years.

[+] Show More

Now Playing

Can a General-Purpose LLM Do Tier-1 Triage?

Romulo Rocha (TandemTrace, BR) Can a general-purpose LLM perform...

Now Playing

Fighting Back Without Hacking Back: Why “Risk Management” Isn’t Enough In The Era of Cyber War

Tom Millar (CISA, US) Since the dawn of FIRST, most cyber adversaries...

Now Playing

From Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF

Dr. Stephen Coston (Centene, US), William Rodriguez (Centene,...

Dr. Stephen Coston (Centene, US), William Rodriguez (Centene, US)

Modern security operations are facing a structural breaking point. Hybrid-cloud environments generate massive volumes of fragmented evidence across AWS, Azure, SaaS platforms, ...and endpoints yet the ability to reconstruct a coherent, defensible narrative has not kept pace. What slows investigations is no longer detection it is interpretation under uncertainty.

As organizations introduce AI to accelerate triage and correlation, a deeper problem emerges: Can we trust the outputs? Can we explain them? And will they hold up when it matters most under audit, regulation, or legal scrutiny?

This session introduces a practical, end-to-end framework for transforming fragmented logs into chronologically consistent, forensically defensible “living timelines.” Built on the Open Cybersecurity Schema Framework (OCSF), the approach redefines incident response as a schema-driven, evidence-centric system rather than a collection of tools.

At the core is a six-layer pipeline Ingest → Normalize → AI Assist → Validate → Timeline → Export designed to operate within existing SOC environments such as Splunk, Sentinel, and Databricks. The architecture treats AI not as an authority, but as an accelerator. Large language models enhance field inference, semantic clustering, and narrative construction, while human-in-the-loop controls ensure that decision authority never leaves the analyst.

What differentiates this model is not speed alone but trust by design. Every transformation is versioned, explainable, and hash verified. Confidence scoring, prompt traceability, and workflow logging create a system where outputs can be audited, reproduced, and defended. The framework embeds evidentiary principles aligned to Daubert, Frye, and Durant, ensuring that AI-assisted investigations meet the standards of scientific reliability, general acceptance, and procedural fairness.

Attendees will walk away with more than concepts they will gain a deployable blueprint: a reproducible architecture, governance checklist, AI transparency maturity model, and schema-first playbooks ready for operational use.

This session advances a critical shift in thinking:

As AI becomes embedded in security operations, the role of cybersecurity must evolve from analyzing events to protecting the integrity of decisions, evidence, and outcomes at machine speed.

---

The presenters Willam Rodriguez and Dr. Stephen Coston, serve as a Lead Security Architect and Director of Security Operator leading hybrid-cloud and AI-augmented incident-response initiatives for a large U.S. healthcare insurer. His work spans log normalization, SOC automation, AI governance, and evidence reliability frameworks. He has designed log-to-timeline pipelines aligned to OCSF and has published on AI governance, bias mitigation, and forensically sound automation in security operations

Dr. Stephen Coston is an AI-enabled security operations architect and cybersecurity strategist operating at the forefront of cloud security, AI governance, and next-generation Security Operations Center (SOC) design. He architects security systems where artificial intelligence functions as core decision infrastructure, transforming how organizations detect, investigate, and respond to threats. His work enables the compression of investigation timelines from hours to minutes while preserving human judgment, auditability, and operational control at scale. Stephen leads initiatives that integrate AI into the fabric of security operations, redefining decision velocity, and elevating the role of analysts from reactive responders to supervisory decision-makers. His focus spans human–AI collaboration, security data architecture, and the emerging attack surface of adversarial AI where model behavior, data pipelines, and automation pathways become targets. With deep experience in incident response and digital forensics, he has led complex investigations across enterprise environments, translating technical signals into actionable intelligence under high-stakes conditions. As a speaker, researcher, and contributor to the evolving field of AI in cybersecurity, Stephen advances a clear thesis: as AI becomes embedded in operational systems, security must evolve from protecting data to protecting decisions. Disclaimer: All thoughts are my own and does not reflect my employer or any of there subsidiaries.

[+] Show More