2027 Cyber Threat Intelligence Conference

Call for Speakers & Workshops

This is the call for submissions for the 2027 FIRST Conference on Cyber Threat Intelligence (CTI), April 21-23, 2027. The event will be held at the Mercure Hotel MOA Berlin, in Berlin, Germany. There will be one day of workshops followed by two days of plenary sessions. This event will be open to both FIRST members and non-members.

TLP:CLEAR proceedings will be live-streamed and recorded to the FIRST YouTube channel.

Speakers may stipulate that their sessions be treated as confidential through TLP designation and all attendees are expected to respect this. TLP designations will be displayed on the agenda. Breaches of the FIRST Code of Conduct (including failing to respect the confidentiality of certain sessions) have consequences.

Point of Contact

Questions about submission topics or sensitivity issues can be sent via email to the chairs of the Program Committee: cticon-chairs@first.org

  • Program Co-Chairs: Patrick Grau and Andreas Muehlemann

Call for Speakers

We are looking for practical experiences, fresh perspectives, lessons learned, successes, and failures across the CTI community.

Potential topics include:

  • AI & Emerging Technology: Leveraging AI and emerging technologies in CTI, including opportunities, limitations, and implications for analysts.
  • CTI Program Development: Building and maturing effective CTI programs aligned with organizational goals, risk, and business priorities.
  • Metrics & Business Value: Measuring CTI effectiveness and demonstrating value to security leadership, executives, and other stakeholders.
  • People & Teams: Structuring and developing CTI teams, including operating models, leadership, skills, career development, and continuous improvement.
  • Requirements & Collection: Intelligence requirements, threat modeling, and collection management as foundations for effective CTI.
  • Threat Prioritization: Threat assessment and prioritization: finding the needle in the haystack and focusing on the threats that matter most.
  • Analysis & Tradecraft: Intelligence tradecraft and analytical quality, including classical intelligence methods, cognitive biases, and structured analysis.
  • Threat Research & Analysis: Technical deep dives of adversary tradecraft, infrastructure, and intent to show how to produce actionable CTI.
  • Enrichment & Context: Creating, enriching, refining, and contextualizing CTI to turn data into actionable intelligence.
  • Operationalizing CTI: Applying intelligence to protection, detection, and response through innovative tools, technologies, and automation.
  • SOC & DFIR: Integrating CTI into SOC, incident response, and digital forensics workflows and overcoming integration challenges.
  • Risk & Decision Support: Applying CTI to vulnerability management, risk management, and strategic decision-making.
  • Collaboration & Stakeholders: Collaboration, communication, and information sharing across security teams, business stakeholders, and external communities.
  • Geopolitics & Global Events: Geopolitics and global events: understanding their impact on cyber threats and intelligence priorities.
  • Lessons Learned: Failing forward: real-world CTI case studies highlighting successes, failures, lessons learned, and what you would do differently.

New for 2027: Threat Analysis. We’re opening the program to practitioner-focused technical deep dives on adversary behavior, capabilities, intent, and TTPs, and on how to generate actionable CTI from them. Talks should teach transferable methods and insights. Submissions that focus solely on a threat actor profile or attack overview remain out of scope.

New for 2027: We are introducing dedicated Beginner and Expert talk levels. A small number of Beginner talks will provide accessible entry points into CTI topics, while Expert sessions will focus on deeper expertise and experience.

Call for Workshops

FIRST is also seeking workshop submissions related to the above topics. There are multiple full or half-day tracks to be filled.

CFP Timeline

  • Call for Speakers Closes: November 23, 2026
  • Acceptance Notifications: Week of December 14, 2026

Speaker Privileges

  • Accepted presentations receive up to two (2) complimentary registration passes.
  • Workshops receive up to two (2) complimentary registration passes, with 1 day passes available for workshop assistants.

Complimentary registrations are non-transferable.

Important Considerations

All proposals should be submitted via EasyChair. If you are new to EasyChair, a registration will be required before accessing the submission form.

Please provide key takeaways as bullet points in your submission.

More complete submissions (with paper uploads) will be given preferential treatment over abstract-only submissions, but all submissions will be given full consideration.

Submissions which the Program Committee determines to be product pitches will be rejected.

Again, all submissions must be received by 23:59 UTC November 23, 2026.

EasyChair Submission Form