Strengthening Incident Response in Latin America and the Caribbean: Reflections from the FIRST Regional Symposium in Mendoza
By Graciela Martínez
Tuesday, November 05, 2026
Cybersecurity challenges do not stop at national borders. Neither should our efforts to address them.
Strengthening incident response capabilities requires more than technology and technical expertise. It requires people, collaboration, trust, knowledge sharing and opportunities for teams to learn from one another.
These were some of the ideas behind the FIRST Regional Symposium for Latin America and the Caribbean, held on October 21–22, 2026, in Mendoza, Argentina, bringing together professionals from across the region to exchange experiences and discuss the challenges facing today's incident response community.
For me, this event represented an important opportunity to continue advancing a goal that has been central to my work at LACNIC CSIRT for many years: helping strengthen the capabilities of incident response teams and fostering a more connected and collaborative cybersecurity ecosystem in Latin America and the Caribbean.
The Symposium brought together professionals with different backgrounds and responsibilities, including CSIRT and SOC managers, cybersecurity analysts, network and infrastructure specialists, technical leaders, government representatives, law enforcement professionals and other stakeholders.
The attendee records included almost a hundred entries representing 17 countries, reflecting the regional and multidisciplinary nature of the community.
This diversity matters. Incident response is not the responsibility of a single type of organization. Effective cybersecurity requires cooperation among network operators, security teams, academia, public institutions, law enforcement and the wider Internet community.
Creating spaces where these different perspectives can meet, share experiences and establish professional connections is an essential part of building regional capacity.
From technical challenges to practical solutions
The technical program reflected the diversity and evolution of the challenges facing incident response teams.
Presentations addressed topics such as:
- Large-scale network scanning and the transformation of technical findings into actionable threat intelligence.
- Observability and cybersecurity monitoring in critical government infrastructure.
- The use of multi-agent artificial intelligence to support incident prioritization, analysis and coordination.
- Threat intelligence methodologies for identifying exposed infrastructure associated with Tor hidden services.
- Lessons learned from developing a university CSIRT.
- Email authentication standards, including SPF, DKIM and DMARC, as mechanisms to mitigate phishing and impersonation.
- Systemic risks associated with technological monocultures in SOC and CSIRT environments.
- Fundamental incident response practices and emerging warning signs for CSIRTs.
One particularly important theme was collaboration. As discussed in the session on cooperation among incident response teams, early warnings and intelligence sharing can make a substantial difference when dealing with large-scale campaigns.
Another important perspective was the need to strengthen the fundamentals. While threats continue to become more sophisticated, basic security practices, visibility, vulnerability management and effective incident handling remain essential.
These discussions demonstrated the value of sharing operational experiences rather than focusing exclusively on theoretical approaches.
Building bridges between incident response and investigations
The second day was dedicated to practical training.
The workshop, Security Incidents Related to Malicious Content and Cryptocurrencies: Analysis, Management, and Preservation of Information, delivered by specialists from the Argentine Federal Police, provided participants with an opportunity to explore the identification, analysis and correlation of technical information associated with malicious content and cryptocurrency-related activities.
An important component was the preservation and documentation of digital information so that it can support subsequent investigations.
This topic highlighted the importance of cooperation between CSIRTs, investigators and other relevant stakeholders. Incident response and criminal investigations have different responsibilities and processes, but effective coordination and appropriate information sharing can strengthen both.
Developing these relationships is particularly relevant in a region where cybersecurity capabilities and resources vary significantly between countries and organizations.
FIRST and the importance of a global community
During the opening session, I had the opportunity to introduce FIRST and share its mission, initiatives and the value of becoming part of an international community of incident response teams.
FIRST provides a global platform for collaboration, enabling teams to connect with peers, exchange information, develop professional relationships and access knowledge and resources that strengthen their work.
For teams in Latin America and the Caribbean, participating in this global community creates opportunities to learn from international experiences while also contributing regional perspectives and expertise.
As a member of the FIRST Board of Directors, I see this as an important part of our collective responsibility: continuing to expand FIRST's global reach, encouraging participation from underrepresented regions and ensuring that the experience and needs of our regional community are part of the broader international conversation.
A long-term commitment to regional capacity building
My work at LACNIC CSIRT has always been closely connected to the development of incident response capabilities across Latin America and the Caribbean.
Beyond incident coordination, this work involves promoting good practices, supporting the development and maturity of CSIRTs, facilitating knowledge exchange and helping organizations understand the importance of having structured capabilities to manage security incidents.
It also means creating opportunities for professionals to meet, learn and build relationships that can become valuable when real incidents occur.
The FIRST Regional Symposium in Mendoza was another step in that direction.
The value of these events goes beyond the sessions themselves. It is also found in the conversations between participants, the exchange of experiences, the new connections established and the relationships that continue long after everyone returns home.
Moving forward: Improving Security Together
There is no single organization that can address today's cybersecurity challenges alone.
We need stronger incident response teams, more collaboration across borders, better information sharing and a broader community that includes different sectors, countries and levels of maturity.
I am grateful to everyone who contributed to making this Symposium possible: FIRST, LACNIC, our co-hosts, speakers, trainers and all the professionals who participated and shared their experience.
Most importantly, I hope the connections made in Mendoza continue to grow and translate into concrete opportunities for collaboration across our region.
Because ultimately, strengthening incident response is not just about improving individual teams. It is about strengthening the entire ecosystem.
Improving Security Together.
