FIRSTCTI26 Recap: Threat Intel & Pretzels Sold Out!
By Grace Staley, FIRST Events Team
Monday, May 18th, 2026
Ten years ago, a group of cybersecurity professionals gathered in Munich with a simple but ambitious idea: create a trusted space where threat intelligence experts from different sectors could actually talk to each other, collaborate openly, and tackle emerging challenges together.
Fast forward to 2026, and that once-modest gathering has grown into one of the FIRST community's most anticipated events: FIRSTCTI. Last month, the conference returned to where it all began, and Bavaria once again became the center of our little cyber threat intelligence universe. This time, bigger, smarter, and more globally connected than ever.
Led by conference chairs Patrick Grau of Exyte and Bavarian born, Dr. Thomas Schreck, from Munich University of Applied Sciences, FIRSTCTI26 featured a full workshop day followed by two plenary days packed with strategic discussions, technical deep-dives, and hands-on learning opportunities. Providing management-level insight for decision-makers, highly technical sessions for practitioners, and collaborative workshops where attendees could actively engage. This year's event sold out with an impressive 450 attendees representing 49 countries, and attendees came ready to learn.
Participant reports praised the technical talks, hands-on labs, and the wide variety of sessions available. This year's buzzworthy topic was Johnathan Anderson's session, Big Game Hunting: Detection Opportunities in Residential Proxy Networks.
AI-focused presentations another hot highlight, reflecting the growing role artificial intelligence is playing across threat detection, analysis, and operational workflows. From proactive intelligence strategies to real-world adversary behavior, sessions tackled both the opportunities and the very real challenges facing defenders today.
Perhaps most importantly, attendees repeatedly shared they walked away with actionable ideas they could immediately apply to their teams, workflows, and organizations.
That's the sweet spot for any conference, not just inspiration: implementation!
FIRSTCTI26 also marked an important milestone for the community as attendees celebrated and thanked Dr. Thomas Schreck for an incredible decade of leadership as co-lead of the Cyber Threat Intelligence program. Over the last ten years, Thomas has helped shape the conference into a respected and collaborative hub for the global CTI community. His dedication has played a major role in expanding the program's impact and creating the environment of trust that FIRSTCTI is known for today.
Of course, like any good conference, the experience extended well beyond the session room walls. When attendees weren't discussing attack chains, indicators, and intelligence pipelines, they had the chance to enjoy everything Munich has to offer. From the historic charm of Marienplatz to bustling beer gardens, the city provided the ideal setting for continuing conversations amongst Bavarian beauty. Because sometimes the best intelligence-sharing happens somewhere between a pretzel and a stein.
Events like FIRSTCTI don't happen without strong community support. This year's conference was made possible thanks to 17 sponsor organizations committed to advancing cybersecurity collaboration and knowledge sharing across the industry. Check them out at: https://www.first.org/conference/firstcti26/sponsors.
Missed the conference content? Have no fear, the TLP:CLEAR sessions were livestreamed and are now available on FIRST's official YouTube channel. Be sure to like and subscribe!
See You in Berlin for FIRSTCTI27
The threat landscape never stops evolving, and neither does the FIRSTCTI community. We'll return April 21–23, 2027 to Berlin for another year of collaboration, innovation, and technical insight. Whether you're an analyst, incident responder, researcher, security leader, or simply someone passionate about adversaries, FIRSTCTI is where the global conversation happens.
The call for speakers and sponsors are tentatively set to open in October. If you have interest in being a part of the 2027 program committee, be on the lookout for the opening of the call for program committee members this September.
Berlin is calling!
