About this Event
Hosted by CREST Focus Group chairs Benn Morris (IR) and Martin Riley (SOC), join us as we deep-dive into the topics of Incident Response & Security Operations Centre. Whether you are just beginning your career or are experienced in the field, this event will offer great insights and a chance to meet with peers from across the industry.
Across the day we'll be featuring expert tech talks, networking opportunities, and fresh insights into the tools, techniques, and trends shaping the field.
AI will feature throughout the day because it is already changing how cybersecurity teams work. Speakers will explore where AI is proving genuinely useful, where the risks and limitations lie, and what it means in practice for Incident Response, SOC and Penetration Testing teams.
Full speaker line up now available!
Who should attend?
Whether you’re early in your cybersecurity career or an experienced professional, this event offers valuable insights into emerging trends and a great opportunity to connect with peers across the industry.
Attendance
- Open to ALL
Event Details:
Date: Wednesday 14 October 2026
Time: 09:00 - 16:00
Location: IET Birmingham: Austin Court, Birmingham
Agenda
?: 08:45 AM
Arrival and Registration
?: 09:30 AM
Welcome and Opening remarks
Host: Boglarka Ronto
?: 09:45 AM
Strategic threat assessment, what shapes the incident & cyber threat landscape
Host: Charlie S
Info: To discuss strategic threat assessment and which shapes the incident and cyber threat landscape. Discussing the big 4 themes that we see, the changes we’ve seen over the last 10 years, what is causing the bulk of incidents, and where we see AI having an impact
?: 10:15 AM
Becoming an NCSC Assured Cyber Incident Response Provider
Host: Keith Cottenden
Info: Becoming an NCSC Assured Cyber Incident Response Provider – What Does It Really Take?
CIR Standard and assessment process, what organisations need to demonstrate, the types of evidence and capabilities assessors are looking for, and some of the common challenges organisations encounter when preparing for assessment.
Looking at the importance of demonstrating a mature and repeatable incident response capability rather than simply having the necessary documentation in place, including areas such as governance, technical capability, operational delivery, personnel, case management and continuous improvement.
?: 10:45 AM
BREAK
?: 11:15 AM
Ahead of the Alert!
Host: Christos Katagis
Info: Ahead of the Alert: C2 Infrastructure Mapping and High-Confidence Attribution of the Kali365 Operator
A deep dive into the Kali365 phishing platform, revealing how investigators uncovered its infrastructure, tracked its operations, and attributed the service to its operator through technical analysis and OSINT.
?: 11:00 AM
Who did it? The Realities of Incident Response and Attribution
Host: Jamie Roderick
Info: Incident Response is challenging, the tempo of events can force priorities on to the investigators. Customers can obsess on attribution (or go the other way and just rebuild). This talk is a canter over some of the challenges that investigators face when looking to attribute during an incident
?: 12:15 PM
LUNCH AND NETWORKING
?: 01:15 PM
Leveraging Android Intrusion logging for CERT Investigations
Host: Stephen Fisher-Davies
Info: In this talk I discuss the most recent Android advanced android protection mechanism Intrusion logging and how you can use device base lining to detect APT intrusions inside these logs
?: 01:45 PM
How much SOC do you really need?
Host: Callum Barnes
Info: How much SOC do you really need - the story of three organisations, three very different answers.
This session challenges the idea that there is a single "best" SOC model, exploring how security operations should be tailored to an organisation's maturity, capabilities and risk appetite. Through real-world examples, it introduces a practical framework based on ownership of visibility, containment and continuous improvement, helping organisations determine the right balance between capability, cost and risk.
?: 02:15 PM
Your EDR Saw It. Your SOC Didn't
Host: Kristen Kadach
Info: Your EDR Saw It. Your SOC Didn't: Hunting the Detection Gaps Between Telemetry and Alerts
This session explores the gap between the telemetry collected by EDR platforms and the alerts actually surfaced to security teams. Using a real-world malware investigation, it demonstrates how endpoint data can reveal malicious activity that goes undetected by default alerts, and how SOC and detection engineering teams can use KQL and behavioural analytics to identify detection gaps and improve threat visibility.
?: 02:45 PM
BREAK
?: 03:00 PM
Beyond the playbook; What it really takes to Excel as an Incident Responder
Info: Beyond the playbook; What it really takes to Excel as an Incident Responder
Technical tool knowledge isn't enough in incident response. This talk reveals what separates exceptional responders from the rest: understanding the 'why' behind forensic evidence and mastering the soft skills that matter when executives are panicking. Discover the skills that truly count when organisations face their worst moments
?: 03:30 PM
Open floor - questions and discussion
Host: Boglarka Ronto
?: 04:00 PM
CLOSE
Event venue & nearby stays
IET Birmingham: Austin Court, 80 Cambridge Street, Birmingham, United Kingdom
Concerts, fests, parties, meetups — all the happenings, one place.