When FIRSTCON26 Rode into Denver
By Grace Staley, FIRST Events Team
Friday, July 3rd, 2026
Well, partner... what a week.
This June, 700 cybersecurity professionals saddled up in Denver, Colorado for the 38th Annual FIRST Conference (FIRSTCON26), proving once again that when the global incident response community gets together, great things happen.
The Mile High City became home to practitioners from around the world who gathered to share knowledge, strengthen trusted relationships, tackle today's toughest security challenges, and remind us all that collaboration is still the most powerful tool in cybersecurity.
Whether you came for the technical deep dives, the hallway conversations, the Birds of a Feather sessions, the Special Interest Groups, or the Gold Rush, there was something around every corner of the range.
Afterall, FIRSTCON isn't just another cybersecurity conference. It's where responders meet responders. It's where researchers compare notes with defenders. It's where new ideas are born over coffee, old friendships are renewed, and future collaborations begin with a simple, "Is that a Hello Kitty sticker?"
"There are many cybersecurity events, and most have become commercial vehicles. Real experts stop attending because the content is too broad, the audience too small, or the conversations too shallow. FIRST is different. It brings together security specialists and incident responders from across the world in a way only a few organisations can. For us, FIRST conferences are the ones when we can reconnect with so many practitioners and thought leaders at once. We are also able to reconnect with people from the CSIRT community from the early days, as well as with new people joining the community. Having a booth boosts the experience even more. It gives us a place to strengthen our visibility and a dedicated spot where people can find and connect with us. That is special and the reason we enjoy coming back."
— Vincent Thiele, COO and Co-Founder, Modat
Lassoing the Learning
FIRSTCON26 would not be possible without the speakers who generously shared their expertise, experiences, lessons learned, and hard-earned insights.
Throughout the week, presenters delivered thought-provoking sessions that challenged assumptions, introduced new ideas, and sparked conversations that continued long after attendees left the meeting rooms. Some of the highlights included: An inspired keynote from Tim Brown, former CISO of SolarWinds; a deep dive on LLM-Powered Forensics; insights on Interpreting Entra ID Signals During AiTM Attacks; and revelations in the age of AI.
To every speaker, workshop instructor, panelist, moderator, and community volunteer: thank you for helping make FIRSTCON26 an unforgettable learning experience!
Highlights of the Hayride
The Wild West made its presence known throughout the week, culminating in Wednesday night's cowboy-themed social event. Cowboy hats, bandanas, boots, and more than a few creative interpretations of western fashion filled the venue as we rubbed elbows and two-stepped together. At least one talking horse was reportedly spotted roaming around.
One unexpected milestone came courtesy of a hotel fire drill. When the alarm sounded, FIRSTCON attendees did what security professionals do best: they followed the process. According to hotel staff, FIRSTCON became the first group they could remember to fully evacuate during a drill.
This year's conference coincided with the kickoff of the FIFA World Cup, creating a unique opportunity to celebrate another activity that brings people together across borders.
Thanks to Michael Mortensen and Nucleus Security, the 2026 unofficial FIRSTCON football match quickly became one of the week's most memorable moments.
Afterall, Football (or “soccer”) is a perfect reflection of what makes the FIRST community special. Participants from different countries, cultures, organizations, and backgrounds coming together over a shared love of sport, just as they do every day through a shared commitment to cybersecurity. Whether on a football pitch or in an incident response channel, success comes from teamwork, trust, communication, and a willingness to help one another.
In a world where so much of our work happens through screens, FIRSTCON reminds us that trust is still built face to face. You can exchange emails for years, hop on countless video calls, or collaborate across continents, but there's something irreplaceable about sharing a meal, raising a glass, and getting to know the person behind the job title. Those moments create the relationships that matter when the pressure is on. When an incident strikes, you're not reaching out to a stranger; you're calling a friend.
That's what makes the FIRST community so special: we're not just building stronger security programs; we're building a network of people who show up for one another when it counts. And around these parts, that's worth more than gold. We know you left Denver with a few new Partners.
FIRSTCON26 was made possible through the generous support of our sponsors, whose commitment to the global cybersecurity community helps create opportunities for collaboration and knowledge sharing throughout the year.
- Special thanks to our Local Host, CISA.
- Gold Sponsors, Dream and VMRay.
- Silver Sponsors, Group-IB and Tidal Cyber.
- Bronze Sponsors, Apura, Censys, Command Zero, CTM360, Daylight Security, Modat, NRD Cyber Security, Spamhaus, TeamT5, and Volexity.
- Social Sponsors, Adobe, and Cisco. Exhibitors, Analyst1, Arcanna, Bureau Veritas Cybersecurity, Flare, Nord Security, SOCRadar, Spacewalk, and Stairwell.
- Capture the Flag Supporters, CERT.br and ZeroFox.
-
Supporting Sponsors, Hitachi, CIRCL, Adobe, and Hack Defender.
"We attend a lot of conferences, and few come close to FIRSTCON for genuine global representation - and Denver was no exception.
Unlike a lot of events its size, FIRSTCON has stayed true to its mission: to make the internet safer through global collaboration. The quality and breadth of content is consistently impressive, and almost every session has something worth taking away.
For Spamhaus, it's also the perfect place to find the CERTs we want to talk to about free, constituency-relevant data and joint research because the people who actually want to improve things tend to show up here."
— Matthew Stith, Community and Industry Outreach, Spamhaus Technology
The Trail Doesn't End Here
As the dust settles on another unforgettable FIRSTCON and attendees return home to put new ideas into practice, the conversations that started in Denver will continue across teams, organizations, countries, and time zones.
And that's the magic of FIRSTCON. Long after the cowboy hats are packed away, the feeling and the friendships remain.
Nearly 700 people traveled from around the world because they believe cybersecurity is stronger when we work together. They came to exchange ideas, build trusted relationships, mentor new members, reconnect with longtime colleagues, and leave just a little smarter than when they arrived.
Thank you to every attendee, speaker, volunteer, sponsor, exhibitor, and community member who made FIRSTCON26 one for the history books.
Until we ride again...
Save the date for the 39th Annual FIRST Conference: Guardians of the Global Network: Uniting for Resilience to be held in the stunning city of Bangkok, Thailand, June 13-18, 2027.
If you’re interested in helping shape the 2027 agenda, consider joining the program committee, and apply through the link above! Submissions are due by July 31.
YEEHAW!
