Keynote
Gov. Terry McAuliffe
Governor of Virginia. Closed day one from the main stage.
The founding IRC conference. Two days at the Ritz-Carlton Pentagon City: three role-based tracks, 36 breakout sessions, keynotes from Gov. Terry McAuliffe and Eric O’Neill, and the community rules that defined IRC events.
Expected attendees
Breakout sessions
Hours of training
Cost to members
Governor of Virginia. Closed day one from the main stage.
Founder of The Georgetown Group, the former FBI operative who caught Robert Hanssen. Opened the conference.
CEO and CISO level panels: Qualys, Wickr, ReversingLabs, United Technologies, Accenture Federal, Capital One, DHS, LogRhythm, Armor, Palo Alto Networks.
Reconstructed from the original conference agenda and speaker glossary, preserved from the legacy site.
Registration and breakfast
Opening remarks from the IRC board, then guest speaker Eric O’Neill (Founder, The Georgetown Group)
C-Level Playing to Win the Game: Cyber Defense = Business Success
Kimberly Watson, JHAPL
Manager Incident Response and Threat Hunting for the Modern Enterprise
Jonathon Ross, Carbon Black
Analyst Toolboxes and Playbook Design Strategy: How to Do It and Why
Joseph Loomis, CyberSponse
C-Level Threat Intelligence Sharing between Government and Industry
Jeff Schilling, Armor
Manager Playbook Generation and Simulation Efforts
Razwan Raja, XOR Security
Analyst Secure Incident Response Communications
Chris Howell, Wickr
Product demonstrations and booth meetings
Lunch
C-Level SOC 2030
Charles Sterner, Palo Alto Networks
Manager Building an IR Plan that Your Organization will Actually Use
Kelly McCracken, Salesforce
Analyst Security Automation and Orchestration: Optimizing SAO with Open Source Tools
Greg Foss, LogRhythm
C-Level Executive Engagement in the IR Lifecycle
Daniel Conroy, CISO, United Technologies
Manager IR Preparation: Continuously Assessing Global IT Assets
Mark Butler, Qualys
Analyst How to Simplify and Accelerate Incident Response with Security Analytics
Nick Bilogorskiy, Cyphort
Panel: Security within the Cloud, How and Why. Philippe Courtot (Qualys), Daniel Conroy (United Technologies), Mario Vuksan (ReversingLabs), Joel Wallenstrom (Wickr), Gus Hunt (Accenture Federal, former CTO CIA). Moderator: Joseph Loomis
Keynote: Governor Terry McAuliffe
Hosted dinners, tables one to six
Breakfast
Cybersecurity IR Social Maturity Handbook discussion. Daniel Shore and Steve Zaccaro, George Mason University
C-Level Next Generation Endpoint Performance and Efficacy
Dean Sapp, Braintrace
Manager Incident Response in the Cloud: Is It Different?
Wayne Reynolds, Armor
Analyst Accelerating Analysis with Decision Trees
Rodney Caudle, NIC
Lunch
C-Level Dawn of Justice: Technology vs Culture in Incident Response
Boyden Rohner (DHS) and Doug Jones (Leidos)
Manager How Do I Know When My SOC is Ready for Automation?
Karlo Arozqueta, Trend Micro
Analyst Network Defense: Leading the Hunt
David Girard, Trend Micro
C-Level The Role of Law Enforcement in the Expanding Realm of Data Compromise
Michael Dickson, Trend Micro
Manager Effective IR in the Age of Containers and Cloud
Mark Butler, Qualys
Analyst Effective Use of Threat Intelligence to Speed Incident Response
Travis Farral, Anomali
Panel: The Evolving SOC in the Near Future. Charles Sterner (Palo Alto Networks), Wayne Reynolds (Armor), Greg Foss (LogRhythm), Boyden Rohner (DHS), Eric VanDine (Capital One). Moderator: Wasif Shakeel, Accenture Federal
Closing remarks from the IR17 board, then the closing cocktail hour and hosted dinners
Titles and companies as of the event.
Nadhem AlFardan
Security Architect, Cisco Systems
Karlo Arozqueta
Trend Micro
Linus Barloon II
Director of Cybersecurity, Office of the Sergeant at Arms, U.S. Senate
Nick Bilogorskiy
Sr. Director, Threat Operations, Cyphort
Mark Butler
CISO, Qualys
Ed Cabrera
Chief Cybersecurity Officer, Trend Micro
Rodney Caudle
NIC
Daniel Conroy
CISO, United Technologies
Philippe Courtot
Chairman and CEO, Qualys
Michael Dickson
Trend Micro
Brian Done
Deputy Chief Technology Officer, DHS CS&C
Travis Farral
Anomali
Greg Foss
Head of Global Security Operations, LogRhythm
David Girard
Breach Detection Team Leader, Trend Micro
Lt. Gen. Rhett Hernandez (ret.)
Former Commander, U.S. Army Cyber Command; President, CyberLens
Chris Howell
CTO, Wickr
Gus Hunt
Cybersecurity practice lead, Accenture Federal; former CTO, CIA
Larry Johnson
CEO, CyberSponse
Doug Jones
Leidos
Joseph Loomis
Founder and CTO, CyberSponse; IR17 convener and panel moderator
Gov. Terry McAuliffe
Governor of Virginia
Kelly McCracken
Salesforce
Gary McIntyre
Senior Security Services Architect, Cisco Systems
Robert Novy
Deputy Assistant Director, Office of Investigations, U.S. Secret Service
Eric O’Neill
Founder, The Georgetown Group
Razwan Raja
Principal, XOR Security
Wayne Reynolds
VP of Security, Armor
Mike Rogers
Former Congressman, Michigan
Boyden Rohner
Director of Cybersecurity Operations, DHS
Jonathon Ross
Carbon Black
Dean Sapp
CISO, Braintrace
Jeff Schilling
Armor
Wasif Shakeel
VP Cyber Defense, Defense Point Security; panel moderator
Daniel Shore
George Mason University
Charles Sterner
Head of Security Operations, Palo Alto Networks
Mark Sullivan
Principal, GSIS
Kelcey Tietjen
CISO, Los Alamos National Laboratory
Gregory Touhill
Cybersecurity and IT Senior Executive
Eric VanDine
Head of Global Cyber Security Operations, Capital One
Mario Vuksan
CEO, ReversingLabs
Joel Wallenstrom
CEO, Wickr
Kimberly Watson
JHAPL
Steve Zaccaro
George Mason University
The original IRC vendor rule: one sponsor per product category, community first, no selling from the stage.
IR17 was the founding IRC conference: two days at the Ritz-Carlton Pentagon City in September 2017, billed as the first operational, community-driven incident response conference. Free to attend, members only, with a corporate or government email required to register.
The format set the template the community kept: three role-based tracks for C-Level, Manager and Analyst audiences, vendor sessions bound by a one-sponsor-per-category rule, panels over pitches, and hosted dinners every evening. Wickr Pro served as the official secure communications channel for the event, and the IRC Slack workspace, still running today, was the community backbone.
IR18 and IR19 followed at the Renaissance Arlington Capital View before the quiet years. The 2026 relaunch returns to smaller formats, but the community-first rules in the room were written here.